七枚样本

显示全部楼层 · 发表于 2016-2-23 14:59:35

aboringman 发表于 2016-2-23 14:31
Trend Micro：

扫描：kill 5 files；

IDP呢

显示全部楼层 · 发表于 2016-2-23 15:01:02

windows7爱好者发表于 2016-2-23 14:59
IDP呢

我准其假，让他去旅游了

不过不久之后就会回来

显示全部楼层 · 发表于 2016-2-23 15:03:19

ericdj 发表于 2016-2-23 14:55
如果BD引擎干掉了可以关闭监控，专门测试主防啊

我可是实机哦，最多360沙盘，还不知道它安全不安全，漏不漏呢

显示全部楼层 · 发表于 2016-2-23 15:12:23

name="C:\Users\XuanXia\Desktop\7 samples\7 samples\54.exe", threat="a variant of Win32/Kryptik.EOVH trojan", action="", info=""
name="C:\Users\XuanXia\Desktop\7 samples\7 samples\amr507.exe", threat="Win32/TrojanDownloader.Nymaim.BA trojan", action="", info=""
name="C:\Users\XuanXia\Desktop\7 samples\7 samples\D502.tmp.exe", threat="Win32/Qadars.AP trojan", action="", info=""
name="C:\Users\XuanXia\Desktop\7 samples\7 samples\rig.exe", threat="a variant of Win32/Kryptik.EOQY trojan", action="", info=""
name="C:\Users\XuanXia\Desktop\7 samples\7 samples\underscore.exe", threat="Win32/PSW.Fareit.H trojan", action="", info=""
name="C:\Users\XuanXia\Desktop\7 samples\7 samples\underscore2.exe", threat="Win32/PSW.Fareit.H trojan", action="", info=""

显示全部楼层 · 发表于 2016-2-23 15:15:35

本帖最后由 ericdj 于 2016-2-23 15:16 编辑

GD
右键kill X6

全部是BD引擎干掉啊～

最后一个入沙
defender.exe

[mw_shl_code=css,true]AVA 25.5628
GD 25.6409

*** Process ***

Process: 7616
File name: defender.exe
Path: c:\users\administrator\desktop\special files\samples#7\defender.exe

Publisher: Unknown publisher
Creation date: 02/22/16 11:24:30
Modification date: 02/22/16 11:24:30

Started by: start.exe
Publisher: Invincea, Inc.

*** Actions ***

The program is trying to create a startup item to launch a program automatically at system startup.
A suspicious location is referenced in startup.

*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\Desktop\Special files\samples#7\defender.exe

The following registry entries were deleted:

\registry\user\sandbox_administrator_suspected\user\current\software\microsoft\windows\currentversion\run || f7efd5a2-3301-49f0-9bcc-a9ee4f8ff51c

YGLhyNLAcoJygmJi4HKCJidoYmJwKnRyQicnJga3cnJycmJigC4nKCcoJga5YuHIopAtJwh3KicIhywnJycnJganKxiKNWYrJxiKNWYrJyYG5ygnBwA
Rules version: 5.0.83
OS: Windows 10.0 Service Pack 0.0 Build: 10240 - Workstation 32bit OS
dll version: 55982

"C:\Users\Administrator\Desktop\Special files\samples#7\defender.exe"
MD5: 579A9D451CD1E74032F59EAAA5A1864F
"C:\Program Files\Sandboxie\Start.exe" /env:00000000_SBIE_CURRENT_DIRECTORY="C:\Users\Administrator\Desktop\Special files\samples#7" /env:=Refresh /elevate "C:\Users\Administrator\Desktop\Special files\samples#7\defender.exe"
MD5:
[/mw_shl_code]

显示全部楼层 · 发表于 2016-2-23 15:17:25

z2009 发表于 2016-2-23 15:03
我可是实机哦，最多360沙盘，还不知道它安全不安全，漏不漏呢

360沙箱没用过

显示全部楼层 · 发表于 2016-2-23 15:29:06

ericdj 发表于 2016-2-23 15:17
360沙箱没用过

主要图方便，还免费，正好和bg中外结合的防御，哈哈，还有sb的要破解，好烦的

显示全部楼层 · 发表于 2016-2-23 16:47:18

为什么没人试试ESS9的智能主动防御

显示全部楼层 · 发表于 2016-2-23 16:48:23

ysj963 发表于 2016-2-23 16:47
为什么没人试试ESS9的智能主动防御

好像ESS没有住房吧

显示全部楼层 · 发表于 2016-2-23 16:49:20

windows7爱好者发表于 2016-2-23 16:48
好像ESS没有住房吧

有啊 HIPS组件自我保护那一栏的!

[病毒样本] 七枚样本

本帖子中包含更多资源

浏览过的版块