公司早晚班调班调整通知 的cmd文件 可疑远控后门程序

云城飞将

        在Skype伪装成人事，加好友发送 一个 公司早晚班调班调整通知 的cmd文件 。目前 压缩包中文件后缀被我改了 。IDA 查看 发 现 可疑URL现 http://58.218.201.42:8989/ 在浏览器中打开 发现  一个HTTP 文件服务器 其中发着一些可执行文件

360 火绒 都检测不出来
使用在线 病毒扫描网站 结果如下





样本，原文件后缀 cmd ，解压密码 123456

Jerry.Lin

衍生物
https://cowtransfer.com/s/f2a5288785554c

狂欢...

本地

dsb2466

多引擎查杀还是使用virustotal好些，更准确：
https://www.virustotal.com/gui/file/cb62be667723993d12f448d4634cd6891340f70c3819cd8aa1643fbefc5c76bb/detection

z68436425

ESET

温馨小屋

卡巴扫描miss。。。
双击也miss

温馨小屋

Filename: 公司早晚班调班调整通知.exe
Threat name: SONAR.Heuristic.170Full Path: Not Available

____________________________

____________________________


On computers as of 
2021/1/14 at 16:21:09

Last Used 
2021/1/14 at 16:21:09

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


公司早晚班调班调整通知.exe Threat name: SONAR.Heuristic.170
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
公司早晚班调班调整通知.exe

____________________________

File Actions

File: c:\Users\nortonltsc\Desktop\ 公司早晚班调班调整通知.exe Threat Removed
File: c:\Users\nortonltsc\AppData\Local\microsoft\Windows\inetcache\IE\T80DLZY5\ PDSOAGC6.htm Threat Removed
File: c:\Users\Public\documents\ 1.rar Threat Removed
____________________________

Network Actions

Event: Network activity (Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
Event: Norton IDS signature detected on network traffic (Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
(Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
Event: Process start: c:\users\nortonltsc\desktop\ 公司早晚班调班调整通知.exe, PID:9116 (Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
____________________________

Suspicious Actions

(Performed by c:\users\nortonltsc\desktop\公司早晚班调班调整通知.exe, PID:9116) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

温馨小屋

MES

NT狼狼

金山毒霸

狂欢...

云QVM已响应