File name: F28B.tmp.exe Detection ratio: 6 / 54 清一色BD系查杀加密勒索挂马

墨家小子

SHA256:        09d4316ba9283be1166077c02aee767a18824f44588b890c8975919828a36de0
File name:        F28B.tmp.exe
Detection ratio:        6 / 54
Analysis date:        2015-12-26 05:34:59 UTC ( 1 minute ago )
https://www.virustotal.com/en/fi ... nalysis/1451108099/

每顿需吃三大碗

解压

nick20010117

欧阳宣

baidu
Win32.Trojan.Kryptik.td.bav

aboringman

AVG：

扫描：miss；

双击：实机双击（不入沙），不久IDP清除本体及其衍生物。

"";"IDP.SEMS.A5, C:\Users\killer\AppData\Roaming\sgajwskhf2.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2015/12/26, 15:53:36"
"";", C:\USERS\KILLER\DESKTOP\F28B.TMP.EXE";"Object was blocked";"Process";"2015/12/26, 15:53:36"
"";", C:\Windows\System32\cmd.exe";"Object was blocked";"Process";"2015/12/26, 15:53:36"
"";", C:\USERS\KILLER\DESKTOP\F28B.TMP.EXE";"Deleted";"File or Directory";"2015/12/26, 15:53:36"
"";", C:\Users\killer\AppData\Roaming\sgajwskhf2.exe";"Object was blocked";"Process";"2015/12/26, 15:53:36"
"";", HKEY_USERS\S-1-5-21-1910074467-3606790842-1030588025-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\MERYHMAS";"Deleted, Moved to Virus Vault";"Registry value";"2015/12/26, 15:53:36"

开开心心卖手机

拉进隔离区扫
[mw_shl_code=xml,true]检测：        TR/Crypt.XPACK.280086 (Cloud)[/mw_shl_code]
为什么有时候监控云报有时候不报啊

pal家族

26.12.2015 17.41.06;检测到的对象 ( 文件 ) 已删除。;D:\360安全浏览器下载\F28B.tmp\F28B.tmp.exe;WinRAR 压缩文件管理器;D:\360安全浏览器下载\F28B.tmp\F28B.tmp.exe;12/26/2015 17:41:06;UDS:DangerousObject.Multi.Generic

zl181503

火绒报毒

ericdj

开开心心卖手机 发表于 2015-12-26 17:39
拉进隔离区扫

为什么有时候 ...

我擦擦~~~~

红伞现在都这么给力啊，得先拉进隔离区~~~~

开开心心卖手机

ericdj 发表于 2015-12-28 22:17
我擦擦~~~~

红伞现在都这么给力啊，得先拉进隔离区~~~~

蛮多新的样本云都可以杀出来，只不过我这里有时实时监控就可以检测，有时还得拉进隔离区扫，大部分还是要拉进去