【开放测试】卡饭病毒样本包 20241206 第205期

zhuzhu009

警告：

       本主题帖中所包含的任何文件和附件都有危害你的计算机的可能，并且没有安全软件可以100%防护这些样本。样本仅供测试、交流和学习，禁止用于任何非法用途。
       请在虚拟机中测试样本。对于下载样本、附件以及点击链接所导致的任何数据泄露、破坏，以及所产生的任何损失，本人和卡饭论坛不负任何责任。

样本下载: https://pan.huang1111.cn/s/mx8dxF1 https://f.ws28.cn/f/fqoeyhp3w0x https://wwzq.lanzouq.com/iCsj72hcd7ob



sha256: 3F296B03BE5E2BB65783DF5F3B5470A983083A095F356FC97C6B53B671804930



压缩包密码：infected

如果样本中包含.ps1文件(Powershell脚本)，则需要手动打开cmd.exe输入以下指令允许运行ps1脚本:

Powershell.exe Set-ExecutionPolicy Bypass



注意：扫描/双击日志请以附件形式（压缩包）或图片上传，也可以 以1号字体放在回复中。         
          对于日志过长以至于影响会员刷帖/回帖体验的回复，管理人员有权进行屏蔽处理。

当前测试阶段：开放测试

wywt123

卡巴 扫描 kill 45x

检测名称	文件名
Trojan.Win32.Phpw.btlm	128e6e284595bc35c4028daebf9e200f1faf2e6f809ec75b35c9ec1dc2868b76.exe
VHO:Trojan.Win32.Agent.xburhm	159e04da0b72590135477fa37369439acc2dd400ba28af7597ab05f0be906280.exe
HEUR:Trojan-Downloader.Win32.Generic	08c78546997ccfbffb833a115f8888ad128e5c4d43bddd9e01e2105132ef0824.exe
HEUR:Trojan.Win32.Generic	16e12889ffc58d6c71929d078c09e1dcc99731c3933ce1b3e2bebce3477e06a5.exe
Trojan.Win32.Phpw.btll	19d0f6b9a8d1ff3ec8a861ca37da7257b1c7db831fb89b812b763928055857fe.exe
HEUR:Trojan-Downloader.Win32.Generic	1c4a6940408bf29fb6034d5800b6b0acbba0a83bbd6d7a658cffd6d6b6be0068.exe
HEUR:Trojan.Win32.Miner.gen	19120b2ecb7405fc7fa7afe0a806571148c00cea20160fe66598016ab5329338.exe
HEUR:Trojan.MSIL.Injurer.pef	1dc8c7e91adbe6f3659d6e4c2d1af9d56c868461cc0bf9e674df7d0cf1a7afc9.exe
HEUR:Trojan.Script.Agent.gen	243409ec8812d65caecda60ae06e6c2e96ff6facad4c547194360731b74bcaea.exe
HEUR:Trojan.Script.Agent.gen	script.au3
HEUR:Trojan.MSIL.Injurer.pef	252af078fcf7992ce1afa0449ffa8591725bf9c46219b19d85369fdc657c8b00.exe
HEUR:Trojan-PSW.Win32.Lumma.pef	234acf55281350a35fc087395b98052b3e759ffc3dab816ae019c84b1c8818f1.exe
HEUR:Trojan.Win32.Miner.gen	366df81ee4f4544727af7fc6db34c02916be114e740ece72a465f6154114d58f.exe
HEUR:Trojan.MSIL.Injurer.pef	42961fe870e4f2ba749d71937a49cf01a5c4e5543e3824395ae004c0aa35c62f.exe
HEUR:Trojan.Script.Agent.gen	43623f1ee4a39b205f5d34be69b04ff6bb6ee66375d3e66a4398496782e42c53.exe
HEUR:Trojan.Script.Agent.gen	script.au3
Trojan-PSW.Win32.Stealerc.oqv	49b75ffaa9e81188cd1cb9d09ec7e43912bf8dbf4c85e3e1ee061e18e7d89efb.exe
HEUR:Trojan-Spy.Win32.Hoaki.gen	47cb2f5b689678b3292f548d7346c6b400dedc6a2b1dde54b2e343b8b5fc2775.exe
HEUR:Trojan.MSIL.Injurer.pef	4decdc379789942364429bbbed02dda060d79e613ed657ca541fd5f37873fd58.exe
Trojan.Win32.Agent.xburgp	545b34e6f4b2e16e39ba5cc6c28294832699ba4f7b5952b9d31041279146fef9.exe
HEUR:Trojan-Dropper.Win32.Generic	49bf2a693d8813f89a4cbea5e6d76f032f6120a40b5ccfb0d439f0eb23e24b39.exe
HEUR:Trojan-PSW.MSIL.Disco.gen	5e0bd8298a3193c217f563a32aae650eb29dbb513716c34a4b7698309edd1f70.exe
UDS:Trojan-PSW.MSIL.Disco.gen	5e0bd8298a3193c217f563a32aae650eb29dbb513716c34a4b7698309edd1f70.exe
HEUR:Trojan-PSW.MSIL.Disco.gen	ComponentBrowserruntimeHostNet.exe
HEUR:Trojan.Win32.Generic	5892cf800275fb41ba0b88395a14bd8d1ddf35d7bbcdb0e064f7bec4b2eaa894.exe
HEUR:Trojan.MSIL.Injurer.pef	589134b6f113c25f73ddf873f770ea08f080fbd4df5cba31f75350fba3bee8f4.exe
Trojan.Win32.Agent.xburga	69262ba209e92d7f48294d4ed048de01e154d7e1280f7d71fae59f0c8bd186f2.exe
HEUR:Trojan.MSIL.Injurer.pef	610c161e95a92b4b00162021c3ee2bc6819ca325c8f84874ea5bff9b1e055d40.exe
HEUR:Trojan.Script.Generic	70278ca40fa83bb0ece05e455ac3907aba311f004ba10f8d723cde1dda8caf89.hta
HEUR:Trojan-Downloader.Win32.Generic	6d08fa0a96bed6936121d80a60807e6682f0e1ce65f4fca2006fffcf109aa85e.exe
HEUR:Trojan-Spy.Win32.Hoaki.gen	7fdb9720a734d4414fa84c1a427a921dc539faef46a9b0bcc4eab409706ab7a5.exe
UDS:Trojan.Win32.Phpw.btlq	74567ee5c75fd4a34c44dc8c75e9f4ea1dcf3c60d6d3fff4e8d8526460e49b10.exe
HEUR:Trojan-PSW.Win32.Lumma.pef	7cb6a9e812c23c7ca54183bb5008fe02493174ad9336373f783a20fe2175fffa.exe
HEUR:Trojan-Downloader.Win32.Generic	afc2c40bc4e0d033e885016bc0be9314a22ff847858aed6f324b591171e671db.exe
Trojan.Win32.Agent.xburfz	b8abe1350be655fad9054056154d5b52128cda3647b1f6232082bd9a4d89a5fb.exe
UDS:Trojan.Script.Agent.gen	b11df28f6c1974e5ae34940cdca8518430d83432ab92376a0d15be5a11817f7b.exe
UDS:Trojan.Win32.Agent.xburhb	b11df28f6c1974e5ae34940cdca8518430d83432ab92376a0d15be5a11817f7b.exe
UDS:Trojan.Script.Agent.gen	script.au3
HEUR:Trojan.Script.Agent.gen	bcb1df1e3ce692f4e284bf91f1873696933a5f2ffd87ac966b719e492b43d1eb.exe
HEUR:Trojan.Script.Agent.gen	script.au3
VHO:Trojan-PSW.Win32.Stealerc.oqw	c6ec5de6bf101287195c824cb5c6308df4ca6fa6cf97fdceb43b9c8fbed30193.exe
HEUR:Trojan.Win32.Generic	c898a6d03e65d0e212cca04c6035c9c9a23cfe504f7e72179746709b0a12889a.exe
HEUR:Backdoor.Win32.Generic	ce50862f51244b9dce6dbde2bc96fa852cff8ca84b720797894a3f43f4e293ca.exe
HEUR:Trojan.Script.Agent.gen	cf265dc6c405c9d0b3e48728139c6dac24a04840091a315c34b8f7852a2f517b.exe
HEUR:Trojan.Script.Agent.gen	script.au3
HEUR:Trojan.Win32.Generic	d03990be37a53cf1ecb8189def43022ed7f04886b043c9640a32ea48fea1f1d4.exe
HEUR:Trojan-Downloader.Win32.Generic	d31671f91056db4b63277269b84841872b047643116fce88f5952393daa22691.exe
UDS:Trojan-Downloader.Win32.Generic	dd9d59f899f0c81547a312a68448532e2f6582469167db3bdb1838390ee62180.exe
Trojan.Win32.Phpw.btln	e8004da7a3c79934e0234cf767e38363368899050858a81dfd31b2010395d40c.exe
Trojan.Win32.Strab.sii	fc555917ce12a41761d6e21ef399d5be7dce2da3d15a05b2ce3fff10abcd77f9.exe
HEUR:Trojan-Spy.Win32.Hoaki.gen	f49bc1066f609e9339d3144cc2c9ff681b72804dc3b1bffe01737f864ae63c5d.exe
HEUR:Trojan-PSW.MSIL.Disco.gen	ff3ec61937bba7d0b4fd993698f3d2a8ba77e4630ed293e4a3e3d0254dc1de50.exe
UDS:Trojan-PSW.MSIL.Disco.gen	ff3ec61937bba7d0b4fd993698f3d2a8ba77e4630ed293e4a3e3d0254dc1de50.exe
HEUR:Trojan-PSW.MSIL.Disco.gen	Surrogatedll.exe
UDS:Backdoor.Win32.Cobalt.fze	fb2ad3e8f55d2b60b0e7ffa23f97f8f1123ce22a3099798d275a94e0649d2eff.exe

余3x

Update:
余3已拉黑

文件名	检测名称
604E77E959C1D2C0435BC480B8158AFD8FBE2DE94FDA68A7D156B912FF1D1852.msi	UDS:Trojan.Win64.Agent.a
2A560C8D6EFCB63ACFA50A30F29CA013DE93F06AC353A2FA85ECE94CA9036FAB.msi	UDS:Trojan.Win64.Agent.a
7E2591F32C29CDD5AF7E2E9A905B4D07CF57D50D01B35C5A7EE011CCAC0DD8CD.msi	UDS:Trojan.Win64.Agent.a

UNknownOoo

火绒
扫描：44x

2712711

ESET 8 miss 5

1073328164

迈克菲扫描 kill 44x

Fadouse

S1 + DI Kill All
静态miss 3x


剩余双击 DI Kill All

Narcissus_

测试

King、暮光

组合kill all

ESET kill 47/48
miss 1x 70278ca40fa83bb0ece05e455ac3907aba311f004ba10f8d723cde1dda8caf89.hta
360 kill 40/48
miss 8x

jijianan2007

FSP  45X

leisong

测试，看看结果