File name: fulchila.exe Detection ratio: 3 / 55 不服你就双击

墨家小子

SHA256:        efc75a37b8d24b65b13f5179957df80af8f516c58aa9cfc63ae7c0ac51f27ae6
File name:        fulchila.exe
Detection ratio:        3 / 55
Analysis date:        2016-01-05 02:53:17 UTC ( 0 minutes ago )
https://www.virustotal.com/en/fi ... nalysis/1451962397/

蓝天二号

双击，，，，，，，，，，，，好多网马。。

挥泪斩情思

KIS UDS

胖福

双击过诺顿！

275751198

360 Trojan.Generic

sanhu35

联网下载很多东西



2016-1-5 12:47:36    访问网络    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: TCP [本机 : 1128] ->  [101.227.143.40 : 80 (http)]
规则: [网络组]出站连接 -> [网络]任意协议 [本机 : 任意端口] -> [任意地址 : 任意端口]

2016-1-5 12:47:49    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
命令行: KeLe2014Beta3.6.2Promote0714_20090195130.exe
规则: [应用程序]*

2016-1-5 12:47:49    修改文件    阻止
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: C:\Documents and Settings\Administrator\IETldCache\index.dat
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:51    访问网络    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: TCP [本机 : 1129] ->  [116.211.92.250 : 80 (http)]
规则: [网络组]出站连接 -> [网络]任意协议 [本机 : 任意端口] -> [任意地址 : 任意端口]

2016-1-5 12:47:53    创建新进程    允许
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: c:\documents and settings\administrator\local settings\temp\nsm42.tmp\ggexit.exe
命令行: "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsm42.tmp\GGExit.exe" 5
规则: [应用程序]*

2016-1-5 12:47:53    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: C:\Program Files\Kele55
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:54    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: C:\Documents and Settings\Administrator\Application Data\Kele55
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:54    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: C:\Documents and Settings\Administrator\「开始」菜单\程序\可乐视频社区
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:54    创建新进程    阻止
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: c:\windows\system32\cmd.exe
命令行: C:\WINDOWS\system32\cmd.exe /C copy /b "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\BaiduPlayer5SetupSilent_357.exe" + "C:\WINDOWS\Fonts\mingliu.ttc" "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\BaiduPlayer5SetupSilent_357.exe"
规则: [应用程序]* -> [子应用程序]『禁运』黑名单

2016-1-5 12:47:54    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: C:\Documents and Settings\Administrator\桌面\可乐视频社区.lnk
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:54    修改注册表值    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\kele55room\shell\open\command
值: "C:\Program Files\Kele55\Kele55.exe" %1
规则: [注册表组]常规关联Ⅰ -> [注册表]*\Classes\*\shell\*\command*

2016-1-5 12:47:54    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: C:\Program Files\Kele55
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:54    向其他进程发送消息    阻止
进程: c:\documents and settings\administrator\local settings\temp\kele2014beta3.6.2promote0714_20090195130.exe
目标: c:\windows\explorer.exe
消息: 0x0419
规则: [应用程序]*

2016-1-5 12:47:57    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: c:\documents and settings\administrator\local settings\temp\baiduplayer5setupsilent_357.exe
命令行: BaiduPlayer5SetupSilent_357.exe
规则: [应用程序]*

2016-1-5 12:47:58    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\baiduplayer5setupsilent_357.exe
目标: C:\Program Files\baidu
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:47:58    创建文件夹    阻止
进程: c:\documents and settings\administrator\local settings\temp\baiduplayer5setupsilent_357.exe
目标: C:\Documents and Settings\Administrator\Application Data\Baidu
规则: [文件组]只读磁盘 -> [文件]c:\*

2016-1-5 12:48:06    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: c:\documents and settings\administrator\application data\360se6\application\360se.exe
命令行: "C:\Documents and Settings\Administrator\Application Data\360se6\Application\360se.exe"  -- "http://120.55.106.87/ZnVsY2hpbGEuZXhl/20.html"
规则: [应用程序]*

2016-1-5 12:48:14    修改文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm
规则: [应用程序组]【授权】高限制组 -> [文件]*

2016-1-5 12:48:21    创建新进程    允许
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: c:\documents and settings\administrator\application data\360se6\application\360se.exe
命令行: "C:\Documents and Settings\Administrator\Application Data\360se6\Application\360se.exe" --type=renderer --lang=zh-CN --disable-client-side-phishing-detection --renderer-print-preview --disable-webgl --disable-pepper-3d-for-untrusted-use --disable-gl-multisamp
规则: [应用程序]*

2016-1-5 12:48:24    访问网络    允许
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: TCP [本机 : 1130] ->  [120.55.106.87 : 80 (http)]
规则: [网络组]出站连接 -> [网络]任意协议 [本机 : 任意端口] -> [任意地址 : 任意端口]

2016-1-5 12:48:24    创建文件    阻止
进程: c:\documents and settings\administrator\application data\360se6\application\360se.exe
目标: C:\Documents and Settings\Administrator\Application Data\360se6\apps\data\common\Favorites\Log\360log_2016_01_05.log
规则: [应用程序组]【授权】高限制组 -> [文件组]user限制写入

2016-1-5 12:48:31    创建新进程    允许
进程: c:\documents and settings\administrator\桌面\fulchila\fulchila.exe
目标: c:\documents and settings\administrator\local settings\temp\iqiyisetup_spl004@kb031.exe
命令行: IQIYIsetup_spl004@kb031.exe
规则: [应用程序]*

2016-1-5 12:48:36    创建文件 (2)    阻止
进程: c:\documents and settings\administrator\local settings\temp\iqiyisetup_spl004@kb031.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nsg49.tmp\nsProcess.dll
规则: [应用程序组]【授权】高限制组 -> [文件组]保护高危文件

2016-1-5 12:48:36    创建文件    阻止
进程: c:\documents and settings\administrator\local settings\temp\iqiyisetup_spl004@kb031.exe
目标: C:\Documents and Settings\Administrator\Local Settings\Temp\nsg49.tmp\NSISdl.dll
规则: [应用程序组]【授权】高限制组 -> [文件组]保护高危文件

尘梦幽然

胖福 发表于 2016-1-5 11:07
双击过诺顿！

什么行为

胖福

尘梦幽然 发表于 2016-1-5 13:48
什么行为

静默安装各种软件！

尘梦幽然

胖福 发表于 2016-1-5 13:51
静默安装各种软件！

你提交没有

胖福

尘梦幽然 发表于 2016-1-5 13:53
你提交没有

提交了(Tracking #39527613)，提交也没啥意义，基本就是按照Trojan.Gen或者Trojan.Gen2入库，改下MD5照过不误！