【开放测试】卡饭病毒样本包 20241103 第183期

裂空我爱杰

xmt12 发表于 2024-11-3 14:22
智量 27/35
EIS 35/35QAX 26/35

eset还是挺狠啊。。
话说纯扫描的话eis跟eav应该一样吧

chyraymond

Kaspersky

xmt12

裂空我爱杰 发表于 2024-11-3 16:57
eset还是挺狠啊。。
话说纯扫描的话eis跟eav应该一样吧

扫描都是一样的，就是主防和纸糊的一样

裂空我爱杰

xmt12 发表于 2024-11-3 17:09
扫描都是一样的，就是主防和纸糊的一样

红伞有了sentry我就把eset的hips关了。。。而且有火绒，基本没啥事。。。

平时就是折腾下单机游戏外{过}{滤}挂，有没有病毒扔沙盘里面也差不多哈哈。就是看重eset不卡机+高扫描率
我把监控的启发都给关了

Luna_ovo

实体机防御，实机测的！（KES+火绒）：
卡巴配置：

解压，卡巴先扫描


剩4x


火绒（开高启发）（刚发现，火绒病毒库是昨天的）


剩2x
（实体机中沙盒运行）

运行第一个，卡巴主防杀


第二个，瞬间退出，可能是sandbox检测

mmmaoo

ESET

样本数量总数为：35
总检出数量为：34
未检出数量为：1
检出率为：97.14%

未检出样本：89463c1b87a5f32ab2ba59d536134516fa593c29bc0a6eda9e3da390d7f05ea6.exe

1. <div>C:\Users\Admin\Desktop\infected20241103\10b20d5ab63333029b484bf4fc528e6cd4dc755c99c31c24054d63f9e3447c1c.bat - PowerShell/TrojanDownloader.Agent.JRS 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\13b53797e8ae8969a0fe2fa57463fae3727af51fe094904b0bd5c4ba22bfd262.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\15d55e886566f3da849370afa83b54cf3be37b95be32bfab0ef36ae56663c6ec.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\1b5f4adeca66e96ef076cfe25b53be7b9a3bb5a0cb50e69001e8985abe8f580d.exe - Win32/GenKryptik.DYUL 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\ab32de059612580f0eb53b279671fc0210762c2e0632a8868b8e2b8a908e22ee.exe > AUTOIT > script.bin - Win32/Injector.Autoit.GON 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\abb44519712f906ab7e337c9fab26534d3261c999dd7837ac56b1e61c56bfc84.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\b499bf51c07c785b31e3cd754b988e7a236a511968f08799c3ddeec0c056b34a.hta > BASE64 > decoded.ps1 - PowerShell/Kryptik.EJ 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\b499bf51c07c785b31e3cd754b988e7a236a511968f08799c3ddeec0c056b34a.hta > BASE64 > decoded.ps1 - PowerShell/Kryptik.EJ 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\b5fa8aa1395fd7cc8023279bb7ef6ac1cbe8913d9fc69beab1152a38969fa469.cmd - PowerShell/TrojanDownloader.Agent.JNL 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\b67516928b87f8b6d79ead65bbb8edcd969f0ff317402dc1985972e563661139.exe - Win64/Packed.PyInstaller.O 可疑应用程序 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\bc9af86a3eb33dcf9a4fb7ad7b0969f447ad0f0b563e06546c2d24230448938f.exe - WinGo/Agent.OM 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\3dc30eca9e2605ee856852687b05a74a8b9463de51a223b8344098ba7b402804.exe > AUTOIT > script.bin - Win32/Injector.Autoit.GOP 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\beda49bfe82dcbd8a63c66c3e7840919e0e8b883d5330e91e066c61a518a1ab9.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\56cd7a444e3f0c16d2b245d5e23f475bc69645bba2aa3d6c9bd22d34dddeb540.exe > AUTOIT > script.bin - Win32/Autoit.ORL 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\c61196d6b3ae9b0c88afb656c58adee79288de13927f288c767bacf2825e8480.exe > AUTOIT > script.bin - Win32/TrojanDropper.Autoit.XD 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\cb8587628b098897d4e1e2e32272e0fdeb0fc952b5bf16d776c7f1a26d02f61c.exe - Win32/GenKryptik.DYUL 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\d1ed381d12ccad419dcc8e8fc14179ef453e03ddd57d6842955ea9ec5176f484.exe - MSIL/Spy.Agent.AES 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\5ee74cad243bc459b9068894fa0fc05d40cc8466322315f0132c8275a78112f9.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\5ff273f03e88a8b0a1f58c85dfa28fee6f44766eb09d53c421eb770d6b965e43.exe - MSIL/Agent.DWN 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe - MSIL/TrojanDropper.Agent.GGG 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\d381a78fa4db5302f27e196158145adf2f40e87a93c5584d7c8b32153a384b32.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\6a910528454646f73cbab1b93c854a0322111c61063711e49257ff9f6317d13f.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\e520d68864b5bd7f6e54afa9a7f346e850f57c06d11f0780d7d4277e3a5c3bb2.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi > MSI > Binary.bz.WrappedSetupProgram > CAB > keygenran.exe - MSIL/Filecoder.Chaos.A 特洛伊木马 的变量 - 已将选择操作推迟到扫描完成后进行</div><div>C:\Users\Admin\Desktop\infected20241103\6c4bf8dc2f2c1cccb9a2470f1610c11397fe168e55972eb0aaee7e77afd5d3d6.exe > AUTOIT > script.bin - Win32/Autoit.ORL 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\ed5aaeace50d0a131b997c7fea354f6f07db12e3df82caa9da5db4d2380cea18.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\807ebe758087a724108a1ab37dc3c954e2cd8aff85c36a8b849f2fc62929e538.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\86abfdc3601520afa34d06dec50f9f71716cc6fde9fb3f47523454115cc894b3.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\9bdc43df16cff6db219f2d3dd4a1e4b650262e73f98d2264926b90664942c187.ps1 - MSIL/AsyncRAT.A 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\f35d39b293f66612de5c9607630a64de7748f5e468d63133b26180125d19a249.exe > AUTOIT > script.bin - Win32/Injector.Autoit.GOP 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\f555f39b7a32994ab52869fc49b03f87c426db8f18800c1497000d76fb0e2552.msc - XML/Runner.BD 特洛伊木马 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\9d11b8db730658666dad535182ea248063dd23966344d458250219652dc392e1.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\fe3e25e07d0c6d9d56cb067571e4dbb7a994c90cf1d7689ee75d83b44e4a8e39.exe - Win32/Packed.Themida.HZB 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\a4af94bf201e48a2a1242d2aea128aff328fbeb5ebd13faebdec74de3717bce3.exe > AUTOIT > script.bin - Win32/Autoit.ORL 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\a978da26e3782765bee3d190ce3462b793d3efd4530534137eb5611abe39043f.exe - Win32/Packed.Themida.HWD 特洛伊木马 的变量 - 已通过删除清除 [1]</div><div>C:\Users\Admin\Desktop\infected20241103\e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi - Suspicious Object - 已删除</div>

复制代码

Nocria

IKARUS - 33/35

1. [03.11.2024 18:30:32] On-demand scan started: "TemporaryScan"
   
2. [03.11.2024 18:30:32] Found, 0.00s, SigName: "Trojan.Win32.Themida", SigId: 515810649, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\15d55e886566f3da849370afa83b54cf3be37b95be32bfab0ef36ae56663c6ec.exe"
   
3. [03.11.2024 18:30:32] Found, 0.00s, SigName: "Trojan.Win32.Krypt", SigId: 515807792, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\1b5f4adeca66e96ef076cfe25b53be7b9a3bb5a0cb50e69001e8985abe8f580d.exe"
   
4. [03.11.2024 18:30:32] Found, 0.01s, SigName: "Win32.SuspectCrc", SigId: 515629849, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\3dc30eca9e2605ee856852687b05a74a8b9463de51a223b8344098ba7b402804.exe"
   
5. [03.11.2024 18:30:32] Found, 0.01s, SigName: "Trojan.Crypt", SigId: 5275398, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\13b53797e8ae8969a0fe2fa57463fae3727af51fe094904b0bd5c4ba22bfd262.exe"
   
6. [03.11.2024 18:30:32] Found, 0.01s, SigName: "Trojan-Dropper.MSIL.Agent", SigId: 4992699, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\5ff273f03e88a8b0a1f58c85dfa28fee6f44766eb09d53c421eb770d6b965e43.exe"
   
7. [03.11.2024 18:30:32] Found, 0.01s, SigName: "Trojan-Dropper.MSIL.Agent", SigId: 515542664, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\60b98a0907f9721cf28ccd684b565f7f77a90565e9a2bd47f75c419472c25a1c.exe"
   
8. [03.11.2024 18:30:32] Found, 0.03s, SigName: "Trojan.Win32.Themida", SigId: 515807802, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\6a910528454646f73cbab1b93c854a0322111c61063711e49257ff9f6317d13f.exe"
   
9. [03.11.2024 18:30:32] Found, 0.06s, SigName: "Trojan.Crypt", SigId: 5275398, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\5ee74cad243bc459b9068894fa0fc05d40cc8466322315f0132c8275a78112f9.exe"
   
10. [03.11.2024 18:30:32] Found, 0.03s, SigName: "Trojan.Win32.Themida", SigId: 515810650, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\807ebe758087a724108a1ab37dc3c954e2cd8aff85c36a8b849f2fc62929e538.exe"
    
11. [03.11.2024 18:30:32] Found, 0.03s, SigName: "Trojan.Win32.Themida", SigId: 515807795, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\86abfdc3601520afa34d06dec50f9f71716cc6fde9fb3f47523454115cc894b3.exe"
    
12. [03.11.2024 18:30:32] Found, 0.00s, SigName: "Trojan.MSIL.AsyncRAT", SigId: 515805458, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\9bdc43df16cff6db219f2d3dd4a1e4b650262e73f98d2264926b90664942c187.ps1"
    
13. [03.11.2024 18:30:32] Found, 0.16s, SigName: "Trojan.Win32.Autoit", SigId: 5616529, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\6c4bf8dc2f2c1cccb9a2470f1610c11397fe168e55972eb0aaee7e77afd5d3d6.exe"
    
14. [03.11.2024 18:30:32] Found, 0.18s, SigName: "Trojan.Win32.Autoit", SigId: 5616529, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\56cd7a444e3f0c16d2b245d5e23f475bc69645bba2aa3d6c9bd22d34dddeb540.exe"
    
15. [03.11.2024 18:30:32] Found, 0.02s, SigName: "Trojan.Crypt", SigId: 5275398, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\a978da26e3782765bee3d190ce3462b793d3efd4530534137eb5611abe39043f.exe"
    
16. [03.11.2024 18:30:32] Found, 0.04s, SigName: "Trojan.Win32.Injector", SigId: 515762992, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\ab32de059612580f0eb53b279671fc0210762c2e0632a8868b8e2b8a908e22ee.exe"
    
17. [03.11.2024 18:30:32] Found, 0.03s, SigName: "Trojan.Win32.Themida", SigId: 515808113, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\abb44519712f906ab7e337c9fab26534d3261c999dd7837ac56b1e61c56bfc84.exe"
    
18. [03.11.2024 18:30:33] Found, 0.02s, SigName: "Trojan.PowerShell.Crypt", SigId: 4250628, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\b499bf51c07c785b31e3cd754b988e7a236a511968f08799c3ddeec0c056b34a.hta"
    
19. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Trojan-Downloader.PowerShell.Agent", SigId: 514251350, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\b5fa8aa1395fd7cc8023279bb7ef6ac1cbe8913d9fc69beab1152a38969fa469.cmd"
    
20. [03.11.2024 18:30:33] Found, 0.17s, SigName: "Trojan.Win32.Autoit", SigId: 5616529, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\a4af94bf201e48a2a1242d2aea128aff328fbeb5ebd13faebdec74de3717bce3.exe"
    
21. [03.11.2024 18:30:33] Found, 0.04s, SigName: "Trojan.WinGo.Shellcoderunner", SigId: 4641936, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\bc9af86a3eb33dcf9a4fb7ad7b0969f447ad0f0b563e06546c2d24230448938f.exe"
    
22. [03.11.2024 18:30:33] Found, 0.03s, SigName: "Trojan.Win32.Themida", SigId: 515808114, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\beda49bfe82dcbd8a63c66c3e7840919e0e8b883d5330e91e066c61a518a1ab9.exe"
    
23. [03.11.2024 18:30:33] Found, 0.06s, SigName: "Trojan-Dropper.Win32.Autoit", SigId: 5667458, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\c61196d6b3ae9b0c88afb656c58adee79288de13927f288c767bacf2825e8480.exe"
    
24. [03.11.2024 18:30:33] Found, 0.10s, SigName: "Trojan.Python.SLoader", SigId: 5458147, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\b67516928b87f8b6d79ead65bbb8edcd969f0ff317402dc1985972e563661139.exe"
    
25. [03.11.2024 18:30:33] Found, 0.06s, SigName: "Trojan.Win32.Krypt", SigId: 515807790, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\cb8587628b098897d4e1e2e32272e0fdeb0fc952b5bf16d776c7f1a26d02f61c.exe"
    
26. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Win32.SuspectCrc", SigId: 515626995, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\d1ed381d12ccad419dcc8e8fc14179ef453e03ddd57d6842955ea9ec5176f484.exe"
    
27. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Trojan.Win32.Themida", SigId: 515807799, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\d381a78fa4db5302f27e196158145adf2f40e87a93c5584d7c8b32153a384b32.exe"
    
28. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Trojan.Win32.Themida", SigId: 515807797, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\e520d68864b5bd7f6e54afa9a7f346e850f57c06d11f0780d7d4277e3a5c3bb2.exe"
    
29. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Trojan.Win32.Themida", SigId: 515807798, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\ed5aaeace50d0a131b997c7fea354f6f07db12e3df82caa9da5db4d2380cea18.exe"
    
30. [03.11.2024 18:30:33] Found, 0.02s, SigName: "Trojan.Filecrypter.Chaos", SigId: 5222803, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\e8af6b996ef72510ec7af7342f3a046c4e6ef20fc717af3091ba03a72ffd89ee.msi"
    
31. [03.11.2024 18:30:33] Found, 0.01s, SigName: "Trojan.Win32.AutoitInject", SigId: 515682819, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\f35d39b293f66612de5c9607630a64de7748f5e468d63133b26180125d19a249.exe"
    
32. [03.11.2024 18:30:33] Found, 0.00s, SigName: "Trojan.Win32.Themida", SigId: 515769691, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\fe3e25e07d0c6d9d56cb067571e4dbb7a994c90cf1d7689ee75d83b44e4a8e39.exe"
    
33. [03.11.2024 18:30:33] Found, 0.02s, SigName: "Trojan-Downloader.XML.URLRedirectDownload", SigId: 5562730, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\f555f39b7a32994ab52869fc49b03f87c426db8f18800c1497000d76fb0e2552.msc"
    
34. [03.11.2024 18:30:33] Found, 0.45s, SigName: "Trojan.Win32.Themida", SigId: 4940204, Type: "VIRUS", File: "C:\Users\promi\Desktop\infected20241103\9d11b8db730658666dad535182ea248063dd23966344d458250219652dc392e1.exe"
    
35. [03.11.2024 18:30:33] On-demand scan FINISHED: "TemporaryScan"
    
36. [03.11.2024 18:30:33] ----------------------------------------------------
    
37. [03.11.2024 18:30:33] Directories scanned: 1
    
38. [03.11.2024 18:30:33] Files scanned: 67
    
39. [03.11.2024 18:30:33] Virus found: 33
    
40. [03.11.2024 18:30:33] ----------------------------------------------------

复制代码

jijianan2007

360TS解压29X，右键扫描2X，剩4

jijianan2007

WSCS解压扫描剩5

jijianan2007

Cylance 27X