龟包 240229 15X

神龟Turmi

无视13号的家族名，我脑抽了。。。
当时满脑子想着MetaSploit和MeterPreter结果打出来一个MetaPreter


下载：
https://malware.camp/Turtle/TurtleSUSP-240229.zip
分流：
https://mirrors-s1.malware.camp/Turtle/TurtleSUSP-240229.zip
https://mirrors-s2.malware.camp/Turtle/TurtleSUSP-240229.zip
https://mirrors-s3.malware.camp/Turtle/TurtleSUSP-240229.zip
龟包列表：
https://malware.camp/Turtle/

SentinelOne：

机学10/15 剩余双击云杀 合计15/15

UNknownOoo

火绒
扫描：12x

1. 扫描文件：15
   
2. 发现风险：12
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-02-AgentTesla-6262a6.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-03-AgentTesla-87108c.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ab51cc6370904ebb, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-04-AgentTesla-c0884a.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ab51cc6370904ebb, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-06-AgentTesla-3b2b3a.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ac3cb7ce3931cea3, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-07-FormBook-a12abe.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ab51cc6370904ebb, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-08-FormBook-20c559.exe, 病毒名：TrojanSpy/MSIL.AgentTesla.mq, 病毒ID：ab51cc6370904ebb, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-09-Redline-413b36.exe, 病毒名：Trojan/Injector.bfs, 病毒ID：cdba250d075b18a6, 处理结果：暂不处理
    
12. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-10-BlankGrabber-01ebb3.exe, 病毒名：TrojanSpy/Python.Stealer.d, 病毒ID：d06410f9a3897eb1, 处理结果：暂不处理
    
13. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-11-Lighter-73a93b.exe, 病毒名：Ransom/LockFile.db, 病毒ID：9d418a7ea19590fc, 处理结果：暂不处理
    
14. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-13-Metapreter-050fba.exe, 病毒名：Backdoor/Meterpreter.dv, 病毒ID：07e794b9fe8a7b44, 处理结果：暂不处理
    
15. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-14-CobaltStrike-bc52c2.exe, 病毒名：Backdoor/CobaltStrike.ag, 病毒ID：9f0df421404120b0, 处理结果：暂不处理
    
16. 风险路径：C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-15-UnknownRansom-33e1d1.exe, 病毒名：TrojanDownloader/Agent.awc, 病毒ID：832da3aa53e92a3f, 处理结果：暂不处理

复制代码

X-Sec
扫描：ALL

1. ---------------------
   
2. 2024/02/29 23:37:43 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-01-Rhadamanthys-65787d.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.89
   
3. 2024/02/29 23:37:43 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-02-AgentTesla-6262a6.exe -- [rame-cloud] Spyware.Noon!8.E7C9
   
4. 2024/02/29 23:37:44 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-03-AgentTesla-87108c.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.80
   
5. 2024/02/29 23:37:44 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-04-AgentTesla-c0884a.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.100
   
6. 2024/02/29 23:37:45 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-05-AgentTesla-494cb4.exe -- [rame-rdm.msil2] Malware.Obfus/MSIL@AI.86
   
7. 2024/02/29 23:37:45 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-06-AgentTesla-3b2b3a.exe -- [rame-cloud] Stealer.Agensla!8.13266
   
8. 2024/02/29 23:37:46 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-07-FormBook-a12abe.exe -- [rame-cloud] Stealer.Agensla!8.13266
   
9. 2024/02/29 23:37:46 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-08-FormBook-20c559.exe -- [rame-cloud] Trojan.AgentTesla!8.104D5
   
10. 2024/02/29 23:37:47 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-10-BlankGrabber-01ebb3.exe -- [rame-classic] Spyware.Agent/PYC!1.EA8F
    
11. 2024/02/29 23:37:47 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-09-Redline-413b36.exe -- [rame-cloud] Stealer.Agent!8.C2
    
12. 2024/02/29 23:37:48 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-12-Remcos-420b66.exe -- [rame-cloud] Trojan.Injector/NSIS!8.1294D
    
13. 2024/02/29 23:37:48 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-11-Lighter-73a93b.exe -- [rame-cloud] Ransom.Agent!8.6B7
    
14. 2024/02/29 23:37:49 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-14-CobaltStrike-bc52c2.exe -- [rame-tfe] Stealer.Mimikatz!8.1335D
    
15. 2024/02/29 23:37:49 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-13-Metapreter-050fba.exe -- [rame-cloud] Trojan.Rozena!8.6D
    
16. 2024/02/29 23:37:50 Threat Detected: C:\Users\UnknownOoo\Downloads\TurtleSUSP-240229\TS-240229-15-UnknownRansom-33e1d1.exe -- [rame-cloud] Trojan.Agent!8.B1E

复制代码

hansyu

ESET 解压清空

biue

GreatMOLA

Malwarebytes 15x

1. Trojan.Crypt.MSIL, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-05-AGENTTESLA-494CB4.EXE
   
2. MachineLearning/Anomalous.95%, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-03-AGENTTESLA-87108C.EXE
   
3. Generic.Malware/Suspicious, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-14-COBALTSTRIKE-BC52C2.EXE
   
4. MachineLearning/Anomalous.94%, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-15-UNKNOWNRANSOM-33E1D1.EXE
   
5. Trojan.Crypt.MSIL, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-01-RHADAMANTHYS-65787D.EXE
   
6. Trojan.MalPack.PNG.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-02-AGENTTESLA-6262A6.EXE
   
7. Trojan.MalPack.PNG.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-06-AGENTTESLA-3B2B3A.EXE
   
8. Trojan.MalPack.PNG.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-04-AGENTTESLA-C0884A.EXE
   
9. Trojan.GuLoader, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-12-REMCOS-420B66.EXE
   
10. Trojan.MalPack.PNG.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-07-FORMBOOK-A12ABE.EXE
    
11. Trojan.MalPack.PNG.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-08-FORMBOOK-20C559.EXE
    
12. Malware.AI.2209384051, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-11-LIGHTER-73A93B.EXE
    
13. Generic.Malware.Agent.DDS, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-10-BLANKGRABBER-01EBB3.EXE
    
14. Spyware.RedLineStealer, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-09-REDLINE-413B36.EXE
    
15. Trojan.Downloader, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-2402291\TS-240229-13-METAPRETER-050FBA.EXE

复制代码

anxiety520

卡巴清空

skycai

奇安信天守  12X

54ss

BEST 扫描杀14x
剩余一个触发沙盒杀
清空

tjsh

河众dev版本（Yara修复+360+测试性启发）：All
断网+测试性启发：13x
关启发（靠DL）：12x
不行，这个Yara又tm炸了，起码可以查一个Metapreter出来吧
补充：没炸，这个Metapreter查不出来（）