利用W32Time服务TimeProviders开机启动的后门病毒1x

显示全部楼层 · 发表于 2022-6-13 21:37:24

md miss

显示全部楼层 · 发表于 2022-6-13 21:46:03

落华无痕发表于 2022-6-13 21:34
自解压包的方便点：https://free.lanzoub.com/iogrl06cwuvc

crowdstrike 双击杀

显示全部楼层 · 发表于 2022-6-13 21:54:01

管家 miss

显示全部楼层 · 发表于 2022-6-13 22:24:04

本帖最后由 kuroandsan 于 2022-6-13 22:25 编辑

dll 信誉杀

显示全部楼层 · 发表于 2022-6-13 23:48:18

显示全部楼层 · 发表于 2022-6-14 06:00:36

McAfee
1x

显示全部楼层 · 发表于 2022-6-14 06:51:10

Hello,
Thank you for the submitted sample (sample-16551239271766.dll.zip).

We have received an update from our Antimalware Laboratory regarding the analysis of the provided sample which states that the file is malicious and a detection will be added in the next couple of updates. Make sure to have Bitdefender Endpoint Security Tools properly updated, in order to benefit from the best protection.  

Should you need any further information, please don't hesitate to contact us.

Have a nice day!

显示全部楼层 · 发表于 2022-6-14 08:59:26

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
14/6/2022 上午 8:56:55;Real-time file system protection;file;C:\Users\123\OneDrive\桌面\NtpService\NtpService.dll;a variant of Win64/Agent.BKM trojan;cleaned by deleting;PIXEL\123;Event occurred during an attempt to access the file by the application: C:\Program Files\Microsoft OneDrive\OneDrive.exe (81C18400CC9E4284707FEBAB832E26D2C342369E).;0EE3C10DF605E6A13F5E3BD4BAFE8824BA236C50;13/6/2022 下午 7:13:29

显示全部楼层 · 发表于 2022-6-14 20:43:10

显示全部楼层 · 发表于 2022-6-15 19:26:13

The SophosLabs has reviewed the submitted sample and have stated the following:
-- Detection added on the file “NtpService.dll” as Troj/Agent-BIYL, it is dropped at %windir%\system32% by parent file EXTSETUP_1_6.exe - 3f4d31c4d587a1d0591563561a469978a18942c2

-- Yesterday we already added detection for the parent file as Troj/Inject-HVO

[病毒样本] 利用W32Time服务TimeProviders开机启动的后门病毒1x

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源