【缉毒卫队测试包】第6期 20170203

神龟Turmi

下载链接：https://eyun.baidu.com/s/3hrFCHa0  解压密码：infected
样本数量：10

本期收集者：神龟Turmi、Windows7爱好者、Popu111


webroot 标准动态启发 6x
剩余 3 6 7 9

update：二十分钟不到 3号已经入库 目前剩余6 7 9

欧阳宣

avira 8x

[mw_shl_code=css,true]D:\Virus\2017.2.3\2017.2.3-10.Ransom.India.exe% (SHA-256: 85f03434823bf9d9fbf6359c60bf7f5d47c65079b3385a11a003d5f879881fcd)
  [DETECTION] Contains suspicious code HEUR/APC (Cloud)
  [NOTE]      The file was moved to the quarantine directory under the name '50c8c306.qua'!
D:\Virus\2017.2.3\2017.2.3-08.Ransom.Cerber.exe% (SHA-256: 2d0a0b404aab8144ac7531077b15e81c636bb81ce1d4e0809f6bfbe110923341)
  [DETECTION] Is the TR/Crypt.XPACK.Gen7 (Cloud) Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '485feca8.qua'!
D:\Virus\2017.2.3\2017.2.3-06.Trojan.Derozax.exe% (SHA-256: 764e1feb721ddf3d2072127abef6c2ca863ffb66b0173ff9d288825bd82beaa8)
  [DETECTION] Contains suspicious code HEUR/APC (Cloud)
  [NOTE]      The file was moved to the quarantine directory under the name '1a00b647.qua'!
D:\Virus\2017.2.3\2017.2.3-05.Ransom.Actualclinic.exe%
  [DETECTION] Is the TR/Crypt.Xpack.pbrdb Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '7c37f9fc.qua'!
D:\Virus\2017.2.3\2017.2.3-04.Trojan.Kovter.exe%
  [DETECTION] Is the TR/Crypt.Xpack.nffto Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '39b3d4c8.qua'!
D:\Virus\2017.2.3\2017.2.3-03.Trojan.Bese.exe%
  [DETECTION] Is the TR/AD.DelfInject.gdmyg Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '46a8e6b6.qua'!
D:\Virus\2017.2.3\2017.2.3-02.Ransom.Locky.exe%
  [DETECTION] Is the TR/Crypt.ZPACK.ltizv Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '0a10caf5.qua'!
D:\Virus\2017.2.3\2017.2.3-01.Ransom.GotdnsCh.exe%
  [DETECTION] Is the TR/Black.Gen2 Trojan
  [NOTE]      The file was moved to the quarantine directory under the name '76088a9e.qua'![/mw_shl_code]

xcvbaby

毒霸：3
扫描类型：自定义查杀
扫描文件总数：15
扫描速度：1文件/秒
发现威胁：3个
清除威胁：3个
=============================================
[2017-02-03 19:45:19]
威胁：d:\我的文档\desktop\2017.2.3\2017.2.3-03.trojan.bese.exe%
类型：win32.troj.generickd.v.(kcloud)
处理方式：删除

[2017-02-03 19:45:19]
威胁：d:\我的文档\desktop\2017.2.3\2017.2.3-08.ransom.cerber.exe%/<a:nsis>/2017.2.3-08.ransom.cerber/<a:nsis>/晙\selfseekers.dll
类型：win32.troj.undef.(kcloud)
处理方式：删除

[2017-02-03 19:45:19]
威胁：d:\我的文档\desktop\2017.2.3\2017.2.3-01.ransom.gotdnsch.exe%
类型：win32.heur.kvmh004.a
处理方式：删除

popu111

管家国内版

高启发，BD引擎（虽然没啥卵用）

woc扫了8分钟你就杀了俩。。。02、03

双击测试中，目前：

01 修改MBR拦截，后消失

04 双击后消失，无反应，目测miss

05 miss

06 xp启动不能

07 miss

08 运行过程中释放神秘衍生物被kill，桌面修改，勒索信出现，后台有个语音在用蹩脚的英语读勒索信，文件未被加密（也可能是测试文件太小）

09 嘿嘿嘿，http://www.bilibili.com/video/av8351733/

10 添加启动项弹窗，阻止后未kill，目前未见动作

KIS2017 6X
剩余02,08,09.10
KOS扫描剩余样本，全部安全

已上报

Dolby123

avast 8x
剩下 7,9

神龟Turmi

霄栋 发表于 2017-2-3 19:52
KIS2017 6X
剩余02,08,09.10
KOS扫描剩余样本，全部安全

Cerber分析出来都是安全？

神龟Turmi

Dolby123 发表于 2017-2-3 19:55
avast 8x
剩下 7,9

看来bobo的yourransom测试版特制版完美all miss啊

神龟Turmi 发表于 2017-2-3 19:56
Cerber分析出来都是安全？

那不是分析结果，只是扫描结果，点那个disagree就可以上报

DF快递

NS剩下三个