File name: CC53.tmp.exe Detection ratio: 3 / 56

墨家小子

https://www.virustotal.com/en/file/17d6ad71870b616d618aa7517e156f2045ae44edd6e850d10c68f2232916e39a/analysis/1458662376/

轩夏

@ericdj
@z2009

900703

這是勒索木馬

z2009

样本呢

ericdj

样本……？

ericdj

轩夏 发表于 2016-3-23 10:23
@ericdj
@z2009

GD主防拦截

墨家小子

ericdj 发表于 2016-3-23 10:35
GD主防拦截

换不带防火墙的GD测试

ericdj

墨家小子 发表于 2016-3-23 11:25
换不带防火墙的GD测试

你是指GDAV么？

墨家小子

轩夏 发表于 2016-3-23 10:23
@ericdj
@z2009

我擦我记得发了样本啊，你这是哪来的？

ericdj

墨家小子 发表于 2016-3-23 11:27
我擦我记得发了样本啊，你这是哪来的？

[mw_shl_code=css,true]AVA 25.5938
GD 25.6563

*** Process ***

Process: 5148
File name: cc53.tmp.exe
Path: c:\sandbox\administrator\suspicious\user\current\desktop\virus\cc53.tmp.exe

Publisher: Unknown publisher
Creation date: 03/23/16 02:31:52
Modification date: 03/23/16 02:21:51

Started by: start.exe
Publisher: Invincea, Inc.


*** Actions ***

The program file is misleadingly named to deceive the user (e.g. 'Image.jpg.exe')
The program establishes a network connection.


*** Quarantine ***

The following files were moved into quarantine:
C:\Sandbox\Administrator\suspicious\user\current\Desktop\virus\CC53.tmp.exe
c:\sandbox\administrator\suspicious\drive\e\baidu download\_help_instructions.txt
c:\sandbox\administrator\suspicious\drive\e\baiduyundownload\ansys 15.0 x32\ansys 15.0.full.permanent.license.cluster.2014.1231.fixed\_help_instructions.txt
c:\sandbox\administrator\suspicious\drive\e\baiduyundownload\ansys 15.0 x32\ansys 15.0.full.permanent.license.cluster.2014.1231.fixed\a69cdfffad15a50f07fff0099b711ea0.locky
c:\sandbox\administrator\suspicious\drive\e\baiduyundownload\ansys 15.0 x32\ansys 15.0.full.permanent.license.cluster.2014.1231.fixed\license使用说明.txt
c:\sandbox\administrator\suspicious\drive\e\dtlfolder\driversdownload\_help_instructions.txt
……
……
……
[/mw_shl_code]

目测这是加密了啊
不知道能不能回滚成功