APT测试第五期样本

LSPLDD

117054487 发表于 2023-11-7 03:49
这些样本都是楼主在国外板块测试过的了，miss的有空直接上报一下

了解了，谢谢提醒捏

LSPLDD

神龟Turmi 发表于 2023-11-7 04:41
01是VHO转的UDS 初次测试时报毒名相同但是前缀是VHO
02 03 04 05的miss和测试时相同
03运行不了是意料 ...

b站看到你了，已关注，下了班就去学习一下捏

神龟Turmi

hhhq316 发表于 2023-11-7 08:23
蜘蛛扫描0
EMSI扫描12

好嘛 这GenericKD和GenericFCA毫无特征强度啊
他们只拉黑了我测BD用过的两个样本 其他同代码不同hash样本都miss了

骨灰级小白

实机，AVAST kill这几个。剩下的挨个双击，被win11安全中心全部拦截

yaokai815

金山毒霸kill

117054487

Hello,

New malicious software was found in the attached files.
Backdoor.Win64.Nimbo:
04-A.dll, 04-B.dll, 04-C.dll, 04-D.dll, 04-E.dll, 04-F.dll
05-A.dll, 05-B.dll, 05-C.dll, 05-D.dll, 05-E.dll, 05-F.dll

Trojan.Win64.Kryptik:
02-A.exe, 02-B.exe, 02-C.exe, 02-D.exe, 02-E.exe, 02-F.exe
03-A.exe, 03-B.exe, 03-C.exe, 03-D.exe, 03-E.exe, 03-F.exe

Detections will be included in the next update.
Thank you for your help.

Best regards, Alexey Safonov, Malware Analyst, Kaspersky Lab
39A/3 Leningradskoe Shosse, Moscow, 125212, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com https://securelist.com
https://opentip.kaspersky.com/ - get insights about suspicious files, hashes, URLs, IP addresses or domain names