#RTF.Macro.virus.sample# （2020-8-7）

川建国代理人

https://app.any.run/tasks/092ac3bd-dea6-4a39-85fa-8b4fe2d85ce2/ 搬运
https://any.run/report/73e2caa408d07e0108e48b2636910a8894434b6f052b80a142eadc2b8e4390fe/092ac3bd-dea6-4a39-85fa-8b4fe2d85ce2 文本资源策划

蓝奏云：https://www.lanzoux.com/imzgzfdoeri

IOC:

1. Main object- "Details-08072020-Y92639.rtf"
   
2.         sha256        73e2caa408d07e0108e48b2636910a8894434b6f052b80a142eadc2b8e4390fe       
   
3.         sha1        38d7fe7b67c4744b1ea129902da7c0c4f6079c5b       
   
4.         md5        4861579583bcb0f4d404f666c248ef77       
   
5. Dropped executable file
   
6.         sha256        C:\Users\admin\AppData\Local\ExplorerFrame\FirewallControlPanel.exe        a075e0bd7a368eca389880829c42b3e9922519e6a5a6a634fa4f1cc4cec6bf72       
   
7. DNS requests
   
8.         domain        webstack.com.au       
   
9. Connections
   
10.         ip        198.74.50.152       
    
11.         ip        82.76.111.249       
    
12.         ip        116.125.120.88       
    
13. HTTP/HTTPS requests
    
14.         url        http://webstack.com.au/wp-includes/U890802/       
    
15.         url        http://82.76.111.249:443/u1AgH1TI/lr87XX8aDGuybXk50ZA/vov8qxGyq/       
    
16.         url        http://116.125.120.88:443/kifP5GaZI13sDY/lvFrhGV6fcTsdRge6W/n9N4HUll/       
    

复制代码

TEXT  ERPORT:

1. General Info
   
2. File name
   
3. Details-08072020-Y92639.rtf
   
4. Full analysis https://app.any.run/tasks/092ac3bd-dea6-4a39-85fa-8b4fe2d85ce2
   
5. Verdict Malicious activity
   
6. Threats:
   
7. Emotet
   
8. Emotet is one of the most dangerous trojans to have been created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.
   
9. 
   
10. Malware Trends Tracker
    
11. 
    
12. More details
    
13. Analysis date 8/7/2020, 09:08:57
    
14. OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
    
15. Tags: macros macros-on-open emotet-doc emotet generated-doc loader trojan
    
16. Indicators:   
    
17. 
    
18. MIME: application/msword
    
19. File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Title: Et., Author: Thomas Rousseau, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Aug 6 23:18:00 2020, Last Saved Time/Date: Thu Aug 6 23:18:00 2020, Number of Pages: 1, Number of Words: 5, Number of Characters: 29, Security: 0
    
20. MD5
    
21. 4861579583BCB0F4D404F666C248EF77
    
22. SHA1
    
23. 38D7FE7B67C4744B1EA129902DA7C0C4F6079C5B
    
24. SHA256
    
25. 73E2CAA408D07E0108E48B2636910A8894434B6F052B80A142EADC2B8E4390FE
    
26. SSDEEP
    
27. 3072:Z4PRXCUQUVPZM4BKIAMQGALSZLJUHWNYWPU/QK:MDRV1M4BNQGISTJUHWNYWPU/QK

复制代码

a233

Avast
SNH:Script [Dropper]

浪里个浪9527

救命稻草

DPT1

henry217

卡巴 2021kill智量依然miss

anthonyqian

诺顿

文件名: Details-08072020-Y92639.rtf
威胁名称: W97M.Downloader

WAR314159

ESET KILL
时间;扫描程序;对象类型;对象;检测;操作;用户;信息;哈希;此处首次所见
2020/8/7 17:18:14;文件系统实时防护;文件;C:\Users\ASUS\AppData\Local\Temp\BNZ.5f2d1c5393f4b5\Details-08072020-Y92639.rtf;VBA/TrojanDownloader.Agent.UAA 特洛伊木马 的变种;通过删除清除;DESKTOP-MHBQUVD\ASUS;在应用程序新建的文件上发生事件: C:\Program Files\Bandizip\Bandizip.exe (103F35C2A271F39642571BC73D10C3EEB1D91B39).;38D7FE7B67C4744B1EA129902DA7C0C4F6079C5B;2020/8/7 15:15:16

OVS

卡巴 kill     提个建议  蓝奏地址加个超链接

川建国代理人

OVS 发表于 2020-8-7 18:01
卡巴 kill     提个建议  蓝奏地址加个超链接

好的呢，下次整改