7X (IcedID-and-Cobalt-Strike-malware-and-artifacts)

显示全部楼层 · 发表于 2022-2-1 12:15:14

MES Kill All

显示全部楼层 · 发表于 2022-2-1 12:37:39

显示全部楼层 · 发表于 2022-2-1 12:48:27

Ahnlab V3 Lite 剩余3x

显示全部楼层 · 发表于 2022-2-1 12:49:16

MS Defender：解压+扫描清空

显示全部楼层 · 发表于 2022-2-1 14:26:17

本帖最后由 aboringman 于 2022-2-1 22:43 编辑

McAfee：6

2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\license.dat 15 1 Generic trojan.qc
2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\alll.ocx 1 1 JTI/Suspect.196612!209fd87608a5 209fd87608a54a91d07a8ed43dd2c4a9
2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\alle.ocx 1 1 JTI/Suspect.196612!b5240bcd8ea0 b5240bcd8ea05ed12e9e8e51a09f25c3
2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\all1.ocx 1 1 JTI/Suspect.196612!ef8744a2c99e ef8744a2c99e6bbf97493998efd9f1b9
2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\all1.ocx 15 1 RDN/Generic.grp ef8744a2c99e6bbf97493998efd9f1b9
2022/02/01 14:23:13 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\alle.ocx 15 1 MLFNG b5240bcd8ea05ed12e9e8e51a09f25c3
2022/02/01 14:23:15 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\Okagdt3.dll 15 1 JTI/Suspect.196612!d4ab88ec5742 d4ab88ec574292bcd9f2ba921188295b
2022/02/01 14:23:16 D:\test\IcedID-and-Cobalt-Strike-malware-and-artifacts\Stolen_Images_Evidence.xlsm 1 1 Downloader-FCHG!D6F2D56FA27B

复制代码

Norton：5

文档双击缺少条件（因为已经寄了）

Reported

Stolen_Images_Evidence.xlsm确定为恶意

license.dat被认为是攻击后的衍生物，但本体无害。

显示全部楼层 · 发表于 2022-2-2 14:42:33

智量(DB:2022/1/24)

扫描miss all

双击内存杀ocx和Office文档调用的regsvr32.exe
剩余几个无法独立运行

[病毒样本] 7X (IcedID-and-Cobalt-Strike-malware-and-artifacts)