13x (2024-01-19, a.m.)

swizzer

Mirror 1
Mirror 2

LSPLDD

卡巴静态12X

#Stealc-b56314a4.exe;#Stealc-b56314a4.exe
HEUR:Trojan-PSW.Win32.Stealerc.gen

08a8cd97.exe;08a8cd97.exe
HEUR:Trojan.MSIL.Injuke.gen

#Remcos-hostcr.exe
HEUR:Backdoor.MSIL.Remcos.gen

14e42ac3.exe
HEUR:Backdoor.MSIL.Androm.gen

#CrealStealer-64ea3274.exe
HEUR:Trojan.Python.Disin.a

da9f9e61.exe
HEUR:Trojan-PSW.Win32.Stealerc.gen

#Miner-2297ce6b.exe
HEUR:Trojan.Win32.Generic

#Remcos-e2f632e9.exe
HEUR:Backdoor.MSIL.Remcos.gen

#Formbook-991c49a8.exe
HEUR:Trojan-Spy.MSIL.Noon.gen

241a013a.exe
HEUR:Trojan.MSIL.Injuke.gen

#AgentTesla-954ac402.exe
UDS:Trojan-PSW.MSIL.Agensla.gen

#AgentTesla-e396a491.exe
Trojan-PSW.MSIL.Agensla.woh

剩余f40c4729.exe双击无反应





BD静态7X

#Formbook-991c49a8.exe
Trojan.GenericKD.71262342

#Remcos-e2f632e9.exe
Trojan.GenericKD.71260218

#Remcos-hostcr.exe
Gen:Variant.Zusy.472040

#Stealc-b56314a4.exe
Gen:Suspicious.Cloud.2.pu0@aCB1pKii

241a013a.exe
Gen:Suspicious.Cloud.2.@p0@aWdBvge

08a8cd97.exe
Gen:Suspicious.Cloud.2.@p0@aKNEEOo

da9f9e61.exe
Gen:Suspicious.Cloud.2.qu0@aWuR0Cai

双击6X

#Miner-2297ce6b.exe
BD日志BUG无法统计

#CrealStealer-64ea3274.exe
Gen:Suspicious.Cloud.2.@FZ@aup4mYo

#AgentTesla-e396a491.exe
Gen:Suspicious.Cloud.2.gvW@aCrjs3ai

#AgentTesla-954ac402.exe
SuspiciousBehavior.71F2A0B2708ACEA8

14e42ac3.exe
-->hxxps://xiazaiwenjian.obs.cn-south-4.myhuaweicloud.com/
危險頁面
-->C:\Users\Public\Downloads\360Saf.exe
Gen:Variant.Babar.120989

f40c4729.exe
SuspiciousBehavior.71F2A0B22648DAFA

LeeHS

crowdstrike 解压杀剩3个。剩下3个阻止运行

DisaPDB

360 扫描10x

UNknownOoo

火绒
扫描：8X

1. 扫描文件：13
   
2. 发现风险：8
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\14e42ac3.exe, 病毒名：Backdoor/MSIL.DCRat.o, 病毒ID：9d03c155ad560fb6, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\#Formbook-991c49a8.exe, 病毒名：Trojan/MSIL.Agent.eq, 病毒ID：f4703a820fb88871, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\da9f9e61.exe, 病毒名：HEUR:VirTool/Obfuscator.gen!C, 病毒ID：09f7c74f7afee22c, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\#Stealc-b56314a4.exe, 病毒名：VirTool/Obfuscator.fq, 病毒ID：87f0b01289503335, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\241a013a.exe, 病毒名：TrojanSpy/MSIL.PwStealer.cv, 病毒ID：9302ccd6672705ec, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\08a8cd97.exe, 病毒名：TrojanSpy/MSIL.PwStealer.cv, 病毒ID：9302ccd6672705ec, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\#Miner-2297ce6b.exe, 病毒名：Trojan/Agent.bjm, 病毒ID：735ea52604be52a1, 处理结果：暂不处理
    
12. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\240119\#CrealStealer-64ea3274.exe, 病毒名：Ransom/LockFile.fl, 病毒ID：9b97d9df1e35b64c, 处理结果：暂不处理

复制代码

X-Sec
扫描：拉黑 ALL

1. ---------------------
   
2. 2024/01/19 10:18:14 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#AgentTesla-954ac402.exe -- [xave-cloud] Spyware.Generic
   
3. 2024/01/19 10:18:14 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#AgentTesla-e396a491.exe -- [xave-cloud] Spyware.Generic
   
4. 2024/01/19 10:18:15 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#Formbook-991c49a8.exe -- [xave-cloud] Stealer.Generic
   
5. 2024/01/19 10:18:15 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#CrealStealer-64ea3274.exe -- [xave-cloud] Stealer.Generic
   
6. 2024/01/19 10:18:16 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#Remcos-e2f632e9.exe -- [xave-cloud] Backdoor.Generic
   
7. 2024/01/19 10:18:16 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#Miner-2297ce6b.exe -- [xave-cloud] Trojan.Generic
   
8. 2024/01/19 10:18:17 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#Remcos-hostcr.exe -- [xave-cloud] Backdoor.Generic
   
9. 2024/01/19 10:18:18 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\08a8cd97.exe -- [xave-cloud] Trojan.Generic
   
10. 2024/01/19 10:18:19 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\14e42ac3.exe -- [xave-cloud] Trojan.Generic
    
11. 2024/01/19 10:18:20 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\241a013a.exe -- [xave-cloud] Trojan.Generic
    
12. 2024/01/19 10:18:20 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\#Stealc-b56314a4.exe -- [xave-cloud] Stealer.Generic
    
13. 2024/01/19 10:18:21 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\da9f9e61.exe -- [xave-cloud] Trojan.Generic
    
14. 2024/01/19 10:18:27 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\240119\f40c4729.exe -- [xave-cloud] Trojan.Generic

复制代码

a1414007

AVG kill 12x
miss 14e42ac3
没双击

Agu

Avast - 掃描12X、沙盒1X

GDHJDSYDH

EIS kill 12x，KFA补漏1x，总计kill all

hhhq316

蜘蛛 5

wenshui1013

趋势科技mac版 4x