#神龟安全组病毒测试包#2016.12.12 10x

显示全部楼层 · 发表于 2016-12-12 22:45:36

本帖最后由神龟Turmi 于 2016-12-12 22:48 编辑

双12快乐今天我第一笔消费五折但是只花了一块钱。。。（一包纸巾）
昨天有一个误报样本，本人深表歉意。。。尽量以后不会出现这样的事情

所有样本均收集自外站感谢Malwr和Hybrid-analysis提供文件分析服务
从百度网盘下载：https://pan.baidu.com/s/1c2yxunQ
从神龟博客下载：https://www.wugui.io/index.php/archives/16.html
报毒名详见压缩包内Reference virus name.txt文件

01.wsf(Ransom https://www.hybrid-analysis.com/ ... nshots/screen_2.png)
Huorong:√
Malwarebytes:√
TrendMicro:√

02.exe
Huorong:√
Malwarebytes:√
TrendMicro:TROJ_MOSERAN.BMC

03.exe
Huorong:Virus/Tufik.g
Malwarebytes:√
TrendMicro:PE_TUFIK.B

04.exe(Ransom.Cerber的变种?Sha1和之前遇到的不同)
Huorong:√
Malwarebytes:Ransom.Cerber
TrendMicro:√

05.exe
Huorong:Trojan/Nanocore
Malwarebytes:Backdoor.NanoCore
TrendMicro:BKDR_NOANCOOE.SM

06.exe(昨天01的变种?非常相似,但容量只有十分之一...加了压缩壳?)
Huorong:Backdoor/Bladabindi.l
Malwarebytes:Trojan.Agent.MSIL
TrendMicro:BKDR_BLADABI.SMC

07.js
Huorong:√
Malwarebytes:√
TrendMicro:√

08.exe
Huorong:Trojan/Obfuscated.bi
Malwarebytes:Trojan.Malpack
TrendMicro:TROJ_GEN.R047C0EL216

09.exe
Huorong:√
Malwarebytes:√
TrendMicro:TROJ_GEN.R00XC0DLB16

10.js(毛子Ransom)
Huorong:√
Malwarebytes:√
TrendMicro:√

统计：Huorong 4/10 Malwarebytes 4/10 TrendMicro 6/10

艾特小伙伴：@fireherman @jasonliul @学雷锋做人

显示全部楼层 · 发表于 2016-12-12 22:49:26

压缩包不加密码的结果，被ESET的流量扫描 blocked

[mw_shl_code=css,true]http://yqall02.baidupcs.com/file/2bf8e8c3120352ac14307105233dd691?bkt=p3-14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&fid=1074582833-250528-393883157077648&time=1481554068&sign=FDTAXGERLBH-DCb740ccc5511e5e8fedcff06b081203-txYCqcSMX7VloakzBFg9errm0WE=&to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= 多个威胁连接中断通过应用程序访问 web 时检测到威胁: C:\Program Files\Mozilla Firefox\firefox.exe.
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 02.vir MSIL/Kryptik.HWU 特洛伊木马的变种连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 03.vir Win32/Tufik.A 病毒连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 04.vir 多个威胁连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 04.vir > NSIS > Script.nsi NSIS/Injector.MX 特洛伊木马连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 04.vir > NSIS > zXoueT8m.cdhNtye Win32/Filecoder.Cerber.B 特洛伊木马连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 04.vir > NSIS > System.dll 压缩文件已损坏－文件无法解压。
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 04.vir > NSIS > uninst.exe 压缩文件已损坏－文件无法解压。
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 05.vir MSIL/NanoCore.E 特洛伊木马连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 06.vir MSIL/Bladabindi.AS 特洛伊木马的变种连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 08.vir Win32/Kryptik.FKVP 特洛伊木马的变种连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 09.vir Win32/Injector.DINY 特洛伊木马的变种连接中断
http://yqall02.baidupcs.com/file ... ;to=yqhb&fm=Yan,B,T,t&sta_dx=832077&sta_cs=2&sta_ft=7z&sta_ct=0&sta_mt=0&fm2=Yangquan,B,T,t&newver=1&newfm=1&secfm=1&flow_ver=3&pkey=14002bf8e8c3120352ac14307105233dd6914d8d07b70000000cb24d&sl=76480590&expires=8h&rt=sh&r=725389382&mlogid=8046747059886810098&vuk=2617836715&vbdid=3602630635&fin=16.12.12.7z&fn=16.12.12.7z&slt=pm&uta=0&rtype=1&iv=0&isw=0&dp-logid=8046747059886810098&dp-callid=0.1.1&csl=80&csign=JqoC68UreBsRHkzro13ikoxRPEQ= > 7ZIP > 09.vir > GZIP > 09.vir Win32/Injector.DINY 特洛伊木马的变种连接中断 [/mw_shl_code]

显示全部楼层 · 发表于 2016-12-12 22:50:12

fireherman 发表于 2016-12-12 22:49
压缩包不加密码的结果，被ESET的流量扫描 blocked

抱歉抱歉

不过今天几个勒索质量不低呢

显示全部楼层 · 发表于 2016-12-12 23:31:54

AVG 6X
"外壳扩展扫描（Shell Extension Scan）"
"高严重性";"6";"6";"0"
"已扫描：";"E:\key\桌面\01.vir;E:\key\桌面\02.vir;E:\key\桌面\03.vir;E:\key\桌面\04.vir;E:\key\桌面\05.vir;E:\key\桌面\06.vir;E:\key\桌面\07.vir;E:\key\桌面\08.vir;E:\key\桌面\09.vir;E:\key\桌面\10.vir"
"已启动：";"2016/12/12, 23:27:54"
"已完成：";"2016/12/12, 23:27:55"
"项目数：";"28"
"启动者：";"key"

"名称";"说明";"状态";"状态";"优先级"
"E:\key\桌面\05.vir";"特洛伊木马 Atros.UPK";"已保护";"已修复";"高"
"E:\key\桌面\04.vir";"特洛伊木马 Generic16_c.BNVL";"已保护";"已修复";"高"
"E:\key\桌面\09.vir";"特洛伊木马 Generic_vb.NWI";"已保护";"已修复";"高"
"E:\key\桌面\06.vir";"特洛伊木马 BackDoor.MSIL.L";"已保护";"已修复";"高"
"E:\key\桌面\08.vir";"特洛伊木马 Generic38.AAZB";"已保护";"已修复";"高"
"E:\key\桌面\03.vir";"发现病毒 Win32/Tufik.A";"已保护";"已修复";"高"

显示全部楼层 · 发表于 2016-12-12 23:41:59

贼麻辣
miss 1/7/9/10

显示全部楼层 · 发表于 2016-12-12 23:45:20

Avira 7x
[mw_shl_code=css,true]Start of the scan: Monday, 12 December, 2016  23:44

Starting the file scan:

Begin scan in 'C:\Users\Ivan\Downloads\16.12.12'
C:\Users\Ivan\Downloads\16.12.12\01.vir
  [DETECTION] Contains recognition pattern of the HTML/ExpKit.Gen6 HTML script virus
C:\Users\Ivan\Downloads\16.12.12\02.vir
  [DETECTION] Is the TR/Dropper.MSIL.amjlt Trojan
C:\Users\Ivan\Downloads\16.12.12\03.vir
  [DETECTION] Contains recognition pattern of the W32/Tufik.A Windows virus
C:\Users\Ivan\Downloads\16.12.12\05.vir
  [DETECTION] Is the TR/Dropper.MSIL.Gen7 Trojan
C:\Users\Ivan\Downloads\16.12.12\06.vir
  [DETECTION] Is the TR/ATRAPS.Gen Trojan
C:\Users\Ivan\Downloads\16.12.12\08.vir
  [DETECTION] Is the TR/Spy.Papras.fangw Trojan
C:\Users\Ivan\Downloads\16.12.12\09.vir
[0] Archive type: GZ
--> Object
      [DETECTION] Is the TR/Dropper.VB.cclhd Trojan
      [WARNING] Infected files in archives cannot be repaired[/mw_shl_code]

显示全部楼层 · 发表于 2016-12-12 23:50:34

jasonliul 发表于 2016-12-12 23:41
贼麻辣
miss 1/7/9/10

完美miss了三个勒索

显示全部楼层 · 发表于 2016-12-13 05:03:15

加了密码你也说一声啊

显示全部楼层 · 发表于 2016-12-13 09:30:09

卡巴
01.vir       HEUR:Trojan.Script.Agent.gen
02.vir       Trojan.Win32.Agent.neygth
03.vir       Virus.Win32.Tufik.a
04.vir       Trojan-Ransom.Win32.Zerber.asxl
05.vir       HEUR:Backdoor.Win32.Generic
06.vir       Trojan.MSIL.Disfa.bqh
07.vir       HEUR:Trojan-Downloader.Script.Generic
08.vir       Trojan.Win32.Inject.wmyy
09.vir       Trojan.Win32.Trickster.bd
10.vir       HEUR:Trojan.Script.Agent.gen

显示全部楼层 · 发表于 2016-12-13 10:24:53

欧阳宣发表于 2016-12-13 05:03
加了密码你也说一声啊

没有密码啊。。。

[病毒样本] #神龟安全组病毒测试包#2016.12.12 10x

评分

本帖子中包含更多资源

本帖子中包含更多资源

浏览过的版块