File name: ed5a……0bb9.exe Detection ratio: 5 / 54

墨家小子

SHA256:        ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9
File name:        ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe
Detection ratio:        5 / 54
Analysis date:        2015-12-22 10:31:19 UTC ( 1 minute ago )



自启动、键盘输入记录、绕开系统防火墙、联网

2015/12/22 18:32:02,C:\Windows\explorer.exe,53,Allowed ;执行应用程序 ("C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe" )

2015/12/22 18:32:09,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,53,Allowed ;执行应用程序 ("cmd.exe")

2015/12/22 18:32:11,C:\Windows\SysWOW64\cmd.exe,53,Blocked ;执行应用程序 (reg  add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "cmd /c C:\Users\Desktop\AppData\Roaming\FolderName\zq.exe" /f)

2015/12/22 18:32:14,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,53,Allowed ;执行应用程序 ("C:\Users\Desktop\AppData\Roaming\svhost.exe")

2015/12/22 18:32:17,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,53,Allowed ;执行应用程序 (C:\windows\system32\cmd.exe /c C:\Users\Desktop\AppData\Roaming\FolderName\zq.exe.bat)

2015/12/22 18:32:21,C:\Windows\SysWOW64\cmd.exe,53,Blocked ;执行应用程序 (timeout  /t 300)

2015/12/22 18:32:24,C:\Users\Desktop\AppData\Roaming\svhost.exe,53,Blocked ;执行应用程序 (netsh firewall add allowedprogram "C:\Users\Desktop\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE)

2015/12/22 18:32:26,C:\Windows\SysWOW64\cmd.exe,53,Blocked ;执行应用程序 (tasklist  /nh /fi "imagename eq svhost.exe" )

2015/12/22 18:32:29,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,47,Allowed ;创建交换数据流 (C:\Users\Desktop\AppData\Roaming\FolderName\zq.exe:Zone.Identifier)

2015/12/22 18:32:31,C:\Users\Desktop\AppData\Roaming\svhost.exe,17,Blocked ;记录键盘输入

2015/12/22 18:32:34,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,41,Blocked ;修改受保护的文件 (C:\Users\Desktop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zq.exe:Zone.Identifier)

2015/12/22 18:32:38,C:\Users\Desktop\AppData\Roaming\svhost.exe,48,Blocked ;出站网络访问

2015/12/22 18:32:41,C:\Users\Desktop\Desktop\1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe,53,Blocked ;执行应用程序 (C:\windows\system32\cmd.exe /c C:\Users\Desktop\AppData\Roaming\FolderName\melt.bat)

2015/12/22 18:33:03,C:\Users\Desktop\AppData\Roaming\svhost.exe,18,Blocked ;记录键盘输入

仙剑问情

小红伞miss

saga3721

文件 ID         文件名         大小(字节)         结果
28684062         ed5a60a0e3db1545b...b9.rar         112.1 KB         OK

以下位置提供了存档中包含的文件及其结果的列表:
文件 ID         文件名         大小(字节)         结果
28684063         ed5a60a0e3db1545b...b9.exe         244 KB         UNDER ANALYSIS

njjsxy

欧阳宣

f-secure
Trojan.GenericKD.2943360
D:\Virus\Virus1\ed5a60a0e3db1545bdf8e5418a62c4c0a7d8802728e7c2e48590831e727c0bb9.exe: Cleaned up