#Magniber .jse 扩展名 9月8日起

显示全部楼层 · 发表于 2022-9-15 21:32:44

火绒已上报

PS. 还好是工作日

显示全部楼层 · 发表于 2022-9-16 00:10:15

8月15日的病毒库。无法拦截DirectSyscall，不过还好，文件都是安全的。

@智量官方

显示全部楼层 · 发表于 2022-9-16 00:13:28

Kaspersky
喷他kill

显示全部楼层 · 发表于 2022-9-16 08:24:48

Trojan:Script/Wacatac.H!ml

WD

显示全部楼层 · 发表于 2022-9-16 09:28:26

显示全部楼层 · 发表于 2022-9-16 09:41:25

本帖最后由 kuroandsan 于 2022-9-16 09:46 编辑

BD入库 3x

2x 云杀/命令行扫描

The file C:\Users\ADog\Desktop\1232134\2.jse is infected with Gen:Suspicious.Cloud.12.00AD4C54780000 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

复制代码

The file C:\Users\ADog\Desktop\1232134\1.jse has been detected as infected with Gen:Suspicious.Cloud.12.0081A797BC0000 and Bitdefender could not clean this item. A device restart is required to finalize the cleaning process.

复制代码

The app C:\Windows\System32\wscript.exe was passed a malicious command line and has been blocked. Your device is now safe.
Command line: "C:\Windows\System32\WScript.exe" "C:\Users\ADog\Desktop\1232134\1.jse"

复制代码

The app C:\Windows\System32\wscript.exe was passed a malicious command line and has been blocked. Your device is now safe.
Command line: "C:\Windows\System32\WScript.exe" "C:\Users\ADog\Desktop\1232134\2.jse"

复制代码

显示全部楼层 · 发表于 2022-9-16 11:18:52

该文件采用了特殊的编码模式。在windows sandbox中运行后电脑管家拦截，放行后文件被加密。

显示全部楼层 · 发表于 2022-9-16 11:19:37

jerry6341 发表于 2022-9-16 11:18
该文件采用了特殊的编码模式。在windows sandbox中运行后电脑管家拦截，放行后文件被加密。

该脚本运行后，会在桌面上生成一个名为“read me”的html文件，用浏览器打开后如图

显示全部楼层 · 发表于 2022-9-16 14:23:11

毒霸

显示全部楼层 · 发表于 2022-9-16 14:26:24

心醉咖啡发表于 2022-9-16 06:23
毒霸

报的很准。3楼的几个杀了吗

[病毒样本] #Magniber .jse 扩展名 9月8日起