特洛伊木马的一个变体RAT

aboringman

230f4 发表于 2015-11-20 23:22
还在否

在啊，虽然只是随便看看

230f4

aboringman 发表于 2015-11-20 23:23
在啊，虽然只是随便看看

detection ratio：low

上报BD

aboringman

230f4 发表于 2015-11-20 23:26
detection ratio：low

上报BD

好的，有宵夜吃

NS：

扫描：miss；

信誉：良好。。。。。。

双击：等了一会，SONAR击杀之。

Filename: 111.exe
Threat name: SONAR.SelfHijack!gen1
Full Path: Not Available

____________________________

____________________________


On computers as of 
2015-11-20 at 23:30:01

Last Used 
2015-11-20 at 23:30:01

Startup Item 
No

Launched 
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


111.exe Threat name: SONAR.SelfHijack!gen1
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
explorer.exe

File Created:
wrar521sc.exe

File Created:
winrar.exe

File Created:
111.exe

____________________________

File Actions

File: c:\documents and settings\administrator\桌面\ 111.exe Threat Removed
Event: Running process: c:\documents and settings\administrator\桌面\ 111.exe Terminated
____________________________

System Settings Actions

Event: Process start (Performed by c:\documents and settings\administrator\桌面\111.exe, PID:7016) No action taken
(Performed by c:\documents and settings\administrator\桌面\111.exe, PID:7016) No action taken
Event: Process start: c:\documents and settings\administrator\桌面\ 111.exe, PID:6440 (Performed by c:\documents and settings\administrator\桌面\111.exe, PID:7016) No action taken
Event: Process start: c:\documents and settings\administrator\桌面\ 111.exe, PID:7016 (Performed by c:\documents and settings\administrator\桌面\111.exe, PID:7016) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

aboringman

230f4 发表于 2015-11-20 23:26
detection ratio：low

上报BD

看那个图标我还以为是以前我玩过的一只Zbot呢

230f4

aboringman 发表于 2015-11-20 23:34
看那个图标我还以为是以前我玩过的一只Zbot呢

111.exe没图标吧？哪个衍生物的图标？

aboringman

230f4 发表于 2015-11-20 23:38
111.exe没图标吧？哪个衍生物的图标？wrar521sc.exe？

有啊，本体就有图标啊

aboringman

230f4 发表于 2015-11-20 23:38
111.exe没图标吧？哪个衍生物的图标？wrar521sc.exe？

对了，那个wrar521sc.exe不是衍生物，而是Winrar的安装程序（就是样本的来源）。。。。。。

230f4

aboringman 发表于 2015-11-20 23:45
对了，那个wrar521sc.exe不是衍生物，而是Winrar的安装程序（就是样本的来源）。。。。。。

我这里看不到图标。。。

这货居然没放出衍生物？还没放就死了？

aboringman

230f4 发表于 2015-11-20 23:52
我这里看不到图标。。。

应该是系统原因吧，xp下文件夹查看格式改平铺就可以看到图标

aboringman

230f4 发表于 2015-11-20 23:52
我这里看不到图标。。。

这货居然没放出衍生物？还没放就死了？

好像真的没有放出就被SONAR击杀掉了。。。。。。