Detection ratio: 2 / 53 SoakSoak ExploitKit Activity 加密勒索挂马 双线操作

墨家小子

SHA256:        3d2758c6dff71b6b9797a8650e9e8a4170afec6ee5a45507181470a3db17ccfe
File name:        944E.tmp.exe
Detection ratio:        2 / 53
Analysis date:        2016-02-01 00:55:49 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/3d2758c6dff71b6b9797a8650e9e8a4170afec6ee5a45507181470a3db17ccfe/analysis/1454288149/

ByteHero        Trojan-Dropper.win32.Agent.f        20160201
Rising        PE:Malware.RDM.12!5.12 [F]        20160129

终于看到我大瑞星，激动的泪水忍不住流了粗来~~~我爱国产我傲娇~~！！

2016/2/1 8:41:54,高,阻止了 localhost 的入侵企图,已阻止,不需要操作,,不需要操作,不需要操作,Web Attack: SoakSoak ExploitKit Activity,"localhost (127.0.0.1, 3XX07)",dXXXq.com/wp-includes/js/json2.min.js?ver=2011-02-23,"localhost (127.0.0.1, 1XXX3)",localhost (127.0.0.1),"TCP, 端口 3XX07",,,

2016/2/1 8:41:53,高,阻止了 localhost 的入侵企图,已阻止,不需要操作,,不需要操作,不需要操作,Web Attack : Malicious Website Script Redirect 16,"localhost (127.0.0.1, 3XX07)",dXXXXXq.com/page-6XXXX6/,"localhost (127.0.0.1, 1XXX6)",localhost (127.0.0.1),"TCP, 端口 31107",,,

nick20010117

aiqinghe

ESET能杀了。

墨家小子

aiqinghe 发表于 2016-2-1 09:45
ESET能杀了。

还是你老实

275751198

最近一段时间360不知肿么了，前天和昨天的大前天的仍没有入库，上报也没反应

pal家族

ByteHero        Trojan-Dropper.win32.Agent.f
这一定是卡巴斯基的马甲

windows7爱好者

只开防火墙
只开主防+防火墙
DPH击杀
蜘蛛这防火墙要赞一个
@230f4
@aboringman
看来蜘蛛防火墙真有这本事

挥泪斩情思

墨家小子

275751198 发表于 2016-2-1 10:24
最近一段时间360不知肿么了，前天和昨天的大前天的仍没有入库，上报也没反应

都在回家的路上，还特么升级毛啊~~过节重要升级重要？

aboringman

ESET：

扫描：pass；

双击：关闭监控，实机双击，AMS 双杀（kryptik，什么鬼。。。。。。）

Time;Scanner;Object type;Object;Threat;Action;User;Information;Hash

2016/2/1 12:08:17;Advanced memory scanner;file;Operating memory » 944E.tmp.exe(3604);Win32/Kryptik.CKQZ trojan;cleaned - contained infected files;;;7F9720BEA5EEE7BC11BF01797EA7A68D13D09682

2016/2/1 12:07:28;Advanced memory scanner;file;Operating memory » 4FB.tmp.exe(6548);Win32/Kryptik.CKQZ trojan;cleaned - contained infected files;;;3B3D2DE1B1157700F637CA1C6D7E88AE1341DBCD



AVG：

扫描：miss all；

双击：实机双击，IDP 双杀。

"";"IDP.SMP.11, C:\Users\kiiler\Desktop\4FB.tmp.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/1, 12:25:11"
"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2016/2/1, 12:25:11"
"";", C:\Users\kiiler\Desktop\4FB.tmp.exe";"Object was blocked";"Process";"2016/2/1, 12:25:11"

"";"IDP.SMP.11, C:\Users\kiiler\Desktop\944E.tmp.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/2/1, 12:26:14"
"";", C:\Windows\explorer.exe";"Object was blocked";"Process";"2016/2/1, 12:26:14"
"";", C:\Users\kiiler\Desktop\944E.tmp.exe";"Object was blocked";"Process";"2016/2/1, 12:26:14"