2020-04-17 - QAKBOT (QBOT) SPX99

YorkWaugh

好久没来了，来诈个尸：https://ww.lanzous.com/ibkl4md
其他样本：https://ww.lanzous.com/b0159g2mb
0140012.zip   (101,528 bytes)
2020-04-17-Qakbot-EXE-spx99-example-1-of-4.bin   (2,295,808 bytes)
2020-04-17-Qakbot-EXE-spx99-example-2-of-4.bin   (2,295,808 bytes)
2020-04-17-Qakbot-EXE-spx99-example-3-of-4.bin   (2,295,808 bytes)
2020-04-17-Qakbot-EXE-spx99-example-4-of-4.bin   (2,295,808 bytes)
2164939.zip   (98,776 bytes)
50208.zip   (95,056 bytes)
82386.zip   (100,122 bytes)

jiaobaoyun51

红伞清空

a233

Avast清空

Xw1nd极风

Norton
扫描VBS的好像都Miss了
双击
这...算拦住了吗

傻猪猪米走鸡

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
2020/4/18 21:09:57;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\2020-04-17-Qakbot-EXE-spx99-example-1-of-4.bin;a variant of Win32/GenKryptik.EILP trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Windows\explorer.exe (421C8FE40D4A8B70547DCCD21D924B3C58C26F89).;111D219DFB11EE95F4B558E2ACF0F19977ACDDAE;2020/4/18 21:09:55
2020/4/18 21:09:58;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\2020-04-17-Qakbot-EXE-spx99-example-2-of-4.bin;a variant of Win32/GenKryptik.EILP trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Windows\explorer.exe (421C8FE40D4A8B70547DCCD21D924B3C58C26F89).;F2AD8B80AE7EFEF7DFFFEEB83456456731264FC3;2020/4/18 21:09:56
2020/4/18 21:09:59;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\2020-04-17-Qakbot-EXE-spx99-example-3-of-4.bin;a variant of Win32/GenKryptik.EILP trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Windows\explorer.exe (421C8FE40D4A8B70547DCCD21D924B3C58C26F89).;4768323A806F3F76741B28B78A2F84641191B14A;2020/4/18 21:09:57
2020/4/18 21:10:00;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\2020-04-17-Qakbot-EXE-spx99-example-4-of-4.bin;a variant of Win32/GenKryptik.EILP trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Windows\explorer.exe (421C8FE40D4A8B70547DCCD21D924B3C58C26F89).;5692F839A7FCAB0188BB98D60AFDA038A450FD89;2020/4/18 21:09:57
2020/4/18 21:11:41;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\0140012\NUM_54386.vbs;VBS/TrojanDownloader.Agent.TIV trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files (x86)\360\360zip\360zip.exe (C2085BBEE171ABAAA42BD3D8209596747E3710B8).;73C40AEAE1B2EEF6CCAEC2B4EB94DA0520269FB6;2020/4/18 21:11:36
2020/4/18 21:11:41;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\0140012\NUM_71700.vbs;VBS/TrojanDownloader.Agent.TIV trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files (x86)\360\360zip\360zip.exe (C2085BBEE171ABAAA42BD3D8209596747E3710B8).;015308AB1FE11BB05A10C33A71188FCA18AD16F7;2020/4/18 21:11:35
2020/4/18 21:11:42;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\0140012\NUM_50905.vbs;VBS/TrojanDownloader.Agent.TIV trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files (x86)\360\360zip\360zip.exe (C2085BBEE171ABAAA42BD3D8209596747E3710B8).;6405B6C167D0454DDBA36A54AE1E8625CC742BC6;2020/4/18 21:11:35
2020/4/18 21:11:42;Real-time file system protection;file;C:\Users\Galaxy\Downloads\2020-04-17-Qakbot-spx99-malware-samples\0140012\NUM_353.vbs;VBS/TrojanDownloader.Agent.TIV trojan;cleaned by deleting;DESKTOP-NV3EN59\Galaxy;Event occurred on a new file created by the application: C:\Program Files (x86)\360\360zip\360zip.exe (C2085BBEE171ABAAA42BD3D8209596747E3710B8).;99D099FA960A924A2E89669DC22813C3CF75FFD1;2020/4/18 21:11:35


By ESET

心醉咖啡

21.56毒霸0
22.07

1. 扫描时间：[2020-04-18 22:06:57]
   
2. 扫描用时：[00:00:07]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：12
   
5. 扫描速度：1文件/秒
   
6. 发现威胁：4个
   
7. 清除威胁：4个
   
8. =============================================
   
9. [2020-04-18 22:07:10]
   
10. 威胁：e:\浏览器下载\2020-04-17-qakbot-spx99-malware-samples\2020-04-17-qakbot-exe-spx99-example-1-of-4.bin
    
11. 类型：win32.troj.banker.(kcloud)
    
12. 处理方式：删除
    
13. 
    
14. [2020-04-18 22:07:10]
    
15. 威胁：e:\浏览器下载\2020-04-17-qakbot-spx99-malware-samples\2020-04-17-qakbot-exe-spx99-example-2-of-4.bin
    
16. 类型：win32.troj.banker.(kcloud)
    
17. 处理方式：删除
    
18. 
    
19. [2020-04-18 22:07:10]
    
20. 威胁：e:\浏览器下载\2020-04-17-qakbot-spx99-malware-samples\2020-04-17-qakbot-exe-spx99-example-3-of-4.bin
    
21. 类型：win32.troj.banker.(kcloud)
    
22. 处理方式：删除
    
23. 
    
24. [2020-04-18 22:07:10]
    
25. 威胁：e:\浏览器下载\2020-04-17-qakbot-spx99-malware-samples\2020-04-17-qakbot-exe-spx99-example-4-of-4.bin
    
26. 类型：win32.troj.banker.(kcloud)
    
27. 处理方式：删除
    
28. 
    

复制代码

巍巍

卡巴清空

QVM360

ESET
0140012.zip > ZIP > NUM_71700.vbs - VBS/TrojanDownloader.Agent.TIV 特洛伊木马
2020-04-17-Qakbot-EXE-spx99-example-1-of-4.bin - Win32/GenKryptik.EILP 特洛伊木马 的变种
2020-04-17-Qakbot-EXE-spx99-example-2-of-4.bin - Win32/GenKryptik.EILP 特洛伊木马 的变种
2020-04-17-Qakbot-EXE-spx99-example-3-of-4.bin - Win32/GenKryptik.EILP 特洛伊木马 的变种
2020-04-17-Qakbot-EXE-spx99-example-4-of-4.bin - Win32/GenKryptik.EILP 特洛伊木马 的变种
2164939.zip > ZIP > NUM_353.vbs - VBS/TrojanDownloader.Agent.TIV 特洛伊木马
50208.zip > ZIP > NUM_50905.vbs - VBS/TrojanDownloader.Agent.TIV 特洛伊木马
82386.zip > ZIP > NUM_54386.vbs - VBS/TrojanDownloader.Agent.TIV 特洛伊木马