BAZARLOADER INFECTION WITH COBALT STRIKE

00006666

BAZARLOADER INFECTION WITH COBALT STRIKE

swizzer

Norton

documents.log  -  Trojan.Gen.MBT
BEB2.dll             -   Trojan.Gen.MBT

正在缓冲

Avast 3x
Win32:Malware-gen   Other:Malware-gen[Trj]

ft-cai

Kasepersky scan 剩余 1x

秋日之殇

剩余的dll文件加载报错了，提示找不到入口点。

救命稻草

NICO-COOPER

SecureAPlus UAV 2xiso手动解压后，kill 1x 目前已将剩余样本打包上报

傻猪猪米走鸡

ESET剩下那个iso文档

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
2022/2/10 12:36:07;Real-time file system protection;file;C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\documents.log;Win64/BazarLoader.BK trojan;cleaned by deleting;RayFAE2BF70C900\Administrator;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (DD8FDBED80E89DB0AF76A44F8FC349BB43E55F6E).;82D479690B5BBD396E935DB79329AB43DA4377A9;2022/2/10 12:36:06
2022/2/10 12:36:07;Real-time file system protection;file;C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BEB2.dll;a variant of Win32/Kryptik.HOHH trojan;cleaned by deleting;RayFAE2BF70C900\Administrator;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (DD8FDBED80E89DB0AF76A44F8FC349BB43E55F6E).;D65880974894384D3D27BFE26ADC49703D41912B;2022/2/10 12:36:06
2022/2/10 12:36:08;Real-time file system protection;file;C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\Attachments.lnk.bin;LNK/Agent.MW trojan;cleaned by deleting;RayFAE2BF70C900\Administrator;Event occurred on a new file created by the application: C:\Program Files\WinRAR\WinRAR.exe (DD8FDBED80E89DB0AF76A44F8FC349BB43E55F6E).;3001131010CA32F09DB5FE11BB9C12B142C987A2;2022/2/10 12:36:06

手动扫描杀了iso
Log
Scan Log
Version of detection engine: 24762P (20220209)
Date: 2022/2/10  Time: 12:38:13
Scanned disks, folders and files: C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\docs_1309.iso
C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\docs_1309.iso » ISO » Attachments.lnk - LNK/Agent.MW trojan - deleted
C:\Users\Administrator\Downloads\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\BazarLoader-and-Cobalt-Strike-malware-and-artifacts\docs_1309.iso » ISO » documents.log - Win64/BazarLoader.BK trojan - deleted
Number of scanned objects: 3
Number of detections: 2
Number of cleaned objects: 2
Time of completion: 12:38:14  Total scanning time: 1 sec (00:00:01)

心心相印

fs kill

心醉咖啡

火绒