#Emotet (2022-01-17) 补充

anthonyqian

隔山打空气 发表于 2022-1-17 19:37
BEST miss all
我人麻了啊，难兄难弟

正常 没提取特征的下场

隔山打空气

anthonyqian 发表于 2022-1-17 19:41
正常 没提取特征的下场

BD不是有个针对性模型 AI:Emotet嘛

所以我以为它能日常通杀呢（
云沙箱分析结束，几乎全部的dll特征都一模一样，除35.dll全杀（其实35也应该杀，但是IoC似乎抽了）

anthonyqian

隔山打空气 发表于 2022-1-17 19:45
BD不是有个针对性模型 AI:Emotet嘛

所以我以为它能日常通杀呢（

没训练到位

隔山打空气

anthonyqian 发表于 2022-1-17 19:49
没训练到位

2333333333333

其实问题不大，BD有这些组织的入侵指标的，网络攻击防护应该能拦截

接下来就该他们加班加点继续训练模型了，这一包Emotet整的好丢人呐

Jirehlov1234

隔山打空气 发表于 2022-1-17 19:45
BD不是有个针对性模型 AI:Emotet嘛

所以我以为它能日常通杀呢（

想通杀你可太小看活跃中的emotet了
看通杀还得是火绒（不是

anthonyqian

诺顿改过hash后才B杀清空。。。奇葩

隔山打空气

Jirehlov1234 发表于 2022-1-17 19:54
想通杀你可太小看活跃中的emotet了
看通杀还得是火绒（不是

确实

传下去，BEST不如火绒，大家快退款

（大雾）

东南大学

大蜘蛛扫描Kill 25x

1. "c:\Downloads\20220117\25x\18.dll" infected with Trojan.Emotet.1141 - deleted
   
2. "c:\Downloads\20220117\25x\19.dll" infected with Trojan.Emotet.1141 - deleted
   
3. "c:\Downloads\20220117\25x\20.dll" infected with Trojan.Emotet.1141 - deleted
   
4. "c:\Downloads\20220117\25x\21.dll" infected with Trojan.Emotet.1141 - deleted
   
5. "c:\Downloads\20220117\25x\22.dll" infected with Trojan.Emotet.1141 - deleted
   
6. "c:\Downloads\20220117\25x\23.dll" infected with Trojan.Emotet.1141 - deleted
   
7. "c:\Downloads\20220117\25x\24.dll" infected with Trojan.Emotet.1141 - deleted
   
8. "c:\Downloads\20220117\25x\25.dll" infected with Trojan.Emotet.1141 - deleted
   
9. "c:\Downloads\20220117\25x\26.dll" infected with Trojan.Emotet.1141 - deleted
   
10. "c:\Downloads\20220117\25x\27.dll" infected with Trojan.Emotet.1141 - deleted
    
11. "c:\Downloads\20220117\25x\28.dll" infected with Trojan.Emotet.1141 - deleted
    
12. "c:\Downloads\20220117\25x\29.dll" infected with Trojan.Emotet.1141 - deleted
    
13. "c:\Downloads\20220117\25x\30.dll" infected with Trojan.Emotet.1141 - deleted
    
14. "c:\Downloads\20220117\25x\31.dll" infected with Trojan.Emotet.1141 - deleted
    
15. "c:\Downloads\20220117\25x\32.dll" infected with Trojan.Emotet.1141 - deleted
    
16. "c:\Downloads\20220117\25x\33.dll" infected with Trojan.Emotet.1141 - deleted
    
17. "c:\Downloads\20220117\25x\34.dll" infected with Trojan.Emotet.1141 - deleted
    
18. "c:\Downloads\20220117\25x\35.dll" infected with Trojan.Emotet.1141 - deleted
    
19. "c:\Downloads\20220117\25x\36.dll" infected with Trojan.Emotet.1141 - deleted
    
20. "c:\Downloads\20220117\25x\37.dll" infected with Trojan.Emotet.1141 - deleted
    
21. "c:\Downloads\20220117\25x\38.dll" infected with Trojan.Emotet.1141 - deleted
    
22. "c:\Downloads\20220117\25x\39.dll" infected with Trojan.Emotet.1141 - deleted
    
23. "c:\Downloads\20220117\25x\40.dll" infected with Trojan.Emotet.1141 - deleted
    
24. "c:\Downloads\20220117\25x\41.dll" infected with Trojan.Emotet.1141 - deleted
    
25. "c:\Downloads\20220117\25x\42.dll" infected with Trojan.Emotet.1141 - deleted

复制代码

NICO-COOPER

Webroot清空突然又想玩这个家伙了，没想到表现不错啊

ICzcz

智量：kill all