https://www.virustotal.com/gui/file/d52db7d432b476636ad942ab7ff543ededf2e752a4a7f2e0044841fd5dd41753/detection
之前7位，现在9位
新增加的两位是CrowdStrike Falcon（以前觉得很强，感觉现在变弱了）和TrendMicro-HouseCall
给我技术设立一个新标签
Popular threat label
trojan.tl0101he26yv
根据VT说
Code insights
The sample demonstrates the 'MirrorExec' technique, which is used to bypass Data Execution Prevention (DEP) by double-mapping a shared memory section. The binary creates a file mapping backed by the system paging file (using CreateFileMappingA with INVALID_HANDLE_VALUE) and maps it twice: once with write permissions (FILE_MAP_WRITE) and once with execute permissions (FILE_MAP_EXECUTE). It then writes shellcode/assembly instructions (including a basic string length calculator) into the writable view and executes them through the executable view. While this dual-mapping evasion technique is highly suspicious and typical of advanced shellcode loaders, the specific sample contains verbose console logging and debug strings ('MirrorExec DEP Bypass', 'Create a bidirectional mapping') indicating it is an educational proof-of-concept (PoC) rather than a malicious payload.
翻译（AI翻译的）
样本演示了“镜像执行”（MirrorExec）技术，该技术通过双重映射共享内存段来绕过数据执行保护（DEP）。该二进制文件创建了一个基于系统分页文件的文件映射（使用 INVALID_HANDLE_VALUE 调用 CreateFileMappingA），并将其映射两次：一次具有写入权限（FILE_MAP_WRITE），一次具有执行权限（FILE_MAP_EXECUTE）。然后，它将 Shellcode/汇编指令（包括一个基础的字符串长度计算器）写入可写视图，并通过可执行视图执行它们。虽然这种双重映射规避技术高度可疑，且是高级 Shellcode 加载器的典型特征，但该特定样本包含了详细的控制台日志输出和调试字符串（如 'MirrorExec DEP Bypass'、'Create a bidirectional mapping'），表明它只是一个教育性的概念验证（PoC）程序，而非恶意攻击载荷。
另外CNC组织开始活跃
例如
https://s.threatbook.com/report/file/0f8edc34bdcd463cb8b75bd3cde3a71c4c66a400ae4fb2935ff9bcea63f0318b
