#6（18.05.19）

显示全部楼层 · 发表于 2018-5-19 17:02:48

本帖最后由 petr0vic 于 2018-5-19 17:05 编辑

infected

HitmanPro
5/6

C:\Users\User\Desktop\6\1.exe
Size . . . . . . . : 504 832 bytes
Age . . . . . . . : 0.0 days (2018-05-19 11:48:17)
Entropy . . . . . : 4.9
SHA-256 . . . . . : 3128EF59736FDCD604698AE3D5869909E54EC1B98D8759360512855174EF8927
Product . . . . . : Realtek AC'97 Update and remove driver Tool
Publisher . . . . : Realtek Semiconductor Corp.
Description . . . : Driver Update and remove for Windows x64 or x86_32
Version . . . . . : 2.7.0.8
Copyright . . . . : Copyright (C) 2000-2005 Realtek Semiconductor Corp.
LanguageID . . . . : 1033
> Kaspersky . . . . : Trojan-Spy.MSIL.Stealer.mh
C:\Users\User\Desktop\6\2.exe
Size . . . . . . . : 183 808 bytes
Age . . . . . . . : 0.0 days (2018-05-19 11:49:05)
Entropy . . . . . : 7.3
SHA-256 . . . . . : 40BF3F74CC9F33174B31A46A19096752BD2D90B7D442EEA22CDF37695BE46AD4
> HitmanPro . . . . : Mal/<b>GandCrab</b>-D
C:\Users\User\Desktop\6\3.exe
Size . . . . . . . : 143 360 bytes
Age . . . . . . . : 0.0 days (2018-05-19 11:49:44)
Entropy . . . . . : 7.0
SHA-256 . . . . . : 966C9BB0414F74EFCF53BF953D1FC9CFC0D7C8966330F0F11E936A8C506884B4
> HitmanPro . . . . : Mal/<b>GandCrab</b>-D
C:\Users\User\Desktop\6\4.exe
Size . . . . . . . : 273 920 bytes
Age . . . . . . . : 0.0 days (2018-05-19 11:50:34)
Entropy . . . . . : 6.8
SHA-256 . . . . . : 7C8305F2D66A0393F6679995BB76FE2847C17DA6FE5891698B5D222CA7489F37
> Kaspersky . . . . : UDS:DangerousObject.Multi.Generic
C:\Users\User\Desktop\6\6.exe
Size . . . . . . . : 141 312 bytes
Age . . . . . . . : 0.0 days (2018-05-19 11:54:39)
Entropy . . . . . : 7.0
SHA-256 . . . . . : C05FF4D5338F85735E516751923E8219ED6BF8DEC04E3E6693F57D36E0F110D6
> Kaspersky . . . . : UDS:DangerousObject.Multi.Generic

复制代码

显示全部楼层 · 发表于 2018-5-19 17:03:28

本帖最后由 191196846 于 2018-5-19 17:06 编辑

KILL ALL EXE

2018/5/19, 17:04:48 [Real-Time Protection] Malware found
The pattern of 'TR/AD.Emotet.B (Cloud) [TR/AD.Emotet.B]'
detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\6\6\6.exe'.
Action performed: Delete file
User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
2018/5/19, 17:04:41 [Real-Time Protection] Malware found
The pattern of 'TR/AD.MoksSteal.Y (Cloud) [TR/AD.MoksSteal.Y]'
detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\6\6\4.exe'.
Action performed: Delete file
User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
2018/5/19, 17:04:35 [Real-Time Protection] Malware found
The pattern of 'TR/Crypt.XPACK.966c9b (Cloud) [TR/Crypt.XPACK.966c9b]'
detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\6\6\3.exe'.
Action performed: Delete file
User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
2018/5/19, 17:04:31 [Real-Time Protection] Malware found
The pattern of 'TR/Crypt.XPACK.40bf3f (Cloud) [TR/Crypt.XPACK.40bf3f]'
detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\6\6\2.exe'.
Action performed: Delete file
User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
2018/5/19, 17:04:22 [Real-Time Protection] Malware found
The pattern of 'TR/Dropper.Gen2 [trojan]'
detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\6\6\1.exe'.
Action performed: Delete file
User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

复制代码

MISS doc

显示全部楼层 · 发表于 2018-5-19 17:19:06

安天智甲终端防御系统

扫描类型：自定义查杀
扫描文件总数：6个
扫描速度：6个文件/秒
发现威胁：2个
清除威胁：2个
=============================================
威胁：C:\Users\1928530784\Desktop\6 - 副本\4.exe
类型：Trojan/Win32.AGeneric(ACloud)
处理方式：删除

威胁：C:\Users\1928530784\Desktop\6 - 副本\1.exe
类型：Trojan[Spy]/MSIL.Generic(ACloud)
处理方式：删除

显示全部楼层 · 发表于 2018-5-19 18:24:25

卡巴还剩5.doc,其他全杀

显示全部楼层 · 发表于 2018-5-19 19:08:21

dongwenqi 发表于 2018-5-19 18:24
卡巴还剩5.doc,其他全杀

doc文档启用宏后主防杀

显示全部楼层 · 发表于 2018-5-19 20:03:02

金山kill1X(6)

显示全部楼层 · 发表于 2018-5-19 23:30:03

I find that Hitman pro is a very interesting tool for its auto upload and quick cloud analysis( how two engines in cloud scan so quickly? i do not understand.)

Also for HitmanPro.Alert. i am confused that if Hitman can identify threat so quickly by sending sample to cloud, why don't they add this feature to HMA? Now HMA only identify the sample that had been uploaded to cloud but no the samples which were changed their MD5 ( HMA miss and do not upload it to cloud after executed )

显示全部楼层 · 发表于 2018-5-20 00:09:27

ESET kill 5

时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
2018/5/20 0:02:24;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#\6\6\5.doc;VBA/TrojanDownloader.Agent.IHF 特洛伊木马;已清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;8A8D16763797F4F3F9D97EC672582191D7AE2549;2018/5/20 0:02:21
2018/5/20 0:02:31;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#\6\6\6.exe;Win32/GenKryptik.CACG 特洛伊木马的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;9E6E5A4DBC0EE58608968911F2EF974CE69B7141;2018/5/20 0:02:21
2018/5/20 0:02:32;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#\6\6\2.exe;Win32/Kryptik.GGWL 特洛伊木马的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;44BAA0E5CBDCBFF17AF32651EBAB0848FA4123C1;2018/5/20 0:02:21
2018/5/20 0:02:32;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#\6\6\3.exe;Win32/Kryptik.GGWL 特洛伊木马的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;D06F86CB8219D87E65373A1518125D9E4FE3F552;2018/5/20 0:02:21
2018/5/20 0:02:35;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#\6\6\4.exe;Win32/GenKryptik.CACH 特洛伊木马的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;539954BCF56977453B7DB9F4B88035301200B1FB;2018/5/20 0:02:21

复制代码

修复5.doc,剩余1.exe

显示全部楼层 · 发表于 2018-5-20 06:39:38

咖啡6/6

显示全部楼层 · 发表于 2018-5-26 13:38:01

火绒全部kill

[病毒样本] #6（18.05.19）

本帖子中包含更多资源

评分

本帖子中包含更多资源

本帖子中包含更多资源

评分