Detection ratio: 5 / 55 nut50a528.exe 专注监视剪贴版变更三十年从未被超越

墨家小子

SHA256:        768a01daa588a787f708a0331bc6b26d12c666df5586e029e426ddd0e975a190
File name:        nut50a528.exe
Detection ratio:        5 / 55
Analysis date:        2015-12-07 14:31:42 UTC ( 1 minute ago )
https://www.virustotal.com/en/fi ... nalysis/1449498702/



2015/12/7 22:32:55,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\AAAA\Desktop\1\nut50a528.exe" )

2015/12/7 22:32:57,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:32:59,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:33:00,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:33:01,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:33:02,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:33:03,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:33:05,C:\Users\AAAA\Desktop\1\nut50a528.exe,24,Blocked ;监视剪贴版变更

2015/12/7 22:33:20,C:\Users\AAAA\Desktop\1\nut50a528.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,hh.exe)

2015/12/7 22:33:24,C:\Users\AAAA\Desktop\1\nut50a528.exe,53,Allowed ;执行应用程序 (C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe)

2015/12/7 22:33:28,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,24,Blocked ;监视剪贴版变更

2015/12/7 22:33:40,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,hh.exe)

2015/12/7 22:33:43,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/7 22:33:50,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,48,Allowed ;出站网络访问

2015/12/7 22:33:53,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,40,Blocked ;以修改权限打开进程或线程 (esif_assist.exe(pid=3044))

2015/12/7 22:34:25,C:\Users\AAAA\AppData\Roaming\alFSVWJB\hh.exe,53,Allowed ;执行应用程序 (C:\Users\AAAA\AppData\Local\Temp\32356421.exe)

2015/12/7 22:34:36,C:\Users\AAAA\AppData\Local\Temp\32356421.exe,24,Blocked ;监视剪贴版变更
2015/12/7 22:34:39,C:\Users\AAAA\AppData\Local\Temp\32356421.exe,24,Blocked ;监视剪贴版变更

2015/12/7 22:34:48,C:\Users\AAAA\AppData\Local\Temp\32356421.exe,53,Allowed ;执行应用程序 ("C:\windows\system32\msiexec.exe")

2015/12/7 22:34:52,C:\Windows\SysWOW64\msiexec.exe,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/7 22:34:54,C:\Windows\SysWOW64\msiexec.exe,48,Allowed ;出站网络访问

2015/12/7 22:35:01,C:\Windows\SysWOW64\msiexec.exe,47,Allowed ;创建交换数据流 (C:\ProgramData\msojglxqp.exe:Zone.Identifier)

2015/12/7 22:35:03,C:\Windows\SysWOW64\msiexec.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows,Load)

2015/12/7 22:35:05,C:\Windows\SysWOW64\msiexec.exe,26,Blocked ;修改受保护的注册表键 (HKCU\Software\Microsoft\Windows\CurrentVersion\Run,80835775)

aboringman

AVG：

扫描：miss；

双击：实机双击（不入沙），报错自杀。。。。。。

XywCloud

SUD to BAV

挥泪斩情思

samlin01

红伞kill

275751198

类型：
HEUR/QVM10.1.Malware.Gen

描述：
木马通常利用系统的漏洞，绕过系统防御，达到：盗取账号、窃取资料、篡改文件、破坏数据的目的。
经过360安全中心检验，此文件是木马，建议您立即处理。

扫描引擎：
360云查杀引擎

文件指纹(MD5)：
30fbedbef8aa7f4fa3949756187f8ebf