#APT #Signed #Pakistan (2020-07)

Jirehlov1234

https://jirehlov.lanzous.com/ihw3zecpgbi

https://www.virustotal.com/gui/f ... 020eea698/detection

https://www.virustotal.com/gui/f ... 2c479a904/detection

https://twitter.com/ShadowChasin ... 24110249046019?s=20

川建国代理人

智量桌面监控Kill All  扫描Kill All

OVS

卡巴beta  清空

Miostartos

FSP杀EXE

欧阳宣

BEST
Proton.VB.Aquila.1.40A.3000001
Trojan.GenericKD.34121482

心醉咖啡

毒霸云鉴定之后

1. 扫描时间：[2020-07-06 14:54:04]
   
2. 扫描用时：[00:00:06]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：2
   
5. 扫描速度：1文件/秒
   
6. 发现威胁：1个
   
7. 清除威胁：1个
   
8. =============================================
   
9. [2020-07-06 14:54:14]
   
10. 威胁：e:\浏览器下载\7.6\microscmgmt.exe
    
11. 类型：win32.troj.undef.(kcloud)
    
12. 处理方式：删除
    
13. 
    

复制代码

狂欢...

C:\360极速浏览器下载\Covid19_Guidelines.doc        木马程序(Generic/Trojan.Dropper.be6)        已删除
c:\360极速浏览器下载\microscmgmt.exe恶意软件(HEUR/QVM20.1.60F7.Malware.Gen)MD5:809ff867d2cfe803ef4ae4102283b45c已删除此文件，如果您发现误删，可从隔离区恢复此文件。   

rogersg

ESET Miss All




两个小时过去了，现在都杀了，一个报Suspicious Object云杀，一个报VBA/TrojanDropper.Agent.BIA入库杀

1. Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
   
2. 2020/7/6 17:36:49;Real-time file system protection;file;D:\Users\Admin\Desktop\7.6\MicroScMgmt.exe;Suspicious Object;cleaned by deleting;DESKTOP-CMJROL5\Admin;Event occurred during an attempt to access the file by the application: C:\Windows\explorer.exe (C07130E269EBFEEFCB7D893F01498BC96AA5AB24).;734807EF7B402219AB1BADB5D5C1804639A465F9;2020/7/6 11:28:51
   
3. 2020/7/6 17:36:51;Real-time file system protection;file;D:\Users\Admin\Desktop\7.6\Covid19_Guidelines.doc;VBA/TrojanDropper.Agent.BIA trojan;cleaned by deleting;DESKTOP-CMJROL5\Admin;Event occurred during an attempt to access the file by the application: C:\Windows\explorer.exe (C07130E269EBFEEFCB7D893F01498BC96AA5AB24).;0AA66138590AB69AC68711A6A50A56DA537A3646;2020/7/6 11:14:02

复制代码

Nocria

Avira scan missed all.

2849

Miostartos 发表于 2020-7-6 14:52
FSP杀EXE

最近FS自家引擎存在感挺高的啊

这是红伞报的吧，反正vt 上红伞是报的这个。