XDocCrypt/Dorifel

显示全部楼层 · 发表于 2012-8-9 19:30:24

本帖最后由 360Tencent 于 2012-8-15 07:52 编辑

http://www.surfright.nl/nl/support/dorifel-decrypter

http://blogs.mcafee.com/mcafee-l ... table-and-doc-files

http://www.securelist.com/en/blo ... _active_and_growing

http://blog.eset.com/2012/08/11/ ... mmers-secret-weapon

http://blog.trendmicro.com/caring-about-quervar/

http://www.symantec.com/connect/ ... holland-aka-dorifel

Introduction

The last 48 hours government, public sector and networks of private companies are hit hard by a new wave of crypto malware named Trojan-Ransom.Win32.Dorifel. Our research revealed that this Trojan entered the networks thanks to a variant of the Zeus/Zbot banking Trojan called Citadel. This means that this Trojan was already present on one of the computers inside the network.

This Dorifel Trojan scans network shares and local (USB) connected drives for Microsoft Office documents. To be precise .doc and .docx (Word) and .xls and .xlsx (Excel) documents. Encountered documents are seized and replaced with an executable program that contains an RC4 encrypted version of the document. The Trojan adds a familiar icon to the file and changes the filename of the document, abusing the RTLO 'vulnerability' (right-to-left-override) to make computer users belief the 'document' has the correct file extension.

So currently, most affected users will not notice anything since the 'documents' open as usual. In its current state the malware is likely all about propagating itself to as many machines as possible. But since the Trojan checks for an online update every half an hour or so, the attacker could later deploy more ruthless malware.

http://tmp.emsisoft.com/fw/decrypt_dorifel.zip

http://dl.surfright.nl/decrypt_dorifel.exe

Citadel

XDocCrypt/Dorifel

显示全部楼层 · 发表于 2012-8-9 19:49:13

本帖最后由 284678343 于 2012-8-9 19:51 编辑

Trojan-Dropper.Win32.Dorifel.heq 已删除 a.exe 2012/08/09 星期四 19:51:09 C:\Users\Chobits\Desktop\TEMP\

复制代码

显示全部楼层 · 发表于 2012-8-9 19:55:21

密码什么啊

显示全部楼层 · 发表于 2012-8-9 19:56:04

huicuan 发表于 2012-8-9 19:55
密码什么啊

infected

显示全部楼层 · 发表于 2012-8-9 20:04:09

毒霸报第二个文件病毒

显示全部楼层 · 发表于 2012-8-9 20:05:36

小红伞杀了

显示全部楼层 · 发表于 2012-8-9 20:07:34

拜託麻煩下次都給個密碼好嗎

。。。。。好幾個都這樣了

显示全部楼层 · 发表于 2012-8-9 20:09:31

第二个，大蜘蛛：
Sample\a.exe - infected with Trojan.MulDrop3.62566

显示全部楼层 · 发表于 2012-8-9 20:13:13

第一个过了大蜘蛛，已上报

显示全部楼层 · 发表于 2012-8-9 20:14:19

本帖最后由悠柚于 2012-8-9 20:17 编辑

FS kill （BD engine）

Trojan.Generic.KDV.684243 (病毒)
D:\Download\bfaa03ee-f631-4e55-bb8a-f27c0a650dea
D:\Download\d33b97dc-f473-48d2-88e7-6f21dfd1ea80
D:\Download\55a4485d-655a-4d2f-b2c3-539fff7b0611
D:\Download\544ca1c3-c723-41bc-a5a3-055d41acbe51
D:\Download\56689b0a-291f-4e60-bbd2-4943e48462aa

Avira TR/PSW.Zbot.AGA Trojan

The file a.exe appears to be infected with "W32/Delf.NBG"

[病毒样本] XDocCrypt/Dorifel

本帖子中包含更多资源

本帖子中包含更多资源