File name: DDB4.tmp.exe Detection ratio: 4 / 55 目测加密勒索挂马 2

墨家小子

SHA256:        4722df4fed8487404898fd58e42797ba419dffe30d74295c80d6d21f159a0f6d
File name:        DDB4.tmp.exe
Detection ratio:        4 / 55
Analysis date:        2016-03-16 01:00:50 UTC ( 0 minutes ago )
https://www.virustotal.com/en/file/4722df4fed8487404898fd58e42797ba419dffe30d74295c80d6d21f159a0f6d/analysis/1458090050/

McAfee        Ransomware-FGN!DC657BC4249C        20160315
McAfee-GW-Edition        BehavesLike.Win32.PWSZbot.gh        20160315
Qihoo-360        HEUR/QVM07.1.Malware.Gen        20160316
TrendMicro-HouseCall        Ransom_HPCRYPTESLA.SMJ9        20160316

saga3721

红伞云查杀 'TR/Crypt.XPACK.Gen2 (Cloud)' [trojan]

z2009

过avg扫描，双击 idp杀

Luca.l

管家扫描miss

双击miss

哈勃：https://habo.qq.com/file/showdet ... =ADQGYF1pB2QIMVs%2F

墨家小子

a1121611810 发表于 2016-3-16 09:22
管家扫描miss

双击miss

为什么不弄一个主防通用大法，能杀就行呗（我引用的）

aboringman

AVG：

扫描：miss；

双击：实机双击，IDP击杀之。（【又现ALEXA】断网情况下的较量）

"";"IDP.ALEXA.51, C:\USERS\KILLER\DESKTOP\DDB4.TMP.EXE";"Deleted";"File or Directory";"2016/3/16, 19:16:00"

"";", C:\USERS\KILLER\DESKTOP\DDB4.TMP.EXE";"Object was blocked";"Process";"2016/3/16, 19:16:00"

"";", C:\Users\killer\Documents\uqwres.exe";"Object was blocked";"Process";"2016/3/16, 19:16:00"

"";", C:\Windows\System32\cmd.exe";"Object was blocked";"Process";"2016/3/16, 19:16:00"

"";", C:\Users\killer\Documents\uqwres.exe";"Deleted, Moved to Virus Vault";"File or Directory";"2016/3/16, 19:16:00"

"";", C:\USERS\KILLER\DESKTOP\DDB4.TMP.EXE";"Object was blocked";"Process";"2016/3/16, 19:16:00"

继续上证据截图：



楼主是不是准备说ALEXA是拉黑报法啊，呵呵

阿菠萝密

楼主哪里来的那么多样本？好不过瘾。

MXCERILYF!

Panda扫描miss

aptcve

114.114.114.114/107.180.50.210往这两个ip发了可以数据包，还没解析成功