EMOTET EPOCH 4 样本 26X

JuMin

pal家族 发表于 2022-4-26 10:14
我们集团统一采购部署的蛐蛐
结果连续两个月持续被依摩泰特渗透，大量内网邮箱等信息被偷，钓鱼邮件一大堆 ...

依摩泰特是哪个？
火绒 Kill 15X

pal家族

JuMin 发表于 2022-4-26 10:54
依摩泰特是哪个？

师傅，你在浏览哪个帖子呢

JuMin

pal家族 发表于 2022-4-26 10:55
师傅，你在浏览哪个帖子呢

突然英文变中文，没反应过来

lvseqiji

pal家族 发表于 2022-4-26 10:44
谁收个人版就不认识就杀
那是在触发敏感期自动调成高敏感度了
普通敏感度可不是非白即黑

我个人版就是开高敏感的，实际体验很不错，没啥误报

pal家族

lvseqiji 发表于 2022-4-26 11:01
我个人版就是开高敏感的，实际体验很不错，没啥误报

你不安装杀软 做到非官方软件不用 效果可能更好

LSPD

MD杀压缩包
Trojan:Script/Wacatac.B!ml

00006666

LSPD 发表于 2022-4-26 12:12
MD杀压缩包
Trojan:Script/Wacatac.B!ml

我这个压缩包有密码的诶

lvseqiji

趋势科技双击杀了一堆

huangzihang

Norton扫描4x。。。这也。。。
虚拟机我连office都没装，双击没法测了

anthonyqian

BD 33个检测

1. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-64-bit-DLL-for-Emotet.bin Trojan.GenericKD.48930960 Deleted
   
2. C:\Users\\Downloads\Compressed\Emotet-epoch4\Form Dt 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
   
3. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
   
4. C:\Users\\Downloads\Compressed\Emotet-epoch4\INV 2022-04-25_1237, United States.doc.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
   
5. C:\Users\\Downloads\Compressed\Emotet-epoch4\INV 2022-04-25_1114, USA.doc.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
   
6. C:\Users\\Downloads\Compressed\Emotet-epoch4\INV 2022-04-25_1237, United States.doc.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
   
7. C:\Users\\Downloads\Compressed\Emotet-epoch4\new_form 04.25.2022, US.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
   
8. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
   
9. C:\Users\\Downloads\Compressed\Emotet-epoch4\INV 2022-04-25_1114, USA.doc.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
   
10. C:\Users\\Downloads\Compressed\Emotet-epoch4\Form Dt 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
11. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form Dt 04.25.2022, United States.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
12. C:\Users\\Downloads\Compressed\Emotet-epoch4\new_form 04.25.2022, US.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
13. C:\Users\\Downloads\Compressed\Emotet-epoch4\Form 04.25.2022, US.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
14. C:\Users\\Downloads\Compressed\Emotet-epoch4\form 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
15. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form Dt 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
16. C:\Users\\Downloads\Compressed\Emotet-epoch4\form 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
17. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form Dt 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
18. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-151354-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 10:13:54 -0600]=>form 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
19. C:\Users\\Downloads\Compressed\Emotet-epoch4\Form 04.25.2022, US.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
20. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form 04.25.2022, USA.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
21. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form 04.25.2022, USA.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
22. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-161815-UTC.eml=>[Subject: RE: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 21:48:11 +0530]=>Form Dt 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
23. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-143534-UTC.eml=>[Subject: Fwd:Re: [subject line information removed]][Date: Mon, 25 Apr 2022 16:35:36 +0100]=>Electronic form 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
24. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-161811-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 22:18:11 +0600]=>Electronic form 04.25.2022, USA.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
25. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-153638-UTC.eml=>[Subject: RE: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 10:36:47 -0600]=>Electronic form Dt 04.25.2022.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
26. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-151354-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 10:13:54 -0600]=>form 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
27. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-163742-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 16:37:41 +0000]=>INV 2022-04-25_1237, US.zip=>INV 2022-04-25_1237, United States.doc.lnk=>(CommandArguments) Trojan.LNK.Gen Deleted
    
28. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-143534-UTC.eml=>[Subject: Fwd:Re: [subject line information removed]][Date: Mon, 25 Apr 2022 16:35:36 +0100]=>Electronic form 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
29. C:\Users\\Downloads\Compressed\Emotet-epoch4\Electronic form Dt 04.25.2022, United States.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
30. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-153638-UTC.eml=>[Subject: RE: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 10:36:47 -0600]=>Electronic form Dt 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
31. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-161815-UTC.eml=>[Subject: RE: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 21:48:11 +0530]=>Form Dt 04.25.2022.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
32. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-163742-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 16:37:41 +0000]=>INV 2022-04-25_1237, US.zip=>INV 2022-04-25_1237, United States.doc.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted
    
33. C:\Users\\Downloads\Compressed\Emotet-epoch4\2022-04-25-Emotet-epoch4-malspam-161811-UTC.eml=>[Subject: Re: Re: [subject line information removed]][Date: Mon, 25 Apr 2022 22:18:11 +0600]=>Electronic form 04.25.2022, USA.lnk=>(Appended File) VBS.Heur.Laburrak.7.C79ABC5F.Gen Deleted

复制代码