【开放测试】卡饭病毒样本包 20250211 第251期

zhuzhu009

警告：

       本主题帖中所包含的任何文件和附件都有危害你的计算机的可能，并且没有安全软件可以100%防护这些样本。样本仅供测试、交流和学习，禁止用于任何非法用途。
       请注意，所有样本均为真实威胁，具有严重危害性。请不要在没有任何安全措施保存，打开或执行这些样本。请在虚拟机中测试样本。对于下载样本、附件以及点击链接所导致的任何数据泄露、破坏，以及所产生的任何损失，本人和卡饭论坛不负任何责任。




样本下载:  https://pan.zhuzhu009.top/s/vmIj  https://wwzq.lanzouq.com/iqf6z2nhhkgb

文件名称: 20250211.zip


SHA256:  D305E2B513D2952147E624369CFFEA91857C974CFC8300BAF253F35B2AC4D35C


压缩包密码：infected

如果样本中包含.ps1文件(Powershell脚本)，则需要手动打开cmd.exe输入以下指令允许运行ps1脚本:

Powershell.exe Set-ExecutionPolicy Bypass



注意：扫描/双击日志请以附件形式（压缩包）或图片上传，也可以 以1号字体放在回复中。         
          对于日志过长以至于影响会员刷帖/回帖体验的回复，管理人员有权进行屏蔽处理。

当前测试阶段：开放测试

郭俊民

自制 40xANK 39x
Lyntien miss9

Nocria

Avira - 42/51

123456aaaafsdeg

金山毒霸

1. [2025-02-11 18:34:41]
   
2. 威胁：c:\users\administrator\desktop\测试\0decf435c7fb10201516cf65e49d6fa0ad04ddc5906765137b3f263c47d801e0.exe
   
3. 类型：msil.trojan.dnoper.gen.(kcloud)
   
4. 处理方式：删除
   
5. 
   
6. [2025-02-11 18:34:41]
   
7. 威胁：c:\users\administrator\desktop\测试\0f6dcca26ed5b5c2ad49aa5ed04e2a297a068135cf56acc3209465704a4abdc3.exe
   
8. 类型：msil.trojan.tasker.gen.(kcloud)
   
9. 处理方式：删除
   
10. 
    
11. [2025-02-11 18:34:41]
    
12. 威胁：c:\users\administrator\desktop\测试\13288324fe1b9f0f0220b49244d67e56b57569ba1cf84de8a94e20a78c7e0de7.bat
    
13. 类型：win32.troj.undef.a.(kcloud)
    
14. 处理方式：删除
    
15. 
    
16. [2025-02-11 18:34:41]
    
17. 威胁：c:\users\administrator\desktop\测试\17b07882b3dfa597e3b777fdadbe230ee76c50f5aee636134589ecd807429443.exe
    
18. 类型：script.trojan-downloader.generic.a.(kcloud)
    
19. 处理方式：删除
    
20. 
    
21. [2025-02-11 18:34:41]
    
22. 威胁：c:\users\administrator\desktop\测试\284c0140353b4ff318b05940dfb1c555df0f5cdc93d7cdffd43a9362ba24e20a.exe
    
23. 类型：script.trojan-downloader.generic.a.(kcloud)
    
24. 处理方式：删除
    
25. 
    
26. [2025-02-11 18:34:41]
    
27. 威胁：c:\users\administrator\desktop\测试\2f05a02f96b48cdb9b14ecb3442d60a67e3eba5a2939ee74cfa48a5708391c47.exe
    
28. 类型：script.trojan-downloader.generic.a.(kcloud)
    
29. 处理方式：删除
    
30. 
    
31. [2025-02-11 18:34:41]
    
32. 威胁：c:\users\administrator\desktop\测试\2cc0a2ec8e308a7433616621cff5cd49893b9e2277c76913eb7dd6e940ddac7b.exe
    
33. 类型：msil.troj.obfuscator.v.(kcloud)
    
34. 处理方式：删除
    
35. 
    
36. [2025-02-11 18:34:41]
    
37. 威胁：c:\users\administrator\desktop\测试\32e7fc96512773d7172f32677eac9edf3efbda2dc17763b069cd390917c7b581.exe
    
38. 类型：win32.trojan.makoob.gen.(kcloud)
    
39. 处理方式：删除
    
40. 
    
41. [2025-02-11 18:34:41]
    
42. 威胁：c:\users\administrator\desktop\测试\360f28577ebce5c521979aa0d72c9c5d055074c479462349cdfe7ca06c2332cc.exe
    
43. 类型：script.trojan-downloader.generic.a.(kcloud)
    
44. 处理方式：删除
    
45. 
    
46. [2025-02-11 18:34:41]
    
47. 威胁：c:\users\administrator\desktop\测试\391e9450f4e7bec0cb249fd43193ef499a752d49532eefb750f2749d71ba794b.exe
    
48. 类型：win64.trojan.injects.a.(kcloud)
    
49. 处理方式：删除
    
50. 
    
51. [2025-02-11 18:34:41]
    
52. 威胁：c:\users\administrator\desktop\测试\842c70e16adba3414dcc87d73c8b44330ce4721164973c6f8e8deb66d60a18d3.exe
    
53. 类型：win32.troj.unknown.a.(kcloud)
    
54. 处理方式：删除
    
55. 
    
56. [2025-02-11 18:34:41]
    
57. 威胁：c:\users\administrator\desktop\测试\9f6b9c69101f368eb0e596b3a184806e30da615f812fcbaa6a1defa283a4eefc.exe
    
58. 类型：win32.troj.unknown.a.(kcloud)
    
59. 处理方式：删除
    
60. 
    
61. [2025-02-11 18:34:41]
    
62. 威胁：c:\users\administrator\desktop\测试\a82c02f11f0714af1013ee124f977ea9caa65475b6e8abaaff21eda9205f897f.exe
    
63. 类型：win32.troj.unknown.a.(kcloud)
    
64. 处理方式：删除
    
65. 
    
66. [2025-02-11 18:34:41]
    
67. 威胁：c:\users\administrator\desktop\测试\b8782da07ae955694686580401c252ccbe8e5bec977e085f644012fb06a5f09d.exe
    
68. 类型：win32.trojan-psw.lumma.a.(kcloud)
    
69. 处理方式：删除
    
70. 
    
71. [2025-02-11 18:34:41]
    
72. 威胁：c:\users\administrator\desktop\测试\472bbd27a17cd8121eb418b2d81d723ac0bafe8d4cd2d39d728cb8ec2991df05.exe
    
73. 类型：msil.trojan.taskun.gen.(kcloud)
    
74. 处理方式：删除
    
75. 
    
76. [2025-02-11 18:34:41]
    
77. 威胁：c:\users\administrator\desktop\测试\48ee69a67c72c0787ba5d2061fd3f7760934e58442d3e62ad0c487bdc24988f3.exe
    
78. 类型：msil.trojan-psw.darkcloud.gen.(kcloud)
    
79. 处理方式：删除
    
80. 
    
81. [2025-02-11 18:34:41]
    
82. 威胁：c:\users\administrator\desktop\测试\49a5a535b2f589a41ce1e579501e1f63c8f924bf36913e07409d805861595647.exe
    
83. 类型：msil.trojan-spy.noon.gen.(kcloud)
    
84. 处理方式：删除
    
85. 
    
86. [2025-02-11 18:34:41]
    
87. 威胁：c:\users\administrator\desktop\测试\64fd6ab37d15abdfb22cb9b80d7fa4d8e60f29b142cb7cf87d45c5e2f45cf482.exe
    
88. 类型：msil.trojan.quasar.gen.(kcloud)
    
89. 处理方式：删除
    
90. 
    
91. [2025-02-11 18:34:41]
    
92. 威胁：c:\users\administrator\desktop\测试\65b878e0d18d156a3731f52f69e69088cdefa85ee630de7a75f1c062068c260b.exe
    
93. 类型：msil.trojan-spy.noon.gen.(kcloud)
    
94. 处理方式：删除
    
95. 
    
96. [2025-02-11 18:34:41]
    
97. 威胁：c:\users\administrator\desktop\测试\68aa37b3484ca101e4e3cae98c9a4abd792a17ad944cd7b13413b5c4a056caa8.exe
    
98. 类型：win32.trojan.generic.a.(kcloud)
    
99. 处理方式：删除
    
100. 
     
101. [2025-02-11 18:34:41]
     
102. 威胁：c:\users\administrator\desktop\测试\696d30288b47939653033e55d37ba60335dc41d4e9e6da1b8d6fbb77f88d8f9b.exe
     
103. 类型：malware.kb.c.933
     
104. 处理方式：需要处理
     
105. 
     
106. [2025-02-11 18:34:41]
     
107. 威胁：c:\users\administrator\desktop\测试\6d6dc614bd305341a4e75638702a92ca04dac9ab31d50ccdf86832da9653cad3.exe
     
108. 类型：msil.troj.agenttesla.v.(kcloud)
     
109. 处理方式：删除
     
110. 
     
111. [2025-02-11 18:34:41]
     
112. 威胁：c:\users\administrator\desktop\测试\7210fe9ae7f716374293efd95b88db7c1d6e726ef1901591aa42ec6c3f11a44d.exe
     
113. 类型：msil.troj.injector.v.(kcloud)
     
114. 处理方式：删除
     
115. 
     
116. [2025-02-11 18:34:41]
     
117. 威胁：c:\users\administrator\desktop\测试\72cf8615572e06a307e5bf51dd08a8a0be3c10865a3eb0329e221916a6e1cbba.exe
     
118. 类型：msil.trojan.taskun.gen.(kcloud)
     
119. 处理方式：删除
     
120. 
     
121. [2025-02-11 18:34:41]
     
122. 威胁：c:\users\administrator\desktop\测试\851c91c41a429bb8d553a9918ae52b98905c845bed658c09b3978acf8f578945.exe
     
123. 类型：msil.trojan.taskun.gen.(kcloud)
     
124. 处理方式：删除
     
125. 
     
126. [2025-02-11 18:34:41]
     
127. 威胁：c:\users\administrator\desktop\测试\86c7bfd52e7aed37047a31eb44a2f1445236e68285584be4d8ecd47d1c3572d8.exe
     
128. 类型：msil.troj.obfuscator.v.(kcloud)
     
129. 处理方式：删除
     
130. 
     
131. [2025-02-11 18:34:41]
     
132. 威胁：c:\users\administrator\desktop\测试\8ba912704a7e4f686d5f29c0277b52fbfdeb1d1708bab9c6d0e06eb48f8dc539.exe
     
133. 类型：win32.hack.remcos.gen.(kcloud)
     
134. 处理方式：删除
     
135. 
     
136. [2025-02-11 18:34:41]
     
137. 威胁：c:\users\administrator\desktop\测试\8de46150d1ecf70fa4ff0511d385d1f9619f1021f20fb3ded65204864d6875ef.exe
     
138. 类型：msil.trojan-psw.disco.gen.(kcloud)
     
139. 处理方式：删除
     
140. 
     
141. [2025-02-11 18:34:41]
     
142. 威胁：c:\users\administrator\desktop\测试\96aa71f70d16e2784488fad332ac65287f33d059cde4cd2858b0dab85340ba0d.bat
     
143. 类型：win32.troj.undef.a.(kcloud)
     
144. 处理方式：删除
     
145. 
     
146. [2025-02-11 18:34:41]
     
147. 威胁：c:\users\administrator\desktop\测试\972faafbe19f1bad0659c02d3480845254ac3fd8565668988d14c3c68164a953.exe
     
148. 类型：msil.troj.agenttesla.v.(kcloud)
     
149. 处理方式：删除
     
150. 
     
151. [2025-02-11 18:34:41]
     
152. 威胁：c:\users\administrator\desktop\测试\a30ac8c321e2bb265f9e2d3f2cfb43549a8fa6171e68d7f4fceefd6db4faacac.exe
     
153. 类型：msil.troj.injector.v.(kcloud)
     
154. 处理方式：删除
     
155. 
     
156. [2025-02-11 18:34:41]
     
157. 威胁：c:\users\administrator\desktop\测试\a4aced5979808f369f5d41d0d2e8f0a16a6c1adbe00c751dfac858fe706a2f3f.exe
     
158. 类型：msil.trojan.taskun.gen.(kcloud)
     
159. 处理方式：删除
     
160. 
     
161. [2025-02-11 18:34:41]
     
162. 威胁：c:\users\administrator\desktop\测试\b06c40802695123acaef9a4d74fa336c0d60779031678ba78368673ce6b00e2a.exe
     
163. 类型：msil.trojan.taskun.gen.(kcloud)
     
164. 处理方式：删除
     
165. 
     
166. [2025-02-11 18:34:41]
     
167. 威胁：c:\users\administrator\desktop\测试\b286b238bf84860b09efb3f0b89b48c01e35ff7746999b6286b9ce0d0af3a48d.exe
     
168. 类型：msil.trojan.taskun.gen.(kcloud)
     
169. 处理方式：删除
     
170. 
     
171. [2025-02-11 18:34:41]
     
172. 威胁：c:\users\administrator\desktop\测试\b9b1c8acdc64f654a3d8c2720782e6be9e7e4705f51649dae046324373e698db.exe
     
173. 类型：win32.trojan.makoob.gen.(kcloud)
     
174. 处理方式：删除
     
175. 
     
176. [2025-02-11 18:34:41]
     
177. 威胁：c:\users\administrator\desktop\测试\ded58d254e0e5153219f4750e2dd4cc29432b23653a46ba5d44d71b396fd237b.exe
     
178. 类型：script.trojan-downloader.generic.a.(kcloud)
     
179. 处理方式：删除
     
180. 
     
181. [2025-02-11 18:34:41]
     
182. 威胁：c:\users\administrator\desktop\测试\e2b644b5e776dec0c171b95064165a1429198545cc4aaf05d0d4df73394e0999.exe
     
183. 类型：win32.trojan-spy.noon.a.(kcloud)
     
184. 处理方式：删除
     
185. 
     
186. [2025-02-11 18:34:41]
     
187. 威胁：c:\users\administrator\desktop\测试\e4a898c6172cdbc1b388447f2d6bde8434474419486fa81b0f9242d25981812a.exe
     
188. 类型：win32.trojan.makoob.gen.(kcloud)
     
189. 处理方式：删除
     
190. 
     
191. [2025-02-11 18:34:41]
     
192. 威胁：c:\users\administrator\desktop\测试\fe1d0791dd2095a674fa38b3c26fe999a1da66022bd2236029ee6c2524e598d1.exe
     
193. 类型：win32.troj.unknown.a.(kcloud)
     
194. 处理方式：删除
     
195. 
     
196. [2025-02-11 18:34:41]
     
197. 威胁：c:\users\administrator\desktop\测试\ddf29347c13ccf39ba46c773b7896b8094ad1712db25b43b1e50a0eab4e668b3.exe
     
198. 类型：win32.hack.androm.gen.(kcloud)
     
199. 处理方式：删除
     
200. 
     
201. [2025-02-11 18:34:41]
     
202. 威胁：c:\users\administrator\desktop\测试\ed0a5ca475d478bf9beecf07cb28bdbd04d3f5e88080e7e3481724914996b9a5.exe
     
203. 类型：win32.troj.unknown.a.(kcloud)
     
204. 处理方式：删除
     
205. 
     
206. [2025-02-11 18:34:41]
     
207. 威胁：c:\users\administrator\desktop\测试\f00843b60c18cdb165b68260c4143494a496eb3fcc763ea9479f92cb21cdfef6.exe
     
208. 类型：msil.trojan.taskun.gen.(kcloud)
     
209. 处理方式：删除
     

复制代码

艳火MUSIC

好久不发了哎测试自制看看

---

绿帽子安全防护 Kill50 Miss1




猎剑云 Kill ALL
2025-02-11 19:22:35,787 - INFO - 总文件数: 51
2025-02-11 19:22:35,787 - INFO - 安全的文件数: 0
2025-02-11 19:22:35,787 - INFO - 未知状态的文件数: 0
2025-02-11 19:22:35,787 - INFO - 正在扫描的文件数: 0
2025-02-11 19:22:35,787 - INFO - 可疑的文件数: 0
2025-02-11 19:22:35,787 - INFO - 恶意的文件数: 51

superLYT

sep剩余1个，有些样本SEP显示赛门铁克已经发现了一年了

PhozeAMTB

WD 仅解压 剩4x。虚拟机双击kill all 。共51x。

hipoxiaxxx

FortiClient 扫描 39X，云沙盒检出 10X

剩余2X已上报：7865c3f9f847c6dbeeb2e2fa76e15805a5a1822d626c82754060df618b7609ac.vbe
                        39e503fc86153bae7138f02d3370b26ddbd140bf8ea21134ae35606bee66091e.exe
--------------------------------------------------------------------------------------------------------------
VBA32 扫描 28X

1. 2025-02-11 22:10:55 | C:\Users\Administrator\Desktop\20250211\17f1ed61991cf8d7e900a14a98716a989389631cbb1339b8bc932f7265747e9c.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
   
2. 2025-02-11 22:10:55 | C:\Users\Administrator\Desktop\20250211\2cc0a2ec8e308a7433616621cff5cd49893b9e2277c76913eb7dd6e940ddac7b.exe: CIL.StupidCryptor.Heur (File, Infected)
   
3. 2025-02-11 22:10:56 | C:\Users\Administrator\Desktop\20250211\48ee69a67c72c0787ba5d2061fd3f7760934e58442d3e62ad0c487bdc24988f3.exe: PE.BrokenSig.Heur (File, Suspicious)
   
4. 2025-02-11 22:10:57 | C:\Users\Administrator\Desktop\20250211\472bbd27a17cd8121eb418b2d81d723ac0bafe8d4cd2d39d728cb8ec2991df05.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
   
5. 2025-02-11 22:10:57 | C:\Users\Administrator\Desktop\20250211\49a5a535b2f589a41ce1e579501e1f63c8f924bf36913e07409d805861595647.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
   
6. 2025-02-11 22:10:57 | C:\Users\Administrator\Desktop\20250211\391e9450f4e7bec0cb249fd43193ef499a752d49532eefb750f2749d71ba794b.exe: Trojan.Autoit.Shellcrun (File, Infected)
   
7. 2025-02-11 22:10:58 | C:\Users\Administrator\Desktop\20250211\65b878e0d18d156a3731f52f69e69088cdefa85ee630de7a75f1c062068c260b.exe: CIL.StupidCryptor.Heur (File, Infected)
   
8. 2025-02-11 22:10:58 | C:\Users\Administrator\Desktop\20250211\68aa37b3484ca101e4e3cae98c9a4abd792a17ad944cd7b13413b5c4a056caa8.exe: TScope.Malware-Cryptor.SB (File, Infected)
   
9. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\6d6dc614bd305341a4e75638702a92ca04dac9ab31d50ccdf86832da9653cad3.exe: CIL.StupidCryptor.Heur (File, Infected)
   
10. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\72cf8615572e06a307e5bf51dd08a8a0be3c10865a3eb0329e221916a6e1cbba.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
    
11. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\696d30288b47939653033e55d37ba60335dc41d4e9e6da1b8d6fbb77f88d8f9b.exe: CIL.StupidCryptor.Heur (File, Infected)
    
12. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\8ba912704a7e4f686d5f29c0277b52fbfdeb1d1708bab9c6d0e06eb48f8dc539.exe: BScope.Backdoor.Remcos (File, Infected)
    
13. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\7210fe9ae7f716374293efd95b88db7c1d6e726ef1901591aa42ec6c3f11a44d.exe: Malware-Cryptor.MSIL.AgentTesla.Heur (File, Infected)
    
14. 2025-02-11 22:10:59 | C:\Users\Administrator\Desktop\20250211\851c91c41a429bb8d553a9918ae52b98905c845bed658c09b3978acf8f578945.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
    
15. 2025-02-11 22:11:00 | C:\Users\Administrator\Desktop\20250211\842c70e16adba3414dcc87d73c8b44330ce4721164973c6f8e8deb66d60a18d3.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
16. 2025-02-11 22:11:00 | C:\Users\Administrator\Desktop\20250211\a4aced5979808f369f5d41d0d2e8f0a16a6c1adbe00c751dfac858fe706a2f3f.exe: TrojanLoader.MSIL.DaVinci.Heur (File, Infected)
    
17. 2025-02-11 22:11:00 | C:\Users\Administrator\Desktop\20250211\86c7bfd52e7aed37047a31eb44a2f1445236e68285584be4d8ecd47d1c3572d8.exe: CIL.StupidCryptor.Heur (File, Infected)
    
18. 2025-02-11 22:11:01 | C:\Users\Administrator\Desktop\20250211\9f6b9c69101f368eb0e596b3a184806e30da615f812fcbaa6a1defa283a4eefc.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
19. 2025-02-11 22:11:01 | C:\Users\Administrator\Desktop\20250211\a30ac8c321e2bb265f9e2d3f2cfb43549a8fa6171e68d7f4fceefd6db4faacac.exe: Dropper.MSIL.Sigma.Heur (File, Infected)
    
20. 2025-02-11 22:11:01 | C:\Users\Administrator\Desktop\20250211\a82c02f11f0714af1013ee124f977ea9caa65475b6e8abaaff21eda9205f897f.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
21. 2025-02-11 22:11:01 | C:\Users\Administrator\Desktop\20250211\b06c40802695123acaef9a4d74fa336c0d60779031678ba78368673ce6b00e2a.exe: Dropper.MSIL.Alpha.Heur (File, Infected)
    
22. 2025-02-11 22:11:02 | C:\Users\Administrator\Desktop\20250211\b286b238bf84860b09efb3f0b89b48c01e35ff7746999b6286b9ce0d0af3a48d.exe: CIL.StupidCryptor.Heur (File, Infected)
    
23. 2025-02-11 22:11:03 | C:\Users\Administrator\Desktop\20250211\c5a14bd933e73b4776cd79bb962b7356eb9676b1575664858ad61e55ef068429.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
24. 2025-02-11 22:11:04 | C:\Users\Administrator\Desktop\20250211\ed0a5ca475d478bf9beecf07cb28bdbd04d3f5e88080e7e3481724914996b9a5.exe: TScope.Trojan.Delf (File, Infected)
    
25. 2025-02-11 22:11:04 | C:\Users\Administrator\Desktop\20250211\f00843b60c18cdb165b68260c4143494a496eb3fcc763ea9479f92cb21cdfef6.exe: CIL.StupidCryptor.Heur (File, Infected)
    
26. 2025-02-11 22:11:05 | C:\Users\Administrator\Desktop\20250211\e2b644b5e776dec0c171b95064165a1429198545cc4aaf05d0d4df73394e0999.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
27. 2025-02-11 22:11:05 | C:\Users\Administrator\Desktop\20250211\fe1d0791dd2095a674fa38b3c26fe999a1da66022bd2236029ee6c2524e598d1.exe: Trojan.Autoit.Shellcrun (File, Infected)
    
28. 2025-02-11 22:11:20 | C:\Users\Administrator\Desktop\20250211\64fd6ab37d15abdfb22cb9b80d7fa4d8e60f29b142cb7cf87d45c5e2f45cf482.exe: Trojan.MSIL.Quasar.Heur (File, Infected)

复制代码

OrangeCell

艳火MUSIC 发表于 2025-2-11 18:32
好久不发了哎测试自制看看

盲猜kill all

Shake2333

mcafee 47X