#8（18.05.17）

bbs2811125

ESET kill 7x
Log
C:\Users\Administrator\Desktop\8\1.exe - a variant of Win32/GenKryptik.BZYO trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\3.exe - a variant of MSIL/Kryptik.NGX trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\4.exe - a variant of Win32/Kryptik.GGUO trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\5.exe - a variant of Win32/GenKryptik.BZVM trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\6.exe - a variant of Win32/Injector.DXZT trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\7.exe - a variant of MSIL/Injector.REK trojan - cleaned by deleting [1]
C:\Users\Administrator\Desktop\8\8.doc - VBA/TrojanDownloader.Agent.IGJ trojan - cleaned

761773275

佔

x291502676

wusiyuanjh 发表于 2018-5-17 17:41
8号虚拟机没office没试，1号KART无反应

1号KART过了 不知道 卡巴个人版的能过不

，就一个.

迈克菲扫描杀6个，剩余5exe和8doc，5双击无法运行，被用户账户控制强制阻止，


5号不使用管理员权限运行就被主防杀了

HellBoyF

微步云沙箱检测2个为恶意，2个为可疑，剩余的检测为安全，其中恶意的样本有进程注入，反调试，窃取FTP客户端信息等信息，详细的行为分析报告可以参考如下链接：
https://s.threatbook.cn/report/w ... io_link_id=j9yGQZPy
https://s.threatbook.cn/report/w ... io_link_id=xogWB1om

心醉咖啡

毒霸扫描miss

ELOHIM

scep scan miss 1 3 5 8

x291502676

x291502676 发表于 2018-5-17 18:28
过了kart，那就多半过卡巴sw了

一号文件   KIS2019    PDM杀

欧阳宣

Malwarebytes

File: 6
Trojan.SmokeLoader, C:\USERS\JEFF6\DOWNLOADS\8\8\1.EXE, No Action By User, [887], [522712],1.0.5146
Trojan.PasswordStealer.MSIL, C:\USERS\JEFF6\DOWNLOADS\8\8\3.EXE, No Action By User, [3756], [522732],1.0.5146
Trojan.Ursnif, C:\USERS\JEFF6\DOWNLOADS\8\8\2.EXE, No Action By User, [5819], [522722],1.0.5146
Spyware.PasswordStealer, C:\USERS\JEFF6\DOWNLOADS\8\8\7.EXE, No Action By User, [3499], [522443],1.0.5146
Trojan.Emotet, C:\USERS\JEFF6\DOWNLOADS\8\8\4.EXE, No Action By User, [6237], [522487],1.0.5146
Trojan.PasswordStealer.ICO.Generic, C:\USERS\JEFF6\DOWNLOADS\8\8\6.EXE, No Action By User, [9369], [522730],1.0.5146

，就一个.

x291502676 发表于 2018-5-17 22:14
一号文件   KIS2019    PDM杀

你是win10，你去试试我哪个勒索，断网KIS关闭应用程序控制（因为应用程序控制有KNS关联，会自动阻止入库的病毒运行）跟文件监控，只开SW，看看有没有反应