File name: q2oic2i0b.exe Detection ratio: 7 / 62 带有数字签名的勒索

墨家小子

https://mega.nz/#!pG4THCiS!s7qkjqR2o-rSXbkGZRPwButySv9yyV75EmCYP7DvA08

https://www.upload.ee/files/7241168/q2oic2i0b.exe.html

Baidu	Win32.Trojan.WisdomEyes.16070401.9500.9999	20170718
Invincea	heuristic	20170607
Kaspersky	UDS:DangerousObject.Multi.Generic	20170718
Palo Alto Networks (Known Signatures)	generic.ml	20170718
Rising	Malware.Obscure!1.9C59 (classic)	20170718
Webroot	W32.Trojan.Gen	20170718
ZoneAlarm by Check Point	UDS:DangerousObject.Multi.Generic	20170718

07/18/17 21:23:47 Prevented process <q2oic2i0b.exe> from writing to <c:\users\XXX\desktop\sync\x\x»ìÄyíá½á11ê©1¤í¼Æ½ÃæÕûìå±íê¾·½·¨ÖÆí¼1æÔòoí11ÔìÏêí¼￡¨¶àá￠»ù′¡¡￠ìõDλù′¡¡￠·¤Dλù′¡¡￠×®»ù′¡)¡¾3¬ÇåÎú￡¬¿é′òó¡¡¿.pdf>.


07/18/17 21:23:41 Prevented process <q2oic2i0b.exe> from writing to <c:\users\all users\usoprivate\xlliveud\xmp_4.9.17.2316_97a4b53cf423e8d0502d16615378fa82_patchinfo.xml>.


07/18/17 21:23:33 Prevented process <q2oic2i0b.exe> from writing to <c:\users\all users\microsoft\crypto\systemkeys\s-1-5-18\e46c1c49f7efcda529f4c48f1f2af2b4_d7efd7d1-1cca-4788-8d12-ecc756e16c04>.


07/18/17 21:23:22 Prevented process <q2oic2i0b.exe> from writing to <c:\users\all users>.


07/18/17 21:23:20 Prevented process <q2oic2i0b.exe> from writing to <c:\users\all users\documents\photomaster\boomerang\profile.ini>.


07/18/17 21:23:14 Prevented process <q2oic2i0b.exe> from writing to <c:\userguidepdf\pdf\fi-fi.pdf>.


07/18/17 21:23:07 Prevented process <q2oic2i0b.exe> from writing to <c:\users\XXX\appdata\local\temp\etilqs_fkdm7qegjknsbj3>.


07/18/17 21:23:07 Prevented <q2oic2i0b.exe> from writing to <\registry\user\s-1-5-21-882639051-1261622828-682048811-1001\software\microsoft\windows\currentversion\run>.


此刻我的心情是卧槽的……

xu378947986

eset 发现威胁

学雷锋做人

火绒扫描 Kill


关闭文件实时监控，双击准确报出勒索，但此时桌面文件已被加密

fdsax

emsi防御失败，文件被加密！自定义规则防御成功！

fdsax 发表于 2017-7-18 21:52
emsi防御失败，文件被加密！

好像因为带数字签名，EMSI将样本视为可信，BB没有监控样本本身的行为

westbyte

Voodooshield拦截
这样本我估计COMODO Firewall会中
欢迎双击@HEMM

fdsax

霄栋 发表于 2017-7-18 22:09
好像因为带数字签名，EMSI将样本视为可信，BB没有监控样本本身的行为

还有这种操作？

westbyte

霄栋 发表于 2017-7-18 22:09
好像因为带数字签名，EMSI将样本视为可信，BB没有监控样本本身的行为

勒索收到的赎金减去买证书的钱还有盈余，带数字签名的勒索病毒会多起来吧

引领五基生活

实机？

fdsax 发表于 2017-7-18 22:17
还有这种操作？

已经上报给emsi了，看他们怎么说吧