【开放测试】卡饭病毒样本包 20250101 第222期

zhuzhu009

警告：

       本主题帖中所包含的任何文件和附件都有危害你的计算机的可能，并且没有安全软件可以100%防护这些样本。样本仅供测试、交流和学习，禁止用于任何非法用途。
       请注意，所以样本均为真实威胁，具有严重危害性。请不要在没有任何安全措施保存，打开或执行这些样本。请在虚拟机中测试样本。对于下载样本、附件以及点击链接所导致的任何数据泄露、破坏，以及所产生的任何损失，本人和卡饭论坛不负任何责任。

2025元旦快乐~

样本下载:https://wwzq.lanzouq.com/i1DqH2jllora https://wormhole.app/n8NrD#KgG_r_Gkf1N1cyKHipdeSA https://c.wss.cc/f/fy3rthvmmtn 复制链接到浏览器打开


sha256:6E6E6750637C487FC92D294E7D4382F459BCAE4DDD4559EC39AA1A8EF148BA2C


压缩包密码：infected

如果样本中包含.ps1文件(Powershell脚本)，则需要手动打开cmd.exe输入以下指令允许运行ps1脚本:

Powershell.exe Set-ExecutionPolicy Bypass



注意：扫描/双击日志请以附件形式（压缩包）或图片上传，也可以 以1号字体放在回复中。         
          对于日志过长以至于影响会员刷帖/回帖体验的回复，管理人员有权进行屏蔽处理。

当前测试阶段：开放测试

123456lwh

感谢分享

woaimou

WD零容忍云miss1X

jijianan2007

360ts   解压35X，右键4X，剩3

Fadouse

DI + KES + S1解压清空

（由于各个产品会重复杀同一个样本，日志仅作为参考）
DI:

Threat Type	Threat Severity	Details	Event Trigger
Malware - Dropper	Very high	E:\Code\Virus\20250101\ab2bda4e7dc25a1edc5eaf2d60045ff7cb732a924ff13336644027cd7966cd16.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\fc1dda87caf1f4dba900eaabb519cd216253affe5bdcf83be605162d266be2f1.exe	Malicious file
Malware - Ransomware	Very high	E:\Code\Virus\20250101\fa545f3f6fa282dbe529483bb3fac3dae0ea6c466a7bcb0bb7f843622bec7177.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\f2d3aa2010aa17c79bd549f081efe1ef635b8e12ae150f200f8d2769b960bd4b.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df.exe	Malicious file
Malware - Spyware	Low	E:\Code\Virus\20250101\d9cfe4c08b2f71b517ba47fe43f8825085b0f4cf9b8e8627ee40e54ec9f6bb05.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\cdf06ee922f209a5ea0f3a2f05acc8813e0cc98384493a54373cc246e8ad1095.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\c35fd8893480f059a48cabc6fc0a956106f55ec96d3fa728fab1bdb4b57c1705.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\c23b7950208b8f8e8a22c401cb5e9a05e560ae6119307d975ba601b4e2e99273.exe	Malicious file
Malware - Ransomware	Very high	E:\Code\Virus\20250101\c0ecc22a4cc8ef912b7d1de3dd48c9dc32ca053535aa71da572aeb6f9c91d4ae.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\be48cb6e3ff7f142a419c4b227fbf9bbe2c6074a58e23ad453380854f749e33e.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\be0554ab88f46d8e6b10243d7b28ae2ce724b43224af3954b62d015693089822.exe	Malicious file
Malware - Dropper	Moderate	E:\Code\Virus\20250101\aeed70a3f936b699e93f18dfc5b4a582a6a08be7d52d8e6229754f96205aecb2.lnk	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\ad2f45143de4a73f40010ac03e0aff210dcf24dfc8b0fffba678c3e9f20d5e22.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\a5d763a75a1e676476c9fc43b354c94f9e10180352e1cb8b7d1a60a69bbd195b.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\a28bd583dab27c6e95c9f14ae64bd0b6831cc9226737f68b1a8bf9dd033843fa.exe	Malicious file
Malware - Dropper	Moderate	E:\Code\Virus\20250101\98a28a0d4d028d446811b620e519d258feb8dc4c494705f372ae0c7c22fa9804.lnk	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\942897e237bc3ab9b597d9258e2541730d2192b957ea21c6242dc373b42dbc8f.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\8dcce53ea838f3f97b8aff36e0a1ffd70aeb1de6b8c6e5d6b530499a07e59fce.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\8812447d76e1ef7b1dbe567acb705e1f2023f2265d99ad83307d858ef429a5b5.exe	Malicious file
Malware - Backdoor	Very high	E:\Code\Virus\20250101\879a5b13745db634a276624a5c476ede618ba844da42d3ec614aafc45051d474.exe	Malicious file
Malware - Ransomware	Very high	E:\Code\Virus\20250101\8776714b524b22667fce6f8d4cfae8bf99061e2a3a4516e48b8335e7b2e65971.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe	Malicious file
Malware - Dropper	Moderate	E:\Code\Virus\20250101\730366e31bef22be8e118ca96c8ed0bfb005a7430e7b1e45a6e952ac603e0d7c.lnk	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\68783c123f5c9c302811fc6391329010a372fc583f5af03c4f65d0656a8a165e.exe	Malicious file
Malware - Backdoor	Very high	E:\Code\Virus\20250101\59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\564084e14d92f08cd1e05273a44bfaf11dd7e539e64943ff59cc651622c18268.exe	Malicious file
Malware - Ransomware	Very high	E:\Code\Virus\20250101\52ccbb030d616f534e5acb49d563ca987c62f915026e83072e78894bb972956a.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\4cf7e80d75cfb9d92f50e61d9fac8f3b859217364a0ada66448b5e3486116f18.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\4ba12035398519562e56cf4b0a0a2e9dae54ec66ee9d54fc474d3e5fff8bef4f.exe	Malicious file
Malware - Dropper	Moderate	E:\Code\Virus\20250101\4b4bb2f618431b740a075df0972cd029be2418c1f1870d411ef4cf1e8779c97e.lnk	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\49039b4b47513f22a7e396b57a73abe02b0032a09089e8fa68c94c0eae655d6b.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\3a9cc87a55b5940d4ee2f074c65934c8f9877ad62f5393c6309cb43a0a1310b5.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\3639435bd811a8f355795a3cef8c0960d6e363efd692a84db1f8e87a3244389a.exe	Malicious file
Malware - Ransomware	Very high	E:\Code\Virus\20250101\36203748faebc1b01f1450c5b93bd31d21b9f98d1e5df663f8a5451c4553dc71.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\30de76c4187db01e3b49096449be96c83f0404b9c2361c30d0fb933fa791d6d6.exe	Malicious file
Malware - Trojan	Very high	E:\Code\Virus\20250101\30d0a42cbfa4c3ff9c23fe502c5abfef4910fd3a7997088e6b0ca512b50d53e2.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\02c7411fd491368727387ac793e3bb3fcd9b792f1a18cec7c0da5cd65cbccc72.exe	Malicious file
Malware - Spyware	Very high	E:\Code\Virus\20250101\079e0791ef0b94ae0974d6e11a041717933017e0e34d3f1aca6f23c63e8700db.exe	Malicious file

S1:


KES 2X:

1. Event: Malicious object detected
   
2. Component: Host Intrusion Prevention
   
3. Result description: Detected
   
4. Type: Trojan
   
5. Name: HEUR:Trojan.HTA.SAgent.gen
   
6. Threat level: High
   
7. Object path: E:\Code\Virus\20250101
   
8. Object name: 3098a9c50afcd478c3eeb9b12b3794109c0f3652263bcaf8b0077c413188e4da.hta
   
9. Reason: Machine learning
   
10. Databases release date: Today, 1/1/2025 11:04:00 AM
    
11. SHA256: 3098A9C50AFCD478C3EEB9B12B3794109C0F3652263BCAF8B0077C413188E4DA
    
12. MD5: 5697159735D484D2D4FFF3EF06AA6F62

复制代码

1. Event: Malicious object detected
   
2. User: WORKGROUP\LAPTOP$
   
3. User type: Initiator
   
4. Application name: DeepETPService.exe
   
5. Application path: C:\Program Files\DeepInstinct
   
6. Component: File Threat Protection
   
7. Result description: Detected
   
8. Type: Trojan
   
9. Name: HEUR:Trojan.VBS.SAgent.gen
   
10. Precision: Heuristic analysis
    
11. Threat level: High
    
12. Object type: File
    
13. Object name: c43aa71f1636522145ea3e384b2546d5a589260cd7a2cc42688dda5944215b68.vbs
    
14. Object path: E:\Code\Virus\20250101
    
15. SHA256 of an object: C43AA71F1636522145EA3E384B2546D5A589260CD7A2CC42688DDA5944215B68
    
16. MD5 of an object: FC612D46CCA59534577F51B16710B323
    
17. Reason: Machine learning
    
18. Databases release date: Today, 1/1/2025 11:04:00 AM

复制代码

jijianan2007

EEA  解压40X剩2，右键扫描1X，剩1

1094947421

jijianan2007

迈克菲  35X

784696777

卡巴应该算清空了？有个清除的。
清除完的vt全绿

xmt12

自制

1. XAS扫描日志
   
2. 扫描开始时间:2025/1/1 14:27:22
   
3. 
   
4. 主程序版本:3.0.7 病毒库版本:1793(2025.1.1)
   
5. 特征库个数：17514
   
6. 黑md5个数：2334116
   
7. 白md5个数：150522
   
8. 
   
9. 危险文件:
   
10. ---------
    
11. 
    
12. D:/用户文件/2/桌面/20250101\02c7411fd491368727387ac793e3bb3fcd9b792f1a18cec7c0da5cd65cbccc72.exe[特征引擎][Win32/Packed.Themida]
    
13. D:/用户文件/2/桌面/20250101\079e0791ef0b94ae0974d6e11a041717933017e0e34d3f1aca6f23c63e8700db.exe[特征引擎][Win32/TrojanDropper.Agent]
    
14. D:/用户文件/2/桌面/20250101\30d0a42cbfa4c3ff9c23fe502c5abfef4910fd3a7997088e6b0ca512b50d53e2.exe[特征引擎][Win32/Packed.Themida]
    
15. D:/用户文件/2/桌面/20250101\30de76c4187db01e3b49096449be96c83f0404b9c2361c30d0fb933fa791d6d6.exe[特征引擎][Win32/Trojan.Generic.51A3141b]
    
16. D:/用户文件/2/桌面/20250101\36203748faebc1b01f1450c5b93bd31d21b9f98d1e5df663f8a5451c4553dc71.exe[特征引擎][Win32/Packed.Themida]
    
17. D:/用户文件/2/桌面/20250101\3639435bd811a8f355795a3cef8c0960d6e363efd692a84db1f8e87a3244389a.exe[特征引擎][Win32/Packed.Themida]
    
18. D:/用户文件/2/桌面/20250101\3a9cc87a55b5940d4ee2f074c65934c8f9877ad62f5393c6309cb43a0a1310b5.exe[ANK云引擎][Win32/ANKCloud.Trojan(0.9994)]
    
19. D:/用户文件/2/桌面/20250101\49039b4b47513f22a7e396b57a73abe02b0032a09089e8fa68c94c0eae655d6b.exe[特征引擎][Win32/TrojanDropper.Agent]
    
20. D:/用户文件/2/桌面/20250101\4ba12035398519562e56cf4b0a0a2e9dae54ec66ee9d54fc474d3e5fff8bef4f.exe[特征引擎][Win32/Packed.Themida]
    
21. D:/用户文件/2/桌面/20250101\4cf7e80d75cfb9d92f50e61d9fac8f3b859217364a0ada66448b5e3486116f18.exe[特征引擎][Win32/TrojanDropper.Agent]
    
22. D:/用户文件/2/桌面/20250101\52ccbb030d616f534e5acb49d563ca987c62f915026e83072e78894bb972956a.exe[特征引擎][Win32/Packed.Themida]
    
23. D:/用户文件/2/桌面/20250101\564084e14d92f08cd1e05273a44bfaf11dd7e539e64943ff59cc651622c18268.exe[特征引擎][Win32/Packed.Themida]
    
24. D:/用户文件/2/桌面/20250101\59405ec9b904646f7d674606945cffab2ece5cb7fba153c91de4c79bb40aa553.exe[特征引擎][Win32/TrojanDropper.Agent]
    
25. D:/用户文件/2/桌面/20250101\68783c123f5c9c302811fc6391329010a372fc583f5af03c4f65d0656a8a165e.exe[特征引擎][Win32/Packed.Themida]
    
26. D:/用户文件/2/桌面/20250101\812e1ee6ec1ad6ad2aa3251eecccbd350b5e50904398df59799e71d437737101.exe[特征引擎][Win32/TrojanDropper.Agent]
    
27. D:/用户文件/2/桌面/20250101\8776714b524b22667fce6f8d4cfae8bf99061e2a3a4516e48b8335e7b2e65971.exe[特征引擎][Win32/Packed.Themida]
    
28. D:/用户文件/2/桌面/20250101\879a5b13745db634a276624a5c476ede618ba844da42d3ec614aafc45051d474.exe[特征引擎][Win64/Trojan.Generic.949523Fb]
    
29. D:/用户文件/2/桌面/20250101\8812447d76e1ef7b1dbe567acb705e1f2023f2265d99ad83307d858ef429a5b5.exe[特征引擎][Win32/Packed.Themida]
    
30. D:/用户文件/2/桌面/20250101\8dcce53ea838f3f97b8aff36e0a1ffd70aeb1de6b8c6e5d6b530499a07e59fce.exe[XAS启发引擎][HEUR/Trojan.FalseSign]
    
31. D:/用户文件/2/桌面/20250101\942897e237bc3ab9b597d9258e2541730d2192b957ea21c6242dc373b42dbc8f.exe[特征引擎][Win32/Packed.Themida]
    
32. D:/用户文件/2/桌面/20250101\a28bd583dab27c6e95c9f14ae64bd0b6831cc9226737f68b1a8bf9dd033843fa.exe[特征引擎][Win32/Packed.Themida]
    
33. D:/用户文件/2/桌面/20250101\a5d763a75a1e676476c9fc43b354c94f9e10180352e1cb8b7d1a60a69bbd195b.exe[特征引擎][Win32/TrojanDropper.Agent]
    
34. D:/用户文件/2/桌面/20250101\ad2f45143de4a73f40010ac03e0aff210dcf24dfc8b0fffba678c3e9f20d5e22.exe[特征引擎][Win32/Packed.Themida]
    
35. D:/用户文件/2/桌面/20250101\be0554ab88f46d8e6b10243d7b28ae2ce724b43224af3954b62d015693089822.exe[特征引擎][Win32/Packed.Themida]
    
36. D:/用户文件/2/桌面/20250101\be48cb6e3ff7f142a419c4b227fbf9bbe2c6074a58e23ad453380854f749e33e.exe[特征引擎][Win32/Packed.Themida]
    
37. D:/用户文件/2/桌面/20250101\c0ecc22a4cc8ef912b7d1de3dd48c9dc32ca053535aa71da572aeb6f9c91d4ae.exe[特征引擎][Win32/TrojanDropper.Agent]
    
38. D:/用户文件/2/桌面/20250101\c23b7950208b8f8e8a22c401cb5e9a05e560ae6119307d975ba601b4e2e99273.exe[特征引擎][Win32/Trojan.Generic.0E39d237]
    
39. D:/用户文件/2/桌面/20250101\c35fd8893480f059a48cabc6fc0a956106f55ec96d3fa728fab1bdb4b57c1705.exe[特征引擎][Win32/Packed.Themida]
    
40. D:/用户文件/2/桌面/20250101\c43aa71f1636522145ea3e384b2546d5a589260cd7a2cc42688dda5944215b68.vbs[文档查杀引擎][virus.7]
    
41. D:/用户文件/2/桌面/20250101\cdf06ee922f209a5ea0f3a2f05acc8813e0cc98384493a54373cc246e8ad1095.exe[特征引擎][Win32/Packed.Themida]
    
42. D:/用户文件/2/桌面/20250101\d9cfe4c08b2f71b517ba47fe43f8825085b0f4cf9b8e8627ee40e54ec9f6bb05.exe[特征引擎][Win32/Trojan.Generic.F7000896]
    
43. D:/用户文件/2/桌面/20250101\e5bcb2a1cdf6cab62da5b7c8e8d78c25acb5627be5028fd5499df561fd4f24df.exe[特征引擎][Win32/Trojan.Generic.0E39d237]
    
44. D:/用户文件/2/桌面/20250101\f2d3aa2010aa17c79bd549f081efe1ef635b8e12ae150f200f8d2769b960bd4b.exe[特征引擎][Win32/Packed.Themida]
    
45. D:/用户文件/2/桌面/20250101\fa545f3f6fa282dbe529483bb3fac3dae0ea6c466a7bcb0bb7f843622bec7177.exe[特征引擎][Win32/TrojanDropper.Agent]
    
46. D:/用户文件/2/桌面/20250101\fc1dda87caf1f4dba900eaabb519cd216253affe5bdcf83be605162d266be2f1.exe[特征引擎][Win32/TrojanDropper.Agent]
    
47. 
    
48. 总文件数:42
    
49. 病毒文件个数:35
    
50. 查杀率:83.33%
    
51. 扫描结束时间:2025/1/1 14:27:32

复制代码