File name: TempradFED05.tmp EAM拦截加密勒索失败 HMPA拦截加密勒索（单独测试）

墨家小子

样本启动并注入svchost，由svchost执行加密勒索，EAM拦截不到加密
https://www.virustotal.com/en/fi ... nalysis/1480470322/

墨家小子

单独测试HMPA防御加密勒索，放行注入修改svchost内存，结果HMPA拦截到加密！

轩夏

卡巴
0f5a2ea1b8ac639d25aa9e5d900edc841c08954bec6c5e8526225a1d09c0abb3.bin.exe
UDS:DangerousObject.Multi.Generic
2c17efb3f4dee427a544af6bf3c2589814be3d20e310a0fb93aff8a4b11b683e.bin.exe
UDS:DangerousObject.Multi.Generic
Order.exe
UDS:DangerousObject.Multi.Generic
QIZNB3e.exe
UDS:DangerousObject.Multi.Generic
scpsis.exe
Trojan.Win32.Fsysna.eceb
TempradFED05.tmp
UDS:DangerousObject.Multi.Generic

SEP14:
TempradFED05.tmp A杀
scpsis.exe B杀
QIZNB3e.exe B杀
Order.exe Infostealer.Limitail
2c17efb3f4dee427a544af6bf3c2589814be3d20e310a0fb93aff8a4b11b683e.bin.exe A杀
0f5a2ea1b8ac639d25aa9e5d900edc841c08954bec6c5e8526225a1d09c0abb3.bin.exe
Trojan.Cryptolock!g24

Eset小粉絲

Avira All Kill
[mw_shl_code=css,true]
Type:        File
Source:        C:\Users\Downloads\0f5a2ea1b8ac639d25aa9e5d900edc841c08954bec6c5e8526225a1d09c0abb3.bin.exe
Status:        Infected
Quarantine object:        43bdee80.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/Crypt.ZPACK.Gen4 (Cloud)
Date/Time:        30/11/2016, 10:21


Type:        File
Source:        C:\Users\Downloads\2c17efb3f4dee427a544af6bf3c2589814be3d20e310a0fb93aff8a4b11b683e.bin.exe
Status:        Infected
Quarantine object:        4c57d4a6.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/ProxChange.2c17ef (Cloud)
Date/Time:        30/11/2016, 10:21


Type:        File
Source:        C:\Users\Downloads\QIZNB3e.exe
Status:        Infected
Quarantine object:        2ca88466.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/Crypt.XPACK.Gen (Cloud)
Date/Time:        30/11/2016, 10:21


Type:        File
Source:        C:\Users\Downloads\Order.exe
Status:        Infected
Quarantine object:        2ce1a762.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/Dropper.MSIL.Gen (Cloud)
Date/Time:        30/11/2016, 10:21


Type:        File
Source:        C:\Users\Downloads\scpsis.exe
Status:        Infected
Quarantine object:        5afc8a4e.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/ATRAPS.etbhc
Date/Time:        30/11/2016, 10:21


Type:        File
Source:        C:\Users\Downloads\TempradFED05.tmp
Status:        Infected
Quarantine object:        7092d0ac.qua
Restored:        NO
Uploaded to Avira:        NO
Operating system:        Windows XP/VISTA Workstation/Windows 7
Search engine:        8.03.42.72
Virus definition file:        8.12.138.152
Detection:        TR/AD.Teerac.2b81a2 (Cloud)
Date/Time:        30/11/2016, 10:20[/mw_shl_code]

dongwenqi

轩夏 发表于 2016-11-30 09:51
卡巴
0f5a2ea1b8ac639d25aa9e5d900edc841c08954bec6c5e8526225a1d09c0abb3.bin.exe
UDS:DangerousObject. ...

卡巴厉害了

linzh

轩夏 发表于 2016-11-30 09:51
卡巴
0f5a2ea1b8ac639d25aa9e5d900edc841c08954bec6c5e8526225a1d09c0abb3.bin.exe
UDS:DangerousObject. ...

也就是全杀咯，那我就不能测双击了

llcy

eset kill all

a445441

微点MISS3个

Tomin2009

效果不错

心醉咖啡

毒霸kill5X