2x Powershell Ransomware

显示全部楼层 · 发表于 2017-7-13 01:49:29

本帖最后由 Dolby123 于 2017-7-13 02:18 编辑

VT : 9/58
https://www.virustotal.com/en/fi ... 962cf56d1/analysis/

SHA256:	a242c9ddf4e92088ab3caf11605cb9a35c77fa751c9f37b54eeec0b962cf56d1
File name:	Ransom PWS Abpodul 802F71B1.js
Detection ratio:	9 / 58
Analysis date:	2017-07-12 15:44:12 UTC ( 1 hour, 52 minutes ago )

[mw_shl_code=css,true]Ad-Aware       Generic.Ransom.PWS.Abpodul.802F71B1       20170712
AegisLab       Virus.Ransom.Pws!c       20170712
Arcabit       Generic.Ransom.PWS.Abpodul.802F71B1       20170712
BitDefender       Generic.Ransom.PWS.Abpodul.802F71B1       20170712
Emsisoft       Generic.Ransom.PWS.Abpodul.802F71B1 (B)       20170712
F-Secure       Generic.Ransom.PWS.Abpodul.802F71B1       20170712
GData       Generic.Ransom.PWS.Abpodul.802F71B1       20170712
MAX       malware (ai score=88)       20170712
eScan       Generic.Ransom.PWS.Abpodul.802F71B1       20170712 [/mw_shl_code]

VT : 12/56
https://www.virustotal.com/en/fi ... 73b51617f/analysis/

SHA256:	cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b51617f
File name:	cce0da7814b5966ffacfecacec0e87aec83989889b56e4dc37eed7873b51617f.bin
Detection ratio:	12 / 56
Analysis date:	2017-07-11 11:07:51 UTC ( 1 day, 6 hours ago )

[mw_shl_code=css,true]Ad-Aware       Trojan.GenericKD.12006309       20170711
AegisLab       Troj.Generickd!c       20170711
Arcabit       Trojan.Generic.DB733A5       20170711
BitDefender       Trojan.GenericKD.12006309       20170711
Emsisoft       Trojan.GenericKD.12006309 (B)       20170711
F-Secure       Trojan.GenericKD.12006309       20170711
GData       Trojan.GenericKD.12006309       20170711
Ikarus       Trojan-Downloader.JS.Nemucod       20170711
MAX       malware (ai score=80)       20170711
Microsoft       Ransom:PowerShell/Abpodul.A       20170711
eScan       Trojan.GenericKD.12006309       20170711
ViRobot       JS.S.Downloader.2445.C       20170711[/mw_shl_code]

显示全部楼层 · 发表于 2017-7-13 01:53:28

本帖最后由 900703 于 2017-7-13 01:58 编辑

看來MAX偵測率很棒嘛
360 Scan Miss! 雙擊攔截

显示全部楼层 · 发表于 2017-7-13 04:05:54

不就是malwaretips刚发的那个么

显示全部楼层 · 发表于 2017-7-13 05:23:03

F-Secure Kill All

Immunet Miss All

显示全部楼层 · 发表于 2017-7-13 08:03:29

老司机杀1，Miss掉d1结尾的样本

显示全部楼层 · 发表于 2017-7-13 08:33:21

BDTS

运行的话

显示全部楼层 · 发表于 2017-7-13 09:11:35

Gollum 发表于 2017-7-13 08:33
BDTS

果然，这类样本在BD2018下无法运行，但也没有弹出拦截信息。有点迷。

显示全部楼层 · 发表于 2017-7-13 09:30:03

可恶

显示全部楼层 · 发表于 2017-7-13 11:29:01

Gollum 发表于 2017-7-13 09:30
可恶

你怎么让它成功运行的。

显示全部楼层 · 发表于 2017-7-13 11:56:17

!!! IMPORTANT INFORMATION !!!!

All of your files are encrypted with RSA-2048 and AES-128 ciphers.
More information about the RSA and AES can be found here:
http://en.wikipedia.org/wiki/RSA_(cryptosystem)
http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
Decrypting of your files is ONLY possible with the private key and decrypt program, which is on our secret server.
To receive your private key follow this link:
1. http://7huuyjioistbluco.onion.to
If the address is not available, follow these steps:
1. Download and install Tor Browser: https://www.torproject.org/download/download-easy.html
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: 7huuyjioistbluco.onion
4. Follow the instructions on the site.

!!! Your Personal identification ID: SRKiHWmMAUPFcVpZfheQC9ab

[病毒样本] 2x Powershell Ransomware

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源