guloader (2023-07-17)

显示全部楼层 · 发表于 2023-7-17 22:12:31

360扫描miss，双击拦截

显示全部楼层 · 发表于 2023-7-17 22:13:11

Kaspersky HEUR:Trojan.VBS.SAgent.gen

显示全部楼层 · 发表于 2023-7-17 22:21:44

显示全部楼层 · 发表于 2023-7-17 22:34:27

金山毒霸miss

显示全部楼层 · 发表于 2023-7-17 22:39:12

本帖最后由 swizzer 于 2023-7-17 22:59 编辑

BEST(also BDIS) missed.
After a Restart:

The app C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe was passed a malicious command line and has been blocked. Your device is now safe.
Command line: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w 1 $Hemi=(Get-ItemProperty -Path 'HKCU:\Yacareskel\').Adres;c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ($Hemi)

复制代码

Partial success.

显示全部楼层 · 发表于 2023-7-18 09:00:23

360kill

显示全部楼层 · 发表于 2023-7-18 10:54:10

蜘蛛

显示全部楼层 · 发表于 2023-7-18 19:24:58

金山毒霸kill

[病毒样本] guloader (2023-07-17)