TurtleRansom v0

wwwab

Hi Team,

Sophos Labs has reviewed your sample and have determined the following:

File states:

============
Following samples are covered under “Troj/Agent-BKJG“

ELF
c13b626e4f1d27ef1220e83c0e6a04b1e508cc50
08279fc6616a8adac0346d5e9b60dfbe9c254b81
b3c1324dc47e3ec34114b8129ab1aaa1ba42c03e
67ec42249df03ec57845c65cd3d59a4ca8ac27f4
06f7b22c7645eb74bc3e7965eb4c88c912cb116f
9079552373d2c573638d80d623b1e77086aae358

Macho
264a7608b986f2aa163ee173828d7f1d44061a54
aad142a701e8b27278477e52582d2b7e49cda1f4

555.exe (SHA1: 804faed19c0d48e8e5f68c6153c58c1d1a2ca0ff) is corrupt


This ticket will now be closed.

Sophos：这Windows端的样本损坏了吧

小岛花六

dustychen1

petr0vic 发表于 2023-11-25 22:53

感谢老哥，Dr.Web清空

petr0vic

dustychen1 发表于 2023-12-1 13:00
感谢老哥，Dr.Web清空

https://bbs.kafan.cn/forum.php?m ... 05&pid=53803294

神龟Turmi

petr0vic 发表于 2023-11-28 19:46
https://bbs.kafan.cn/forum.php?mod=redirect&goto=findpost&ptid=2263205&pid=53799224

https://objective-see.org/blog/blog_0x76.html

anthonyqian

铁壳终于分析完了，目测全部hash拉黑：

Files Submitted / Assessment

#	Filename	Hash (SHA256/MD5)	Determination	Signature Protection Name	Extended Defs Version & Sequence Number	Assessment
1	20231125132148-12-sample(s).zip	BA8625595D62F9F6573BF9F0257648DAC3E7C09A6DC0451D156A05C1C6D83D36 / 0F1B0C3BB7D8E128ECBBE6571CFBA749	Archive	N/A	N/A	File is a archive file.
2	91a5faa41d19090e1c5c1016254fd22a.vir	A48AF4A62358831FE5376AA52DB1A3555B0C93C1665B242C0C1F49462F614C56 / 91A5FAA41D19090E1C5C1016254FD22A	Already Detected	OSX.Trojan.Gen	11/27/2023 rev. 20 & 231678	File is detected by Symantec AV products with the latest definitions.
3	8aa2ba539740aed251f006c2c6ecad23.vir	52337055CCA751B8B2B716A1C8F3BA179DDD74B268B67641ADE223D3D3CF773D / 8AA2BA539740AED251F006C2C6ECAD23	Already Detected	trojan.gen.mbt	11/27/2023 rev. 20 & 231678	File is detected by Symantec AV products with the latest definitions.
4	67baf56a929be3a7b03459f8bee5a0a1.vir	F5B9B80F491E5779F646D2510A2C9C43F3072C45302D271798C4875544ACE4F2 / 67BAF56A929BE3A7B03459F8BEE5A0A1	Already Detected	trojan.gen.npe	11/27/2023 rev. 20 & 231678	File is detected by Symantec AV products with the latest definitions.
5	8a53f6e4e46023de77d874c2faca020c.vir	A4789E0B79A8BAC486FBC3B0F00B6DCBAAC6854E621D40FC3005D23F83D2E5EC / 8A53F6E4E46023DE77D874C2FACA020C	Already Detected	trojan.gen.npe	11/27/2023 rev. 20 & 231678	File is detected by Symantec AV products with the latest definitions.
6	782284dae1244553f15795f5e32f1f56.vir	B384155B74845BEEEA0F781C9C216C69ECEB018520D819DD09823CFF6EF0E7DE / 782284DAE1244553F15795F5E32F1F56	Already Detected	trojan.gen.npe	12/1/2023 rev. 21 & 231765	File is detected by Symantec AV products with the latest definitions.
7	a5023ffd14ce39f2ca81261a36bc1927.vir	5F9CD91D8D1DCFE2F6CF4C6995AD746694CE57023DFB82B1CD6AF5697113D1B0 / A5023FFD14CE39F2CA81261A36BC1927	Already Detected	OSX.Trojan.Gen	11/26/2023 rev. 22 & 231663	File is detected by Symantec AV products with the latest definitions.
8	7acca4ae31fca1e92d92374e53e6fdd6.vir	00B52A5905E042A9A9F365F7E5404F420AE26F463F24C069D6076E9094F61A8E / 7ACCA4AE31FCA1E92D92374E53E6FDD6	Already Detected	trojan.gen.mbt	11/26/2023 rev. 22 & 231663	File is detected by Symantec AV products with the latest definitions.
9	529404c71791ae3c4d4c4cbd2901167b.vir	62F84AFDAB28727AB47B5C1E4AF92B33DC2B11E55DCA7B097FE94DA5BCC9EC4E / 529404C71791AE3C4D4C4CBD2901167B	Already Detected	trojan.gen.npe	11/28/2023 rev. 23 & 231703	File is detected by Symantec AV products with the latest definitions.
10	c0fc411df7436c28e8e567407c185d97.vir	DF5F7570BF0B1F99F33C31913AB9F25B9670286E8E2462278AEA2157F8173A68 / C0FC411DF7436C28E8E567407C185D97	Already Detected	trojan.gen.npe	12/2/2023 rev. 20 & 231785	File is detected by Symantec AV products with the latest definitions.
11	822900fa44a08a8a1e1f0dc14697d5b8.vir	F14EF1C911DEB8714D1BB501064505C13237049AC51F0A657DA4B0BF11F5F59E / 822900FA44A08A8A1E1F0DC14697D5B8	Already Detected	trojan.gen.mbt	11/26/2023 rev. 22 & 231663	File is detected by Symantec AV products with the latest definitions.
12	12306f134610a7aba33ba67993dfb9ad.vir	65EEA957148D75C29213DFF0C5465C6DC1DB266437865538CFE8744C2436F5E1 / 12306F134610A7ABA33BA67993DFB9AD	Already Detected	trojan.gen.mbt	11/26/2023 rev. 22 & 231663	File is detected by Symantec AV products with the latest definitions.
13	79966500ccb17916d24ba2a2bfd875a7.vir	B5AB9C61C81DFCD2242B615C9AF2CB018403C9A784B7610B39ED56222D669297 / 79966500CCB17916D24BA2A2BFD875A7	Already Detected	trojan.gen.npe	11/29/2023 rev. 23 & 231724	File is detected by Symantec AV products with the latest definitions.

bbszy

vt上趋势不报
mac上的趋势清空

GreatMOLA

anthonyqian 发表于 2023-12-3 17:19
铁壳终于分析完了，目测全部hash拉黑：

Files Submitted / Assessment

实测也是拉黑报法，AdvML根本没触发。。。