Locky Ransomware JBlfwMLcM1.exe

csklho

Payment_201708-2866.jse VT: https://www.virustotal.com/en/file/ff7b03ca1e1c00076c782d2fcdb2273fe7329f07d5618f63eaefeff2d75ba87c/analysis/1504067419/
TrendMicro OfficeScan detected as Mal_Nemucod-JS01

JBlfwMLcM1.exe VT: https://www.virustotal.com/en/file/ce9469a6e37a26a7f6673ef1e63ba6b66162cfe8aaf68c2a6df075ebe0fe7886/analysis/
TrendMicro OfficeScan detected as Ransom_CERBER.SMALY0

温馨小屋

和泉纱雾

Gollum

BDTS

KIS

NS

XZ8SM7Sx0bVkoUV

火绒kill

桑德尔

红伞

心醉咖啡

管家

[mw_shl_code=css,true]【扫描信息】

开始时间:2017-8-30 19:07:09
扫描用时:00:00:02
扫描类型:指定位置杀毒
扫描引擎:管家云查杀引擎 管家反病毒引擎 管家系统修复引擎
扫描状态:扫描完成


【扫描结果】

扫描文件数:2
发现风险数:1
已处理风险数:1


---------------------
2017-8-30 19:07:13 MD5:cc1ba7243244a2cccf4389d5df771c16 F:\浏览器下载\Locky\JBlfwMLcM1.exe [Win32.Trojan.Raasj.Auto]  [删除成功]
---------------------
[/mw_shl_code]

Jerry.Lin

TPCMgr kill 1

[mw_shl_code=css,true][Scan information]

Start time:2017-8-30 19:13:56
Elapsed time:00:00:01
Scan type:Custom scan
Antivirus engines:Tencent cloud protection engine    Tencent antivirus engine II    Tencent system repair engine    Bitdefender local antivirus engine   
Scan status:Scan complete


[Scan Report]

Files scanned:2
Threats detected:1
Threats processed:1


---------------------
2017-8-30 19:14:00 MD5:81a1a33040a4a78d7860f91585a16ff9 D:\迅雷下载\病毒测试区\Locky\Payment_201708-2866.jse --> (INFECTED_JS) [JS:Trojan.JS.Downloader.PZ]  [Delete success]
---------------------
[/mw_shl_code]

实机沙盒双击exe！miss！文件被加密！

zst470396853

360  监控kill一个  扫描kill一个

ziyerain2015

双击EXE 360应该会拦截
双击JS 360应该被过了
火绒和PC MANAGER 扫描MISS 双击也不跳应该都GG--腾讯是29号的库，看上面30已经可以杀了，惨差一点就不行