Trojan/Rootkit 2015.05.29 Several steps to malware from chm file

显示全部楼层 · 发表于 2015-5-30 04:16:43

本帖最后由君陌潇于 2015-5-30 04:24 编辑

Password for the malicious sample: infected
Verified Malware Samples: Yes, this only contains malware

Online-scanners results:  https://www.virustotal.com/en/fi ... 1dcf1cf2b/analysis/
https://www.virustotal.com/en/fi ... e0f3caa21/analysis/
https://www.virustotal.com/en/fi ... 0697b2b04/analysis/
https://www.virustotal.com/en/fi ... 33216d5ed/analysis/

显示全部楼层 · 发表于 2015-5-30 07:13:21

上报火绒

显示全部楼层 · 发表于 2015-5-30 08:35:49

360云清空
扫描结果
======================
高危风险项
----------------------
D:\邮件\新建文件夹\新建文件夹 (2)\新建文件夹\新建文件夹 (3)\新建文件夹 (5)\搬运中转站\4files\1.chm Script/Trojan.271 已删除
D:\邮件\新建文件夹\新建文件夹 (2)\新建文件夹\新建文件夹 (3)\新建文件夹 (5)\搬运中转站\4files\mpathizeprincipl.exe HEUR/QVM03.0.Malware.Gen 已删除
D:\邮件\新建文件夹\新建文件夹 (2)\新建文件夹\新建文件夹 (3)\新建文件夹 (5)\搬运中转站\4files\M.exe HEUR/QVM20.1.Malware.Gen 已删除
D:\邮件\新建文件夹\新建文件夹 (2)\新建文件夹\新建文件夹 (3)\新建文件夹 (5)\搬运中转站\4files\dll.exe HEUR/QVM03.0.Malware.Gen 已删除

显示全部楼层 · 发表于 2015-5-30 09:17:22

[mw_shl_code=css,true]Time;Scanner;Object type;Object;Threat;Action;User;Information
2015/5/30 9:14:53;Real-time file system protection;file;C:\Users\Administrator\Downloads\4files\mpathizeprincipl.exe;Win32/Rioselx.B trojan;cleaned by deleting - quarantined;DP-201308201536\Administrator;Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2015/5/30 9:14:53;Real-time file system protection;file;C:\Users\Administrator\Downloads\4files\M.exe;Win32/Rioselx.B trojan;cleaned by deleting - quarantined;DP-201308201536\Administrator;Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2015/5/30 9:14:53;Real-time file system protection;file;C:\Users\Administrator\Downloads\4files\dll.exe;a variant of MSIL/Injector.FPT trojan;cleaned by deleting - quarantined;DP-201308201536\Administrator;Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
2015/5/30 9:14:52;Real-time file system protection;file;C:\Users\Administrator\Downloads\4files\1.chm;HTML/TrojanDownloader.Agent.NCY trojan;cleaned by deleting - quarantined;DP-201308201536\Administrator;Event occurred on a new file created by the application: D:\Program Files\7-Zip\7zG.exe.
[/mw_shl_code]

显示全部楼层 · 发表于 2015-5-30 09:34:54

本帖最后由 pal家族于 2015-5-30 15:12 编辑

卡巴3x
miss那个chm
30.05.2015 15.11.16;检测到的对象（文件）已删除。;D:\搜狗高速下载\4files\1.chm//razor.htm;D:\搜狗高速下载\4files\1.chm//razor.htm;Trojan-Downloader.HTML.Agent.acp
目前可以杀了

显示全部楼层 · 发表于 2015-5-30 11:50:31

[mw_shl_code=css,true]5/30/2015 11:49:51 AM "E:\Virus\4files\M.exe" "Artemis!599E4E9BF991" "2"

5/30/2015 11:49:52 AM "E:\Virus\4files\mpathizeprincipl.exe" "Artemis!A5C3B957CB50" "2"

5/30/2015 11:49:52 AM "E:\Virus\4files\dll.exe" "Artemis!ED08A71EF06F" "2"[/mw_shl_code]

显示全部楼层 · 发表于 2015-5-30 12:25:03

蛋挞miss 1.chm

显示全部楼层 · 发表于 2015-5-30 14:07:04

红伞和管家也都miss1

显示全部楼层 · 发表于 2015-5-30 14:08:25

显示全部楼层 · 发表于 2015-5-30 14:10:22

百度，解压 Kill 3X miss 1.chm
360卫士，解压 Kill3x 右键扫描 Kill 1.chm

[病毒样本] Trojan/Rootkit 2015.05.29 Several steps to malware from chm file

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块