Detection ratio: 4 / 54 诺顿下载智能分析、HMPA、SSF Vs 加密勒索挂马

墨家小子

SHA256:        470803dcdd4614a5d4726099dd25187351d7a9678689816298d6a3ceebdcb1c2
File name:        95C2.tmp.exe
Detection ratio:        4 / 54
Analysis date:        2016-03-08 04:58:59 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/470803dcdd4614a5d4726099dd25187351d7a9678689816298d6a3ceebdcb1c2/analysis/1457413139/

AegisLab        Troj.W32.Gen        20160307
Malwarebytes        Trojan.Pseudo        20160308
Rising        PE:Malware.Generic(Thunder)!1.A1C4 [F]        20160308
Tencent        Win32.Trojan.Bp-ransomware.Ejqz        20160308

以下依次验证防御层次，从漏洞攻击防御到AD防御木马启动。就如同楼主为什么喜欢刁难SSF要修补注入防御一样，多层次以及拦截点的意思。





防护全开，SSF、诺顿、HMPA，进挂马网页，HMPA最先动手，漏洞攻击防御不是浪得虚名的，IPS哑火。木马进入本地还叫漏洞攻击防御成功吗？


关闭HMPA，SSF、诺顿全开，进入挂马网页，IPS继续沉默是金，SSF携手诺顿下载智能分析双双拦截！

ymb668888

卡巴扫描miss，双击，主防全部拦截，并回滚
[mw_shl_code=css,true]08.03.2016 13.31.50;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\hdjiuogoitfq.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\0c37dbeee2eff5307fe9e0f949d2cf5b\目录说明.txt;c:\sandbox\administrator\defaultbox\drive\c\0c37dbeee2eff5307fe9e0f949d2cf5b\目录说明.txt;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$rlgp1vb.rar;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$rlgp1vb.rar;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$ilgp1vb.rar;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$ilgp1vb.rar;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$ilgp1vb.rar;c:\sandbox\administrator\defaultbox\drive\c\$recycle.bin\s-1-5-21-2013802216-4099067677-4003685837-500\$ilgp1vb.rar;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.50;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:50
08.03.2016 13.31.28;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:28
08.03.2016 13.31.28;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\8AE0.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\hdjiuogoitfq.exe;03/08/2016 13:31:28
08.03.2016 13.31.20;恶意程序已终止;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\hdjiuogoitfq.exe;03/08/2016 13:31:20
08.03.2016 13.31.20;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\sandbox\administrator\defaultbox\drive\c\windows\hdjiuogoitfq.exe;03/08/2016 13:31:20
08.03.2016 13.31.20;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\users\administrator\downloads\8ae0.tmp.exe;03/08/2016 13:31:20
08.03.2016 13.28.03;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\jdnrguoflggf.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\autodesk\autocad_2014_simplified_chinese_win_32bit_dlm\eula\czech.rtf;c:\sandbox\administrator\defaultbox\drive\c\autodesk\autocad_2014_simplified_chinese_win_32bit_dlm\eula\czech.rtf;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\connections\savedlegacysettings;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\connections\savedlegacysettings;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\proxyenable;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\proxyenable;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时文件被恢复;c:\sandbox\administrator\defaultbox\drive\c\0c37dbeee2eff5307fe9e0f949d2cf5b\目录说明.txt;c:\sandbox\administrator\defaultbox\drive\c\0c37dbeee2eff5307fe9e0f949d2cf5b\目录说明.txt;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.28.03;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:28:03
08.03.2016 13.27.32;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:27:32
08.03.2016 13.27.32;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\1F35.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\jdnrguoflggf.exe;03/08/2016 13:27:32
08.03.2016 13.27.24;恶意程序已终止;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;C:\Sandbox\Administrator\DefaultBox\drive\C\Windows\jdnrguoflggf.exe;03/08/2016 13:27:24
08.03.2016 13.27.24;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\users\administrator\downloads\1f35.tmp.exe;03/08/2016 13:27:24
08.03.2016 13.27.24;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\sandbox\administrator\defaultbox\drive\c\windows\jdnrguoflggf.exe;03/08/2016 13:27:24
08.03.2016 13.22.56;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:56
08.03.2016 13.22.56;恶意程序的操作已回滚;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\aowfhvamekss.exe;03/08/2016 13:22:56
08.03.2016 13.22.56;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\connections\savedlegacysettings;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\connections\savedlegacysettings;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:56
08.03.2016 13.22.56;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\proxyenable;HKEY_USERS\sandbox_administrator_defaultbox\user\current\software\microsoft\windows\currentversion\internet settings\proxyenable;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:56
08.03.2016 13.22.56;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:56
08.03.2016 13.22.56;回滚恶意程序的操作时注册表键值被恢复;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_USERS\sandbox_administrator_defaultbox\machine\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:56
08.03.2016 13.22.22;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:22
08.03.2016 13.22.22;恶意程序已删除;PDM:Trojan.Win32.Generic;C:\Users\Administrator\Downloads\95C2.tmp.exe;c:\sandbox\administrator\defaultbox\drive\c\windows\aowfhvamekss.exe;03/08/2016 13:22:22
08.03.2016 13.22.12;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\sandbox\administrator\defaultbox\drive\c\windows\aowfhvamekss.exe;03/08/2016 13:22:12
08.03.2016 13.22.12;检测到恶意程序;PDM:Trojan.Win32.Generic;MDM Device Interface for Rio 800 device.;c:\users\administrator\downloads\95c2.tmp.exe;03/08/2016 13:22:12

[/mw_shl_code]

送信Y

数字扫描miss

z2009

全部过红伞wg，360下载保护未知

双击，红伞全部kill

a445441

微点拦截3个

胖福

那年夏天0ooo

HUORONG

rrorr

胖福 发表于 2016-3-8 15:30

这个是啥

icedream89

ess9 入库了
所以说 有时候把样本下载到本地 强行关掉监控双击很变态很变态

windows7爱好者

来晚了