#Netwire #Signed (2022-06-13)

Jirehlov1234

上一集：https://bbs.kafan.cn/thread-2235634-1-1.html

我爱你哦123

卡巴入库了

aboringman

360：miss

自动上传后寄

1. 2022-06-14 11:43:44     木马程序(Trojan.Generic)MD5:1fd52f39d9d8854cc4b3101ee5489c3f              已删除此文件，如果您发现误删，可从隔离区恢复此文件。        d:\test\zoominstallerfu.exe

复制代码

已有分类

谁谁谁

腾管16.0：miss

swizzer

Jirehlov1234

swizzer 发表于 2022-6-14 04:12

第二个是文件名报法（？）

swizzer

Jirehlov1234 发表于 2022-6-14 12:15
第二个是文件名报法（？）

文件名报法一般是Heur.Suspicious.PE.__，这个报法应该跟文件名无关（甚至有时在程序运行数分钟后才会触发这个报法）

不过目前也只观察到在kms身上出现过这种报法

onedrive

诺顿：下载智能分析

Filename: ZoomInstallerFu.exe
Threat name: WS.Reputation.1Full Path: C:\Users\realpc\Downloads\ZoomInstallerFu\ZoomInstallerFu.exe

____________________________

____________________________


On computers as of
2022/6/14 at 12:34:29

Last Used
2022/6/14 at 12:36:30

Startup Item
No

Launched
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe


____________________________


ZoomInstallerFu.exe Threat name: WS.Reputation.1
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

Medium
This file risk is medium.


____________________________


https://bbs.kafan.cn/forum.php?m ... DM3Nzh8MjIzNzE3Nw==
Downloaded File  from bbs.kafan.cn
Source: External Media

ZoomInstallerFu.exe

____________________________

File Actions

File: C:\Users\realpc\Downloads\ZoomInstallerFu\ ZoomInstallerFu.exe Removed
____________________________


File Thumbprint - SHA:
1a406441ee9a05e405e81cdf76e727826fc647fc6aa1bd531abb94ff3a6c0b3e
File Thumbprint - MD5:
1fd52f39d9d8854cc4b3101ee5489c3f

Solomondemeter

Time;Scanner;Object type;Object;Detection;Action;User;Information;Hash;First seen here
14/6/2022 下午 12:45:10;Real-time file system protection;file;C:\Users\123\OneDrive\桌面\ZoomInstallerFu.exe;a variant of Win32/GenCBL.CBN trojan;cleaned by deleting;PIXEL\123;Event occurred during an attempt to access the file by the application: C:\Windows\explorer.exe (E29739445A000EAD41A8902C67269FE5D74EEEAA).;3CFAAF332E4877B5B4C5E08659A288C51324CA2A;14/6/2022 上午 11:36:07

开开心心卖手机