Detection ratio: 1 / 55

墨家小子

SHA256:        590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5
File name:        Постановление суда.scr
Detection ratio:        1 / 55
Analysis date:        2015-12-08 08:38:24 UTC ( 6 minutes ago )
https://www.virustotal.com/en/fi ... 65a7d32c5/analysis/



2015/12/8 16:47:30,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr" /S)

2015/12/8 16:47:39,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,50,Allowed ;使用 DNS 解析服务访问网络

2015/12/8 16:47:41,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,48,Allowed ;出站网络访问

2015/12/8 16:48:46,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,53,Allowed ;执行应用程序 ("C:\windows\SysWOW64\cmd.exe" /c move /Y "C:\Users\AAAA\AppData\Local\Temp\tmp4311.tmp" "C:\windows\system32\bmkujmw.dll")

2015/12/8 16:48:52,C:\Windows\SysWOW64\cmd.exe,41,Allowed ;修改受保护的文件 (C:\Windows\SysWOW64\bmkujmw.dll)

2015/12/8 16:48:56,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,53,Blocked ;执行应用程序 ("C:\windows\SysWOW64\cmd.exe" /c reg add "HKLM\System\CurrentControlSet\Services\Goizcuop" /ve /f)

2015/12/8 16:49:00,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,53,Blocked ;执行应用程序 (C:\windows\system32\rundll32.exe "C:\windows\system32\bmkujmw.dll",EntryPointA Goizcuop INST)

2015/12/8 16:49:12,C:\Users\AAAA\Desktop\AA\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr,53,Blocked ;执行应用程序 ("C:\windows\system32\cmd.exe" /c ping -n 1 127.0.0.1 && del "C:\Users\AAAA\Desktop\AA\590A4D~1.SCR" >> NUL)

共和时代

ATC   kill

XywCloud

BAV启发杀

xyz0703

08.12.2015 17.16.29;检测到的对象（文件）已删除。;C:\Users\XYZ\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr;Microsoft Windows Search Protocol Host;C:\Users\XYZ\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr;12/08/2015 17:16:29;UDS:DangerousObject.Multi.Generic

aboringman

AVG：

扫描：miss；

双击：实机双击（不入沙），这家伙真狠，引起了多次内存波动，内存占用忽高忽低。。。。。。在反复波动之后，其恶意行为终于暴露出来：AVG防火墙提示是否允许其衍生物“590A4DEDB34956E454D384E882440E731D50A83A819CFEF000596D165A7D32C5.scr”连接网络，同意后不久，IDP击杀其衍生物。

"";"IDP.Trojan.0ED0F0DA, C:\Users\killer.Killer-PC\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/8, 20:28:50"
"";", C:\Users\killer.Killer-PC\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr";"Object was blocked";"Process";"2015/12/8, 20:28:50"
"";", C:\Users\killer.Killer-PC\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr";"Object was blocked";"Process";"2015/12/8, 20:28:50"
"";", C:\Users\killer.Killer-PC\Desktop\590a4dedb34956e454d384e882440e731d50a83a819cfef000596d165a7d32c5.scr";"Object was blocked";"Process";"2015/12/8, 20:28:50"

samlin01

红伞kill

275751198

360 QVM20