CryptoShield.Ransom (17.02.18)

显示全部楼层 · 发表于 2017-2-18 19:13:41

infected

https://www.virustotal.com/en/fi ... 4c88a5c4e/analysis/

显示全部楼层 · 发表于 2017-2-18 19:27:18

Filename: cryptoshield.exe
Threat name: Ransom.TroldeshFull Path: d:\360安全浏览器下载\1\cryptoshield.exe

____________________________

____________________________

On computers as of
2017/2/18 at 19:24:59

Last Used
2017/2/18 at 19:26:59

Startup Item
No

Launched
No

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.

____________________________

cryptoshield.exe Threat name: Ransom.Troldesh
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week ago.

High
This file risk is high.

____________________________

https://att.kafan.cn/forum.php?mo ... Dk3NTc3MnwyMDc3NTcw
Downloaded File from att.kafan.cn
Source: External Media

cryptoshield.exe

____________________________

File Actions

File: d:\360安全浏览器下载\1\ cryptoshield.exe Removed
____________________________

File Thumbprint - SHA:
e680fae09e442833699d9e6e8363f08cca7d8bd92d7abc86027d6a14c88a5c4e
File Thumbprint - MD5:
d391b1eb0b261d5ce4c1055bb6edf0a6

显示全部楼层 · 发表于 2017-2-18 19:42:13

BDF ATC kill

显示全部楼层 · 发表于 2017-2-18 19:52:21

ClamAV miss

显示全部楼层 · 发表于 2017-2-18 20:11:28

微点拦截

显示全部楼层 · 发表于 2017-2-18 20:29:48

[mw_shl_code=css,true]
Type: File
Source: C:\Users\Ivan\Downloads\CryptoShield.exe
Status: Infected
Quarantine object: 0012874a.qua
Restored: NO
Uploaded to Avira: NO
Operating system: Windows XP/VISTA Workstation/Windows 7
Search engine: 8.03.42.182
Virus definition file: 8.12.155.164
Detection: HEUR/APC (Cloud)
Date/Time: 18/2/2017, 20:28[/mw_shl_code]

显示全部楼层 · 发表于 2017-2-18 21:23:24

Windows Defender miss

显示全部楼层 · 发表于 2017-2-18 21:45:30

断网可杀

显示全部楼层 · 发表于 2017-2-18 22:08:14

卡巴报勒索

显示全部楼层 · 发表于 2017-2-18 22:22:41

卡巴非毒库报

PDM主防报危险

允许通过运行

读取一堆系统进程，
然后要启动新进程
EXPLOR.EXE NOTEPAD等
HIPS阻止
最后哑火

[病毒样本] CryptoShield.Ransom (17.02.18)

本帖子中包含更多资源

本帖子中包含更多资源