收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 【05.31】#VirusPackage 10x + Modified Samples
12
返回列表 发新帖
楼主: Jerry.Lin
 收起左侧

[病毒样本] 【05.31】#VirusPackage 10x + Modified Samples

[复制链接]
bbs2811125
发表于 2018-5-31 18:53:22 | 显示全部楼层
本帖最后由 bbs2811125 于 2018-5-31 19:00 编辑

ESET 05 31 18:52

Samples(9/10) + M(8/10) = Total(17/20) 就是那么自信
  1. Version of detection engine: 17474P (20180531)
  2. Date: 2018/5/31  Time: 18:52:19
  3. Scanned disks, folders and files: D:\搜狗高速下载\Virus10x 0531
  4. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(1).exe - Win32/TrojanDownloader.Delf.CKU trojan - cleaned by deleting [1]
  5. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(10).exe - a variant of Win32/Kryptik.GHGF trojan - cleaned by deleting [1]
  6. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(2).exe - a variant of Win32/GenKryptik.CBFI trojan - cleaned by deleting [1]
  7. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(4).exe - a variant of Win32/Injector.DYIH trojan - cleaned by deleting [1]
  8. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(5).exe - a variant of Win32/Injector.DYIH trojan - cleaned by deleting [1]
  9. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(6).exe - a variant of Win32/Injector.DYIF trojan - cleaned by deleting [1]
  10. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(7).exe - a variant of Win32/Injector.DYHL trojan - cleaned by deleting [1]
  11. D:\搜狗高速下载\Virus10x 0531\Modified Samples\(9).exe - a variant of Win32/Kryptik.GHGF trojan - cleaned by deleting [1]
  12. D:\搜狗高速下载\Virus10x 0531\Samples\(1).exe - Win32/TrojanDownloader.Delf.CKU trojan - cleaned by deleting [1]
  13. D:\搜狗高速下载\Virus10x 0531\Samples\(10).exe - a variant of Win32/Kryptik.GHGF trojan - cleaned by deleting [1]
  14. D:\搜狗高速下载\Virus10x 0531\Samples\(2).exe - a variant of Win32/GenKryptik.CBFI trojan - cleaned by deleting [1]
  15. D:\搜狗高速下载\Virus10x 0531\Samples\(3).exe - MSIL/Spy.Agent.AUS trojan - cleaned by deleting [1]
  16. D:\搜狗高速下载\Virus10x 0531\Samples\(4).exe - a variant of Win32/Injector.DYIH trojan - cleaned by deleting [1]
  17. D:\搜狗高速下载\Virus10x 0531\Samples\(5).exe - a variant of Win32/Injector.DYIH trojan - cleaned by deleting [1]
  18. D:\搜狗高速下载\Virus10x 0531\Samples\(6).exe - a variant of Win32/Injector.DYIF trojan - cleaned by deleting [1]
  19. D:\搜狗高速下载\Virus10x 0531\Samples\(7).exe - a variant of Win32/Injector.DYHL trojan - cleaned by deleting [1]
  20. D:\搜狗高速下载\Virus10x 0531\Samples\(9).exe - a variant of Win32/Kryptik.GHGF trojan - cleaned by deleting [1]
  21. Number of scanned objects: 20
  22. Number of threats found: 17
  23. Number of cleaned objects: 17
  24. Time of completion: 18:52:30  Total scanning time: 11 sec (00:00:11)
复制代码


剩余样本SEP全杀，大杀器就是大杀器不服不行

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

心醉咖啡
发表于 2018-5-31 19:04:28 | 显示全部楼层
毒霸扫描miss
回复

举报

Jerry.Lin
 楼主| 发表于 2018-5-31 19:27:59 | 显示全部楼层
ELOHIM 发表于 2018-5-31 17:35
SCEP 05 31 17:28

Samples(1/10) + M(2/10) = Total(3/20)

你仔细看看pal大写的
回复

举报

Jerry.Lin
 楼主| 发表于 2018-5-31 19:39:35 | 显示全部楼层
K7 05 31 19:39
Samples(2/10) + M(2/10) = Total(4/20)
回复

举报

ELOHIM
发表于 2018-5-31 20:07:44 | 显示全部楼层
本帖最后由 ELOHIM 于 2018-5-31 20:13 编辑
191196846 发表于 2018-5-31 19:27
你仔细看看pal大写的

只有第一行有大写字母啊？没看懂啊。。

求明示。

搞的我的网都断了。。。

到底是怎么回事啊。。求PM。

回复

举报

Jerry.Lin
 楼主| 发表于 2018-5-31 20:38:09 | 显示全部楼层
本帖最后由 191196846 于 2018-5-31 20:40 编辑

AVIRA

新启发技术效果不错呀

Samples(10/10) + M(10/10) = Total(20/20)

  1. 2018/5/31, 20:37:35 [Real-Time Protection] Malware found
  2.         The pattern of 'TR/Crypt.XPACK.Gen (Cloud) [TR/Crypt.XPACK.Gen]'
  3.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(9).exe'.
  4.         Action performed: Delete file
  5.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  7. 2018/5/31, 20:37:20 [Real-Time Protection] Malware found
  8.         The pattern of 'TR/Crypt.XPACK.ae6a28 (Cloud) [TR/Crypt.XPACK.ae6a28]'
  9.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(10).exe'.
  10.         Action performed: Delete file
  11.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  13. 2018/5/31, 20:37:03 [Real-Time Protection] Malware found
  14.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
  15.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(8).exe'.
  16.         Action performed: Delete file
  17.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  19. 2018/5/31, 20:36:48 [Real-Time Protection] Malware found
  20.         The pattern of 'DR/Delphi.f15f87 (Cloud) [DR/Delphi.f15f87]'
  21.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(6).exe'.
  22.         Action performed: Delete file
  23.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  25. 2018/5/31, 20:36:31 [Real-Time Protection] Malware found
  26.         The pattern of 'HEUR/AGEN.1014677 [heuristic]'
  27.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(5).exe'.
  28.         Action performed: Delete file
  29.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  31. 2018/5/31, 20:36:28 [Real-Time Protection] Malware found
  32.         The pattern of 'HEUR/AGEN.1014677 [heuristic]'
  33.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(4).exe'.
  34.         Action performed: Delete file
  35.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  37. 2018/5/31, 20:36:24 [Real-Time Protection] Malware found
  38.         The pattern of 'TR/ATRAPS.Gen [trojan]'
  39.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(3).exe'.
  40.         Action performed: Delete file
  41.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  43. 2018/5/31, 20:36:09 [Real-Time Protection] Malware found
  44.         The pattern of 'TR/Crypt.XPACK.Gen (Cloud) [TR/Crypt.XPACK.Gen]'
  45.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(2).exe'.
  46.         Action performed: Delete file
  47.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  49. 2018/5/31, 20:35:47 [Real-Time Protection] Malware found
  50.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
  51.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(1).exe'.
  52.         Action performed: Delete file
  53.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  55. 2018/5/31, 20:35:00 [Real-Time Protection] Malware found
  56.         The pattern of 'TR/AD.Emotet.E (Cloud) [TR/AD.Emotet.E]'
  57.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(10).exe'.
  58.         Action performed: Delete file
  59.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  61. 2018/5/31, 20:34:57 [Real-Time Protection] Malware found
  62.         The pattern of 'TR/AD.Emotet.F (Cloud) [TR/AD.Emotet.F]'
  63.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(9).exe'.
  64.         Action performed: Delete file
  65.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  67. 2018/5/31, 20:34:53 [Real-Time Protection] Malware found
  68.         The pattern of 'HEUR/Malware [heuristic]'
  69.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(8).exe'.
  70.         Action performed: Move file to quarantine
  71.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  73. 2018/5/31, 20:34:50 [Real-Time Protection] Malware found
  74.         The pattern of 'DR/Delphi.5ab807 (Cloud) [DR/Delphi.5ab807]'
  75.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(6).exe'.
  76.         Action performed: Delete file
  77.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  79. 2018/5/31, 20:34:46 [Real-Time Protection] Malware found
  80.         The pattern of 'HEUR/AGEN.1014677 [heuristic]'
  81.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(5).exe'.
  82.         Action performed: Delete file
  83.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  85. 2018/5/31, 20:34:43 [Real-Time Protection] Malware found
  86.         The pattern of 'HEUR/AGEN.1014677 [heuristic]'
  87.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(4).exe'.
  88.         Action performed: Delete file
  89.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  91. 2018/5/31, 20:34:38 [Real-Time Protection] Malware found
  92.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
  93.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(3).exe'.
  94.         Action performed: Delete file
  95.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  97. 2018/5/31, 20:34:34 [Real-Time Protection] Malware found
  98.         The pattern of 'TR/Crypt.XPACK.9bb681 (Cloud) [TR/Crypt.XPACK.9bb681]'
  99.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(2).exe'.
  100.         Action performed: Delete file
  101.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  103. 2018/5/31, 20:34:29 [Real-Time Protection] Malware found
  104.         The pattern of 'HEUR/AGEN.1019945 [heuristic]'
  105.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(1).exe'.
  106.         Action performed: Delete file
  107.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  109. 2018/5/31, 20:34:10 [Real-Time Protection] Malware found
  110.         The pattern of 'DR/Delphi.onlgl [dropper]'
  111.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(7).exe'.
  112.         Action performed: Delete file
  113.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  115. 2018/5/31, 20:34:10 [Real-Time Protection] Malware found
  116.         The pattern of 'DR/Delphi.onlgl [dropper]'
  117.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Modified Samples\(7).exe'.
  118.         Action performed: Delete file
  119.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001

  121. 2018/5/31, 20:34:09 [Real-Time Protection] Malware found
  122.         The pattern of 'DR/Delphi.onlgl [dropper]'
  123.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\Virus10x 0531\Samples\(7).exe'.
  124.         Action performed: Delete file
  125.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
复制代码



回复

举报

a27573
发表于 2018-5-31 20:59:51 | 显示全部楼层
ESET 05 31 20:59

Samples(10/10) + M(9/10) = Total(19/20)

  1. 时间;扫描程序;对象类型;对象;威胁;操作;用户;信息;哈希;此处首次所见
  2. 2018/5/31 20:56:30;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(2).exe;Win32/Kryptik.GHGU 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;48369481FEA476202709222F4D651687AB688607;2018/5/31 20:55:31
  3. 2018/5/31 20:56:33;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(1).exe;Win32/Spy.Zumanek.DF 特洛伊木马;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;61B9F343F4CC389D7F0EFACCC9063B749AAF5E78;2018/5/31 20:55:31
  4. 2018/5/31 20:56:45;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(10).exe;Win32/Kryptik.GHGF 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;8F3C4CFBF318529AD1FC86F70F1E8E3AF3ED8321;2018/5/31 20:55:31
  5. 2018/5/31 20:56:53;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(3).exe;MSIL/Spy.Agent.AUS 特洛伊木马;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;B8493CEE69910B95B3F96F74BBC7A4F8D58BB641;2018/5/31 20:55:31
  6. 2018/5/31 20:56:57;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(4).exe;Win32/Injector.DYIH 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;60F99A0DEE6B4E3F0788C6B353E66C6A819F8FD5;2018/5/31 20:55:31
  7. 2018/5/31 20:56:59;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(6).exe;Win32/Injector.DYIF 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;542D572CA06E1583F1C97EFAC672B1196A75BAA9;2018/5/31 20:55:31
  8. 2018/5/31 20:57:06;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(7).exe;Win32/Injector.DYHL 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;B8E5F227799556A3436C87DC73783F8C61D19EAB;2018/5/31 20:55:31
  9. 2018/5/31 20:57:10;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(5).exe;Win32/Injector.DYIH 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;E7ED2BEECF4FB1930EC4DEBDCA85E58BCDF52B9A;2018/5/31 20:55:31
  10. 2018/5/31 20:57:11;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(9).exe;Win32/Emotet.BH 特洛伊木马;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;006C6814AC5B7255B6B51DC0305DF8F50C4134F8;2018/5/31 20:55:31
  11. 2018/5/31 20:57:13;文件系统实时防护;文件;F:\病毒\收集\包(长期)\#VirusPackage\Virus10x 0531\Samples\(8).exe;Win32/GenKryptik.CBHR 特洛伊木马 的变种;通过删除清除;JINXY\宇;在应用程序新建的文件上发生事件: D:\Program Files\WinRAR\WinRAR.exe (223FCC242AB6880ADE5250A9A43E3888D270CABE).;2843A90B944986A199479B13EF45BBB25CE3B05E;2018/5/31 20:55:31
复制代码
回复

举报

XZ8SM7Sx0bVkoUV
发表于 2018-6-1 10:31:59 | 显示全部楼层
火绒 kill4
回复

举报

540923555
发表于 2018-6-1 17:00:56 | 显示全部楼层
本帖最后由 540923555 于 2018-6-1 17:02 编辑
ELOHIM 发表于 2018-5-31 17:35
SCEP 05 31 17:28

Samples(1/10) + M(2/10) = Total(3/20)

3.exe又是那个无限fondue进程的。。。这个程序上报多少次微软都不管，其余的都除了M1，已经被WD干掉了

另外M1运行出错，未见恶意行为

评分

参与人数 1人气 +1 收起 理由
ELOHIM + 1 感谢解答： ）

查看全部评分

回复

举报

540923555
发表于 2018-6-1 17:03:40 | 显示全部楼层
2605276004x 发表于 2018-5-31 17:38
Kaspersky     2018/05/31--17:40
Samples(8/10) + M(2/10) = Total(10/20)

M1也无法运行，报错后进程退出，无行为
回复

举报

12
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-4-26 01:25 , Processed in 0.094218 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表