数签样本

1446547521

来源：http://bbs.kafan.cn/thread-1961749-1-1.html

卡巴不报



https://virusscan.jotti.org/zh-CN/filescanjob/7k4d0w18vu
密码：kafan

pal家族

源文件目前卡巴还只是拉黑，修改MD5报毒是不可能的啊。。。。
不过这次入库速度好慢，不爽。。。。。

ps 700kb 4700kb。。。差别好大

蛋挞的BD库更新比其他几家oem都慢啊

pal家族

用卡巴双击了下 WIN10 64位，太困了，，，，，



04.02.2016 23.01.58;Actions of malicious program rolled back;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;c:\users\小之之\appdata\roaming\brrryrc.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Actions of malicious program rolled back;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Actions of malicious program rolled back;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Registry value restored when rolling back actions of malicious program;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Registry value restored when rolling back actions of malicious program;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Registry value restored when rolling back actions of malicious program;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.58;Registry value restored when rolling back actions of malicious program;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system\enablelinkedconnections;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:58
04.02.2016 23.01.44;Malicious program deleted;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;c:\users\小之之\appdata\roaming\brrryrc.exe;02/04/2016 23:01:44
04.02.2016 23.01.44;Malicious program deleted;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;c:\users\小之之\appdata\roaming\brrryrc.exe;02/04/2016 23:01:44
04.02.2016 23.01.44;Malicious program deleted;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:44
04.02.2016 23.01.44;Malicious program deleted;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:44
04.02.2016 23.01.31;Malicious program terminated;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;C:\Users\小之之\AppData\Roaming\brrryrc.exe;02/04/2016 23:01:31
04.02.2016 23.01.31;Malicious program detected;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:31
04.02.2016 23.01.31;Malicious program detected;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;d:\360安全浏览器下载\80_2\80_2.exe;02/04/2016 23:01:31
04.02.2016 23.01.31;Malicious program detected;PDM:Trojan.Win32.Generic;Socialising Untainted Sears;c:\users\小之之\appdata\roaming\brrryrc.exe;02/04/2016 23:01:31

275751198

这个是楼主用工具修改了原样本是嘛？？？

1446547521

275751198 发表于 2016-2-4 23:06
这个是楼主用工具修改了原样本是嘛？？？

加了数字签名

1446547521

诺顿 WS.Reputation.1

icedream89

ess9解压杀

运行了一下 好像没看到有什么动作- -？

dongwenqi

pal家族 发表于 2016-2-4 23:02
用卡巴双击了下 WIN10 64位，太困了，，，，，

辛苦了，夜耗子

windows7爱好者

DT.WEB  kill

轩夏

name="C:\Users\XuanXia\Desktop\80_2\80_2.exe", threat="Win32/Filecoder.TeslaCrypt.I trojan", action="", info=""