掛馬樣本包(4X) #0617

piouu

Agu 发表于 2017-6-17 23:29
我這裡也是，大概是不支援續傳軟體。檔案不大就用瀏覽器下載吧

感谢解答

Eset小粉絲

piouu 发表于 2017-6-17 23:08
XP系统用IDM下载时提示“无法与......建立安全连接”

已测试，IDM可以支援下载喔。

諾言敵不過時間

火絨3X MISS 1ulxomeobigohiwhufovi.exe

B100D1E55

Agu 发表于 2017-6-17 15:14
Payload可以正常分析，看來應該是有反調試所以金剛沒法分析：
https://www.hybrid-analysis.com/sample/ ...

的确是有反调试的样子。
一开始我还以为我虚拟机的伪装大法被识破了所以闪退，后来发现可以复现payload的行为（在temp释放一个bat然后删除自身）。实际上你贴的那个样本的链接已经换了一个同名的新样本，基本命中了我后来加的大部分反虚拟机规则……

Jirehlov1234

BDTS 2017 UP TO DATE

[mw_shl_code=xml,true]BitDefender Log File


Product : Bitdefender Total Security 2017
Scanning task : Contextual Scan
Log date : 2017年6月18日 星期日 6:49:42
Log path : C:\Users\Administrator\AppData\Roaming\Bitdefender\Desktop\Profiles\Logs\2ab858ed-450b-4bb6-b67c-8e3c45ec13ac\1497739775_1_02.xml


Scan Paths:
Path : E:\TEST\1ulxomeobigohiwhufovi.exe
Path : E:\TEST\1306.exe
Path : E:\TEST\index.exe
Path : E:\TEST\pax617.exe


[-]Scan Results

[-]Resolved issues:
Object Path Threat Name Final Status

E:\TEST\index.exe Gen:Variant.Zusy.242302 Deleted
E:\TEST\pax617.exe Gen:Variant.Mikey.66431 Deleted
E:\TEST\1306.exe Trojan.GenericKD.5368635 Deleted
E:\TEST\1ulxomeobigohiwhufovi.exe Trojan.GenericKD.5369509 Deleted


[-]Detailed Scan Summary

[-]Basic
Scanned items : 4
Infected items : 4
Suspicious items : 0 (no suspected items have been detected)
Resolved items : 4
Unresolved items : 0 (no issues remained unresolved)

[-]Advanced
Scan time : 0: 0: 01
Files per second : 4
Skipped items : 0
Password-protected items : 0
Overcompressed items : 0
Scanned archives : 0
Input-output errors : 0
Scanned boot sectors : 0
Scanned processes : 0
Infected processes : 0
Scanned registry keys : 0
Infected registry keys : 0
Scanned cookies : 0
Infected cookies : 0


[-]Scan Options

[-]Target Threat Types:
Scan for viruses : Yes
Scan for adware : Yes
Scan for spyware : Yes
Scan for applications : Yes
Scan for dialers : Yes
Scan for rootkits : No
Scan for keyloggers : Yes

[-]Target Selection Options:
Scan registry keys : No
Scan cookies : No
Scan boot sectors : No
Scan memory processes : No
Scan archives : Yes
Scan runtime packers : Yes
Scan emails : Yes
Scan all files : Yes
Heuristic Scan : Yes
Scanned extensions : none configured
Excluded extensions : none configured

[-]Target Processing:
Default primary action for infected objects : None
Default secondary action for infected objects : None
Default primary action for suspicious objects : None
Default secondary action for suspicious objects : None
Default action for hidden objects : None
Default action for password-protected objects : Prompt for password

[-]Scan engines summary
Number of virus signatures : 8905685
[/mw_shl_code]