x4 (2023-09-06)

显示全部楼层 · 发表于 2023-9-6 20:09:32

MD 1

显示全部楼层 · 发表于 2023-9-6 20:09:36

F-Secure: Avira 1+ F-S 2

显示全部楼层 · 发表于 2023-9-6 20:21:46

诺顿 kill all

显示全部楼层 · 发表于 2023-9-6 20:43:39

Emptied.

显示全部楼层 · 发表于 2023-9-6 21:05:35

eset kill all

显示全部楼层 · 发表于 2023-9-6 21:30:23

蜘蛛missall

显示全部楼层 · 发表于 2023-9-6 21:46:15

McAfee
1.vbs  -  missed
2.js  - 高级防火墙阻止外联
3.vbs  -  Trojan:Script/Downloader.SZ
4.vbs -  执行powershell被阻止Trojan:Script/AgentTesla.MB

显示全部楼层 · 发表于 2023-9-6 21:49:37

本帖最后由企稳向好于 2023-9-6 21:53 编辑

EMSI with EDR 4X:

不过这里有个问题，4.vbs添加启动项的行为明明被EDR记录了，但是既没有关联到原始样本，导致对4.vbs采取缓解操作时没有清理，又不能单独采取缓解措施，还是有点不爽

显示全部楼层 · 发表于 2023-9-6 22:46:43

显示全部楼层 · 发表于 2023-9-7 01:50:50

本帖最后由 aboringman 于 2023-9-7 02:42 编辑

2023/9/7 1:49:09 C:\Users\Killer\Desktop\4\3.vbs [L] Script:SNH-gen [Trj] (0)
File was successfully moved to chest...
2023/9/7 1:49:20 C:\Users\Killer\Desktop\4\4.vbs [L] VBS:Obfuscated-JN [Cryp] (0)
File was successfully moved to chest...
2023/9/7 1:49:24 C:\Users\Killer\Desktop\4\1.vbs [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest...
2023/9/7 1:49:27 C:\Users\Killer\Desktop\4\2.js [L] Other:Malware-gen [Trj] (0)
File was successfully moved to chest...
2023/9/7 1:49:29 C:\Users\Killer\Desktop\4\2.js [L] Other:Malware-gen [Trj] (0)

复制代码

复制代码

[病毒样本] x4 (2023-09-06)