[2015.4.22]今日样本之QQ粘虫

pal家族

23.04.2015 08.20.54;检测到的对象（文件）已删除。;D:\搜狗高速下载\2015.4.22(1)\2015.4.22(1);WinRAR 压缩文件管理器;D:\搜狗高速下载\2015.4.22(1)\2015.4.22(1);04/23/2015 08:20:54;Trojan.Win32.Gotango.afk

狐狸糊涂

错过的剪接

学雷锋做人 发表于 2015-4-22 23:11
360安全卫士(关伞)：安全

云安全计划结果：暂无风险

居然没反应啊，果然还是弱了些。

抑郁使者

胖福

Filename: 2015.4.22(1).exe
Threat name: SONAR.Heuristic.130Full Path: Not Available

____________________________

____________________________


On computers as of 
2015-4-23 at 07:09:22

Last Used 
2015-4-23 at 07:09:22

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


2015.4.22(1).exe Threat name: SONAR.Heuristic.130
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
2015.4.22(1).exe

____________________________

File Actions

File: f:\norton样本\临时收集\ 2015.4.22(1).exe Threat Removed
____________________________

Registry Actions

Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Google\ Google Pinyin 2->ActiveTime:1429767766 Repaired
Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Google\ Google Pinyin 2->ActiveSkin:... Repaired
Registry change: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ 2015_RASAPI32 Threat Removed
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->EnableFileTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->EnableConsoleTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->FileTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->ConsoleTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->MaxFileSize No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASAPI32->FileDirectory No Action Required
Registry change: HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ 2015_RASMANCS Threat Removed
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->EnableFileTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->EnableConsoleTracing No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->FileTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->ConsoleTracingMask No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->MaxFileSize No Action Required
Registry change: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ 2015_RASMANCS->FileDirectory No Action Required
Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Microsoft\Windows\CurrentVersion\ Internet Settings->ProxyEnable:0 Repaired
Registry change: HKEY_USERS\S-1-5-21-1429125506-3924845992-1376771031-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ Connections->SavedLegacySettings:... Repaired
____________________________

Network Actions

Event: Network activity (Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:5864) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:5864) No action taken
(Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:5864) No action taken
Event: Process start: f:\norton样本\临时收集\ 2015.4.22(1).exe, PID:5864 (Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:5864) No action taken
Event: Process start (Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:1924) No action taken
Event: Process start: f:\norton样本\临时收集\ 2015.4.22(1).exe, PID:1924 (Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:1924) No action taken
____________________________

Suspicious Actions

(Performed by f:\norton样本\临时收集\2015.4.22(1).exe, PID:5864) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

僵尸爱上猫

胖福 发表于 2015-4-23 13:48
Filename: 2015.4.22(1).exe
Threat name: SONAR.Heuristic.130Full Path: Not Available

22.5?

fuzhk

丿岁月灬流年

金山毒霸 KILL