File name: B017.tmp.exe Detection ratio: 4 / 55 加密勒索挂马

墨家小子

SHA256:        f8f2111e7e4e3b73ac0c880cc07e7c05791a4e91d3323f6e89097865e6853a08
File name:        B017.tmp.exe
Detection ratio:        4 / 55
Analysis date:        2016-02-22 13:35:05 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/f8f2111e7e4e3b73ac0c880cc07e7c05791a4e91d3323f6e89097865e6853a08/analysis/1456148105/

AhnLab-V3        Trojan/Win32.Teslacrypt        20160222
McAfee        Ransom-Teerac!90D258E2969B        20160222
Qihoo-360        HEUR/QVM07.1.Malware.Gen        20160222
Rising        PE:Trojan.Ransom-Tesla!1.A322 [F]        20160222

不测IPS了，这一类型的漏洞攻击必拦，手残党颤抖吧~~

windows7爱好者

神点被过，我已被加密

rrorr

IDP.SMP.12 向实机双击的勇士问好

趋势HEU_AEGISCS230

pal家族

卡巴扫描miss
我在下载xiao电影就不测试双击了。。。

墨家小子

pal家族 发表于 2016-2-22 21:50
卡巴扫描miss
我在下载xiao电影就不测试双击了。。。

我们农村人营养不够，请不要在我帖子提小电影几个字
































































































































老司机，求带求PM

墨家小子

windows7爱好者 发表于 2016-2-22 21:46
神点被过，我已被加密

你好，这里是21世纪，请不要再考古了

tgzw1680

卡巴，双pdm

1446547521

[mw_shl_code=css,true]文件名: aqhrhosarmpp.exe
威胁名称: SONAR.Heuristic.132完整路径: 不可用

____________________________

____________________________


在电脑上的创建时间 
2016/2/22 ( 22:14:15 )

上次使用时间 
2016/2/22 ( 22:14:15 )

启动项目 
否

已启动 
是

SONAR 主动防护监视电脑上的可疑程序活动。

____________________________


aqhrhosarmpp.exe 威胁名称: SONAR.Heuristic.132
定位


极少用户信任的文件
诺顿社区中有 不到 5 名用户使用了此文件。

极新的文件
该文件已在 不到 1 周 前发行。

高
此文件具有高风险。


____________________________


来源: 外部介质

源文件:
aqhrhosarmpp.exe

____________________________

文件操作

文件: c:\users\jhon\documents\ aqhrhosarmpp.exe 威胁已删除
文件: c:\users\jhon\documents\ recover_file_lwgktvauy.txt 威胁已删除
文件: c:\$recycle.bin\s-1-5-21-1210211650-4209756102-4011342482-1002\ recovery+nfyqx.png 威胁已删除
文件: c:\$recycle.bin\s-1-5-21-1210211650-4209756102-4011342482-1002\ recovery+nfyqx.txt 威胁已删除
文件: c:\$recycle.bin\s-1-5-21-1210211650-4209756102-4011342482-1002\ recovery+nfyqx.html 威胁已删除
文件: c:\cflog\ recovery+nfyqx.png 威胁已删除
文件: c:\cflog\ recovery+nfyqx.txt 威胁已删除
文件: c:\cflog\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\amdkmpfd\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\amdkmpfd\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\amdkmpfd\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\amd\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\multimedia\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\multimedia\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\multimedia\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ati technologies\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\spmanifests\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\spmanifests\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\spmanifests\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\symantec shared\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\device\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\device\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\device\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win32\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win32\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win32\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win64\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win64\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\win64\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\bin\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\include\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\include\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\include\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\sockets\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\vmci\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\drivers\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\vmware\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\common files\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\audio\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\audio\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\audio\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\realtek\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\uninstall information\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\uninstall information\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\uninstall information\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows multimedia platform\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows multimedia platform\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows multimedia platform\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\zh-cn\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\zh-cn\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\zh-cn\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows photo viewer\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows portable devices\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows portable devices\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windows portable devices\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\registration\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\registration\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\registration\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\schema\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\schema\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\schema\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\configuration\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\en\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\en\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\en\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\zh-hans\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\zh-hans\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\zh-hans\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\1.0.0.1\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\packagemanagement\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\bin\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\bin\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\bin\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\en-us\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\en-us\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\en-us\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\calculator\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\calculator\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\calculator\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\validator\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\validator\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\validator\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\examples\ recovery+nfyqx.html 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\functions\assertions\ recovery+nfyqx.png 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\functions\assertions\ recovery+nfyqx.txt 威胁已删除
文件: c:\users\jhon\appdata\local\virtualstore\program files\windowspowershell\modules\pester\3.3.5\functions\assertions\ recovery+nfyqx.html 威胁已删除
____________________________

注册表操作

注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\Software\ 3450FEF7AE8D2525, 注册表配置单元: 64 位 威胁已删除
注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ Content->CachePrefix, 注册表配置单元: 64 位 已修复
注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ Cookies->CachePrefix:Cookie:, 注册表配置单元: 64 位 已修复
注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ History->CachePrefix:Visited:, 注册表配置单元: 64 位 已修复
注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\ Internet Settings->ProxyEnable:0, 注册表配置单元: 64 位 已修复
注册表更改: HKEY_USERS\S-1-5-21-1210211650-4209756102-4011342482-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ Connections->SavedLegacySettings:..., 注册表配置单元: 64 位 已修复
____________________________

网络操作

事件: 网络活动 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:1028) 未采取操作
____________________________

系统设置操作

事件: 进程启动 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:5476) 未采取操作
(执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:5476) 未采取操作
事件: 进程启动: c:\users\jhon\documents\ aqhrhosarmpp.exe, PID:1028 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:5476) 未采取操作
事件: 进程启动 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:1028) 未采取操作
事件: 进程启动: c:\users\jhon\documents\ aqhrhosarmpp.exe, PID:5476 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:5476) 未采取操作
事件: 进程启动: c:\users\jhon\documents\ aqhrhosarmpp.exe, PID:1028 (执行者 c:\users\jhon\documents\aqhrhosarmpp.exe, PID:1028) 未采取操作
____________________________


文件指纹 - SHA:
不可用
文件指纹 - MD5:
不可用
[/mw_shl_code]



这个是不是被加密的？

温馨小屋

BD扫描miss

墨家小子

1446547521 发表于 2016-2-22 22:17
[mw_shl_code=css,true]文件名: aqhrhosarmpp.exe
威胁名称: SONAR.Heuristic.132完整路径: 不可用

...

SSP没有行为类型53和联网监控于是乎就悲剧了，想愉快双击加一个HMPA