盗号及后门

sam.to

File Name:C:\Users\Admin\Desktop\Samples\20130607\02.ex#e
File size:24821 bytes
MD5     :BC56AB9E62B16C11685D2CF69CA79E28
SHA1    :A066160AE69A2C0F1EADC35CA8399E29B40D376C
CRC32   :7E793FAA

https://www.virustotal.com/en-gb ... nalysis/1370535001/


File Name:C:\Users\Admin\Desktop\Samples\20130607\01.ex#e
File size:17024 bytes
MD5     :F51F75E574305313817285A195F0CA73
SHA1    :768D01B4618557D474D315B5722266C89F6CC739
CRC32   :0D24F533

https://www.virustotal.com/en-gb ... nalysis/1370534998/

vm001

有密码

lifan88

密码啊

蝉鸣时

ESET NOD32 detected.

01.ex#e - Win32/Small.NJ trojan
02.ex#e - a variant of Win32/Farfli.RE trojan

sxyuqiao

vm001 发表于 2013-6-7 00:18
有密码

不是infected 就是 virus

sxyuqiao

毒霸一个HeurC 一个undefined

fireold

G Data
01.exe

*** Process ***

Process: 3288
File name: 01.exe
Path: c:\users\alan\downloads\20130607\samples\20130607\01.exe

Publisher: Unknown publisher
Creation date: 06/06/13 22:56:46
Modification date: 06/04/13 20:46:59

Started by: explorer.exe
Publisher: Microsoft Windows


*** Actions ***

A packer was run on the program file, possibly to conceal malicious content.
The packer used is often used to conceal malware.
The program has saved files in the system folder.
The program has created or manipulated an executable file.
The program created a copy of itself.
The program has copied itself to the Windows folder.
The program has created or manipulated an executable file in the system folder.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\alan\Downloads\20130607\Samples\20130607\01.exe
C:\Windows\System32\game.exe

The following registry entries were deleted:


YHLy0HJycnJiYuBywnLCYmLwcnJycmJicCp0ckInJyYGt3JycnJiYnAsJycnJyYGeHJycnJiYpArJ2egJicnJycmBuxycnJyYmLALycnJycmBr5i0XLgLRa8gvAsJycnJyYGdyknJycnJgaHKycnJycmBqcrF11jpnJy0TVmKicmBrcoJycnJyYGtyonCOcoJwwA
Rules version: 4.1.2
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Users\alan\Downloads\20130607\Samples\20130607\01.exe"
C:\Windows\Explorer.EXE

02.exe

*** Process ***

Process: 3816
File name: 02.exe
Path: c:\users\alan\downloads\20130607\samples\20130607\02.exe

Publisher: Unknown publisher
Creation date: 06/06/13 22:56:46
Modification date: 06/04/13 21:03:26

Started by: svchost.exe
Publisher: Microsoft Windows


*** Actions ***

The virus scanner has detected that the file is malicious.
The program has saved files in the system folder.
The program has created or manipulated an executable file.
The program has created or manipulated an executable file in the system folder.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\alan\AppData\Local\Temp\wi693252nd.temp
C:\Users\alan\Downloads\20130607\Samples\20130607\02.exe
C:\Windows\FuckYou.reg
C:\Windows\FuckYou.txt
C:\Windows\MyInformations.ini
C:\Windows\System32\lianzhan.dll

The following registry entries were deleted:


YHLS0HJyKSeXYmLgcqJyomJi8HJycnJiYnAqdHJCJycmBrdycnJyYmKQKycJ7HJyKCeHYmLALycnJycmBm1ycnJyYmJwuHJyKSeXYmJwuoKhXmOmcoKhXmOmcmJicJtycnJyYmJwq3JycJ1ycnJyYmJwjnJyAAA
Rules version: 4.1.2
OS: Windows 6.1 Service Pack 1.0 Build: 7601 - Workstation 32bit OS
dll version: 30732

"C:\Users\alan\Downloads\20130607\Samples\20130607\02.exe"

就当我是上帝

NIS2013报01.exe，漏了第二个

llcy

毒霸

曹亮亮

Windows无法打开此文件