【开放测试】卡饭病毒样本包 第136期

安静的Snow

NORTON V22  扫描miss 8 实体机未双击

biue

腾讯电脑管家 21X

秋日之殇

卡巴扫描剩余4个，其中vbs脚本和xls文件ksn拉黑了

东南大学

CS解压+扫描杀14余12

1. FedEx Receipt_53065724643.xls
   
2. Maersk_BL_Invoice_Packinglist.vbs
   
3. MpClient.dll
   
4. ORDER-7019-2024.js
   
5. Payment Confirmation (1).vbs
   
6. Payment_Confirmation_Receipts.vbs
   
7. PO-24701248890.js
   
8. Revised Invoice 7389293.vbs
   
9. Revised Proforma Invoice Order.vbs
   
10. SOA.vbs
    
11. STATEMENT OF ACCOUNT.vbs
    
12. ❉𝔽𝕒𝕔𝕥𝕦𝕣𝕒❉_⑦①⑤⑨⑦.hta

复制代码

YU2711

Trend Micro Scan 18x


其余双击

Miss样本

swizzer

BEST
我这边的云连接貌似有问题，姑且当个lower bound吧

孤勇者

卡巴斯基解压kill23/26，其余已上报

驭龙

ESET报到
什么！清空了？


扫描的完整日志：
Scan Log
Version of detection engine: 29489P (20240702)
Date: 2024/7/2  Time: 19:03:08
Scanned disks, folders and files: D:\virus\26x (2024-07-02)
D:\virus\26x (2024-07-02)\0702\SOA.vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\STATEMENT OF ACCOUNT.vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\30.exe - a variant of Win32/TrojanDownloader.VB.RUX trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Vyuctovani_2024_07-1206812497·pdf.exe » NSIS » Script.nsi - NSIS/Injector.CSW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Vyuctovani_2024_07-1206812497·pdf.exe » NSIS » Svenskheds.Gre28 - PowerShell/Agent.BTQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Ziraat Bankasi Swift Mesaji.exe » NSIS » Script.nsi - NSIS/Injector.ASH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\hesaphareketi__.exe - MSIL/Spy.AgentTesla.F trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\lumma.exe - a variant of Win32/GenKryptik.GZFW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\vv.exe - Suspicious Object - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\❉𝔽𝕒𝕔𝕥𝕦𝕣𝕒❉_⑦①⑤⑨⑦.hta - VBS/Agent.RZC trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\710_SO_TO_CHITTAGONG1_CFS-SOE777_PKCGP2410001-AMD-8248-HBL_DRAFT.scr - a variant of Win32/TrojanDownloader.ModiLoader.ADM trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe » AUTOIT » script.bin - a variant of Win32/Injector.Autoit.GCW trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\FedEx Receipt_53065724643.xls - Win32/Exploit.CVE-2017-0199.ABD trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\ISOTRAILER Trailer Sheets Inquiry.scr - a variant of MSIL/TrojanDownloader.Agent.QWY trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\KWOTASIE.exe » NSIS » Script.nsi - NSIS/Injector.CSP trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\KWOTASIE.exe » NSIS » Phantasies.ude - PowerShell/Agent.BTQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Maersk_BL_Invoice_Packinglist.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\MpClient.dll - Win64/Agent.EBO trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\ORDER-7019-2024.js - JS/Kryptik.CTH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED-xlsx.scr - a variant of MSIL/Kryptik.ALVU trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\PO-24701248890.js - JS/Kryptik.CTH trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Payment Confirmation (1).vbs - VBS/Agent.SCS trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Payment_Confirmation_Receipts.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\QUOTATION_JULQTRA071244úPDF.scr - a variant of MSIL/TrojanDownloader.Agent.QWM trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\RFQ QUG24-200370054200.exe - a variant of MSIL/GenKryptik.GZGE trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Revised Invoice 7389293.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\Revised Proforma Invoice Order.vbs - VBS/Agent.SCQ trojan - cleaned by deleting [1]
D:\virus\26x (2024-07-02)\0702\SKM_C3350191107102111.exe - a variant of MSIL/Kryptik.ALVX trojan - cleaned by deleting [1]
Number of scanned objects: 64
Number of detections: 28
Number of cleaned objects: 28
Time of completion: 19:03:54  Total scanning time: 46 sec (00:00:46)
Notes:
[1] Object has been deleted as it only contained the virus body.

Nocria

IKARUS - 18 / 26



________________________________________________________

EMSISOFT - (6+8) / 26

真小读者

shulun743 发表于 2024-7-2 18:02
最近的样本，都挺大的， 为何会这样，难道是为了虚拟机逃逸？

26个才8M，还大？