龟包 240113 15X

神龟Turmi

下载：https://turtlesusp.run/samples/0 ... rtleSUSP-240113.zip

Malwarebytes：

扫描14X 双击0X 合计14/15

UNknownOoo

火绒
扫描：12X

1. 扫描文件：15
   
2. 发现风险：12
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-10-CobaltStrike-037dc6.exe, 病毒名：Backdoor/CobaltStrike.d, 病毒ID：9c6caf6b7979d2d0, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-06-CobaltStrike-6a9d8c.exe, 病毒名：Backdoor/CobaltStrike.d, 病毒ID：9c6caf6b7979d2d0, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-04-CobaltStrike-f35bc9.exe, 病毒名：Backdoor/CobaltStrike.d, 病毒ID：9c6caf6b7979d2d0, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-08-Msfvenom-af80ca.exe, 病毒名：HVM:Trojan/Swrort.gen!A, 病毒ID：d6e29035d2489e60, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-05-CobaltStrike-5a62e4.exe, 病毒名：Backdoor/CobaltStrike.d, 病毒ID：9c6caf6b7979d2d0, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-13-AgentTesla-2a34f3.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：d74520d1b2d3abdd, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-03-Redline-dc96f9.exe, 病毒名：Trojan/MSIL.Agent.fb, 病毒ID：9c15edef518bfd15, 处理结果：暂不处理
    
12. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-14-RisePro-8dc506.exe, 病毒名：HEUR:TrojanDownloader/Agent.bf, 病毒ID：7bec03d7fe2662cb, 处理结果：暂不处理
    
13. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-02-Miner-94719c.exe, 病毒名：Trojan/CoinMiner.en, 病毒ID：179c7eb3da0aae6f, 处理结果：暂不处理
    
14. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-12-AgentTesla-556b10.exe, 病毒名：HVM:VirTool/Obfuscator.gen!A, 病毒ID：b27d4294cde6a1ec, 处理结果：暂不处理
    
15. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-11-Lumma-b5c549.exe, 病毒名：HEUR:VirTool/Obfuscator.gen!C, 病毒ID：09f7c74f7afee22c, 处理结果：暂不处理
    
16. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-15-RisePro-70fff8.exe, 病毒名：HVM:Trojan/SelfLoader.a, 病毒ID：dfd4668b4850b54f, 处理结果：暂不处理

复制代码

运行：
TurtleSUSP-240113-01-SliverFox-efdee0.exe -> 注入拦截

1. 病毒名称：ADV:Trojan/GenInjector.B!1.1
   
2. 病毒路径：C:\Users\Administrator\Desktop\TurtleSUSP-240113_2\TurtleSUSP-240113-01-SliverFox-efdee0.exe
   
3. 操作结果：已处理，删除文件

复制代码

TurtleSUSP-240113-07-Titan-34390e.exe -> 阻止高敏行为后自退

1. 防护项目：Autorun配置文件
   
2. 目标文件：C:\autorun.inf
   
3. 操作结果：已阻止
   

复制代码

1. 防护项目：任务管理器屏蔽配置项
   
2. 操作类型：修改
   
3. 数据内容：0x00000001 (1)
   
4. 目标注册表：HKEY_USERS\S-1-5-21-2358378876-2357486606-955946799-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
   
5. 操作结果：已阻止
   

复制代码

TurtleSUSP-240113-09-UnknownStealer-26ff03.exe -> 勒索诱捕（？）

1. 病毒名称：Ransom/Rattrap.A
   
2. 病毒路径：C:\Users\Administrator\Desktop\TurtleSUSP-240113_2\TurtleSUSP-240113-09-UnknownStealer-26ff03.exe
   
3. 操作结果：已处理
   

复制代码

X-Sec
扫描：12X

1. ---------------------
   
2. 2024/01/14 01:22:49 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-01-SliverFox-efdee0.exe -- [rame-tfe] Backdoor.Agent!8.C5D
   
3. 2024/01/14 01:22:49 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-02-Miner-94719c.exe -- [rame-cloud] PUA.CoinMiner!8.4639
   
4. 2024/01/14 01:22:50 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-04-CobaltStrike-f35bc9.exe -- [rame-classic] Backdoor.CobaltStrike/x64!1.E382
   
5. 2024/01/14 01:22:51 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-03-Redline-dc96f9.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
6. 2024/01/14 01:22:52 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-06-CobaltStrike-6a9d8c.exe -- [rame-classic] Backdoor.CobaltStrike/x64!1.D04A
   
7. 2024/01/14 01:22:56 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-10-CobaltStrike-037dc6.exe -- [rame-classic] Backdoor.CobaltStrike/x64!1.E382
   
8. 2024/01/14 01:23:00 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-11-Lumma-b5c549.exe -- [rame-tfe] Spyware.Windigo!8.119B5
   
9. 2024/01/14 01:23:01 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-12-AgentTesla-556b10.exe -- [rame-cloud] Trojan.Injector!8.C4
   
10. 2024/01/14 01:23:03 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-13-AgentTesla-2a34f3.exe -- [rame-cloud] Stealer.Agensla!8.13266
    
11. 2024/01/14 01:23:04 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-14-RisePro-8dc506.exe -- [rame-classic] Downloader.Agent!1.D93C
    
12. 2024/01/14 01:23:08 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-15-RisePro-70fff8.exe -- [rame-cloud] Trojan.GenCBL!8.12138
    
13. 2024/01/14 01:23:11 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TurtleSUSP-240113_2\TurtleSUSP-240113-05-CobaltStrike-5a62e4.exe -- [rame-classic] Backdoor.CobaltStrike/x64!1.E382

复制代码

Baby小尧

卡巴21.16.6.458 扫描清除14x，剩余02样本双击报not-a-virus。

神龟Turmi

Baby小尧 发表于 2024-1-14 01:31
卡巴21.16.6.458 扫描清除14x，剩余02样本双击报not-a-virus。日志睡醒再发

02是挖矿 报not-a-virus也问题不大
但是它是个有C&C的挖矿 而且是运行后sync结束立即开始 我相信这不是正常拿来挖矿的 大概率是恶意的（常见于攻击各种无人值守的服务器白嫖算力）

hushuai

BDTS 扫描剩余01和05，双击均云杀

z614606517

华为乾坤  病毒库 12 21号      剩余3   10多天前的病毒库还能杀这么多   有点意思   是不是上了云啊

petr0vic

avast
scan
14/15


launch
1/1

GDHJDSYDH

EIS监控+扫描剩余1x（最后一个被KFA捕获秒了）

mmmaoo

江民14x，昨天的库：

123456aaaafsdeg

360 all!!

1. 360 Total Security扫描日志
   
2. 
   
3. 扫描时间：2024-01-14 10:28:31
   
4. 扫描用时：00:00:09
   
5. 扫描项目总数：15
   
6. 威胁总数：15
   
7. 处理威胁数：15
   
8. 
   
9. 扫描选项
   
10. ----------------------
    
11. 扫描压缩包：否
    
12. 常规引擎设置：鲲鹏引擎
    
13. 
    
14. 扫描内容
    
15. ----------------------
    
16. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-01-SliverFox-efdee0.exe
    
17. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-02-Miner-94719c.exe
    
18. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-03-Redline-dc96f9.exe
    
19. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-04-CobaltStrike-f35bc9.exe
    
20. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-05-CobaltStrike-5a62e4.exe
    
21. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-06-CobaltStrike-6a9d8c.exe
    
22. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-07-Titan-34390e.exe
    
23. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-08-Msfvenom-af80ca.exe
    
24. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-09-UnknownStealer-26ff03.exe
    
25. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-10-CobaltStrike-037dc6.exe
    
26. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-11-Lumma-b5c549.exe
    
27. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-12-AgentTesla-556b10.exe
    
28. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-13-AgentTesla-2a34f3.exe
    
29. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-14-RisePro-8dc506.exe
    
30. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-15-RisePro-70fff8.exe
    
31. 
    
32. 扫描结果
    
33. ======================
    
34. 高风险项目
    
35. ----------------------
    
36. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-02-Miner-94719c.exe 5065E3FA41C99B663FA3D91322A96B61 94719CA7BE9A44C6C8E2F9D4B276C7508790540A 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win64/Miner.Generic.HgEATRcA][隔离文件][已处理]
    
37. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-01-SliverFox-efdee0.exe 580911F86E1DC793D2B792618ADFA79A EFDEE04989D958519067046F9817002887A5DC43 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win64/Backdoor.Generic.HgEATRcA][隔离文件][已处理]
    
38. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-03-Redline-dc96f9.exe C11E51EAA2268F57211074AF172AD9B5 DC96F955100955921D05403ECB93620B72C7D5D2 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Generic.HwMAorcA][隔离文件][已处理]
    
39. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-05-CobaltStrike-5a62e4.exe 48D41F7B8B4FABF4AA0A4DE5708A6982 5A62E4D8B0DEEC0BA52AD9D83440E4E34E97FAF9 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win64/HackTool.CobaltStrike.HgEATRcA][隔离文件][已处理]
    
40. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-06-CobaltStrike-6a9d8c.exe 9A88794DDFC666E1F3B6BFF5434663C5 6A9D8CBDC27B3E253568543E254EB6A713D04E47 70,4,2,4,280,1,256, || 0_0_1  [鲲鹏引擎][Trojan.Win64.Cobalt.A][隔离文件][已处理]
    
41. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-07-Titan-34390e.exe A0CABAE4AB8997C9FC9B48A633EA039F 34390E4713FDD061E6AAA0D314CB7539AFEF01BE 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Generic.HgIATRcA][隔离文件][已处理]
    
42. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-08-Msfvenom-af80ca.exe 4AF76D720ED551DC9E18FAAA358A6E1C AF80CA7A498D72E33A22C78D45E7D652F46F9D9D 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Swrort.HgIATRcA][隔离文件][已处理]
    
43. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-09-UnknownStealer-26ff03.exe 8E7120AA5B1942CB9970EC4756FA90A3 26FF0331CAA16D84228521C67D3AEE7B93D3C93F 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win64/Trojan.Generic.H8oAoX4A][隔离文件][已处理]
    
44. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-04-CobaltStrike-f35bc9.exe 9D2FD3758BB3ADCD7D827A82994EE9C2 F35BC9979C6EC22D628B93876F1B1C5FD39239EA 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win64/HackTool.CobaltStrike.H8oAorcA][隔离文件][已处理]
    
45. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-10-CobaltStrike-037dc6.exe 7E5266046B2D6898D3AB0A96424A5714 037DC678328587CF813C27ED780B10015A4CA3EC 70,4,2,4,280,1,256, || 0_0_1  [鲲鹏引擎][Backdoor.Win64.CobaltStrike.A][隔离文件][已处理]
    
46. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-11-Lumma-b5c549.exe 89D6B35EA8F5A4EC45E09563313E00A4 B5C5492AC6DD8AA4714CC09B986591394D7A43AC 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Chapak.HwoCpY0A][隔离文件][已处理]
    
47. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-12-AgentTesla-556b10.exe 9FCFD49CAB037D685A5237F4A8987132 556B109FDFA4E2D61504B34F6FFC9F45AD92F3A1 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Strab.HgIATRcA][隔离文件][已处理]
    
48. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-14-RisePro-8dc506.exe 7EDC7839432AA6801008C4E71ADF7D2E 8DC506BECA3EF89B9220F621157319FB0E5AD216 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Generic.HgIATRQA][隔离文件][已处理]
    
49. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-15-RisePro-70fff8.exe 4CED536BED38E5603CFD226990FAF817 70FFF875549BC13630CF04D3F235EE104C9CA4D6 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/Trojan.Generic.HgIATRcA][隔离文件][已处理]
    
50. C:\Users\Administrator\Desktop\新建文件夹\TurtleSUSP-240113-13-AgentTesla-2a34f3.exe 699E3AFFC886E4D354DE82B9C2898C2B 2A34F358155CECCDBF91D2412B8C7AFE7EE33142 70,3,2,4,280,1,256, || 0_0_1  [360云查杀引擎][Win32/TrojanSpy.AgentTesla.HwMAob4A][隔离文件][已处理]
    

复制代码