掛馬樣本包(4X) #0830

Agu

darker.exe
掛馬網址：darkshark.website/Spider/darker.exe
VT(16/66)：https://www.virustotal.com/#/fil ... 9b3665f3b/detection

8Wk9PXl4cF.exe
掛馬網址：bemnyc.com/OSJABqbMag
VT(17/66)：https://www.virustotal.com/#/fil ... 95ebd9b10/detection

41.exe
掛馬網址：yuanjhua.com/OwUzt/
VT(16/67)：https://www.virustotal.com/#/fil ... 192c4183e/detection

IMU1e7_NewPO.exe
掛馬網址：u.lewd.se/IMU1e7_NewPO.jpg
VT(14/67)：https://www.virustotal.com/#/fil ... 3b9834c4b/detection

樣本載點(密碼infected)：
（主要）https://we.tl/t-17dUpAQohU
（備用）https://1.bitsend.jp/download/51 ... a97.html?setLang=en

測試：
Malwarebytes - 3X

Kaspersky用户

SEP自动防护KILL3，剩下一个IMU1e7_NewPO.exe扫描MISS，沙盘运行MISS。

WHALE-FALL

McAfee
在扫描 D:\下载\MalwarePack#0830\41.exe 时检测到了名为 Artemis!51DFC5304FE2 的 特洛伊木马程序。
在扫描 D:\下载\MalwarePack#0830\8Wk9PXl4cF.exe 时检测到了名为 Artemis!FDD20F86E91D 的 特洛伊木马程序。
在扫描 D:\下载\MalwarePack#0830\IMU1e7_NewPO.exe 时检测到了名为 Artemis!66BE1E01DE6B 的 特洛伊木马程序。
在扫描 D:\下载\MalwarePack#0830\darker.exe 时检测到了名为 Artemis!D9159FBFFE7A 的 特洛伊木马程序。

Jerry.Lin

ESET
4/4

1. Time;Scanner;Object type;Object;Threat;Action;User;Information;Hash;First seen here
   
2. 2018/8/30 15:00:19;Real-time file system protection;file;D:\迅雷下载\病毒测试区\MalwarePack#0830\8Wk9PXl4cF.exe;a variant of Win32/Injector.EACK trojan;cleaned by deleting;DESKTOP-2OOJP6P\LH;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (6878FB97113E60307F61B28688D717EDC3E753F0).;118E24748A3427D2D15C481E71BB4D1DB76204DE;2018/8/30 15:00:17
   
3. 2018/8/30 15:00:19;Real-time file system protection;file;D:\迅雷下载\病毒测试区\MalwarePack#0830\41.exe;a variant of Win32/Injector.EACK trojan;cleaned by deleting;DESKTOP-2OOJP6P\LH;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (6878FB97113E60307F61B28688D717EDC3E753F0).;9479E8BBF02A488539F94FE7132DC9B18CDFD016;2018/8/30 15:00:17
   
4. 2018/8/30 15:00:19;Real-time file system protection;file;D:\迅雷下载\病毒测试区\MalwarePack#0830\IMU1e7_NewPO.exe;a variant of Win32/Injector.EACL trojan;cleaned by deleting;DESKTOP-2OOJP6P\LH;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (6878FB97113E60307F61B28688D717EDC3E753F0).;4F71CCF9B7CDD4A1C167FB295B357873A381D065;2018/8/30 15:00:17
   
5. 2018/8/30 15:00:19;Real-time file system protection;file;D:\迅雷下载\病毒测试区\MalwarePack#0830\darker.exe;a variant of Generik.BRVVAMJ trojan;cleaned by deleting;DESKTOP-2OOJP6P\LH;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (6878FB97113E60307F61B28688D717EDC3E753F0).;8ED451A41AD2B72C166843BD095298C64A459606;2018/8/30 15:00:17
   

复制代码

ATP_synthase

未双击

椿花湫月

诺顿已经团灭了智量也全杀

www-tekeze

火绒报2X，智量清空。

Jerry.Lin

看火绒的报毒名貌似启用了新算法……

275751198

扫描结果
======================
高危风险项
----------------------
D:\360极速浏览器下载\MalwarePack#0830\41.exe        HEUR/QVM20.1.8601.Malware.Gen        已删除
D:\360极速浏览器下载\MalwarePack#0830\8Wk9PXl4cF.exe        木马程序(Trojan.Generic)        已删除
D:\360极速浏览器下载\MalwarePack#0830\darker.exe        感染型病毒(Win32/Trojan.45d)        已删除
D:\360极速浏览器下载\MalwarePack#0830\IMU1e7_NewPO.exe        感染型病毒(Win32/Trojan.Multi.daf)        已删除

www-tekeze

191196846 发表于 2018-8-30 17:30
看火绒的报毒名貌似启用了新算法……

你不说我还没注意，以前确实从未见过。