2020-04-02 - VBS-BASED MALWARE INFECTION

显示全部楼层 · 发表于 2020-4-3 08:05:56

Shown above: Example from one of the zip archives and its extracted VBS file.

Shown above: Traffic from an infection filtered in Wireshark.

Shown above: Artifacts seen in the infected user's AppData\Local\Temp folder during this infection..

Shown above: Scheduled task to keep this infection persistent.

显示全部楼层 · 发表于 2020-4-3 08:08:21

本帖最后由 QVM360 于 2020-4-3 08:13 编辑

ESET清空

显示全部楼层 · 发表于 2020-4-3 08:24:11

本帖最后由 swizzer 于 2020-4-3 08:27 编辑

智量

扫描清空

显示全部楼层 · 发表于 2020-4-3 08:27:56

360TS miss all

显示全部楼层 · 发表于 2020-4-3 08:48:27

本帖最后由 CHURP 于 2020-4-3 08:50 编辑

火绒扫描 MISS

显示全部楼层 · 发表于 2020-4-3 09:29:07

BD 实时防护清空
VB:Trojan.Valyria.2882

[病毒样本] 2020-04-02 - VBS-BASED MALWARE INFECTION