6/18 样本5X

rogersg

https://c-t.work/s/45046e85c6104b
搬运自Anyrun

OVS

卡巴 2021  清空

a233

Avast 4X

rogersg

智量 3×

二扫，清空

LSPD

Norton 4x

1. 2020/6/18 19:17:13,高,检测到 General_docsINV&BLpdf.bin (Trojan.Gen.2) (检测方: 自动防护),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1
   
2. 2020/6/18 19:17:13,高,检测到 General_docsINV&BLpdf.bin (Heur.AdvML.C) (检测方: 自动防护),已隔离,已解决 - 不需要操作,已执行 威胁 操作: 1
   
3. 2020/6/18 19:16:39,高,1820x.doc (Bloodhound.RTF.12) 检测方 自动防护,已阻止,已解决 - 不需要操作,已执行  操作: 0
   
4. 2020/6/18 19:16:38,高,2d96fe3f24d210373fc92692c26ac87c4cb3bee0b0423bbefbad8f9fe2327b08.ps1 (Backdoor.PsEmpire) 检测方 自动防护,已阻止,已解决 - 不需要操作,已执行  操作: 0
   
5. 2020/6/18 19:16:38,高,PO_196700.doc (Bloodhound.RTF.12) 检测方 自动防护,已阻止,已解决 - 不需要操作,已执行  操作: 0

复制代码

Nocria

IKARUS

1. [18.06.2020 19:43:49] On-demand scan started: "user_defined"
   
2. [18.06.2020 19:43:49] Found, 0.16s, SigName: "Exploit.CVE-2017-11882", SigId: 3412394, Type: "VIRUS", File: "C:\Users\promi\Desktop\样本5X\1820x.doc"
   
3. [18.06.2020 19:43:49] Found, 0.31s, SigName: "Trojan-Downloader.PowerShell.Agent", SigId: 3389120, Type: "VIRUS", File: "C:\Users\promi\Desktop\样本5X\2d96fe3f24d210373fc92692c26ac87c4cb3bee0b0423bbefbad8f9fe2327b08.ps1"
   
4. [18.06.2020 19:43:49] Found, 0.16s, SigName: "Win32.SuspectCrc", SigId: 304191696, Type: "VIRUS", File: "C:\Users\promi\Desktop\样本5X\General_docsINV&BLpdf.bin"
   
5. [18.06.2020 19:43:49] Found, 0.16s, SigName: "Exploit.CVE-2017-11882", SigId: 3412394, Type: "VIRUS", File: "C:\Users\promi\Desktop\样本5X\PO_196700.doc"
   
6. [18.06.2020 19:43:49] On-demand scan FINISHED: "user_defined"
   
7. [18.06.2020 19:43:49] ----------------------------------------------------
   
8. [18.06.2020 19:43:49] Directories scanned: 1
   
9. [18.06.2020 19:43:49] Files scanned: 5
   
10. [18.06.2020 19:43:49] Virus found: 4
    
11. [18.06.2020 19:43:49] ----------------------------------------------------

复制代码

WAR314159

ESET KILL 4X


<?xml version="1.0" encoding="utf-8" ?>
<ESET>
  <LOG>
    <RECORD>
      <COLUMN NAME="时间">2020/6/17 20:24:45</COLUMN>
      <COLUMN NAME="扫描程序">文件系统实时防护</COLUMN>
      <COLUMN NAME="对象类型">文件</COLUMN>
      <COLUMN NAME="对象">C:\Users\XXXXXX\AppData\Local\Temp\BNZ.5eea0b88cb77f3\382ae412ae682c0c1241c2bbafec413b0f9bb5829a68ec199399dcb38e9cf05c.exe</COLUMN>
      <COLUMN NAME="检测">Win32/GenKryptik.EMPU 特洛伊木马 的变种</COLUMN>
      <COLUMN NAME="操作">通过删除清除</COLUMN>
      <COLUMN NAME="用户">XXXXXXXXXXXXXXX</COLUMN>
      <COLUMN NAME="信息">在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (CFF587F4A8F595C2CB13F3961F7AD51CC0813184).</COLUMN>
      <COLUMN NAME="哈希">4D51367638800728B94AF5BA0B6D364C407C7773</COLUMN>
      <COLUMN NAME="此处首次所见">2020/6/17 20:24:43</COLUMN>
    </RECORD>
    <RECORD>
      <COLUMN NAME="时间">2020/6/18 20:20:52</COLUMN>
      <COLUMN NAME="扫描程序">文件系统实时防护</COLUMN>
      <COLUMN NAME="对象类型">文件</COLUMN>
      <COLUMN NAME="对象">C:\Users\XXXXXXXXXX\AppData\Local\Temp\BNZ.5eeb5c1f936ca9\2d96fe3f24d210373fc92692c26ac87c4cb3bee0b0423bbefbad8f9fe2327b08.ps1</COLUMN>
      <COLUMN NAME="检测">PowerShell/TrojanDownloader.Agent.ABM 特洛伊木马</COLUMN>
      <COLUMN NAME="操作">通过删除清除</COLUMN>
      <COLUMN NAME="用户">XXXXXXXXXXXXX</COLUMN>
      <COLUMN NAME="信息">在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (CFF587F4A8F595C2CB13F3961F7AD51CC0813184).</COLUMN>
      <COLUMN NAME="哈希">D64CB9F20830613F2BED47C6E019FD331569F543</COLUMN>
      <COLUMN NAME="此处首次所见">2020/6/18 18:00:50</COLUMN>
    </RECORD>
    <RECORD>
      <COLUMN NAME="时间">2020/6/18 20:20:52</COLUMN>
      <COLUMN NAME="扫描程序">文件系统实时防护</COLUMN>
      <COLUMN NAME="对象类型">文件</COLUMN>
      <COLUMN NAME="对象">C:\Users\XXXXXXXX\AppData\Local\Temp\BNZ.5eeb5c1f936ca9\DEBT_69304_06162020.vbs</COLUMN>
      <COLUMN NAME="检测">VBS/Kryptik.PB 特洛伊木马</COLUMN>
      <COLUMN NAME="操作">通过删除清除</COLUMN>
      <COLUMN NAME="用户">XXXXXXXXXXXXX</COLUMN>
      <COLUMN NAME="信息">在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (CFF587F4A8F595C2CB13F3961F7AD51CC0813184).</COLUMN>
      <COLUMN NAME="哈希">20A73CA29AE7428F52B2059509604EDDDFC619C6</COLUMN>
      <COLUMN NAME="此处首次所见">2020/6/18 18:00:35</COLUMN>
    </RECORD>
    <RECORD>
      <COLUMN NAME="时间">2020/6/18 20:20:52</COLUMN>
      <COLUMN NAME="扫描程序">文件系统实时防护</COLUMN>
      <COLUMN NAME="对象类型">文件</COLUMN>
      <COLUMN NAME="对象">C:\Users\XXXXXAppData\Local\Temp\BNZ.5eeb5c1f936ca9\PO_196700.doc</COLUMN>
      <COLUMN NAME="检测">Generik.GJEGGYO 特洛伊木马 的变种</COLUMN>
      <COLUMN NAME="操作">通过删除清除</COLUMN>
      <COLUMN NAME="用户">XXXXXXXXX</COLUMN>
      <COLUMN NAME="信息">在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (CFF587F4A8F595C2CB13F3961F7AD51CC0813184).</COLUMN>
      <COLUMN NAME="哈希">BBF5ACD6403A14CCBC20D1E5EB03FFE808C6C5F5</COLUMN>
      <COLUMN NAME="此处首次所见">2020/6/18 18:01:36</COLUMN>
    </RECORD>
    <RECORD>
      <COLUMN NAME="时间">2020/6/18 20:20:52</COLUMN>
      <COLUMN NAME="扫描程序">文件系统实时防护</COLUMN>
      <COLUMN NAME="对象类型">文件</COLUMN>
      <COLUMN NAME="对象">C:\Users\XXXXXXXXXX\AppData\Local\Temp\BNZ.5eeb5c1f936ca9\General_docsINV&amp;BLpdf.bin</COLUMN>
      <COLUMN NAME="检测">MSIL/Kryptik.WJP 特洛伊木马 的变种</COLUMN>
      <COLUMN NAME="操作">通过删除清除</COLUMN>
      <COLUMN NAME="用户">XXXXXXXXXXXXX/COLUMN>
      <COLUMN NAME="信息">在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (CFF587F4A8F595C2CB13F3961F7AD51CC0813184).</COLUMN>
      <COLUMN NAME="哈希">F0D795C19D26824B114A65187FB27E26FF0EE54F</COLUMN>
      <COLUMN NAME="此处首次所见">2020/6/18 18:18:21</COLUMN>
    </RECORD>
</LOG>
</ESET>

wangyuhe

Malwarebytes 1X

rogersg

wangyuhe 发表于 2020-6-18 21:55
Malwarebytes 1X

这么菜的吗？

swizzer

rogersg 发表于 2020-6-18 18:55
智量 3×

二扫，清空

智量对脚本类的查杀一直不好，全靠主防杀······所以漏了算意料之中