【开放测试】卡饭病毒样本包 20241211 第206期

显示全部楼层 · 发表于 2024-12-11 15:37:02

本帖最后由 zhuzhu009 于 2024-12-11 23:28 编辑

警告：

   本主题帖中所包含的任何文件和附件都有危害你的计算机的可能，并且没有安全软件可以100%防护这些样本。样本仅供测试、交流和学习，禁止用于任何非法用途。
   请在虚拟机中测试样本。对于下载样本、附件以及点击链接所导致的任何数据泄露、破坏，以及所产生的任何损失，本人和卡饭论坛不负任何责任。

样本下载:  https://pan.huang1111.cn/s/nqG3ASm https://f.ws28.cn/f/fs5ed9flrkx https://wwzq.lanzouq.com/ixCSw2hu0e9i

sha256: 4E58FAE4E3857FC4F4C2530DC6A064EB102BEFAF3842DB3216BD21BFAF877E3C

压缩包密码：infected

如果样本中包含.ps1文件(Powershell脚本)，则需要手动打开cmd.exe输入以下指令允许运行ps1脚本:

Powershell.exe Set-ExecutionPolicy Bypass

注意：扫描/双击日志请以附件形式（压缩包）或图片上传，也可以以1号字体放在回复中。
      对于日志过长以至于影响会员刷帖/回帖体验的回复，管理人员有权进行屏蔽处理。

当前测试阶段：开放测试

显示全部楼层 · 发表于 2024-12-11 15:38:43

本帖最后由 ninjagaocc 于 2024-12-11 16:03 编辑

金山毒霸剩2x

显示全部楼层 · 发表于 2024-12-11 15:41:59

本帖最后由 Loyisa 于 2024-12-11 16:07 编辑

BD 扫描24x 剩余6x

157c924023fefdb1a919140f91a6906c6a44992491ae317a1864fc2d95a51d4f.exe Gen:Variant.Jalapeno.575 已刪除
14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc.exe Gen:Variant.Zusy.569715 已刪除
498ac6b747691eb456fc24ac26c3932effca9b46e39740963120f711e72aefc9.exe Gen:Variant.Jalapeno.18807 已刪除
1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe Generic.Malware.SLcbg.68F14A34 已刪除
42458188732ffad7ac8223445549dfd5a1b5dfdc48bddb5ddd1286a22040efe9.exe Gen:Variant.Zusy.569029 已刪除
4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053.exe Gen:Variant.Bulz.174081 已刪除
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe Gen:Variant.Ser.Jalapeno.103 已刪除
c42ff0e95c3a8b533fb78017109f2906e20912e27ceb5139e8e5d4ab7e8e2780.exe Gen:Heur.MSIL.Androm.1 已刪除
59c341f20744beabcb7424a555a19d5b695a93c4f2afd5c65773511025bcf9d2.exe Trojan.GenericKD.74918283 已刪除
725f1f569ffd78d2fd1ec2e576b1ac6ab984b905fef3945c549b8b3c4c9cd1c0.exe Gen:Variant.Zusy.569715 已刪除
75fe376124a43dc809dc5a35682ca462337b460f14bb0836d054d47f7eced1e8.exe Gen:Variant.Ulise.498272 已刪除
84b4eda5d456a2c49d117a0b99bc2ed03044eaa144eb5f6c28a248e673e406db.exe Trojan.GenericKD.75105936 已刪除
ffc5aa1770ce1da1dad67760e7b342eb0a033a66e3379ba167928bdd22b3305e.exe Trojan.Agent.GLXE 已刪除
91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f.exe Trojan.GenericKD.75102786 已刪除
99e3e8a30f946770b612f530e63f0448d4e0dc261d165918b09abd2dd67d08c3.exe Gen:Heur.MSIL.Krypt.44 已刪除
c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe Gen:Variant.Jalapeno.575 已刪除
aa0de67aabbc67effdeef899e9b68e072aa927bfec1d95202740702615fe06f6.exe Gen:Variant.Lazy.554556 已刪除
acfb69abba1ac633b684bfbd5a90212aecd15d5f571a6cb2fb75463e4ad02534.doc=>(objdata) Exploit.RTF-ObfsStrm.Gen 已刪除
ae5c7d34410a6e33a3c14fd2b676d74f7f8327a73741423f786ad04c8b3615c9.exe Gen:Variant.Symmi.93663 已刪除
c049ffcacd139b734c807013fefa36e6730077930d3736f342aaddc3fe144497.exe Gen:Variant.Jalapeno.19057 已刪除
c73ff8630476795ba4dde19e7763d1aae50978b0b9b029cd71828a2da3c2197c.exe Gen:Variant.Jalapeno.4360 已刪除
cb4626ad921c63113e18c3aefb109f70c8e334089871133ea675d62d836d810b.exe Trojan.MSIL.Basic.8.Gen 已刪除
fbe36ec46358b7284655cb7872bce650ec230cf1e57b2a507cce14b4242ca23d.exe Gen:Variant.Symmi.84601 已刪除
da4b8840562135313b4af52637a248fbab262a37fb041e12a9b93e5cda32ae2f.lnk=>(CommandArguments) Heur.BZC.YAX.Pantera.35.386999D9 已刪除

复制代码

双击3x 共计27x

3fda9975f9a08ff37ed6dd52d64b7f69e692ee8d1cc132c48b055256efa43779.exe
ATC

4cb6e157f0e9238f03c72cc399d9178e997f97c1c80360b6cd3278af5ece1a15.exe
无法运行

9a1c659df3f2a04d8982ea66ce8397736c98eda3059ceebc467033ac35e176ed.exe
atc

a1c32d445b79a5fefcfccddf7c3d976fe585f07f1ccc675e57e289a0e86edc83.exe
无法运行

a1c32d445b79a5fefcfccddf7c3d976fe585f07f1ccc675e57e289a0e86edc83.exe
kill 衍生物

还有个xlsm没环境

显示全部楼层 · 发表于 2024-12-11 15:45:20

本帖最后由 wywt123 于 2024-12-11 16:24 编辑

卡巴扫描 25x 离线22x UDS3x

文件名	检测名称	处理
Module1	HEUR:Trojan.Script.Generic	Disinfected
Module2	HEUR:Trojan.Script.Generic	Disinfected
Module3	HEUR:Trojan.Script.Generic	Disinfected
157c924023fefdb1a919140f91a6906c6a44992491ae317a1864fc2d95a51d4f.exe	HEUR:Backdoor.MSIL.Crysan.gen	Deleted
14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc.exe	Trojan-PSW.Win32.Tepfer.pszegu	Deleted
objdata	HEUR:Exploit.MSOffice.Generic	Deleted
acfb69abba1ac633b684bfbd5a90212aecd15d5f571a6cb2fb75463e4ad02534.doc	HEUR:Exploit.MSOffice.CVE-2018-0802.gen	Deleted
1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe	HEUR:Trojan.Win32.Generic	Deleted
3fda9975f9a08ff37ed6dd52d64b7f69e692ee8d1cc132c48b055256efa43779.exe	HEUR:Trojan-PSW.Win32.Stealerc.gen	Deleted
498ac6b747691eb456fc24ac26c3932effca9b46e39740963120f711e72aefc9.exe	HEUR:Trojan-PSW.MSIL.Stealer.gen	Deleted
50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe	HEUR:Trojan-Spy.MSIL.Noon.gen	Deleted
725f1f569ffd78d2fd1ec2e576b1ac6ab984b905fef3945c549b8b3c4c9cd1c0.exe	Trojan-PSW.Win32.Tepfer.pszegs	Deleted
84b4eda5d456a2c49d117a0b99bc2ed03044eaa144eb5f6c28a248e673e406db.exe	HEUR:Trojan-PSW.Win32.Stealerc.gen	Deleted
91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f.exe	Trojan.Win32.Strab.snh	Deleted
99e3e8a30f946770b612f530e63f0448d4e0dc261d165918b09abd2dd67d08c3.exe	HEUR:Trojan.Win32.Generic	Deleted
ae5c7d34410a6e33a3c14fd2b676d74f7f8327a73741423f786ad04c8b3615c9.exe	Trojan-Downloader.Win32.Phpw.lgn	Deleted
c049ffcacd139b734c807013fefa36e6730077930d3736f342aaddc3fe144497.exe	HEUR:Backdoor.MSIL.Androm.gen	Deleted
c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe	HEUR:Backdoor.MSIL.Crysan.gen	Deleted
c42ff0e95c3a8b533fb78017109f2906e20912e27ceb5139e8e5d4ab7e8e2780.exe	HEUR:Trojan.MSIL.Dnoper.gen	Deleted
c73ff8630476795ba4dde19e7763d1aae50978b0b9b029cd71828a2da3c2197c.exe	HEUR:Backdoor.MSIL.XClient.b	Deleted
d45d2bd7ac43796f2087198349fe8817f6aaf48484a4b356bd61a76a9631b740.bat	HEUR:Trojan-Dropper.BAT.Agent.gen	Deleted
aa0de67aabbc67effdeef899e9b68e072aa927bfec1d95202740702615fe06f6.exe	HEUR:Trojan.Win32.Loader.gen	Deleted
da4b8840562135313b4af52637a248fbab262a37fb041e12a9b93e5cda32ae2f.lnk	HEUR:Trojan.Multi.Powedon.a	Deleted
cb4626ad921c63113e18c3aefb109f70c8e334089871133ea675d62d836d810b.exe	HEUR:Trojan-PSW.MSIL.Disco.gen	Deleted
fbe36ec46358b7284655cb7872bce650ec230cf1e57b2a507cce14b4242ca23d.exe	HEUR:Trojan-PSW.Win32.Lumma.pef	Deleted

文件名	检测名称	处理
4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053.exe	UDS:DangerousObject.Multi.Generic	Deleted
42458188732ffad7ac8223445549dfd5a1b5dfdc48bddb5ddd1286a22040efe9.exe	UDS:Trojan.Win32.Strab.shw	Deleted
9a1c659df3f2a04d8982ea66ce8397736c98eda3059ceebc467033ac35e176ed.exe	UDS:DangerousObject.Multi.Generic	Deleted

余5x

图里那个xlsm，清除了

显示全部楼层 · 发表于 2024-12-11 15:56:07

本帖最后由 Fadouse 于 2024-12-11 20:29 编辑

DI All
DeepInstinct 静态 25x

Action	Threat Type	Details
Prevented	Malware - Ransomware	E:\Code\Virus\aa\aa0de67aabbc67effdeef899e9b68e072aa927bfec1d95202740702615fe06f6.exe
Prevented	Malware - Backdoor	E:\Code\Virus\aa\fbe36ec46358b7284655cb7872bce650ec230cf1e57b2a507cce14b4242ca23d.exe
Prevented	Malware - Dropper	E:\Code\Virus\aa\da4b8840562135313b4af52637a248fbab262a37fb041e12a9b93e5cda32ae2f.lnk
Prevented	Malware - Dropper	E:\Code\Virus\aa\cb4626ad921c63113e18c3aefb109f70c8e334089871133ea675d62d836d810b.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\c73ff8630476795ba4dde19e7763d1aae50978b0b9b029cd71828a2da3c2197c.exe
Prevented	Malware - Backdoor	E:\Code\Virus\aa\c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\c42ff0e95c3a8b533fb78017109f2906e20912e27ceb5139e8e5d4ab7e8e2780.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\c049ffcacd139b734c807013fefa36e6730077930d3736f342aaddc3fe144497.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\ae5c7d34410a6e33a3c14fd2b676d74f7f8327a73741423f786ad04c8b3615c9.exe
Prevented	Malware - Virus	E:\Code\Virus\aa\42458188732ffad7ac8223445549dfd5a1b5dfdc48bddb5ddd1286a22040efe9.exe
Prevented	Malware - Dropper	E:\Code\Virus\aa\acfb69abba1ac633b684bfbd5a90212aecd15d5f571a6cb2fb75463e4ad02534.doc
Prevented	Malware - Spyware	E:\Code\Virus\aa\9a1c659df3f2a04d8982ea66ce8397736c98eda3059ceebc467033ac35e176ed.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\99e3e8a30f946770b612f530e63f0448d4e0dc261d165918b09abd2dd67d08c3.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\84b4eda5d456a2c49d117a0b99bc2ed03044eaa144eb5f6c28a248e673e406db.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\725f1f569ffd78d2fd1ec2e576b1ac6ab984b905fef3945c549b8b3c4c9cd1c0.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\59c341f20744beabcb7424a555a19d5b695a93c4f2afd5c65773511025bcf9d2.exe
Prevented	Malware - Backdoor	E:\Code\Virus\aa\157c924023fefdb1a919140f91a6906c6a44992491ae317a1864fc2d95a51d4f.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe
Prevented	Malware - Trojan	E:\Code\Virus\aa\4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053.exe
Prevented	N/A	E:\Code\Virus\aa\0056b899adf4c8a99dd0c53d8fae6e5781ad7b53b62f5b0f8dff61e7f9b9dbdf.xlsm
Prevented	Malware - Spyware	E:\Code\Virus\aa\498ac6b747691eb456fc24ac26c3932effca9b46e39740963120f711e72aefc9.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\3fda9975f9a08ff37ed6dd52d64b7f69e692ee8d1cc132c48b055256efa43779.exe
Prevented	Malware - Spyware	E:\Code\Virus\aa\1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe
Prevented	Malware - Backdoor	E:\Code\Virus\aa\14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc.exe

其余exe均无法运行，双击bat报错自退

显示全部楼层 · 发表于 2024-12-11 15:58:09

本帖最后由 2712711 于 2024-12-11 16:36 编辑

avira miss 6

显示全部楼层 · 发表于 2024-12-11 16:04:22

本帖最后由 King、暮光于 2024-12-11 16:54 编辑

ESET miss 4x

360补杀3x

最终 4cb6e157f0e9238f03c72cc399d9178e997f97c1c80360b6cd3278af5ece1a15.exe miss

显示全部楼层 · 发表于 2024-12-11 16:10:15

本帖最后由 ssa9527 于 2024-12-11 16:28 编辑

卡巴360全杀。火绒剩5个，双击没有任何拦截

显示全部楼层 · 发表于 2024-12-11 16:10:36

本帖最后由 yaokai815 于 2024-12-13 17:39 编辑

瑞星 29x

显示全部楼层 · 发表于 2024-12-11 16:17:44

本帖最后由 a1414007 于 2024-12-11 16:31 编辑

fsp 扫描kill 23x miss 7x

HEUR/APC
C:\Users\J\Desktop\aa\14a7faa5a16cbc6e031beb668ec24d78b04d8fe4959766cf11722932b93317dc.exe - 已隔离
HEUR/AGEN.1307404
C:\Users\J\Desktop\aa\157c924023fefdb1a919140f91a6906c6a44992491ae317a1864fc2d95a51d4f.exe - 已隔离
TR/Dropper.Gen7
C:\Users\J\Desktop\aa\1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe - 已隔离
TR/AVI.Stealc.xupbp
C:\Users\J\Desktop\aa\3fda9975f9a08ff37ed6dd52d64b7f69e692ee8d1cc132c48b055256efa43779.exe - 已隔离
TR/Redcap.uxffj
C:\Users\J\Desktop\aa\42458188732ffad7ac8223445549dfd5a1b5dfdc48bddb5ddd1286a22040efe9.exe - 已隔离
TR/Spy.Agent.geewy
C:\Users\J\Desktop\aa\498ac6b747691eb456fc24ac26c3932effca9b46e39740963120f711e72aefc9.exe - 已隔离
HEUR/AGEN.1311032
C:\Users\J\Desktop\aa\4fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053.exe - 已隔离
TR/AD.SnakeStealer.vdmdz
C:\Users\J\Desktop\aa\50e5353cf814e1f75d7c18a99c897670905b7e119d5d02cb532e0466819d68ba.exe - 已隔离
HEUR/APC
C:\Users\J\Desktop\aa\59c341f20744beabcb7424a555a19d5b695a93c4f2afd5c65773511025bcf9d2.exe - 已隔离
HEUR/APC
C:\Users\J\Desktop\aa\725f1f569ffd78d2fd1ec2e576b1ac6ab984b905fef3945c549b8b3c4c9cd1c0.exe - 已隔离
TR/Crypt.ZPACK.Gen
C:\Users\J\Desktop\aa\84b4eda5d456a2c49d117a0b99bc2ed03044eaa144eb5f6c28a248e673e406db.exe - 已隔离
TR/AD.Swotter.kaozj
C:\Users\J\Desktop\aa\91ae1faec9830fc63441d4a2819d460fee2bace496c5f11663e81aa88f922d2f.exe - 已隔离
TR/ATRAPS.Gen
C:\Users\J\Desktop\aa\99e3e8a30f946770b612f530e63f0448d4e0dc261d165918b09abd2dd67d08c3.exe - 已隔离
TR/Crypt.ZPACK.Gen
C:\Users\J\Desktop\aa\9a1c659df3f2a04d8982ea66ce8397736c98eda3059ceebc467033ac35e176ed.exe - 已隔离
EXP/AVI.CVE.qcvyx
C:\Users\J\Desktop\aa\acfb69abba1ac633b684bfbd5a90212aecd15d5f571a6cb2fb75463e4ad02534.doc - 已隔离
TR/Crypt.XPACK.Gen
C:\Users\Jia Liu\Desktop\aa\ae5c7d34410a6e33a3c14fd2b676d74f7f8327a73741423f786ad04c8b3615c9.exe - 已隔离
TR/AD.LokiBot.zkvgy
C:\Users\J\Desktop\aa\c049ffcacd139b734c807013fefa36e6730077930d3736f342aaddc3fe144497.exe - 已隔离
TR/Dropper.Gen
C:\Users\J\Desktop\aa\c42ff0e95c3a8b533fb78017109f2906e20912e27ceb5139e8e5d4ab7e8e2780.exe - 已隔离
HEUR/AGEN.1307404
C:\Users\J\Desktop\aa\c66fdb0e04d7bee6ac4513956d1cf5f9fc21e27cad0d32bbc7906ff4440ed2e9.exe - 已隔离
HEUR/AGEN.1370976
C:\Users\J\Desktop\aa\c73ff8630476795ba4dde19e7763d1aae50978b0b9b029cd71828a2da3c2197c.exe - 已隔离
TR/Dropper.Gen
C:\Users\J\Desktop\aa\cb4626ad921c63113e18c3aefb109f70c8e334089871133ea675d62d836d810b.exe - 已隔离
LNK/YAV.Minerva.da4b88
C:\Users\J\Desktop\aa\da4b8840562135313b4af52637a248fbab262a37fb041e12a9b93e5cda32ae2f.lnk - 已隔离
TR/Crypt.XPACK.Gen
C:\Users\J\Desktop\aa\fbe36ec46358b7284655cb7872bce650ec230cf1e57b2a507cce14b4242ca23d.exe - 已隔离

复制代码

双击 ps脚本网站被拦截了

剩下几个exe都说不适合系统版本，xlsm不知道用什么打开

[病毒样本] 【开放测试】卡饭病毒样本包 20241211 第206期

评分

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源

评分

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源