Trojan.Ransomlock(赎金木马）

显示全部楼层 · 发表于 2011-10-17 04:25:34

本帖最后由绅博周幸于 2011-10-17 04:26 编辑

Sample Upload Confirmation
Thank you for submitting this sample. Our specialists are going to analyze your submission as soon as possible and the results will be used in the optimization process for our products - Thus, all G Data customers around the world can profit from your contribution!

Submission Details:
File: ssssss.exe
Size: 122.5 KB
Md5: a7bf69955ac3624942ebe4c93a1bb104
Sha256: f680bd124591e49d900ea467bb9a9dc73
37d5e0b0c905b1de1ff43c0126e76fb
Source: Website
Reason: Malicious

显示全部楼层 · 发表于 2011-10-17 04:35:17

eset kill

显示全部楼层 · 发表于 2011-10-17 04:56:46

显示全部楼层 · 发表于 2011-10-17 07:09:29

2011-10-17 07:06:29 创建新进程允许
进程: c:\windows\explorer.exe
目标: e:\downloads\ssssss\ssssss.exe
命令行: "E:\downloads\ssssss\ssssss.exe"
规则: [应用程序]*

2011-10-17 07:06:51 创建文件允许
进程: e:\downloads\ssssss\ssssss.exe
目标: C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\nkaij.e
规则: [文件]*

2011-10-17 07:07:08 修改注册表值阻止
进程: e:\downloads\ssssss\ssssss.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ghixpro
值: rundll32 C:\DOCUME~1\ADMINI~1\APPLIC~1\MICROS~1\Protect\nkaij.e, qktj
规则: [注册表组]自动运行程序所在位置 -> [注册表]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*

2011-10-17 07:07:13 设置文件隐藏属性阻止
进程: e:\downloads\ssssss\ssssss.exe
目标: C:\Documents and Settings\Administrator\Application Data\Microsoft\Protect\nkaij.e
规则: [文件]*

2011-10-17 07:07:32 创建新进程阻止并结束进程
进程: e:\downloads\ssssss\ssssss.exe
目标: c:\program files\internet explorer\iexplore.exe
命令行: "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
规则: [应用程序]*

显示全部楼层 · 发表于 2011-10-17 07:42:51

红伞miss，to

显示全部楼层 · 发表于 2011-10-17 07:46:34

2011-10-17 07:40:42 C:\Documents and Settings\Roger\桌面\virus\ssssss\ssssss.exe Sandboxed As Partially Limited

2011-10-17 07:40:42 C:\Program Files\Internet Explorer\IEXPLORE.EXE Sandboxed As Partially Limited

2011-10-17 07:40:44 C:\Program Files\Internet Explorer\IEXPLORE.EXE Sandboxed As Partially Limited

2011-10-17 07:40:44 C:\Documents and Settings\Roger\桌面\virus\ssssss\ssssss.exe Modify Key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uqgygvh

訪問網路

常駐進程，是IE

显示全部楼层 · 发表于 2011-10-17 08:03:39

mb kill

显示全部楼层 · 发表于 2011-10-17 09:55:21

BitDefender to

显示全部楼层 · 发表于 2011-10-17 10:06:55

斗牛犬主防 KILL

显示全部楼层 · 发表于 2011-10-17 10:51:12

[病毒样本] Trojan.Ransomlock(赎金木马）

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块