#Loki

显示全部楼层 · 发表于 2020-4-17 21:24:07

本帖最后由 Nocria 于 2020-4-17 21:32 编辑

https://c-t.work/s/6c458690c0f141

Courtesy of @abuse_ch

COVID-19 themed malspam distributing GuLoader->Loki:

HELO: main.com
Sending IP: 173.82.186.59
From: "Mr. Kelvin" <erdman@rmcsport.com>
Subject: COVID-19:Copy of Transfer Receipt From Our Bank
Attachment: Receipt-POR08173.gz (contains "Receipt-POR08173.exe")

Loki C2:
http://rnarport.com/deal/five/fre.php

IKARUS killed

Date and Time: 17/04/2020 21:26:08
File Name: 7e1ac39cca3a3e1674a4fb288ed4c309ed7c80588d8e9430a9b77b4a11716f18.exe
Original Path: C:\Users\promi\Desktop\7e1ac39cca3a3e1674a4fb288ed4c309ed7c80588d8e9430a9b77b4a11716f18\
File Size: 116 kB
Detection Name: Win32.SuspectCrc
Detection-ID: 298033200
Suggestion: Backup and Delete

复制代码

显示全部楼层 · 发表于 2020-4-17 21:26:28

Malwarebytes

显示全部楼层 · 发表于 2020-4-17 21:27:00

BEST
HyperDetect 机器学习检测到威胁. 文件已删除。C:\Users\ljsjo\Desktop\7e1ac39cca3a3e1674a4fb288ed4c309ed7c80588d8e9430a9b77b4a11716f18.exe 是恶意软件 Gen:Illusion.ML.Miata.C.2.17.3010101

显示全部楼层 · 发表于 2020-4-17 21:27:34

ESET日志
D:\下载\7e1ac39cca3a3e1674a4fb288ed4c309ed7c80588d8e9430a9b77b4a11716f18\7e1ac39cca3a3e1674a4fb288ed4c309ed7c80588d8e9430a9b77b4a11716f18.exe - Win32/Injector.ELNK 特洛伊木马的变种 - 通过删除清除 [1]

显示全部楼层 · 发表于 2020-4-17 21:29:41

本帖最后由巍巍于 2020-4-17 21:31 编辑

卡巴

显示全部楼层 · 发表于 2020-4-17 21:30:48

诺顿C杀

显示全部楼层 · 发表于 2020-4-17 21:36:17

显示全部楼层 · 发表于 2020-4-17 22:08:32

Avast
FileRepMalware

[可疑文件] #Loki

评分

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

评分

浏览过的版块