BAZARLOADER INFECTION WITH COBALT STRIKE (2022-02-04) (34X)

显示全部楼层 · 发表于 2022-2-5 14:59:22

本帖最后由 anthonyqian 于 2022-2-5 23:11 编辑

BD 扫描杀4个。
---------

已清空，基本上是GenericKD和Trojan.GenericFCA.Agent

显示全部楼层 · 发表于 2022-2-5 15:06:18

Sophos EXE全杀

显示全部楼层 · 发表于 2022-2-5 15:09:21

anthonyqian 发表于 2022-2-5 14:59
BD 扫描杀4个。

BD是EXE样本报了四个么

显示全部楼层 · 发表于 2022-2-5 15:15:11

00006666 发表于 2022-2-5 15:09
BD是EXE样本报了四个么

1个EXE 和 3个HTA

显示全部楼层 · 发表于 2022-2-5 15:19:29

本帖最后由 Nocria 于 2022-2-5 15:31 编辑

G DATA - 25/34

显示全部楼层 · 发表于 2022-2-5 15:37:34

MS Defender：清空exe，其中大部分触发了自动上报，还剩21个不知道修没修复的hta

显示全部楼层 · 发表于 2022-2-5 15:43:14

Avast all

显示全部楼层 · 发表于 2022-2-5 15:53:06

锁库智量（2022/1/24）

清空

2022-02-05 15:51:29|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\CUFniru.exe|Heur.ML.PE.E
2022-02-05 15:51:29|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\FHtkRL.exe|Heur.ML.PE.E
2022-02-05 15:51:29|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\JeyRthXD.exe|Heur.ML.PE.E
2022-02-05 15:51:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\KZWSMDL.exe|Heur.ML.PE.E
2022-02-05 15:51:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\QzsLdG.exe|Heur.ML.PE.E
2022-02-05 15:51:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\ScudX.exe|Heur.ML.PE.E
2022-02-05 15:51:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\UjhmJFPd.exe|Heur.ML.PE.E
2022-02-05 15:51:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\WAXKU.exe|Heur.ML.PE.E
2022-02-05 15:51:31|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\YMpRJ.exe|Heur.ML.PE.E
2022-02-05 15:51:31|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\downloaded-EXE-files\ymgIH.exe|Heur.ML.PE.E
2022-02-05 15:51:41|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Antrag-394-394.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:50|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-61-61.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:53|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-396-396.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:55|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-406-406.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:57|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-631-631.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:58|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-693-693.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:51:59|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-746-746.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:09|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Antrag-534-534.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:11|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Antrag-809-809.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:13|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Antrag-944-944.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:14|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-964-964.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:15|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-1242-1242.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:16|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-1391-1391.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:25|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_35303473.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:25|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_33524497.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:26|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_19047313.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:26|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_16654897.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:27|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_16148809.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:28|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_8695513.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:28|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Rechnung_5536297.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:29|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-2858-2858.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:29|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-2850-2850.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-2674-2674.hta|WIBD:HEUR.MalCmdline.B0
2022-02-05 15:52:30|C:\Users\Dolphiner\Downloads\2022-02-04-BazarLoader-malware-samples\2022-02-04-BazarLoader-malware-samples\extracted-hta-files\Auftrag-1731-1731.hta|WIBD:HEUR.MalCmdline.B0

复制代码

显示全部楼层 · 发表于 2022-2-5 16:00:24

ANY.LNK 发表于 2022-2-5 15:37
MS Defender：清空exe，其中大部分触发了自动上报，还剩21个不知道修没修复的hta

HTA不知道能不能修复，正常的话如果检出了应该是隔离文件。

显示全部楼层 · 发表于 2022-2-5 16:03:04

00006666 发表于 2022-2-5 16:00
HTA不知道能不能修复，正常的话如果检出了应该是隔离文件。

我这边历史记录里有报告hta威胁，所以不知道到底修没修（之前见到将<html>间的内容全部删除或换上空格的）

[病毒样本] BAZARLOADER INFECTION WITH COBALT STRIKE (2022-02-04) (34X)

本帖子中包含更多资源

本帖子中包含更多资源

评分

浏览过的版块