伪装者~

Monismith

加壳的，GD活动监控未失手

AVA 25.9034
GD 25.8167

*** Process ***

Process: 5736
File name: mswords2k8 - 副本.exe
Path: c:\users\admin\desktop\伪装者+数字签名+壳\mswords2k8 - 副本.exe

Publisher: Unknown publisher
Creation date: 11/15/16 11:50:14
Modification date: 11/15/16 00:46:25

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The cloud server recognized this file and identified it as malicious.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Cent Browser.lnk
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cent Browser.lnk
C:\Users\admin\Desktop\伪装者+数字签名+壳\mswords2k8 - 副本.exe

The following registry entries were deleted:


YHLC0HKCcoJiYnAqdHJCJycmBrdycnJyYmJwLCcnJycmBrlycvAoJyonKiYG73JycnJiYnC6kqFXY7ZykqFXY7ZyYmJwjnLCcI9ygnCfcoJygmJiAAA
Rules version: 5.0.123
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 65948

"C:\Users\admin\Desktop\伪装者+数字签名+壳\mswords2k8 - 副本.exe"
MD5: 0C086EBD4927095B76D735E3AAC78F3E
C:\Windows\Explorer.EXE
MD5:

275751198

2920650 发表于 2016-11-15 17:27
360:感到自豪呵~
这个病毒有什么破坏行为？
PS;太太懒了，不测第2个了。spy那个是原版，QVM30自学习杀的 ...

不用加壳，有效数签就可以过360的云扫，永远的病

BHHZDQL

数字签名是无效的。。。加数字签名，未加壳的，弹蓝窗


原版:也是蓝窗，不过我开了云引擎扫过后并且防护启用了云缓存后，就会报毒了



总之，这个样本反应了安全地带在查壳方面的不足，下个版本一定会改进

DF快递

sep全kill