PuntoLoader (19.02.20)

Jerry.Lin

https://twitter.com/James_inthe_box/status/1097885218248175617
https://analyze.intezer.com/#/an ... 9-877d-0026542ee801
https://twitter.com/luc4m/status/1097889934990602241

#apt #Buhtrap


uwyet001.tmp.exe
https://www.virustotal.com/en/fi ... e67fdef1b/analysis/

p.ssj.exe
https://www.virustotal.com/en/fi ... e3f11bcfa/analysis/

winmm.dll
https://www.virustotal.com/#/fil ... bc22fe1c933c003e038




https://www.lanzous.com/i36ts0b

www-tekeze

智量Heur清空，火绒miss all 。。  有空双击。。。

www-tekeze

红伞，清空！

你好，再见

www-tekeze

ESET，清空！

dreams521

卡巴 ACE

1. 20.02.2019 13.53.44;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\winmm.dll;C:\Users\Administrator\Desktop\PuntoLoader\winmm.dll;HEUR:Trojan.Win32.Agent.gen;木马程序;02/20/2019 13:53:44
   
2. 20.02.2019 13.53.42;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//winmm.dll;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//winmm.dll;UDS:DangerousObject.Multi.Generic;02/20/2019 13:53:42
   
3. 20.02.2019 13.53.42;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//Data.exe;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//Data.exe;UDS:DangerousObject.Multi.Generic;02/20/2019 13:53:42
   
4. 20.02.2019 13.53.42;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//#;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe//#;UDS:DangerousObject.Multi.Generic;02/20/2019 13:53:42
   
5. 20.02.2019 13.53.42;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe;C:\Users\Administrator\Desktop\PuntoLoader\p.ssj.exe;HEUR:Trojan-Spy.Win32.Agent.gen;木马程序;02/20/2019 13:53:42
   
6. 20.02.2019 13.53.41;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//#;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//#;UDS:DangerousObject.Multi.Generic;02/20/2019 13:53:41
   
7. 20.02.2019 13.53.41;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//winmm.dll;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//winmm.dll;HEUR:Trojan.Win32.Agent.gen;木马程序;02/20/2019 13:53:41
   
8. 20.02.2019 13.53.41;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe;UDS:Trojan-Dropper.Win32.Agent.bjxlxg;木马程序;02/20/2019 13:53:41
   
9. 20.02.2019 13.53.41;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//Data.exe;C:\Users\Administrator\Desktop\PuntoLoader\uwyet001.tmp.exe//Data.exe;UDS:DangerousObject.Multi.Generic;02/20/2019 13:53:41
   

复制代码

我要打十個

pre

BD 修复2X 隔离1X
日志
Feature:
Antivirus

The file D:\A\uwyet001.tmp.exe is infected with Trojan.GenericKD.31688619.The threat has been successfully blocked, your device is safe.

Feature:
Antivirus

The file D:\A\p.ssj.exe is infected with Trojan.GenericKD.31568871.The threat has been successfully blocked, your device is safe.

Feature:
Antivirus

The file D:\A\winmm.dll is infected with Trojan.GenericKD.31688619 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

Jirehlov1234

dreams521 发表于 2019-2-20 13:54
卡巴 ACE

ACE什么意思

dreams521

Jirehlov1234 发表于 2019-2-20 22:42
ACE什么意思

团灭