夜神模拟器供应链攻击样本

温馨小屋

Filename: 842497c20072fc9b92f2b18e1d690103.exe
Threat name: Trojan.Gen.MBTFull Path: C:\Users\NortonLTSC\Desktop\842497c20072fc9b92f2b18e1d690103.exe

____________________________

____________________________


On computers as of 
2021/2/2 at 14:33:55

Last Used 
2021/2/2 at 14:33:55

Startup Item 
No

Launched 
No

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.


____________________________


842497c20072fc9b92f2b18e1d690103.exe Threat name: Trojan.Gen.MBT
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media


____________________________

File Actions

File: C:\Users\NortonLTSC\Desktop\ 842497c20072fc9b92f2b18e1d690103.exe Blocked
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

空伐Void

温馨小屋 发表于 2021-2-2 14:34
Filename: 842497c20072fc9b92f2b18e1d690103.exe
Threat name: Trojan.Gen.MBTFull Path: C:%users\Norto ...

感觉诺顿好多MBT和GEN.2

温馨小屋

空伐Void 发表于 2021-2-2 21:22
感觉诺顿好多MBT和GEN.2

新病毒大多数都是这些名字，其实就是MD5拉黑，和卡巴的UDS云杀差不多，而且很久都不会分类入库，除非有名的一些病毒。

swizzer

智量 昨天的病毒库
双击，本体被报WIBD:HEUR.MalPersistence.M并回滚衍生物。

2021-02-02 23:20:49|D:\$aa\1\2.1\842497c20072fc9b92f2b18e1d690103.exe|WIBD:HEUR.MalPersistence.M
2021-02-02 23:20:58|C:\ProgramData\LoGiTech\LoGitech.exe|威胁回滚(隔离)
2021-02-02 23:20:58|C:\ProgramData\LoGiTech\LBTServ.dll|威胁回滚(隔离)
2021-02-02 23:20:58|C:\Users\Administrator\AppData\LocalLow\SogouPY\InputStaticstics.dat.sgbak|威胁回滚(隔离)

单独双击衍生物，10min后仍无反应···
@智量官方

空伐Void

swizzer 发表于 2021-2-2 23:34
智量 昨天的病毒库
双击，本体被报WIBD:HEUR.MalPersistence.M并回滚衍生物。

很少看见智量回滚

swizzer

空伐Void 发表于 2021-2-3 00:00
很少看见智量回滚

随便双击个#AgentTesla都能看见

空伐Void

swizzer 发表于 2021-2-3 00:12
随便双击个#AgentTesla都能看见

只有勒索，AgentTesla才能回滚吗？

InApproaching

swizzer 发表于 2021-2-3 00:12
随便双击个#AgentTesla都能看见

我好像懂了什么~

QVM360

swizzer 发表于 2021-2-3 00:12
随便双击个#AgentTesla都能看见

agenttesla衍生物比较明显

BitterLotus

Avira Kill