每日样本包（7.14)

东方妖妖梦

http://pan.baidu.com/s/1eQlOoIA
密码：infected

已上报火绒

zl181503

金山干掉3个

狐狸糊涂

BD杀4个，余13

dongwenqi

@pal家族 测试诺顿，@OAKESS 测试卡巴

OAKESS

dongwenqi 发表于 2015-7-14 08:43
@pal家族 测试诺顿，@OAKESS 测试卡巴

目前在体验10无法测试

z2009

bullguard 杀7 余10

wjy19800315

WD查杀

剩余样本

XywCloud

跳过测试。

dongwenqi

OAKESS 发表于 2015-7-14 09:29
目前在体验10无法测试

好吧，win10感觉如何？你硬盘是固态？

白露为霜

行为描述：检测是否存在指定注册表键

附加信息：
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut

.


行为描述：在其他进程中申请内存

附加信息：
%system%\wbem\wmiprvse.exe

.


行为描述：创建互斥体

附加信息：
"RPCSS_REGEVENT:{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"

"WMIPRVSE.EXE"

.


行为描述：创建进程

附加信息：
%system%\wbem\wmiprvse.exe

.


行为描述：启动指定服务

附加信息：
RASMAN >> %system%\svchost.exe -k netsvcs

.


行为描述：添加开机自启动项

附加信息：
[MaglaPlayerUpdater] - "%ProgramFiles%\Elektro Kod\MaglaPlayerUpdater.exe"

.

..

文件操作监控


操作 文件MD5 文件大小 文件路径

新增 4c3237eb1437152b74f7b1b75c4e8677 262 %ProgramFiles%\Elektro Kod\\Applic...
新增 c292d75b88671454eae22dc75aaa830b 21024 %ProgramFiles%\Elektro Kod\\MaglaP...
新增 425c417288978e0ccbd4bc27838242df 134656 %ProgramFiles%\Elektro Kod\\HtmlAg...
新增 f2329c4568c82b2ccaa507b76ca7dbc9 368128 %ProgramFiles%\Elektro Kod\\newton...
新增 b85244088f12a16aa0a0943086b63b9b 68790 %ProgramFiles%\Elektro Kod\\Icon.i...
新增 db170fcc343be60cff38856d61bba390 330752 %ProgramFiles%\Elektro Kod\\Intero...
新增 40ca12a932b425119e010d694274f1f1 16896 %ProgramFiles%\Elektro Kod\\Uninst...
新增 17a1a557a32f2336d435232a49133352 72704 %ProgramFiles%\Elektro Kod\\MediaS...
新增 23ea831d694de049bd5334a0a4c06f97 287232 %ProgramFiles%\Elektro Kod\\MaglaP...
新增 e52229e96fd6f3532532a5086c264b44 53760 %ProgramFiles%\Elektro Kod\\AxInte...
新增 32e2603f7aac9ee5bbed736f92d0da87 264704 %ProgramFiles%\Elektro Kod\\VkNet....
新增 8331c613f218bd2f12051bcaeda9670f 22 %USERPROFILE%\Local Settings\Appli...
..




loading


•新增
•删除
•修改
注册表监控

HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

[MaglaPlayerUpdater] = ["C:\\Program Files\\Elektro Kod\\MaglaPlayerUpdater.exe"]


HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mag...

[Publisher] = [Elektro Kod]

[DisplayIcon] = [C:\\Program Files\\Elektro Kod\\icon.ico]

[DisplayVersion] = [1.0.0]

[DisplayName] = [Magla Player]

[UninstallString] = ["C:\\Program Files\\Elektro Kod\\Uninstall.exe" --uninstall]

[InstallLocation] = [C:\\Program Files\\Elektro Kod]


HKEY_LOCAL_MACHINE\\SYSTEM\ControlSet001\Enum\Root\LEGACY_RASMAN\0000\Contr...

[ActiveService] = [RasMan]


HKEY_LOCAL_MACHINE\\SYSTEM\ControlSet001\Enum\Root\LEGACY_TAPISRV\0000\Cont...

[ActiveService] = [TapiSrv]


HKEY_LOCAL_MACHINE\\SYSTEM\ControlSet001\Services\Eventlog\Application

[Sources] = [Microsoft H.323 Telephony Service Provider]


HKEY_LOCAL_MACHINE\\SYSTEM\ControlSet001\Services\Eventlog\Application\Micr...

[TypesSupported] = [0x00000007]

[EventMessageFile] = [C:\\WINDOWS\\System32\\h323.tsp]


HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RASMAN\0000\C...

[ActiveService] = [RasMan]


HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TAPISRV\0000\...

[ActiveService] = [TapiSrv]


HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Services\Eventlog\Application

[Sources] = [Microsoft H.323 Telephony Service Provider]


HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Services\Eventlog\Application\...

[EventMessageFile] = [C:\\WINDOWS\\System32\\h323.tsp]

[TypesSupported] = [0x00000007]

..

网络监控

网络操作
[Resolve HOST Name]axxdfgprepelicahuanj.com

[Resolve HOST Name]dafdafdadsa.com

[Resolve HOST Name]dsadsaxafcdaf.net

[Resolve HOST Name]ivda.ru

[Resolve HOST Name]vcyaevnovi.net

火眼未报毒