龟包 240316 12X

神龟Turmi

今天几个样本来源都找遍了，还用掉了几十次VT API搜索次数，一个AgentTesla都没找到。。。

下载：
https://malware.camp/Turtle/TurtleSUSP-240316.zip
分流：
https://mirrors-s1.malware.camp/Turtle/TurtleSUSP-240316.zip
https://mirrors-s2.malware.camp/Turtle/TurtleSUSP-240316.zip
https://mirrors-s3.malware.camp/Turtle/TurtleSUSP-240316.zip
龟包列表：
https://malware.camp/Turtle/

GreatMOLA

Malwarebytes 11x

1. Trojan.Agent.MSIL.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-06-LUMMA-4E8387.EXE
   
2. Generic.Malware/Suspicious, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-08-GH0STRAT-A46FC1.EXE
   
3. Generic.Malware/Suspicious, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-09-GH0STRAT-3848F0.EXE,
   
4. Trojan.Agent.MSIL.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-01-RISEPRO-9D2AC8.EXE
   
5. Backdoor.XenoRAT, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-07-XENO-3A441C.EXE
   
6. Spyware.CrealStealer.Python.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-02-CREAL-F3EB00.EXE
   
7. Trojan.MalPack, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-04-LUMMA-E670EA.EXE
   
8. Trojan.Dropper.MSIL.Generic, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-10-GH0STRAT-EC8E89.EXE
   
9. Generic.Malware.AI.DDS, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-03-BLANKGRABBER-5E25AE.EXE
   
10. Malware.AI.310344896, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-05-LUMMA-302BB3.EXE
    
11. Malware.Sandbox.48, C:\USERS\WANGL\DOWNLOADS\TURTLESUSP-240316\TS-240316-11-GH0STRAT-A21580.EXE

复制代码

Bitdefender exec+scan 12x

UNknownOoo

火绒（没开高级启发
扫描：9x

1. 扫描文件：12
   
2. 发现风险：9
   
3. 已处理风险：0
   
4. 病毒详情：
   
5. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-01-RisePro-9d2ac8.exe, 病毒名：Trojan/MSIL.Agent.gq, 病毒ID：480de0f93d03ca55, 处理结果：暂不处理
   
6. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-04-Lumma-e670ea.exe, 病毒名：Trojan/Injector.bfs, 病毒ID：3f6df37acd8bc223, 处理结果：暂不处理
   
7. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-11-Gh0stRAT-a21580.exe, 病毒名：Backdoor/Lotok.w, 病毒ID：d4e76df9065a4b6e, 处理结果：暂不处理
   
8. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-06-Lumma-4e8387.exe, 病毒名：Trojan/MSIL.Agent.gq, 病毒ID：480de0f93d03ca55, 处理结果：暂不处理
   
9. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-09-Gh0stRAT-3848f0.exe, 病毒名：Backdoor/Meterpreter.ak, 病毒ID：a00d08efda1aa78c, 处理结果：暂不处理
   
10. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-07-Xeno-3a441c.exe, 病毒名：Trojan/MSIL.Agent.dj, 病毒ID：c5c57cb4688e2ddd, 处理结果：暂不处理
    
11. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-10-Gh0stRAT-ec8e89.exe, 病毒名：Backdoor/Meterpreter.ak, 病毒ID：a00d08efda1aa78c, 处理结果：暂不处理
    
12. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-08-Gh0stRAT-a46fc1.exe, 病毒名：Backdoor/Meterpreter.ak, 病毒ID：a00d08efda1aa78c, 处理结果：暂不处理
    
13. 风险路径：C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-02-Creal-f3eb00.exe, 病毒名：Ransom/LockFile.fl, 病毒ID：9b97d9df1e35b64c, 处理结果：暂不处理

复制代码

X-Sec
扫描：ALL

1. ---------------------
   
2. 2024/03/16 21:01:21 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-01-RisePro-9d2ac8.exe -- [rame-cloud] Stealer.Agent!8.C2
   
3. 2024/03/16 21:01:21 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-02-Creal-f3eb00.exe -- [rame-cloud] Spyware.Agent!8.C6
   
4. 2024/03/16 21:01:22 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-04-Lumma-e670ea.exe -- [rame-cloud] Trojan.Kryptik!8.8
   
5. 2024/03/16 21:01:23 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-05-Lumma-302bb3.exe -- [rame-cloud] Spyware.Zbot!8.16B
   
6. 2024/03/16 21:01:24 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-03-BlankGrabber-5e25ae.exe -- [rame-classic] Spyware.Agent/PYC!1.EA8F
   
7. 2024/03/16 21:01:24 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-06-Lumma-4e8387.exe -- [rame-cloud] Stealer.Agent!8.C2
   
8. 2024/03/16 21:01:24 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-08-Gh0stRAT-a46fc1.exe -- [rame-cloud] Trojan.Rozena!8.6D
   
9. 2024/03/16 21:01:24 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-07-Xeno-3a441c.exe -- [rame-classic] Backdoor.XenoRAT!1.F6EA
   
10. 2024/03/16 21:01:25 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-10-Gh0stRAT-ec8e89.exe -- [rame-tfe] Trojan.Rozena!8.6D
    
11. 2024/03/16 21:01:25 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-09-Gh0stRAT-3848f0.exe -- [rame-tfe] Trojan.Rozena!8.6D
    
12. 2024/03/16 21:01:27 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-11-Gh0stRAT-a21580.exe -- [rame-cloud] Trojan.Generic!8.C3
    
13. 2024/03/16 21:01:27 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\TS-240316-12-UnknownStealer-0fccf0.exe -- [rame-cloud] Trojan.Tpyc!8.1874B

复制代码

biue

御坂14857号

不错，EIS解压11x，拉黑1x，总共清空

Fadouse

Kaspersky Premium + ESET Smart Security Premium Kill All

心醉咖啡

360

滑稽VMware15

卡巴斯基
Kaspersky Plus

Kill ALL

https://bbs.kafan.cn/forum.php?mod=attachment&aid=MzM4MjY4N3xkNWQ1ZmEwNTRjMGEzN2RlZGYzY2IyYTc1Y2M2MWIxM3wxNzE0MjU3MTM1&request=yes&_f=.jpeg

tjsh

河众断网11只
联网All

谈谈MEMZ

BEST