Detection ratio: 1 / 55 自启动、键盘记录、联网……各种乱马二分之一

墨家小子

SHA256:        807f8e77f8557fb5eb892dcd5931ac2cfe5a477f9aff75b242100569e22e64a6
File name:        807f8e77f8557fb5eb892dcd5931ac2cfe5a477f9aff75b242100569e22e64a6.exe
Detection ratio:        1 / 55
Analysis date:        2015-12-02 02:11:36 UTC ( 0 minutes ago )
https://www.virustotal.com/en/fi ... nalysis/1449022296/



2015/12/2 10:11:47,C:\Windows\explorer.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\Desktop\1111\807f8e77f8557fb5eb892dcd5931ac2cfe5a477f9aff75b242100569e22e64a6.exe" )

2015/12/2 10:11:49,C:\Users\AAAAAA\Desktop\1111\807f8e77f8557fb5eb892dcd5931ac2cfe5a477f9aff75b242100569e22e64a6.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Local\TempWise Memory Optimizer.exe" )

2015/12/2 10:11:51,C:\Users\AAAAAA\Desktop\1111\807f8e77f8557fb5eb892dcd5931ac2cfe5a477f9aff75b242100569e22e64a6.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Local\Tempaldalam.exe" )

2015/12/2 10:11:54,C:\Users\AAAAAA\AppData\Local\TempWise Memory Optimizer.exe,51,Blocked ;Inter-process communication (TaskScheduler)

2015/12/2 10:11:56,C:\Users\AAAAAA\AppData\Local\Tempaldalam.exe,53,Allowed ;Execution of an application ("C:\Users\AAAAAA\AppData\Roaming\svchost.exe" )

2015/12/2 10:12:01,C:\Users\AAAAAA\AppData\Local\TempWise Memory Optimizer.exe,53,Allowed ;Execution of an application (C:\windows\SysWOW64\WerFault.exe -u -p 1424 -s 536)

2015/12/2 10:12:01,C:\Windows\SysWOW64\WerFault.exe,40,Allowed ;Opening process or thread for modify access (TempWise Memory Optimizer.exe(pid=1424))

2015/12/2 10:12:02,C:\Windows\SysWOW64\WerFault.exe,50,Allowed ;Accessing the network via DNSResolver service
2015/12/2 10:12:02,C:\Windows\SysWOW64\WerFault.exe,48,Allowed ;Outgoing network access
establish an outgoing network connection (TCP)
RemoteAddress=games32.no-ip.biz(149.255.192.97) RemotePort=1188

2015/12/2 10:12:06,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,53,Blocked ;Execution of an application (netsh firewall add allowedprogram "C:\Users\AAAAAA\AppData\Roaming\svchost.exe" "svchost.exe" ENABLE)

2015/12/2 10:12:07,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 10:12:11,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,41,Blocked ;Modifying protected file (C:\Users\AAAAAA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\23556fb1360f366337f97c924e76ead3.exe)

2015/12/2 10:12:14,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,17,Blocked ;Recording keyboard input
2015/12/2 10:12:17,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 10:12:20,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,50,Allowed ;Accessing the network via DNSResolver service

2015/12/2 10:12:21,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Blocked ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

2015/12/2 10:12:28,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,48,Blocked ;Outgoing network access

2015/12/2 10:12:30,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,18,Terminated ;Recording keyboard input

2015/12/2 10:12:32,C:\Users\AAAAAA\AppData\Roaming\svchost.exe,26,Terminated ;Modifying protected registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,23556fb1360f366337f97c924e76ead3)

wjy19800315

数字神拉黑

蓝天二号

GD 行为监控 发威

XywCloud

SUD to BAV

胖福

文件名: tempaldalam.exe
威胁名称: SAPE.Heur.84830完整路径: c:\users\administrator\appdata\local\tempaldalam.exe

____________________________

____________________________


在电脑上的创建时间 
2015-12-2 ( 10:35:21 )

上次使用时间 
2015-12-2 ( 10:35:21 )

启动项目 
否

已启动 
否

威胁类型: 启发式病毒。 根据恶意软件启发式技术检测威胁。

____________________________


tempaldalam.exe 威胁名称: SAPE.Heur.84830
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质


____________________________

文件操作

文件: c:\users\administrator\appdata\local\ tempaldalam.exe 已阻止
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用

驭龙

ESS MISS

wjy19800315

驭龙 发表于 2015-12-2 10:36
ESS MISS

eset双击不知会怎么样

驭龙

wjy19800315 发表于 2015-12-2 11:00
eset双击不知会怎么样

我对ESS双击不抱希望

wjy19800315

驭龙 发表于 2015-12-2 11:01
我对ESS双击不抱希望

发现
数字对付这类样本
不知为什么这么给力

驭龙

wjy19800315 发表于 2015-12-2 11:03
发现
数字对付这类样本
不知为什么这么给力

其实360不错的

我ESS的号被封，刚刚又弄一个，如果还封的话，我就不用ESS