16x样本包

wwwab

火绒爃 发表于 2021-6-10 14:08
怪不得看一楼的图那么熟悉

此样本包里面的样本全部均选自火绒安全论坛

BFAX

wwwab 发表于 2021-6-10 21:10
上报了吗

上报了，只要miss的我没有特殊说明都会上报

wwwab

BFAX 发表于 2021-6-10 21:14
上报了，只要miss的我没有特殊说明都会上报

都入库了吗，有没有白的

Nocria

IKARUS - 15/16

1. [10.06.2021 21:20:22] On-demand scan started: "user_defined"
   
2. [10.06.2021 21:20:22] Found, 0.31s, SigName: "Trojan-Downloader.VBA.Agent", SigId: 4127610, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\12.ppam"
   
3. [10.06.2021 21:20:22] Found, 0.79s, SigName: "Trojan.VB.Crypt", SigId: 3781368, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\3.exe"
   
4. [10.06.2021 21:20:22] Found, 0.94s, SigName: "Trojan.Win32.Injector", SigId: 177488376, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\6.exe"
   
5. [10.06.2021 21:20:22] Found, 0.46s, SigName: "Backdoor.Win32.PcClient", SigId: 3486491, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\789.exe"
   
6. [10.06.2021 21:20:22] Found, 0.15s, SigName: "Trojan-Downloader.XLM.Agent", SigId: 4128320, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Compensation_1899326776_06072021.xlsm"
   
7. [10.06.2021 21:20:23] Found, 0.766s, SigName: "Trojan.Bluteal", SigId: 3826642, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Eyes(1).exe"
   
8. [10.06.2021 21:20:23] Found, 0.922s, SigName: "Trojan.Bluteal", SigId: 3826642, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Eyes.exe"
   
9. [10.06.2021 21:20:23] Found, 0.172s, SigName: "Exploit.CVE-2017-11882", SigId: 3283595, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Payment Confirmation 2021.xlsx"
   
10. [10.06.2021 21:20:23] Found, 0.32s, SigName: "Trojan-Downloader.Office.Crypt", SigId: 324354403, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Quote SEQTE00311701.xlsx"
    
11. [10.06.2021 21:20:23] Found, 0.47s, SigName: "Backdoor.MSIL.Bladabindi", SigId: 2658068, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\RFQ PRICE LIST FOR LEABANON 8938920993.exe"
    
12. [10.06.2021 21:20:23] Found, 0.31s, SigName: "Trojan.Inject", SigId: 324351676, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\RFQ27559404D4E5A.PDF.exe"
    
13. [10.06.2021 21:20:23] Found, 0.78s, SigName: "Backdoor.Win32.PcClient", SigId: 3346827, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\sunnie.exe"
    
14. [10.06.2021 21:20:23] Found, 0.78s, SigName: "Exploit.CVE-2017-11882", SigId: 3386025, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\Swift Payment  Copy.doc"
    
15. [10.06.2021 21:20:23] Found, 0.47s, SigName: "Packed.Win32.Crypt", SigId: 3848776, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\TQZ23 DESCO MC.exe"
    
16. [10.06.2021 21:20:23] Found, 0.78s, SigName: "Backdoor.MSIL.Bladabindi", SigId: 2658068, Type: "VIRUS", File: "C:\Users\promi\Desktop\Downloads(20210610064529)\Downloads\付款發票_pdf_______________________________.exe"
    
17. [10.06.2021 21:20:23] On-demand scan FINISHED: "user_defined"
    
18. [10.06.2021 21:20:23] ----------------------------------------------------
    
19. [10.06.2021 21:20:23] Directories scanned: 2
    
20. [10.06.2021 21:20:23] Files scanned: 30
    
21. [10.06.2021 21:20:23] Virus found: 15
    
22. [10.06.2021 21:20:23] ----------------------------------------------------

复制代码

BFAX

wwwab 发表于 2021-6-10 21:16
都入库了吗，有没有白的

邮件上报处理结果：
①

Greetings,

该样本已经可以被检测出，请将数据库更新到最新后试一下。

Eyes.exe -- UDS:Trojan.Win32.Agent
789.exe -- UDS:Trojan-Banker.Win32.Banbra.gen

②

Greetings,

其他样本文件，我们会提交到病毒中心进行分析，相对问题回复的时长要比较普通的邮件回复周期要久一些，请您谅解。
如有任何新的消息，我们会第一时间回复您。

③

Greetings!

感谢您的帮助，在提交的样本中发现了新的检测。它的检测将包含在下一次数据库更新中。
Eyes(1).exe - Trojan.Win32.Agentb.klkp
sunnie.exe - Backdoor.Win32.Agent.myubvf

无白文件

11111111111445

出自火绒论坛,但是火绒只杀15个,这就搞笑了

huicuan

Nocria 发表于 2021-6-10 21:21
IKARUS - 15/16

你好  看到头像就想起了你，请问您现在用什么安全软件呢

wwwab

11111111111445 发表于 2021-6-10 21:47
出自火绒论坛,但是火绒只杀15个,这就搞笑了

当时官人回复是入库了的
里面有很多宏病毒，不排除是被修复了

wwwab

BFAX 发表于 2021-6-10 21:41
邮件上报处理结果：
①

我就说嘛，我的样本包质量老高了

Mr.NoProblem

mcafee antivirus plus ，手动扫，发现11个，