#Vbs script virus# （2020-8-5）virus name：taskhost.vbs

川建国代理人

https://app.any.run/tasks/c9b43ffd-19af-493e-a6bb-fddc3531b681/ 搬运
https://any.run/report/0fb0049ad82d81a8e6dde1b76258f776533a3d4b38cb905b063d4b433c1f6025/c9b43ffd-19af-493e-a6bb-fddc3531b681  文本资源规划
蓝奏云：https://www.lanzoux.com/io7Tkfbxaed
IOC:

1. Main object- "taskhost.vbs"
   
2.         sha256        0fb0049ad82d81a8e6dde1b76258f776533a3d4b38cb905b063d4b433c1f6025       
   
3.         sha1        56d6e7dbe1ece21f442f0338a4676bb01ca5d599       
   
4.         md5        084904f21717a5be0488a0eb844402b3       
   
5. DNS requests
   
6.         domain        dr7far.duckdns.org       
   
7.         domain        dns.msftncsi.com       
   
8. Connections
   
9.         ip        179.233.81.56       
   

复制代码

TEXT  ERPORT:

1. General Info
   
2. File name
   
3. taskhost.vbs
   
4. Full analysis https://app.any.run/tasks/c9b43ffd-19af-493e-a6bb-fddc3531b681
   
5. Verdict Malicious activity
   
6. Analysis date 8/5/2020, 15:58:21
   
7. OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
   
8. Indicators:  
   
9. 
   
10. MIME: text/plain
    
11. File info: ASCII text, with CRLF line terminators
    
12. MD5
    
13. 084904F21717A5BE0488A0EB844402B3
    
14. SHA1
    
15. 56D6E7DBE1ECE21F442F0338A4676BB01CA5D599
    
16. SHA256
    
17. 0FB0049AD82D81A8E6DDE1B76258F776533A3D4B38CB905B063D4B433C1F6025
    
18. SSDEEP
    
19. 192:MI64MHHSH8XDC/V8/R7UQ4TDGBGW+VJHRMUFOYGHN/QVRTAFVYHAWNZWUUXZ:MV4MHYHRLGBGW+VJXMUFOFXIASWU2

复制代码

henry217

我来测试了，用火绒剑记录一些行为这混病毒静默运行，就占了0.1%的内存，把我注册表改的一塌糊涂

a233

Avast
BV:Worm-BS [Trj]

16315

试试

狂欢...

360

Jerry.Lin

火绒
Worm/VBS.Jenxcus.b

wwwmjrcom

avast free kill

OVS

卡巴  kill

henry217

OVS 发表于 2020-8-6 08:01
卡巴  kill

卡巴2021的上下文菜单开始弹窗扫描了，不太习惯

WAR314159

ESET KILL
时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2020/8/6 9:02:07;文件系统实时防护;文件;C:\Users\ASUS\AppData\Local\Temp\BNZ.5f2b568a1e0954\taskhost.vbs;VBS/Agent.NJZ 蠕虫;通过删除清除;DESKTOP-MHBQUVD\ASUS;在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (103F35C2A271F39642571BC73D10C3EEB1D91B39).;56D6E7DBE1ECE21F442F0338A4676BB01CA5D599;2020/8/5 22:06:54