2020-03-23 - INFO_03_23.DOC PUSHES MALWARE (VALAK, MAYBE?)

YorkWaugh

下载地址：https://www.lanzous.com/ial7wte
ASSOCIATED FILES:
2020-03-23-infection-IOCs.txt.zip   2.0 kB (1,958 bytes)
2020-03-23-infection-traffic-from-info_03_23.pcap.zip   270 kB (270,381 bytes)

2020-03-23-malware-and-artifacts.zip   379 kB (379,088 bytes)

IMAGES

Shown above:  Extracting info_03_23.doc from the zip archive.

Shown above:  Screenshot of the Word doc.

Shown above:  Traffic from the infection filtered in Wireshark.

Shown above:  Alerts using the ETPRO ruleset from Suricata using Sguil in Security Onion.

Shown above:  Initial artifacts dropped after enabling macros.

Shown above:  Follow-up malware/artifacts.

Shown above:  Scheduled task to keep the infection persistent, indicating use of an Alternate Data Stream (ADS).

Shown above:  Windows registry updates created during this infection.

liu237

a233

Avast

巍巍

卡巴扫描

a27573

ESET index.dll Win32/Kryptik.HCFB

QVM360

时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2020/3/24 12:08:15;文件系统实时防护;文件;C:\Users\chenruoren\下载\2020-03-23-malware-and-artifacts\index.dll;Win32/Kryptik.HCFB 特洛伊木马 的变种;通过删除清除;LAPTOP-4U2QD2R4\chenruoren;在应用程序新建的文件上发生事件: C:\Program Files (x86)\360\360zip\360zip.exe (9C98FC5BEE0F10AA63EE60C6289026F1180821CB).;48CE5F2A5BE760ACAE63A7494E9DFD84D87C1014;2020/3/24 12:08:13

BBS晨曦

a233 发表于 2020-3-24 11:53
Avast

avast有没有技术白皮书啊

a233

BBS晨曦 发表于 2020-3-24 12:43
avast有没有技术白皮书啊

https://www.avast.com/zh-cn/about这个网站找找

BBS晨曦

a233 发表于 2020-3-24 12:56
https://www.avast.com/zh-cn/about这个网站找找

可以了

心醉咖啡

毒霸

1. 扫描时间：[2020-03-24 13:08:51]
   
2. 扫描用时：[00:00:08]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：29
   
5. 扫描速度：3文件/秒
   
6. 发现威胁：1个
   
7. 清除威胁：1个
   
8. =============================================
   
9. [2020-03-24 13:09:15]
   
10. 威胁：f:\浏览器下载\2020-03-23-malware-and-artifacts\s60w.0
    
11. 类型：win32.js.opfile.ls2a
    
12. 处理方式：删除
    
13. 
    

复制代码