File name: CAE8.tmp.exe Detection ratio: 2 / 55 加密勒索挂马

显示全部楼层 · 发表于 2016-3-4 08:36:56

SHA256: 577b410eedb20229f1f12a34d1bf1f8801b8d3e96f36009ea2be8ca5fc1959c9
File name: CAE8.tmp.exe
Detection ratio: 2 / 55
Analysis date: 2016-03-04 00:34:12 UTC ( 1 minute ago )
https://www.virustotal.com/en/file/577b410eedb20229f1f12a34d1bf1f8801b8d3e96f36009ea2be8ca5fc1959c9/analysis/1457051652/

McAfee Ransomware-FFR!7C3D1F9BE7B4 20160303
McAfee-GW-Edition BehavesLike.Win32.Downloader.fm 20160303

显示全部楼层 · 发表于 2016-3-4 09:34:44

现在都流行拉黑大法吗？
2016-3-4 9:33:57 文件系统实时防护文件 C:\Documents and Settings\Administrator\My Documents\CAE8.tmp.exe Suspicious Object 已删除

显示全部楼层 · 发表于 2016-3-4 09:37:37

HMPA
[mw_shl_code=css,true]Mitigation CryptoGuard

Platform    6.1.7601/x86 06_3c*
PID       1756
Application  C:\Windows\lyfaoipidhvc.exe
Description  Mannerism Scat Rafting 0.244

Filename    C:\Windows\lyfaoipidhvc.exe

C:\Users\Administrator.PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ORKVNOM\blank[1].png
C:\Users\Administrator.PC\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8ORKVNOM\bkgrey[1].png
C:\$Recycle.Bin\S-1-5-21-2822333451-2535238799-2698388218-500\$RGGXS6Y.doc

Code Injection
00400000-00486000  536KB C:\Windows\lyfaoipidhvc.exe [380]
7FFDF000-7FFE0000 4KB
1  C:\Windows\lyfaoipidhvc.exe [380]
2  C:\Users\Administrator.PC\Desktop\CAE8.tmp\CAE8.tmp.exe [948]
3  C:\Users\Administrator.PC\Desktop\CAE8.tmp\CAE8.tmp.exe [2832]
4  C:\Windows\explorer.exe [3528]
5  C:\Windows\System32\userinit.exe [3444]
6  C:\Windows\System32\winlogon.exe [3228]
winlogon.exe
7  C:\Windows\System32\smss.exe [3172]
\SystemRoot\System32\smss.exe 00000000 00000040

Process Trace
1  C:\Windows\lyfaoipidhvc.exe [1756]
2  C:\Windows\lyfaoipidhvc.exe [380]
3  C:\Users\Administrator.PC\Desktop\CAE8.tmp\CAE8.tmp.exe [948]
4  C:\Users\Administrator.PC\Desktop\CAE8.tmp\CAE8.tmp.exe [2832]
5  C:\Windows\explorer.exe [3528]
6  C:\Windows\System32\userinit.exe [3444]
7  C:\Windows\System32\winlogon.exe [3228]
winlogon.exe
8  C:\Windows\System32\smss.exe [3172]
\SystemRoot\System32\smss.exe 00000000 00000040
[/mw_shl_code]

显示全部楼层 · 发表于 2016-3-4 10:31:08

显示全部楼层 · 发表于 2016-3-4 11:06:24

显示全部楼层 · 发表于 2016-3-4 11:13:29

显示全部楼层 · 发表于 2016-3-4 11:45:05

360这个入库规则也很要命啊，不比把木马入风险库右键扫描不报更让人闹心啊

显示全部楼层 · 发表于 2016-3-4 11:46:07

微点拦截

显示全部楼层 · 发表于 2016-3-4 12:55:35

红伞云查杀'TR/Crypt.XPACK.Gen2 (Cloud)' [trojan]

[可疑文件] File name: CAE8.tmp.exe Detection ratio: 2 / 55 加密勒索挂马

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源