#Webshell

hsks

https://www.fireeye.com/blog/thr ... -and-extortion.html
https://www.virustotal.com/gui/f ... 794692c1b/detection

anthonyqian

ESET miss

liu237

卡巴

心心相印

火绒、智量扫描miss

心醉咖啡

毒霸

1. 扫描时间：[2021-03-04 08:11:45]
   
2. 扫描用时：[00:00:04]
   
3. 扫描类型：自定义查杀
   
4. 扫描文件总数：1
   
5. 扫描速度：1文件/秒
   
6. 发现威胁：1个
   
7. 清除威胁：1个
   
8. =============================================
   
9. [2021-03-04 08:11:53]
   
10. 威胁：e:\浏览器下载\5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b\5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown
    
11. 类型：win32.scriptc.undef.a.(kcloud)
    
12. 处理方式：删除
    
13. 
    

复制代码

温馨小屋

Filename: 5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown
Threat name: InfostealerFull Path: C:\Users\NortonLTSC\AppData\Local\Temp\vmware-NortonLTSC\VMwareDnD\14cf2adf\5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown

____________________________

____________________________


On computers as of 
2021/3/4 at 11:20:52

Last Used 
2021/3/4 at 11:20:52

Startup Item 
No

Launched 
No

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.


____________________________


5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown Threat name: Infostealer
Locate


Few Users
Fewer than 50 users in the Norton Community have used this file.

New
This file was released 20 days ago.

High
This file risk is high.


____________________________


Source: External Media


____________________________

File Actions

File: C:\Users\NortonLTSC\AppData\Local\Temp\vmware-NortonLTSC\VMwareDnD\14cf2adf\ 5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown Blocked
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

Nocria

IKARUS

1. Date and Time: 3/4/2021 6:57:32 PM
   
2. File Size: 3.01 kB
   
3. Detection Name: Trojan.Script.Agent
   
4. Detection-ID: 319755535
   
5. Suggestion: Backup
   
6. File Name: 5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown
   
7. Original Path: C:\Users\promi\Desktop
   

复制代码

k2132

火绒 报    智量无

jasperchau

温馨小屋 发表于 2021-3-4 11:20
Filename: 5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b.unknown
Threat name: Inf ...

诺顿牛逼哈哈

温馨小屋

jasperchau 发表于 2021-3-5 13:01
诺顿牛逼哈哈

这牛逼啥，都两个月之前的样本了