#AgentTesla

显示全部楼层 · 发表于 2020-4-5 18:23:53

Courtesy of @abuse_CH

COVID-19 themed malspam distributing AgentTesla:

HELO: h55.sserv.ru
Sending IP: 95.215.177.133
From: ITALIA SEPA <vladimir@naksealing.ru>
Subject: URGENT COVID-19 ORDER ITIALIA SEPA
Attachment: ITIALIA SEPA PRODUCTZION REQUEST FOR COV-19 INV-029302938.7z (contains "ITIALIA SEPA PRODUCTZION REQUEST FOR COV-19 INV-029302938.exe")

AgentTesla FTP exfil server:
ftp.fox8live.com:21 (207.191.38.36)

显示全部楼层 · 发表于 2020-4-5 18:25:10

Avast
Win32:PWSX-gen [Trj]

显示全部楼层 · 发表于 2020-4-5 18:25:53

本帖最后由 CHURP 于 2020-4-5 18:29 编辑

ESET时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2020/4/5 18:26:12;文件系统实时防护;文件;D:\病毒\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13.exe;MSIL/GenKryptik.EHUX 特洛伊木马的变种;通过删除清除;DESKTOP-DPC8PKS\23012;在应用程序新建的文件上发生事件: F:\Bandizip\Bandizip.exe (796EE37271EA3605459ECAACE4E3130C96CB11D3).;6248EC71CD5B3CEF7C5F1720966ED9DC7EA9D275;2020/4/5 18:26:07

显示全部楼层 · 发表于 2020-4-5 18:27:12

a233 发表于 2020-4-5 18:25
Avast
Win32:PWSX-gen [Trj]

你这是单身了多少年的手速

显示全部楼层 · 发表于 2020-4-5 18:28:38

CHURP 发表于 2020-4-5 18:27
你这是单身了多少年的手速

今天没玩游戏一直蹲在样本区

显示全部楼层 · 发表于 2020-4-5 18:34:22

卡巴拉黑
05.04.2020 18.33.56;Detected object (file) deleted;D:\360极速浏览器下载\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13.exe;D:\360极速浏览器下载\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13.exe;UDS:DangerousObject.Multi.Generic;04/05/2020 18:33:56

显示全部楼层 · 发表于 2020-4-5 22:03:34

Avira
TR/Dropper.MSIL.Gen8

显示全部楼层 · 发表于 2020-4-5 22:09:53

火绒不报迈克菲发现病毒

显示全部楼层 · 发表于 2020-4-5 22:36:14

BD拉黑
The file C:\Users\JOJO\Downloads\b2fc9766f26d0ade21f6fc89a59a9eb0d18dad53496df5d08b37678c5da35a13.exe is infected with Gen:Suspicious.Cloud.4.Fm0@ay@YBHj and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

[可疑文件] #AgentTesla

本帖子中包含更多资源

本帖子中包含更多资源