下载者木马/Downloader 1x

LSPD

Kaspersky 双击 miss

huangzihang

LSPD 发表于 2022-6-6 16:25
Kaspersky 双击 miss

这个后台会下载木马，多等一会PDM应该是可以杀的

LSPD

huangzihang 发表于 2022-6-6 16:33
这个后台会下载木马，多等一会PDM应该是可以杀的

等了10来分钟了，仍然没反应

huangzihang

LSPD 发表于 2022-6-6 16:39
等了10来分钟了，仍然没反应

外国佬的样本，不排除是因为连不上网所以衍生物下载失败，卡巴没反应

开开心心卖手机

SEP kill exe

心醉咖啡

毒霸扫描miss

lvzhiwei

sophos home解压和扫描均miss

pal家族

Event: Malicious object detected
User: GP76\Xzz123
User type: Active user
Application name: MBSETUP.exe
Application path: E:\virus
Component: AMSI Protection
Result description: Detected
Type: Trojan
Name: UDS:Trojan.Multi.GenericML.xnet
Precision: Exactly
Threat level: High
Object type: File
Object name: amsi_stream_7
Object path: uid://
MD5 of an object: 54FDCC9CCD126C0A2A0D02A452BF27DB
Reason: Cloud Protection

Event: The object scan result has been sent to a third-party application
User: GP76\Xzz123
User type: Active user
Application name: MBSETUP.exe
Application path: E:\virus
Component: AMSI Protection
Result description: Not processed
Type: Trojan
Name: UDS:Trojan.Multi.GenericML.xnet
Precision: Exactly
Threat level: High
Object type: File
Object name: amsi_stream_7
Object path: uid://
MD5 of an object: 54FDCC9CCD126C0A2A0D02A452BF27DB
Reason: Logged


很神奇 卡巴报了一个这个 然后程序自己退出了 卡巴没报告有拦截动作、