【开放测试】卡饭病毒样本包 第136期

QVM360

样本下载：
https://mc163.lanzoue.com/i2VhT23bwyng

1. 208A58C11DF2608BA40DAF453A31DDD82230357077397F3B2F1A7645E881B232

复制代码

样本数量：26
压缩包密码：infected

回帖格式不做要求。

驭龙

ESET报到
什么！清空了？


扫描的完整日志：
Scan Log
Version of detection engine: 29489P (20240702)
Date: 2024/7/2  Time: 19:03:08
Scanned disks, folders and files: D:\virus\26x (2024-07-02)
D:\virus\26x (2024-07-02)\0702\SOA.vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\STATEMENT OF ACCOUNT.vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\30.exe - a variant of Win32/TrojanDownloader.VB.RUX trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Vyuctovani_2024_07-1206812497·pdf.exe » NSIS » Script.nsi - NSIS/Injector.CSW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Vyuctovani_2024_07-1206812497·pdf.exe » NSIS » Svenskheds.Gre28 - PowerShell/Agent.BTQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Ziraat Bankasi Swift Mesaji.exe » NSIS » Script.nsi - NSIS/Injector.ASH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\hesaphareketi__.exe - MSIL/Spy.AgentTesla.F trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\lumma.exe - a variant of Win32/GenKryptik.GZFW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\vv.exe - Suspicious Object - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\❉𝔽𝕒𝕔𝕥𝕦𝕣𝕒❉_⑦①⑤⑨⑦.hta - VBS/Agent.RZC trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr - a variant of Win32/TrojanDownloader.ModiLoader.ADM trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.GCW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\FedEx Receipt_53065724643.xls - Win32/Exploit.CVE-2017-0199.ABD trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\ISOTRAILER Trailer Sheets Inquiry.scr - a variant of MSIL/TrojanDownloader.Agent.QWY trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\KWOTASIE.exe » NSIS » Script.nsi - NSIS/Injector.CSP trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\KWOTASIE.exe » NSIS » Phantasies.ude - PowerShell/Agent.BTQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Maersk_BL_Invoice_Packinglist.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\MpClient.dll - Win64/Agent.EBO trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\ORDER-7019-2024.js - JS/Kryptik.CTH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED-xlsx.scr - a variant of MSIL/Kryptik.ALVU trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\PO-24701248890.js - JS/Kryptik.CTH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Payment Confirmation (1).vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Payment_Confirmation_Receipts.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\QUOTATION_JULQTRA071244úPDF.scr - a variant of MSIL/TrojanDownloader.Agent.QWM trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\RFQ QUG24-200370054200.exe - a variant of MSIL/GenKryptik.GZGE trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Revised Invoice 7389293.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Revised Proforma Invoice Order.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\SKM_C3350191107102111.exe - a variant of MSIL/Kryptik.ALVX trojan - cleaned by deleting [1]
Number of scanned objects: 64
Number of detections: 28
Number of cleaned objects: 28
Time of completion: 19:03:54  Total scanning time: 46 sec (00:00:46)
Notes:
[1] Object has been deleted as it only contained the virus body.

1073328164

迈克菲扫描 kill 20x

真小读者

金山安全终端 云引擎3X+红伞本地引擎2X


mse补杀




剩余




==========
0703复测金山15X，云14X+伞1X



剩余

BitterLotus

DI 解压 14x


双击（除dll） 9x 剩3x


S1 16x

QVM360

360



有一些是云响应杀的，以第一次扫描为准

shulun743

最近的样本，都挺大的， 为何会这样，难道是为了虚拟机逃逸？

莒县小哥

WD杀24枚

QVM360

shulun743 发表于 2024-7-2 18:02
最近的样本，都挺大的， 为何会这样，难道是为了虚拟机逃逸？

大个p，这次的算小的，大的一般加了强壳为了躲避检测

QVM360

火绒这次出息了（可能是脚本文件多，火绒扫描脚本文件强）



双击

sudfiona

天融信 病毒库：2024/07/01 19:43
开始时间：2024/07/02 03:17
总计用时：00:00:04
扫描对象：149个
发现威胁：6个
已处理威胁：4个
发现系统修复项：0个
处理系统修复项：0个

1. 病毒详情
   
2. 
   
3. 威胁路径：C:\Users\User\Desktop\0702\Maersk_BL_Invoice_Packinglist.vbs, 病毒名：HEUR:Trojan/VBS.Agent.p, 病毒ID：[d8aa3f5e49a5df72], 处理结果：删除成功
   
4. 威胁路径：C:\Users\User\Desktop\0702\Payment_Confirmation_Receipts.vbs, 病毒名：HEUR:Trojan/VBS.Agent.p, 病毒ID：[d8aa3f5e49a5df72], 处理结果：删除成功
   
5. 威胁路径：C:\Users\User\Desktop\0702\Revised Proforma Invoice Order.vbs, 病毒名：HEUR:Trojan/VBS.Agent.p, 病毒ID：[d8aa3f5e49a5df72], 处理结果：删除成功
   
6. 威胁路径：C:\Users\User\Desktop\0702\Revised Invoice 7389293.vbs, 病毒名：HEUR:Trojan/VBS.Agent.p, 病毒ID：[d8aa3f5e49a5df72], 处理结果：删除成功
   
7. 威胁路径：C:\Users\User\Desktop\0702\QUOTATION_JULQTRA071244úPDF.scr, 病毒名：TrojanDownloader/MSIL.Agent.yh, 病毒ID：[216cb1b98f3ef808], 处理结果：隔离失败
   
8. 威胁路径：C:\Users\User\Desktop\0702\ORDER-7019-2024.js, 病毒名：SVM:TrojanDownloader/JS.Nemucod.m, 病毒ID：[661fe0c1d567bfbd], 处理结果：隔离失败
   
9. 
   

复制代码