[病毒样本] CS

显示全部楼层 · 发表于 2023-8-13 20:06:37

本帖最后由 hsks 于 2023-8-13 20:09 编辑

https://cowtransfer.com/s/facd4a77cb064c
https://tria.ge/230813-n5gjqsdf6w

显示全部楼层 · 发表于 2023-8-13 20:11:10

腾讯电脑管家扫描miss

显示全部楼层 · 发表于 2023-8-13 20:17:53

本帖最后由 huorong 于 2023-8-13 20:33 编辑

瑞星防病毒安全软件 missed
20:30 已上报瑞星

显示全部楼层 · 发表于 2023-8-13 20:21:39

本帖最后由不知起什么名于 2023-8-13 20:34 编辑

事件: 检测到恶意对象
用户类型: 发起者
应用程序名称: explorer.exe
应用程序路径: C:\Windows
组件: 文件威胁防护
结果说明: 检测到
类型: 木马
名称: UDS:Trojan.Win32.CobaltStrike.dfg
精确度: 确切
威胁级别: 高
对象类型: 文件
对象名称: lsass.exe
对象路径: D:\Download
对象的 SHA256: 08652D415A6B8F788A0E4914B3517C81FC49EF1BE964548E00B92067FA66B702
对象的 MD5: A832CC87A6C0C80EE12ADDDEBD1DBF2D
原因: 云保护

嗯？为什么卡巴把fakeTG的html网页也给报毒了难道是根据访问的对象来报毒的嘛

显示全部楼层 · 发表于 2023-8-13 20:27:15

类型:木马-伪装成Windows系统文件的程序
描述:木马通常利用系统的漏洞，绕过系统防御，达到：盗取账号、窃取资料、篡改文件、破坏数据的目的。经过360安全中心检验，此文件是木马，建议您立即处理。
扫描引擎:云安全引擎
文件路径:D:\360安全浏览器下载\lsass\lsass.exe
文件大小:2.83M (2,970,784 字节)
文件指纹（MD5）:a832cc87a6c0c80ee12adddebd1dbf2d
数字签名:Microsoft Corporation
数字签名是否有效:无效
处理建议:隔离文件

显示全部楼层 · 发表于 2023-8-13 20:31:29

高级威胁防护阻止了一个恶意进程。进程路径: C:\Users\苏敬轩\Desktop\lsass\lsass.exe. 威胁名称: ATC.SuspiciousBehavior.5735C3226F334979.

显示全部楼层 · 发表于 2023-8-13 20:35:34

eset kill

显示全部楼层 · 发表于 2023-8-13 21:04:08

微软目前报告为Trojan:Win32/Wacatac.B!ml

显示全部楼层 · 发表于 2023-8-13 21:40:56

显示全部楼层 · 发表于 2023-8-13 21:51:14

Norton
SONAR kill，回滚。

Filename: lsass.exe
Threat name: SONAR.SuspLaunch!g266Full Path: Not Available
____________________________
____________________________
On computers as of
8/13/2023 at 9:49:37 PM
Last Used
8/13/2023 at 9:49:37 PM
Startup Item
No
Launched
Yes
Behavioral Protection monitors for suspicious program activity on your computer.
____________________________
lsass.exeThreat name: SONAR.SuspLaunch!g266
Locate
Very Few Users
Fewer than 5 users in the Norton Community have used this file.
Very New
This file was released less than 1 week ago.
High
This file risk is high.
____________________________
Source: External Media
Source File:
WinRAR.exe
File Created:
lsass.exe
____________________________
File Actions
File: c:\Users\User\Desktop\lsass\lsass.exeThreat Removed
____________________________
System Settings Actions
Event: Process start (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:11488)No action taken
Event: Process start (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:1704)No action taken
Event: Process start: c:\users\user\desktop\lsass\lsass.exe, PID:11488 (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:11488)No action taken
Event: Process start (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:5580)No action taken
Event: Process start: c:\users\user\desktop\lsass\lsass.exe, PID:5580 (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:5580)No action taken
Event: Process start (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:6852)No action taken
Event: Process start: c:\users\user\desktop\lsass\lsass.exe, PID:6852 (Performed by c:\users\user\desktop\lsass\lsass.exe, PID:6852)No action taken
____________________________
File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

复制代码

[病毒样本] CS

本帖子中包含更多资源

本帖子中包含更多资源