#Stealer

Hibike

https://www.upload.ee/files/16001795/Stealer.zip.html

骨灰级小白

多次下载失败

LSPLDD

卡巴扫描剩余 ama.exe 双击后PDM杀，成功清除并回滚 kill all

zfc234

熊猫扫描miss all，双击2x
Virus detected W32/Exploit.gen  Location: C:\Users\Noah\AppData\Local\Temp\b64c58644b\Utsysc.exe            30/11/2023 17:21 Neutralized  
Virus detected W32/Exploit.gen  Location: C:\ProgramData\pinterests\XRJNZC.exe                              30/11/2023 17:19 Neutralized  


ManageEngine NGAV持续补漏







DMG没测

GDHJDSYDH

EIS kill 3x，手动右键扫描又kill 1x，总结kill all

嘿嘿不能说

多个广告之后才能正常下载，2333



ama.exe：寄

ma.exe：出错退出

上报之后不久再杀一个，另一个被阻止启动







国外样本？那就由国外解决

1. C:\Users\Killer\Desktop\Stealer\CrackInstaller.dmg|>Crack Installer\Crack Installer|>amd64 [L] MacOS:AMOS-E [Trj] (0)
   
2. C:\Users\Killer\Desktop\Stealer\CrackInstaller.dmg|>Crack Installer\Crack Installer|>arm64 [L] MacOS:AMOS-E [Trj] (0)
   
3. C:\Users\Killer\Desktop\Stealer\CrackInstaller.dmg|>Crack Installer\Crack Installer [L] MacOS:AMOS-E [Trj] (0)
   
4. 2023/12/1 2:29:08        C:\Users\Killer\Desktop\Stealer\cp.exe [L] Win32:CrypterX-gen [Trj] (0)
   
5. 文件已成功移至隔离区...
   
6. 2023/12/1 2:29:16        C:\Users\Killer\Desktop\Stealer\ma.exe [L] Win64:TrojanX-gen [Trj] (0)
   
7. 文件已成功移至隔离区...
   
8. 2023/12/1 2:29:19        C:\Users\Killer\Desktop\Stealer\ama.exe [L] Win32:Evo-gen [Trj] (0)
   
9. 文件已成功移至隔离区...

复制代码

心醉咖啡

360

Agu

360國際版 - 3X

1. Scan Result
   
2. ======================
   
3. High-risk Items
   
4. ----------------------
   
5. C:\Users\YR\Downloads\Malware\Stealer\ama.exe 51A360BC35C67313085B19F39D266732 C541D61A56476AACC77BB9208F53999E12C03212 70,3,2,4,280,1,256, || 0_0_1  [360 Cloud Scan Engine][Win32/Trojan.Generic.HgIATOsA][Quarantined files][Not resolved]
   
6. C:\Users\YR\Downloads\Malware\Stealer\CrackInstaller.dmg 5EAEC3FF73CF4C19EFB918417B425F43 34F80163D10A27406DAE4F42CB5C3723CF17BDA9 70,3,2,4,280,1,256, || 0_0_0  [360 Cloud Scan Engine][Mac/Trojan.Generic.HjQATOoA][Quarantined files][Not resolved]
   
7. C:\Users\YR\Downloads\Malware\Stealer\cp.exe 187B8FD3EEC014587462F6E26057C00C 8EA4ADBAD5D621049B6DB6CC5CC980E6EB531CDB 70,3,2,4,280,1,256, || 0_0_1  [360 Cloud Scan Engine][Win32/Trojan.Generic.HgIATOsA][Quarantined files][Not resolved]

复制代码

6小時後2掃已入庫

1. Scan Result
   
2. ======================
   
3. High-risk Items
   
4. ----------------------
   
5. C:\Users\YR\Downloads\Malware\Stealer\ma.exe 972D3EC6A976765BEE7F681E6884C13A E80AE6A00B1EAC69EA79DDA90E1DB4DE315382C3 70,3,2,4,280,1,256, || 0_0_1  [360 Cloud Scan Engine][Win64/Trojan.Generic.GgEATOsA][Quarantined files][Not resolved]

复制代码

Avast - 4X(顯示6X但以樣本數為主)


Emsisoft - 4X

雨下樱成冢

FSP kill ALL

UNknownOoo

火绒
扫描：2X

1. 扫描文件：4
   
2. 发现风险：2
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\cp.exe, 病毒名：HVM:Trojan/ClipBanker.e, 病毒ID：da26ea1ed8a58f01, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\ma.exe, 病毒名：Trojan/MSIL.Injector.me, 病毒ID：684b9dd1efed5413, 处理结果：暂不处理
   

复制代码

X-Sec
扫描：3X

1. ---------------------
   
2. 2023/12/01 12:39:20 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\cp.exe -- [rame-tfe] Trojan.ClipBanker!8.5FB
   
3. 2023/12/01 12:39:20 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\ama.exe -- [xave-cloud] Stealer.Generic
   
4. 2023/12/01 12:39:21 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\ma.exe -- [rame-cloud] Trojan.Generic!8.C3
   

复制代码