史诗级大毒霸

显示全部楼层 · 发表于 2016-9-2 13:17:37

本帖最后由我要打十個于 2016-9-5 18:48 编辑

母体： https://yunpan.cn/cMXVf5zE23qbn （提取码：72b4）

n件衍生物： https://yunpan.cn/cMXVyrbQaK7sn （提取码：1535）

PW：infected

一直感染...

2016-09-02 13:03:05 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Updater.exe
2016-09-02 13:03:02 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Updater.exe
2016-09-02 13:02:59 C:\Users\Administrator\AppData\Roaming\bt.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\tmp61377807.bat
2016-09-02 13:02:59 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Uninstall.exe
2016-09-02 13:02:59 C:\Users\Administrator\AppData\Roaming\bt.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\tmp61377807.bat
2016-09-02 13:02:54 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Uninstall.exe
2016-09-02 13:02:53 C:\Users\Administrator\AppData\Roaming\bt.exe 创建进程 C:\Users\Administrator\AppData\Roaming\Ezizs\uhdua.exe
2016-09-02 13:02:50 C:\Users\Administrator\AppData\Roaming\bt.exe 创建进程 C:\Users\Administrator\AppData\Roaming\Ezizs\uhdua.exe
2016-09-02 13:02:46 C:\Users\Administrator\AppData\Roaming\bot.exe 创建进程 C:\Users\Administrator\AppData\Roaming\crys.exe
2016-09-02 13:02:45 C:\Users\Administrator\AppData\Roaming\bot.exe 创建进程 C:\Users\Administrator\AppData\Local\Temp\tmpd66f1e51.bat
2016-09-02 13:02:41 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vunace32.exe
2016-09-02 13:02:39 C:\Users\Administrator\AppData\Roaming\bot.exe 创建进程 C:\Users\Administrator\AppData\Roaming\crys.exe
2016-09-02 13:02:30 C:\Users\Administrator\AppData\Roaming\Pony.exe 访问COM接口 LocalSecurityAuthority.Restore
2016-09-02 13:02:10 C:\Users\Administrator\AppData\Roaming\bt.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\Ezizs\uhdua.exe
2016-09-02 13:02:05 C:\Users\Administrator\AppData\Roaming\bot.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\tmpd66f1e51.bat
2016-09-02 13:02:01 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\unace32.exe
2016-09-02 13:01:59 C:\Users\Administrator\AppData\Roaming\o.exe 访问COM接口 C:\Windows\System32\svchost.exe
2016-09-02 13:01:51 C:\Users\Administrator\AppData\Roaming\o.exe 访问COM接口 C:\Windows\System32\svchost.exe
2016-09-02 13:01:50 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\soft.exe
2016-09-02 13:01:50 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\conhost.exe
2016-09-02 13:01:50 C:\Users\Administrator\AppData\Roaming\Pony.exe 访问COM接口 LocalSecurityAuthority.Backup
2016-09-02 13:01:45 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\RegDll64.exe
2016-09-02 13:01:45 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 访问内存 C:\Users\Administrator\Desktop\binld[1].exe
2016-09-02 13:01:41 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\soft.exe
2016-09-02 13:01:37 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 访问内存 C:\Users\Administrator\Desktop\binld[1].exe
2016-09-02 13:01:32 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\RegDll64.exe
2016-09-02 13:01:30 C:\Users\Administrator\AppData\Roaming\crys.exe 访问内存 C:\Users\Administrator\AppData\Roaming\o.exe
2016-09-02 13:01:28 C:\Users\Administrator\AppData\Roaming\Pony.exe 访问COM接口 LocalSecurityAuthority.Tcb
2016-09-02 13:01:28 C:\Users\Administrator\AppData\Roaming\o.exe 访问内存 C:\Windows\explorer.exe
2016-09-02 13:00:58 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\soft.exe
2016-09-02 13:00:40 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vRegDll32.exe
2016-09-02 13:00:37 C:\Users\Administrator\AppData\Roaming\crys.exe 访问内存 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe
2016-09-02 13:00:28 C:\Users\Administrator\AppData\Roaming\o.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Local\Temp\o.exe
2016-09-02 13:00:16 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\RegDll32.exe
2016-09-02 12:59:57 C:\Users\Administrator\AppData\Roaming\o.exe 直接键盘访问 C:\Users\Administrator\AppData\Roaming\o.exe
2016-09-02 12:59:51 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\Pony.exe
2016-09-02 12:59:43 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vbz.exe
2016-09-02 12:59:37 C:\Users\Administrator\AppData\Roaming\crys.exe 访问内存 C:\Users\Administrator\AppData\Roaming\bot.exe
2016-09-02 12:59:34 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\o.exe
2016-09-02 12:59:24 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\bz.exe
2016-09-02 12:59:12 C:\Users\Administrator\AppData\Roaming\crys.exe 访问COM接口 {8BC3F05E-D86B-11D0-A075-00C04FB68820}
2016-09-02 12:59:09 C:\Users\Administrator\AppData\Roaming\crys.exe 访问COM接口 C:\Windows\System32\svchost.exe
2016-09-02 12:59:04 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\o.exe
2016-09-02 12:58:45 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 访问内存 C:\Program Files\chrome\Chrome\chrome.exe
2016-09-02 12:58:45 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vBandizip64.exe
2016-09-02 12:58:38 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\crys.exe
2016-09-02 12:58:32 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Bandizip64.exe
2016-09-02 12:57:54 C:\Users\Administrator\AppData\Roaming\cry.exe 访问COM接口 C:\Windows\System32\svchost.exe
2016-09-02 12:57:50 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\crys.exe
2016-09-02 12:57:40 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 访问内存 C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-09-02 12:57:35 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vBandizip32.exe
2016-09-02 12:57:31 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\cry.exe
2016-09-02 12:57:23 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 访问内存 C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-09-02 12:57:17 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 创建进程 C:\Windows\SysWOW64\explorer.exe
2016-09-02 12:57:12 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Bandizip32.exe
2016-09-02 12:57:07 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe 创建进程 C:\Windows\SysWOW64\explorer.exe
2016-09-02 12:56:51 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\cry.exe
2016-09-02 12:56:45 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\vAiview32.exe
2016-09-02 12:56:39 C:\Users\Administrator\AppData\Roaming\bot.exe 创建进程 C:\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe
2016-09-02 12:56:34 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\bt.exe
2016-09-02 12:56:07 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Program Files\Bandizip\Aiview32.exe
2016-09-02 12:55:54 C:\Users\Administrator\AppData\Roaming\ba.exe 访问内存 C:\Windows\explorer.exe
2016-09-02 12:55:54 C:\Users\Administrator\AppData\Roaming\bot.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\Yswidi\cuuty.exe
2016-09-02 12:55:48 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\bt.exe
2016-09-02 12:55:38 C:\Users\Administrator\AppData\Roaming\ba.exe 访问内存 C:\Windows\explorer.exe
2016-09-02 12:55:13 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\bot.exe
2016-09-02 12:54:58 C:\Users\Administrator\AppData\Roaming\ba.exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\Paint.exe
2016-09-02 12:54:52 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\bot.exe
2016-09-02 12:54:35 C:\Users\Administrator\Desktop\binld[1].exe 创建进程 C:\Users\Administrator\AppData\Roaming\ba.exe
2016-09-02 12:53:43 C:\Users\Administrator\Desktop\binld[1].exe 修改文件 C:\360SANDBOX\SHADOW\Users\Administrator\AppData\Roaming\ba.exe

这样的自启方式差评

显示全部楼层 · 发表于 2016-9-2 13:28:23

avast! miss母体，衍生物剩余4X

显示全部楼层 · 发表于 2016-9-2 13:41:20

本帖最后由 pal家族于 2016-9-2 15:34 编辑

卡巴母子一共剩4x
母死

也就是只剩余1x 位置文件

哇！有好多Z BOT！
谁来吃菜！
自己看卡巴报毒名找吧

双击0.exe

02.09.2016 13.47.34;Detected object (process memory) deleted;d:\360安全浏览器下载\衍生物24x\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;PDM:Trojan.Win32.Generic;Other malware;09/02/2016 13:47:34

杀！！！

回滚记录：

[mw_shl_code=css,true]02.09.2016 13.44.47;Malicious program detected;PDM:Trojan.Win32.Generic;D:\360安全浏览器下载\衍生物24X\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;09/02/2016 13:44:47
02.09.2016 13.45.25;Actions of malicious program rolled back;PDM:Trojan.Win32.Generic;D:\360安全浏览器下载\衍生物24X\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;09/02/2016 13:45:25
02.09.2016 13.45.25;File deleted when rolling back actions of malicious program;c:\users\72428\appdata\roaming\microsoft\windows\start menu\programs\startup\update.lnk;c:\users\72428\appdata\roaming\microsoft\windows\start menu\programs\startup\update.lnk;D:\360安全浏览器下载\衍生物24X\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;09/02/2016 13:45:25
02.09.2016 13.45.25;File deleted when rolling back actions of malicious program;c:\users\72428\appdata\local\temp\o.exe;c:\users\72428\appdata\local\temp\o.exe;D:\360安全浏览器下载\衍生物24X\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;09/02/2016 13:45:25
02.09.2016 13.45.01;Malicious program deleted;PDM:Trojan.Win32.Generic;D:\360安全浏览器下载\衍生物24X\o.exe;d:\360安全浏览器下载\衍生物24x\o.exe;09/02/2016 13:45:01
02.09.2016 13.44.47;Malicious program terminated;PDM:Trojan.Win32.Generic;D:\360安全浏览器下载\衍生物24X\o.exe;D:\360安全浏览器下载\衍生物24X\o.exe;09/02/2016 13:44:47
[/mw_shl_code]

上报之后的回复：
Greetings,

感谢您的帮助，在您提交的附件中已经发现新的恶意软件，请稍后更新最新数据库试一下。
o.exe detected Worm.Win32.AutoIt.wsz

感谢您对卡巴斯基的信任与支持！

显示全部楼层 · 发表于 2016-9-2 13:49:14

pal家族发表于 2016-9-2 13:41
卡巴母子一共剩4x
母死

卡巴的防护体系就是牛X，搞得我都想回归了（放弃了三年激活码转战COMODO...）

显示全部楼层 · 发表于 2016-9-2 14:09:14

Avira
The pattern of 'TR/Dropper.MSIL.dqf [trojan]'
detected in file 'C:\Users\User\Downloads\Compressed\binld[1].exe.

[mw_shl_code=css,true]Start of the scan: Friday, 2 September, 2016  14:07

Starting the file scan:

Begin scan in 'C:\Users\User\Downloads\Compressed\衍生物24X'
C:\Users\User\Downloads\Compressed\衍生物24X\Aiview32.exe
  [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\Bandizip32.exe
  [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\Bandizip64.exe
  [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\bot.exe
  [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\bt.exe
  [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\bz.exe
  [DETECTION] Is the TR/ATRAPS.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\cry.exe
  [DETECTION] Is the TR/Dropper.MSIL.yqvr Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\crys.exe
  [DETECTION] Is the TR/Dropper.MSIL.xiiz Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\cuuty.exe
  [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan
Successful Cloud SDK initialization and license check.
The file 'C:\Users\User\Downloads\Compressed\衍生物24X\o.exe' was scanned with the Protection Cloud. SHA256 = D2FA5999EED4EA459F64E41AD9DA5E24D1E97A4FD73E1B344878FF7284CE796D
C:\Users\User\Downloads\Compressed\衍生物24X\o.exe (SHA-256: d2fa5999eed4ea459f64e41ad9da5e24d1e97a4fd73e1b344878ff7284ce796d)
  [DETECTION] Contains suspicious code HEUR/APC (Cloud)
C:\Users\User\Downloads\Compressed\衍生物24X\Paint.exe
  [DETECTION] Is the TR/ATRAPS.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\Pony.exe
  [DETECTION] Is the TR/PSW.Fareit.iloen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\RegDll32.exe
  [DETECTION] Is the TR/Crypt.ULPM.Gen Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\soft.exe
  [DETECTION] Is the TR/Spy.A.6512 Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\uhdua.exe
  [DETECTION] Is the TR/Crypt.XPACK.Gen2 Trojan
C:\Users\User\Downloads\Compressed\衍生物24X\unace32.exe
  [DETECTION] Is the TR/ATRAPS.Gen Trojan[/mw_shl_code]

显示全部楼层 · 发表于 2016-9-2 14:26:12

MSE
[mw_shl_code=css,true]C:\Users\XuanXia\Desktop\衍生物24X\Aiview32.exe->(UPX) Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\Bandizip32.exe->(UPX)  Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\Bandizip64.exe->(UPX)  Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\bot.exe             Infected: PWS:Win32/Zbot!VM
C:\Users\XuanXia\Desktop\衍生物24X\bt.exe                Infected: PWS:Win32/Zbot!VM
C:\Users\XuanXia\Desktop\衍生物24X\bz.exe->(UPX)       Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\cry.exe             Infected: Backdoor:MSIL/Noancooe.C
C:\Users\XuanXia\Desktop\衍生物24X\crys.exe             Infected: TrojanSpy:MSIL/Omaneat!rfn
C:\Users\XuanXia\Desktop\衍生物24X\cuuty.exe             Infected: PWS:Win32/Zbot!VM
C:\Users\XuanXia\Desktop\衍生物24X\Paint.exe->(UPX)    Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\Pony.exe             Infected: Trojan:Win32/Bagsu!rfn
C:\Users\XuanXia\Desktop\衍生物24X\Pony.exe->(UPX)       Infected: Trojan:Win32/Bagsu!rfn [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\RegDll32.exe->(UPX) Infected: Virus:Win32/Grenam.B [non_writable_container]
C:\Users\XuanXia\Desktop\衍生物24X\soft.exe             Infected: PWS:Win32/Zbot!CI
C:\Users\XuanXia\Desktop\衍生物24X\uhdua.exe             Infected: PWS:Win32/Zbot!VM
C:\Users\XuanXia\Desktop\衍生物24X\unace32.exe->(UPX)    Infected: Virus:Win32/Grenam.B [non_writable_container][/mw_shl_code]

显示全部楼层 · 发表于 2016-9-2 14:47:02

母体行为 https://www.maldun.com/analysis/ ... g0NmRzZmFzZGZhc2Rm/

显示全部楼层 · 发表于 2016-9-2 15:09:38

AVG

显示全部楼层 · 发表于 2016-9-2 15:15:11

母体miss

显示全部楼层 · 发表于 2016-9-2 16:05:03

一看行为，不可能过掉360

[病毒样本] 史诗级大毒霸

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源