Malware Pack 2015.05.30 11 Various samples

显示全部楼层 · 发表于 2015-5-31 02:22:50

Password for the malicious sample: infected
Verified Malware Samples: Yes, this only contains malware

链接: http://pan.baidu.com/s/1gdtldR1 密码: h1sw

显示全部楼层 · 发表于 2015-5-31 07:33:28

本帖最后由 230f4 于 2015-5-31 07:54 编辑

eset 9/11

剩下两个双击

放弃

显示全部楼层 · 发表于 2015-5-31 07:58:16

显示全部楼层 · 发表于 2015-5-31 08:28:51

360 云 8X 剩余3个 2个云鉴定风险，1只转人工

显示全部楼层 · 发表于 2015-5-31 10:11:38

卡巴 9X
[mw_shl_code=css,true]31.05.2015 10.10.57;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll//data0001.res;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll//data0001.res;Trojan.Win32.Small.ctq;木马程序;05/31/2015 10:10:57
31.05.2015 10.10.57;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll;;未知威胁;05/31/2015 10:10:57
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\cee42317826ba81f2676d8f8b409384d\druSTuYu.dll;D:\搜狗高速下载\Samples\Samples\cee42317826ba81f2676d8f8b409384d\druSTuYu.dll;HEUR:Trojan.Win32.Generic;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\96233f8b441f8231709380b5a416566c\scckdq.exe;D:\搜狗高速下载\Samples\Samples\96233f8b441f8231709380b5a416566c\scckdq.exe;Trojan.Win32.Neurevt.vob;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\minerltc.exe;D:\搜狗高速下载\Samples\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\minerltc.exe;Trojan.Win32.Reconyc.efjh;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\cee42317826ba81f2676d8f8b409384d\cee42317826ba81f2676d8f8b409384d;D:\搜狗高速下载\Samples\Samples\cee42317826ba81f2676d8f8b409384d\cee42317826ba81f2676d8f8b409384d;Trojan.MSIL.Inject.bvsn;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\96233f8b441f8231709380b5a416566c\96233f8b441f8231709380b5a416566c;D:\搜狗高速下载\Samples\Samples\96233f8b441f8231709380b5a416566c\96233f8b441f8231709380b5a416566c;Backdoor.Win32.Atbot.viz;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\417fb131f9aecfd67b2f1c5a4d7994a7;D:\搜狗高速下载\Samples\Samples\417fb131f9aecfd67b2f1c5a4d7994a7;Trojan.MSIL.Disfa.gjly;木马程序;05/31/2015 10:11:01
31.05.2015 10.11.01;检测到的对象（文件）已删除。;D:\搜狗高速下载\Samples\Samples\2f426ef312b4a6674473ccb9de4d4cf7;D:\搜狗高速下载\Samples\Samples\2f426ef312b4a6674473ccb9de4d4cf7;Backdoor.Win32.Atbot.viy;木马程序;05/31/2015 10:11:01
[/mw_shl_code]

显示全部楼层 · 发表于 2015-5-31 11:26:53

火绒全部miss，上报~

显示全部楼层 · 发表于 2015-5-31 13:03:09

显示全部楼层 · 发表于 2015-5-31 15:03:35

蛋挞，右键kill 8

[mw_shl_code=html,true]Virus check with G DATA INTERNET SECURITY
Version 25.1.0.3 (2015/4/7)
Virus signature dated 2015/5/31
Start time: 2015/5/31 15:02:56
Engine(s): Engine A (AVA 25.1812), Engine B (GD 25.5171)
Heuristics: On
Archives: On
System areas: Off
Check rootkits: Off
Analysis performed in full: 2015/5/31 15:02:59
11 files checked
8 infected files detected
0 suspicious files found

Object: 2f426ef312b4a6674473ccb9de4d4cf7
Path: C:\Users\eric\Desktop\virus\Samples
Status: Virus detected
Virus: Trojan.GenericKD.2452618 (Engine A)

Object: 96233f8b441f8231709380b5a416566c
Path: C:\Users\eric\Desktop\virus\Samples\96233f8b441f8231709380b5a416566c
Status: Virus detected
Virus: Trojan.GenericKD.2452373 (Engine A)

Object: scckdq.exe
Path: C:\Users\eric\Desktop\virus\Samples\96233f8b441f8231709380b5a416566c
Status: Virus detected
Virus: Trojan.GenericKD.2452436 (Engine A)

Object: cc659fd36cf01f0dd1658ef9c59d6ce0
Path: C:\Users\eric\Desktop\virus\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0
Status: Virus detected
Virus: Trojan.GenericKD.2452763 (Engine A)

Object: Loader.dll
Path: C:\Users\eric\Desktop\virus\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0
Status: Virus detected
Virus: Trojan.GenericKD.2452499 (Engine A)

Object: minerltc.exe
Path: C:\Users\eric\Desktop\virus\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0
Status: Virus detected
Virus: Gen:Variant.Kazy.354204 (Engine A)

Object: cee42317826ba81f2676d8f8b409384d
Path: C:\Users\eric\Desktop\virus\Samples\cee42317826ba81f2676d8f8b409384d
Status: Virus detected
Virus: Trojan.GenericKD.2452674 (Engine A)

Object: druSTuYu.dll
Path: C:\Users\eric\Desktop\virus\Samples\cee42317826ba81f2676d8f8b409384d
Status: Virus detected
Virus: Trojan.GenericKD.2452471 (Engine A)
[/mw_shl_code]

显示全部楼层 · 发表于 2015-5-31 15:41:54

AVIRA kill all files.(a file is killed by APC)
[mw_shl_code=css,true]开始在“C:\Documents and Settings\Administrator\桌面\Samples”中扫描
C:\Documents and Settings\Administrator\桌面\Samples\2f426ef312b4a6674473ccb9de4d4cf7
  [检测]       是 TR/LorisBot.A.22 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\417fb131f9aecfd67b2f1c5a4d7994a7
  [检测]       是 TR/Dropper.MSIL.166806 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\96233f8b441f8231709380b5a416566c\96233f8b441f8231709380b5a416566c
  [检测]       是 TR/Injector.354304.8 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\96233f8b441f8231709380b5a416566c\scckdq.exe
  [检测]       是 TR/Injector.355840.4 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\cc659fd36cf01f0dd1658ef9c59d6ce0
  [检测]       是 TR/Dropper.MSIL.166944 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll
  [检测]       是 TR/Dropper.MSIL.Gen2 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\ltc.exe
  [检测]       是 TR/Dropper.MSIL.167177 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\minerltc.exe
  [检测]       是 TR/CoinMiner.sxaz 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cee42317826ba81f2676d8f8b409384d\cee42317826ba81f2676d8f8b409384d
  [检测]       是 TR/GherlaInject.A.106 特洛伊木马
C:\Documents and Settings\Administrator\桌面\Samples\cee42317826ba81f2676d8f8b409384d\druSTuYu.dll
  [检测]       是 TR/Injector.33792.11 特洛伊木马

开始杀毒：
C:\Documents and Settings\Administrator\桌面\Samples\cee42317826ba81f2676d8f8b409384d\druSTuYu.dll
  [检测]       是 TR/Injector.33792.11 特洛伊木马
  [注意]       文件已被移到名为“51b21e63.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\cee42317826ba81f2676d8f8b409384d\cee42317826ba81f2676d8f8b409384d
  [检测]       是 TR/GherlaInject.A.106 特洛伊木马
  [注意]       文件已被移到名为“49353137.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\minerltc.exe
  [检测]       是 TR/CoinMiner.sxaz 特洛伊木马
  [注意]       文件已被移到名为“1b7d6b23.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\ltc.exe
  [检测]       是 TR/Dropper.MSIL.167177 特洛伊木马
  [注意]       文件已被移到名为“7d5f24ec.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\Loader.dll
  [检测]       是 TR/Dropper.MSIL.Gen2 特洛伊木马
  [注意]       文件已被移到名为“38dd09d5.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\cc659fd36cf01f0dd1658ef9c59d6ce0\cc659fd36cf01f0dd1658ef9c59d6ce0
  [检测]       是 TR/Dropper.MSIL.166944 特洛伊木马
  [注意]       文件已被移到名为“47ad3b40.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\96233f8b441f8231709380b5a416566c\scckdq.exe
  [检测]       是 TR/Injector.355840.4 特洛伊木马
  [注意]       文件已被移到名为“0b78170a.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\96233f8b441f8231709380b5a416566c\96233f8b441f8231709380b5a416566c
  [检测]       是 TR/Injector.354304.8 特洛伊木马
  [注意]       文件已被移到名为“77315777.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\417fb131f9aecfd67b2f1c5a4d7994a7
  [检测]       是 TR/Dropper.MSIL.166806 特洛伊木马
  [注意]       文件已被移到名为“5a567821.qua”的隔离目录中！
C:\Documents and Settings\Administrator\桌面\Samples\2f426ef312b4a6674473ccb9de4d4cf7
  [检测]       是 TR/LorisBot.A.22 特洛伊木马
  [注意]       文件已被移到名为“43014370.qua”的隔离目录中！

扫描结束时间： 2015年5月31日  15:36
已用时间: 00:02 分钟

扫描完毕.

   4 已扫描目录
   22 已扫描文件
   10 发现病毒和/或恶意程序
   0 文件被划定为可疑
   0 个文件已删除
   0 病毒和恶意程序已修复
   10 文件已移到隔离区
   0 文件已重命名
   0 无法扫描的文件
   12 不关心的文件
   1 存档已扫描
   0 警告
   10 说明
[/mw_shl_code]

[mw_shl_code=css,true]在文件“C:\Documents and Settings\Administrator\桌面\Samples\cee42317826ba81f2676d8f8b409384d\AdobeARMservice.exe”中检测到病毒或
恶意程序“HEUR/APC (Cloud) [HEUR/APC]”。
执行的操作：拒绝访问[/mw_shl_code]

显示全部楼层 · 发表于 2015-5-31 16:43:00

趋势，解压 Kill 1X，双击未扫描的EXE程序，全删除（.EXE）。

[病毒样本] Malware Pack 2015.05.30 11 Various samples

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源