APT-C-23 双尾蝎APT组织攻击巴勒斯坦的样本

心醉咖啡

毒霸

1. 扫描时间：[2020-03-09 10:05:29]
   
2. 扫描用时：[00:00:09]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：14
   
5. 扫描速度：1文件/秒
   
6. 发现威胁：1个
   
7. 清除威胁：1个
   
8. =============================================
   
9. [2020-03-09 10:05:48]
   
10. 威胁：f:\浏览器下载\apt-c-23 sample %28pass infected%29\sample\employee-entitlements-2020.doc
    
11. 类型：win32.scriptc.undef.a.(kcloud)
    
12. 处理方式：修复
    
13. 
    

复制代码

欧阳宣

avira剩余三个exe

www-tekeze

swizzer 发表于 2020-3-9 08:39
智量
除了doc全是入库杀

恢复昨晚虚拟机快照看过了，一样一样的。。

www-tekeze

火绒杀2X，看来APT真不是重点哎。。

swizzer

www-tekeze 发表于 2020-3-9 11:21
恢复昨晚虚拟机快照看过了，一样一样的。。

我把exe都双击过了，都是WIBD:HEUR.Trojan.V报法

www-tekeze

swizzer 发表于 2020-3-9 11:36
我把exe都双击过了，都是WIBD:HEUR.Trojan.V报法

同一系列呗。。。只要行为能表现出来，必杀无疑。。

K560987

卡巴刚解压完就kill all了

DPT1

心醉咖啡 发表于 2020-3-9 10:06
毒霸

日志里绝大多数的报undef
一扫杀9个


十秒钟二嫂再杀五个

Nocria

IKARUS emptied.

1. [09.03.2020 12:09:30] On-demand scan started: "user_defined"
   
2. [09.03.2020 12:09:30] Found, 0.00s, SigName: "Trojan-Spy.Agent", SigId: 293652734, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\asala-panet-il-music-live-892578923756-mp3.exe"
   
3. [09.03.2020 12:09:30] Found, 0.00s, SigName: "Trojan-Spy.Agent", SigId: 289851981, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\artisan-video-5625572889047205-9356297846-mp4.exe"
   
4. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan-Downloader.VBA.Agent", SigId: 293029361, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\السيرة الذاتية منال1.doc"
   
5. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan.Dropper.Agent", SigId: 288105763, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\أهم المستجدات_347678363764.exe"
   
6. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan-Spy.Agent", SigId: 293439966, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Scholarships in Serbia 2019-2020_pdf.exe"
   
7. [09.03.2020 12:09:30] Found, 0.31s, SigName: "Trojan-Spy.Agent", SigId: 292372635, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Brochure-Jerusalem_26082019_pdf.exe"
   
8. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan-Spy.Agent", SigId: 289767958, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Meeting Agenda_pdf.exe"
   
9. [09.03.2020 12:09:30] Found, 0.31s, SigName: "Trojan-Spy.Agent", SigId: 288616174, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Internet in government_984747457_489376.exe"
   
10. [09.03.2020 12:09:30] Found, 0.15s, SigName: "Trojan.SuspectCRC", SigId: 288648239, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Employee-entitlements-2020.doc"
    
11. [09.03.2020 12:09:30] Found, 0.47s, SigName: "Trojan-Spy.Agent", SigId: 289882292, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\final_meeting_9659836_299283789235_rar.exe"
    
12. [09.03.2020 12:09:30] Found, 0.47s, SigName: "Trojan-Spy.Agent", SigId: 289882297, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\entelaqa_hamas_32_1412_847403867_rar.exe"
    
13. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan.Dropper.Agent", SigId: 284103607, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Directory of Government Services_pdf.exe"
    
14. [09.03.2020 12:09:30] Found, 0.32s, SigName: "Trojan-Spy.Agent", SigId: 289851978, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Define the Internet in government institutions_pdf.exe"
    
15. [09.03.2020 12:09:30] Found, 0.16s, SigName: "Trojan-Spy.Agent", SigId: 288802405, Type: "VIRUS", File: "C:\Users\promi\Desktop\APT-C-23 sample (pass infected)\sample\Congratulations_Jan-7_78348966_pdf.exe"
    
16. [09.03.2020 12:09:30] On-demand scan FINISHED: "user_defined"
    
17. [09.03.2020 12:09:30] ----------------------------------------------------
    
18. [09.03.2020 12:09:30] Directories scanned: 0
    
19. [09.03.2020 12:09:30] Files scanned: 14
    
20. [09.03.2020 12:09:30] Virus found: 14
    
21. [09.03.2020 12:09:30] ----------------------------------------------------

复制代码

AK2019

Rising安全云终端 清空 图片传不上来就不传了