Reyptson ransomware 西班牙语勒索信

引领五基生活

，就一个.

AVA 25.13402
GD 25.10012

*** Process ***

Process: 5364
File name: 1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe
Path: d:\360极速浏览器下载\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe

Publisher: Unknown publisher
Creation date: 2017年7月16日 21:11:47
Modification date: 2017年7月16日 0:40:37

Started by: Explorer.EXE
Publisher: Microsoft Windows


*** Actions ***

The virus scanner has detected that the file is malicious.
The program is trying to create a startup item to launch a program automatically at system startup.
An unknown process was accessed.
The program has created or manipulated an executable file.
The program can be used to execute any program code.
The cloud server recognized this file and identified it as malicious.


*** Quarantine ***

The following files were moved into quarantine:
C:\Users\Administrator\AppData\Roaming\Spotify\SpotifyWebHelper\Spotify.vbs
C:\Users\Administrator\AppData\Roaming\Spotify\SpotifyWebHelper\SpotifyWebHelper.exe
D:\360极速浏览器下载\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe

The following registry entries were deleted:

\registry\user\s-1-5-21-3791087008-2748381550-4144482455-500\software\microsoft\windows\currentversion\run || spotify web helper v1.0

YHKSDiwnJyYmJwctJygnJycHLicrJyonBy8nJycnJganQicpdHJCJwi3cpJycnKCgCsnKCYmJwjocnJiYnJykCsnp5AtJwfpcrJiYnKyoCwnKyYmJwvbcnJiYnJywConJyYmJwf8cnJiYnJy0CgnKyYmJwvtcoJiYnKC8CYnKSYmJwmPcsJywmJi8C4nJycnJgZ3KicHpysb/zVmKioZmjVmKycb/zVmKgm3LScnJycmBscuJyomJicKxy8nLSYmJw3nKCe5cI9yknCfcoJycnJycK9ycmJicnKAlnKygGpygmJicoKA+3KicpJycoCuctKAvnLSYmJy0gAA
Rules version: 5.0.148
OS: Windows 10.0 Service Pack 0.0 Build: 14393 - Workstation 64bit OS
dll version: 70613

"D:\360极速浏览器下载\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a\1d2968648d8e72ff017ebad79e1b16eb8d09fb8257e5a5235e0ad63e6bee0c4a.exe"
MD5: C9DAFB23BDBA2A46FE1E573AE75C0D4D
C:\Windows\explorer.exe /factory,ceff45ee-c862-41de-aee2-a022c81eda92 -Embedding
MD5: 679D17F8CDB938C7100D7A647953677E

尘梦幽然

68221281 发表于 2017-7-16 02:13
诺顿双击被过，SONAR无反应。
附上一个VT的图，有意思的是除了CrowdStrike的机器学习以外，赛门铁克 ...

CrowdStrike的报法和其他厂商似乎并不太一样，他们的检测更像是告诉你这个文件有多少的可能性是恶意的

schumi小粉

毫无压力！

尘梦幽然 发表于 2017-7-17 00:32
CrowdStrike的报法和其他厂商似乎并不太一样，他们的检测更像是告诉你这个文件有多少的可能性是恶意的

这个样本100%的确定性，感觉还是很厉害的。不过确实感觉赛门铁壳的误报要少一点。

shanghaiplmm

有密码，解不开。

Dolby123

shanghaiplmm 发表于 2017-7-17 12:47
有密码，解不开。

infected

greenfinger168

一解压，ESS直接删除