15x (2024-01-18, p.m.)

swizzer

Mirror 1
Mirror 2

XywCloud

1个Electron Stealer，已跟进处理
虽然在比较早的时候（22年下半年）就有了检测这类威胁的基本条件（能直接扫描到内部的JS代码），但确实是没有认真做过相关的检测
后面会慢慢探索更好的处理方式

GDHJDSYDH

EIS+KFA监控+扫描剩余一个exe+俩文件夹，沙箱内双击运行文件夹里的exe失败（黑dll估计都被杀了），剩下一个stealer miss，这个玩意儿是准备打包上传？卡巴拉黑速度好快，第二次双击直接云+主防联动杀

UNknownOoo

火绒
扫描：7X

1. 扫描文件：26
   
2. 发现风险：7
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-0ac7a3df.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-873f7e8d.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-71370c82.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-ff8a33f6.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#Amadey-clip64.dll, 病毒名：TrojanSpy/ClipBanker.y, 病毒ID：6b4e3c1aab0bbe92, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#Kutaki-INF_Note.exe, 病毒名：Trojan/Gold, 病毒ID：fae66c9de474f957, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240118-2\9fff5f8f.exe, 病毒名：HVM:Trojan/Injector.bu, 病毒ID：3887996be891bf91, 处理结果：暂不处理

复制代码

X-Sec
扫描：13X

1. ---------------------
   
2. 2024/01/18 15:27:11 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-0ac7a3df.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
3. 2024/01/18 15:27:12 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-71370c82.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
4. 2024/01/18 15:27:12 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-873f7e8d.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
5. 2024/01/18 15:27:13 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#Amadey-clip64.dll -- [rame-tfe] Trojan.Agent!8.B1E
   
6. 2024/01/18 15:27:13 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#AgentTesla-ff8a33f6.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
7. 2024/01/18 15:27:14 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#Kutaki-INF_Note.exe -- [rame-classic] Stealer.Kutaki!1.D278
   
8. 2024/01/18 15:27:26 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\02358bea.bat -- [rame-cloud] Downloader.Agent/BAT!8.112A5
   
9. 2024/01/18 15:27:27 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\175651f9.exe -- [xave-cloud] Backdoor.Generic
   
10. 2024/01/18 15:28:56 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\9fff5f8f.exe -- [rame-tfe] Backdoor.Agent!8.C5D
    
11. 2024/01/18 15:30:10 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\dc756b7c.exe -- [rame-cloud] Backdoor.Androm!8.113
    
12. 2024/01/18 15:30:11 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#DllHijack-1\dllhost.exe -- [xave-cloud] PUA.Generic
    
13. 2024/01/18 15:30:11 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#DllHijack-1\QuickSeeBase.dll -- [xave-cloud] Trojan.Generic
    
14. 2024/01/18 15:30:12 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240118-2\#DllHijack-2\RuntimeBroker.exe -- [xave-cloud] PUA.Generic

复制代码

hhhq316

蜘蛛 1

DisaPDB

360 自动上报卡死了

两分二十秒 扫描12x



自动机 3+1

无核晶 双击1x

合计 13/15

GreatMOLA

TES 12x

t0kenzero

S1 14X

Miss
dc756b7c.exe   没跑起来

BEST 15x

Agu

WSCS - 掃描11X


Emsisoft - 掃描7X

Nocria

IKARUS - 10/15