恶意ps1（附衍生文件）

御坂14857号

https://wwbdd.lanzouu.com/iAHCF3ifsdud
https://wormhole.app/d9YrJ3#2p9NryvSlToybuaj7opC9g

ps1文件vt初次上传检出1x：https://www.virustotal.com/gui/f ... 104b9279d/detection
衍生文件vt初次上传0检出：https://www.virustotal.com/gui/f ... fc494b7b6/detection

22222221

trellix 漏洞利用规则防护 阻止1

elastic kill

Myrenaser

BD启发扫描杀，罕见啊

谈谈MEMZ

1. Application Information:
   
2. Source process ID: 9744
   
3. Source process name: powershell.exe
   
4. Source application location: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
   
5. Source process command line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\User\Desktop\temp.ps1'"
   
6. Source application version: 10.0.20348.2849 (WinBuild.160101.0800)
   
7. Source application publisher: Microsoft Corporation
   
8. Source application signers: Microsoft Corporation,Microsoft Corporation,Microsoft Corporation
   
9. Source process user name: N/A\User
   
10. 
    
11. 
    
12. Prevention Information:
    
13. Prevention date: 2026年2月13日
    
14. Prevention time: 21:43:12
    
15. OS version: 10.0.20348
    
16. Component: Behavioral Threat Protection
    
17. Cortex XDR code: C0400067
    
18. Prevention description: 检测到恶意行为
    
19. Verdict: 0
    
20. Quarantined: False
    
21. Post-Detected: False
    
22. Rule name: msbuild_assembly_load
    
23. Remote actor causality ID: Adyc7o5oNeAAACYQAAAAAA==
    

复制代码

看得出来 PA 很着急了
Prevention description: !!!

1. Application Information:
   
2. 
   
3. 
   
4. Prevention Information:
   
5. Prevention date: 2026年2月13日
   
6. Prevention time: 22:23:19
   
7. OS version: 10.0.20348
   
8. Component: WildFire - Post Detection
   
9. Cortex XDR code: C040008C
   
10. Prevention description: !!!
    
11. Verdict: 2
    
12. Quarantined: False
    
13. Post-Detected: True
    
14. Hash: 2ee61a250c028efdfe524a9a8947087bbe4d3ffd3a3d9865df37d33104b9279d

复制代码

啊松

卡巴pdm

1073328164

AVG MISS

对对对对

ESET扫描全miss，实机不敢双击

WGC_ZY

卡巴：


ESET拦截了几个URL：

Alexander1026

360杀毒解压直接杀

hansyu

ESSP
temp.ps1  -  ESET LiveGuard 特洛伊木马
衍生物
small.bat  -  ESET LiveGuard 特洛伊木马