File name: TMP3C9D.tmp Detection ratio: 5 / 54 加密勒索挂马

墨家小子

SHA256:        3118d1228a40c2d9d19be36a2d46cdfe73981c5a24094c7ae7439c5757877553
File name:        TMP3C9D.tmp
Detection ratio:        5 / 54
Analysis date:        2016-01-22 05:04:54 UTC ( 1 minute ago )
https://www.virustotal.com/en/fi ... nalysis/1453439094/

ESET-NOD32        a variant of Win32/Injector.CQRA        20160122
Malwarebytes        Trojan.Zbot.Spy        20160122
McAfee-GW-Edition        BehavesLike.Win32.PWSZbot.fh        20160122
Qihoo-360        HEUR/QVM10.1.Malware.Gen        20160122
Rising        PE:Malware.RDM.24!5.1E [F]        20160121

很另类的加密勒索样本，既要监视键盘输入记录，又要加密勒索，还有别的行为，这个赌窝出来的东西真是极品

pal家族

22.01.2016 13.14.55;Detected object (file) deleted.;D:\360安全浏览器下载\TMP3C9D\TMP3C9D.tmp;D:\360安全浏览器下载\TMP3C9D\TMP3C9D.tmp;UDS:DangerousPattern.Multi.Generic

Mary04

下载研究 感谢楼主

墨家小子

Mary04 发表于 2016-1-22 13:15
下载研究 感谢楼主

单一样本研究没有好玩的，这个毒窝里东西只要允许运行explorer，连SSF都拦截不住，都不知道怎么添加启动项的，至于加密勒索和记录键盘输入都是次要的了

275751198

360报了

狐狸糊涂

BD双击,ATC杀掉,注销后没有发现启动项

windows7爱好者

，云太快，我很想试试关了防护进沙箱看看数字主防

aboringman

ESET：

扫描：killed；

Time;Scanner;Object type;Object;Threat;Action;User;Information
2016/1/22 15:22:46;Real-time file system protection;file;C:\Users\killer\Desktop\TMP3C9D.tmp;a variant of Win32/Injector.CQRA trojan;cleaned by deleting - quarantined;;Event occurred on a new file created by the application: D:\Haozip\HaoZip.exe.

双击：关闭监控，实机双击，AMS再次靠谱，干掉母体及衍生物。

Time;Scanner;Object type;Object;Threat;Action;User;Information
2016/1/22 15:23:34;Advanced memory scanner;file;Operating memory » C:\Users\killer\AppData\Roaming\oammqhe45.exe;a variant of Win32/Filecoder.TeslaCrypt.I trojan;cleaned - quarantined;;

2016/1/22 15:23:31;Advanced memory scanner;file;Operating memory » C:\Users\killer\Desktop\TMP3C9D.exe;a variant of Win32/Filecoder.TeslaCrypt.I trojan;cleaned - quarantined;;

Avira：

扫描：killed，进隔离区调云击杀。

Type:        File
Source:        C:\Users\killer\Desktop\TMP3C9D.tmp
Status:        Infected
Quarantine object:        05b35cb1.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.34.124
Virus definition file:        8.12.49.198
Detection:        TR/Crypt.ZPACK.181212 (Cloud)
Date/Time:        2016/1/22, 15:29

小飞侠.net