APT-C-23 双尾蝎APT组织攻击巴勒斯坦的样本

Crazyman_Army_C

时间线是从2019.12——2020.2
解压密码:infected
详细报告分析(非专业 人士勿看)
刺向巴勒斯坦的致命毒针——双尾蝎 APT 组织的攻击活动分析与总结
https://mp.weixin.qq.com/s/YW1pJ6g0JTRhROtIXjRisA

Crazyman_Army_C

样本链接:https://www.lanzous.com/ia2ihsf

静影沉璧

cleaned all

QVM360

静影沉璧 发表于 2020-3-9 08:27
cleaned all

E家报14项清空！
Brochure-Jerusalem_26082019_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
Congratulations_Jan-7_78348966_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
sample\Define the Internet in government institutions_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
Directory of Government Services_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
Employee-entitlements-2020.doc - Generik.JUZWCIV 特洛伊木马 的变种
Internet in government_984747457_489376.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
Meeting Agenda_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
Scholarships in Serbia 2019-2020_pdf.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
artisan-video-5625572889047205-9356297846-mp4.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
asala-panet-il-music-live-892578923756-mp3.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
entelaqa_hamas_32_1412_847403867_rar.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
final_meeting_9659836_299283789235_rar.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
أهم المستجدات_347678363764.exe - Win32/Spy.Delf.QWY 特洛伊木马 的变种
السيرة الذاتية منال1.doc - VBA/TrojanDownloader.Agent.RRD 特洛伊木马

swizzer

智量
除了doc全是入库杀

Jerry.Lin

Norton 清空

1. Trojan.Gen.MBT
   
2. Type: Anomaly
   
3. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
   
4. Categories: Virus
   
5. Status: Fully Resolved
   
6. -----------
   
7. 9 Infected Files
   
8. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\artisan-video-5625572889047205-9356297846-mp4.exe - Deleted
   
9. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Congratulations_Jan-7_78348966_pdf.exe - Deleted
   
10. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Define the Internet in government institutions_pdf.exe - Deleted
    
11. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\entelaqa_hamas_32_1412_847403867_rar.exe - Deleted
    
12. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Directory of Government Services_pdf.exe - Deleted
    
13. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\final_meeting_9659836_299283789235_rar.exe - Deleted
    
14. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Internet in government_984747457_489376.exe - No Action Required
    
15. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\asala-panet-il-music-live-892578923756-mp3.exe - Deleted
    
16. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\أهم المستجدات_347678363764.exe - No Action Required
    
17. 1 Browser Cache
    
18. 
    
19. 
    
20. 
    
21. W97M.Downloader
    
22. Type: Anomaly
    
23. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
    
24. Categories: Virus
    
25. Status: Fully Resolved
    
26. -----------
    
27. 2 Infected Files
    
28. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Employee-entitlements-2020.doc - Deleted
    
29. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\السيرة الذاتية منال1.doc - Deleted
    
30. 1 Browser Cache
    
31. 
    
32. 
    
33. 
    
34. Trojan.Gen.2
    
35. Type: Anomaly
    
36. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
    
37. Categories: Virus
    
38. Status: Fully Resolved
    
39. -----------
    
40. 4 Infected Files
    
41. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Internet in government_984747457_489376.exe - Deleted
    
42. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Meeting Agenda_pdf.exe - Deleted
    
43. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Scholarships in Serbia 2019-2020_pdf.exe - Deleted
    
44. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\أهم المستجدات_347678363764.exe - Deleted
    
45. 1 Browser Cache
    
46. 
    
47. 
    
48. 
    
49. Trojan Horse
    
50. Type: Anomaly
    
51. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
    
52. Categories: Virus
    
53. Status: Fully Resolved
    
54. -----------
    
55. 1 Infected File
    
56. C:\Users\zhong\Downloads\MalwareTest\Kafan\APT-C-23 sample (pass infected)\sample\Brochure-Jerusalem_26082019_pdf.exe - Deleted
    
57. 1 Browser Cache

复制代码

ATP_synthase

卡巴全杀

54ss

BD  清空

sichuanwenxuan

MES监控杀11个。双击杀剩下的两个应用程序。最后剩下一个doc文件。

a233

Avast清空