BackDoor.Wirenet

Flying_Bird

Type: BackDoor/Wirenet

SHA1 Info:

dbust.exe
SHA1:99F5F4689A4FB45FF88AB8379777D06F001030EB

99F5F4689A4FB45FF88AB8379777D06F001030EB
SHA1:99F5F4689A4FB45FF88AB8379777D06F001030EB

Password: infected

蓝天二号

文件名: dbust.exe
完整路径: C:\Users\micro\Desktop\新建文件夹\dbust.exe

____________________________

____________________________


开发人员 
不可用

版本 
不可用

已识别 
2016/1/30 ( 16:07:49 )

上次使用时间 
2016/1/30 ( 16:08:26 )

启动项 
否


____________________________


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

不良
有许多迹象表明此文件不可信。


____________________________


源文件:
haozip.exe

创建的文件:
dbust.exe

____________________________


文件指纹 - SHA:
ae22e3bfb3e2bbbc7b758ec6bc9fa9c6d57a281ba7b4446830404a461cb620f2
文件指纹 - MD5:
ca7ed6e2bbc30d7a591f532e08349c8c

popu111

已过bd扫描

aboringman

KIS：

扫描：kill all files.

30.01.2016 16.10.07;Detected object (file) deleted.;C:\Users\kiiler\Desktop\drop\99F5F4689A4FB45FF88AB8379777D06F001030EB;C:\Users\kiiler\Desktop\drop\99F5F4689A4FB45FF88AB8379777D06F001030EB;UDS:DangerousObject.Multi.Generic;Unknown threat;01/30/2016 16:10:07

30.01.2016 16.08.51;Detected object (file) deleted.;C:\Users\kiiler\Desktop\sample\99F5F4689A4FB45FF88AB8379777D06F001030EB;C:\Users\kiiler\Desktop\sample\99F5F4689A4FB45FF88AB8379777D06F001030EB;UDS:DangerousObject.Multi.Generic;Unknown threat;01/30/2016 16:08:51

30.01.2016 16.08.51;Detected object (file) deleted.;C:\Users\kiiler\Desktop\dbust.exe;C:\Users\kiiler\Desktop\dbust.exe;UDS:DangerousObject.Multi.Generic;Unknown threat;01/30/2016 16:08:51

双击：已入库样本，无双击条件。


AVG：

扫描：kill all files（真罕见。。。。。。）；

"";"Trojan horse MSIL9.BOMJ, C:\Users\kiiler\Desktop\dbust.exe";"Secured"
"";"Trojan horse MSIL9.BOMJ, C:\Users\kiiler\Desktop\99F5F4689A4FB45FF88AB8379777D06F001030EB";"Secured"

双击：关闭监控，实机双击，IDP双杀（以下为详细信息）。

dbust.exe（测了两次，第二次貌似IDP记住了，瞬间击杀。。。。。。）：

第一次（need reboot）：

"";"IDP.SMP.11, C:\Users\kiiler\Desktop\新建文件夹\dbust.exe";"Healed, Moved to Virus Vault";"File or Directory";"2016/1/30, 16:24:24"
"";", C:\Users\kiiler\Desktop\新建文件夹\dbust.exe";"Object was blocked";"Process";"2016/1/30, 16:24:24"
"";", C:\Users\kiiler\AppData\Roaming\Microsoft\HKRUN.exe";"Object was blocked";"Process";"2016/1/30, 16:24:24"
"";", C:\Users\kiiler\AppData\Roaming\Microsoft\HKRUN.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/1/30, 16:24:24"
"";", C:\Users\kiiler\Desktop\新建文件夹\dbust.exe";"Object was blocked";"Process";"2016/1/30, 16:24:24"

第二次无需重启，直接击杀：

"";"IDP.Program.D1B0A5C0, C:\Users\kiiler\Desktop\新建文件夹\dbust.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/1/30, 16:32:24"
"";", C:\Users\kiiler\Desktop\新建文件夹\dbust.exe";"Object was blocked";"Process";"2016/1/30, 16:32:24"

99F5F4689A4FB45FF88AB8379777D06F001030EB.exe（无需重启）：

"";"IDP.Program.D1B0A5C0, C:\Users\kiiler\Desktop\新建文件夹\99F5F4689A4FB45FF88AB8379777D06F001030EB.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/1/30, 16:31:33"
"";", C:\Users\kiiler\Desktop\新建文件夹\99F5F4689A4FB45FF88AB8379777D06F001030EB.exe";"Object was blocked";"Process";"2016/1/30, 16:31:33"
"";", C:\Users\kiiler\AppData\Roaming\Microsoft\HKRUN.exe";"Object was blocked";"Process";"2016/1/30, 16:31:33"
"";", C:\Users\kiiler\AppData\Roaming\Microsoft\HKRUN.exe";"Object was blocked";"Process";"2016/1/30, 16:31:33"
"";", C:\Users\kiiler\AppData\Roaming\Microsoft\HKRUN.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/1/30, 16:31:33"
"";", HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{SL5JY177-PJ3Y-E8CD-646H-S0V6OY4OJKL6}";"Deleted, Moved to Virus Vault";"Registry key";"2016/1/30, 16:31:33"
"";", HKEY_USERS\S-1-5-21-2236816692-667211127-2861217297-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\REGEDIT1";"Deleted, Moved to Virus Vault";"Registry value";"2016/1/30, 16:31:33"
"";", C:\Users\kiiler\Desktop\新建文件夹\99F5F4689A4FB45FF88AB8379777D06F001030EB.exe";"Object was blocked";"Process";"2016/1/30, 16:31:33"

蓝天二号

aboringman 发表于 2016-1-30 16:12
KIS：

扫描：kill all files.

云的力量。。。。

aboringman

蓝天二号 发表于 2016-1-30 16:13
云的力量。。。。

然而我并不在意，我依旧坚持本地能力才是王道

ELOHIM

论坛是不是出问题了啊？
下载次数为0也可以出结果的。。汗。

蓝天二号

aboringman 发表于 2016-1-30 16:14
然而我并不在意，我依旧坚持本地能力才是王道

关防御 双击。。。

aboringman

蓝天二号 发表于 2016-1-30 16:16
关防御 双击。。。

AVG：正在准备。。。。。。

卡巴：已入库样本，无法双击。

猥琐大叔