#Zloader #Signed #Certbypass (2022-01-05)

显示全部楼层 · 发表于 2022-1-5 19:30:11

显示全部楼层 · 发表于 2022-1-5 19:33:55

火绒1x

显示全部楼层 · 发表于 2022-1-5 19:49:46

avast kill1x

显示全部楼层 · 发表于 2022-1-5 20:02:16

FSS

显示全部楼层 · 发表于 2022-1-5 20:04:10

kaspersky 3x

显示全部楼层 · 发表于 2022-1-5 20:09:16

本帖最后由 aboringman 于 2022-1-5 21:13 编辑

Norton：3

2022/1/5 20:04:31,高,检测到 reboot.dll (Trojan.Malfilter) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行威胁操作: 1
2022/1/5 20:04:28,高,检测到 appContast.dll (Trojan.Malfilter) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行威胁操作: 1
2022/1/5 20:04:27,高,检测到 9092.dll (Trojan.Gen.MBT) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行威胁操作: 1
2022/1/5 20:04:27,高,检测到 9092.dll (Heur.AdvML.C) (检测方: 下载智能分析),已隔离,已解决 - 不需要操作,已执行威胁操作: 1

复制代码

另外两个信誉良好

显示全部楼层 · 发表于 2022-1-5 20:36:06

锁库智量
病毒库：2021/12/8

9092.dll双击杀MEMRAY:MalCode.D0
剩余两个dll加载后找不到入口点。
exe应该是白文件？

显示全部楼层 · 发表于 2022-1-5 20:39:28

360

显示全部楼层 · 发表于 2022-1-5 20:47:47

显示全部楼层 · 发表于 2022-1-5 21:04:26

大蜘蛛Kill 2x

Engine 12.06.8.12260/7.00.52.08270 (2.2), 10754645 records, 2022/01/05 19:33
Last updated 2022/01/05 19:33
This is Windows XP Professional x86 (Build 2600), Service Pack 3
The user is INTEL\Administrator:INTEL\None [url=home.php?mod=space&uid=340]@[/url] INTEL
Using "..\st.drweb.com\static\beta_files\win\12.5\keys\drweb32.key" as Dr.Web Key file
This Dr.Web Key is for 1 computer (Beta Dr.Web)
WARNING! System has not been scanned for rootkits.
Scan files using 2 engines and "" mask
The mask was translated to "" filter
"c:\Downloads\20220105\1.5\Java.msi/stream000/AteraAgent.exe" is riskware program Program.RemoteAdminNET.1
"c:\Downloads\20220105\1.5\Java.msi/stream000/AteraAgent.exe" - infected
"c:\Downloads\20220105\1.5\Java.msi/stream000" - infected archive
"c:\Downloads\20220105\1.5\Adminpriv.exe" is hacktool program Tool.NSudo.1 - deleted
"c:\Downloads\20220105\1.5\Java.msi" - deleted
WARNING! Restore points directories have not been scanned
Total 2.7 Mbytes in 5 files scanned (23 objects, 4 containers)
Total 3 files are clean
Total 2 files are infected
Total 2 files are neutralized
Scan time is 00:01:01, 46KB/sec

复制代码

[病毒样本] #Zloader #Signed #Certbypass (2022-01-05)