#PACKAGE 0611

Jerry.Lin

lanzou

那个……OD貌似被蜜汁关键词




Total : 46 (23+23)

#勿传VT
#在样本有效期内（24小时），建议无需手动上报样本至厂商，便于其他人测试行为拦截，响应速度等
#样本序号以收集时间顺序排序，越大代表越接近现在时间


如 Modified Samples 报毒名与原样本有较大出入，则不计算在内。
行为防御检测计算在内
鼓励双击，结果置顶


回帖格式建议

杀软名称 + 时间

Samples查杀率 + M_Samples查杀率 = Total



例如：

XXXX  05 22 21:27

Samples(5/10) + M(3/10) = Total(8/20)  40%


----------------------------------------------
Second Scan 05 22 21:29

Samples(7/10) + M(3/10) = Total(10/20) 50%

dongwenqi

卡巴斯基
Samples(19/23) + M(9/23) = Total(28/46)  61%

Jerry.Lin

  21:07

Samples(22/23) + M(21/23) = Total(43/46)  93%

1. 2018/6/11, 21:07:09 [System Scanner] Scan
   
2.         Scan completed [The scan has been done completely.].
   
3.          Number of files:        3
   
4.          Number of directories:        2
   
5.          Number of detections:        0
   
6.          Number of warnings:        0
   
7. 
   
8. 2018/6/11, 21:06:56 [Real-Time Protection] Malware found
   
9.         The pattern of 'TR/Dropper.Gen [trojan]'
   
10.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(23).exe'.
    
11.         Action performed: Delete file
    
12.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
13. 
    
14. 2018/6/11, 21:06:53 [Real-Time Protection] Malware found
    
15.         The pattern of 'TR/Dropper.Gen [trojan]'
    
16.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(22).exe'.
    
17.         Action performed: Delete file
    
18.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
19. 
    
20. 2018/6/11, 21:06:48 [Real-Time Protection] Malware found
    
21.         The pattern of 'TR/PSW.Fareit.0cbaca (Cloud) [TR/PSW.Fareit.0cbaca]'
    
22.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(21).exe'.
    
23.         Action performed: Delete file
    
24.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
25. 
    
26. 2018/6/11, 21:06:44 [Real-Time Protection] Malware found
    
27.         The pattern of 'TR/Dropper.VB.e7f936 (Cloud) [TR/Dropper.VB.e7f936]'
    
28.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(20).exe'.
    
29.         Action performed: Delete file
    
30.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
31. 
    
32. 2018/6/11, 21:06:41 [Real-Time Protection] Malware found
    
33.         The pattern of 'DR/Delphi.31d789 (Cloud) [DR/Delphi.31d789]'
    
34.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(19).exe'.
    
35.         Action performed: Delete file
    
36.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
37. 
    
38. 2018/6/11, 21:06:36 [Real-Time Protection] Malware found
    
39.         The pattern of 'TR/Dropper.MSIL.7253a2 (Cloud) [TR/Dropper.MSIL.7253a2]'
    
40.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(18).exe'.
    
41.         Action performed: Delete file
    
42.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
43. 
    
44. 2018/6/11, 21:06:32 [Real-Time Protection] Malware found
    
45.         The pattern of 'TR/Crypt.ZPACK.Gen [trojan]'
    
46.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(17).exe'.
    
47.         Action performed: Delete file
    
48.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
49. 
    
50. 2018/6/11, 21:06:29 [Real-Time Protection] Malware found
    
51.         The pattern of 'HEUR/AGEN.1028369 [heuristic]'
    
52.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(16).exe'.
    
53.         Action performed: Delete file
    
54.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
55. 
    
56. 2018/6/11, 21:06:26 [Real-Time Protection] Malware found
    
57.         The pattern of 'TR/Crypt.EPACK.45f784 (Cloud) [TR/Crypt.EPACK.45f784]'
    
58.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(15).exe'.
    
59.         Action performed: Delete file
    
60.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
61. 
    
62. 2018/6/11, 21:06:22 [Real-Time Protection] Malware found
    
63.         The pattern of 'TR/Dropper.Gen [trojan]'
    
64.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(14).exe'.
    
65.         Action performed: Delete file
    
66.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
67. 
    
68. 2018/6/11, 21:06:19 [Real-Time Protection] Malware found
    
69.         The pattern of 'TR/Dropper.Gen [trojan]'
    
70.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(13).exe'.
    
71.         Action performed: Delete file
    
72.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
73. 
    
74. 2018/6/11, 21:06:16 [Real-Time Protection] Malware found
    
75.         The pattern of 'TR/Dropper.Gen [trojan]'
    
76.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(12).exe'.
    
77.         Action performed: Delete file
    
78.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
79. 
    
80. 2018/6/11, 21:06:13 [Real-Time Protection] Malware found
    
81.         The pattern of 'TR/Dropper.Gen [trojan]'
    
82.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(11).exe'.
    
83.         Action performed: Delete file
    
84.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
85. 
    
86. 2018/6/11, 21:06:10 [Real-Time Protection] Malware found
    
87.         The pattern of 'TR/Crypt.ZPACK.Gen [trojan]'
    
88.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(9).exe'.
    
89.         Action performed: Delete file
    
90.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
91. 
    
92. 2018/6/11, 21:06:08 [Real-Time Protection] Malware found
    
93.         The pattern of 'DR/Delphi.Gen [dropper]'
    
94.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(8).exe'.
    
95.         Action performed: Delete file
    
96.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
    
97. 
    
98. 2018/6/11, 21:06:02 [Real-Time Protection] Malware found
    
99.         The pattern of 'DR/Delphi.f33d58 (Cloud) [DR/Delphi.f33d58]'
    
100.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(7).exe'.
     
101.         Action performed: Delete file
     
102.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
103. 
     
104. 2018/6/11, 21:05:58 [Real-Time Protection] Malware found
     
105.         The pattern of 'DR/Delphi.Gen [dropper]'
     
106.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(6).exe'.
     
107.         Action performed: Delete file
     
108.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
109. 
     
110. 2018/6/11, 21:05:50 [Real-Time Protection] Malware found
     
111.         The pattern of 'TR/Dropper.Gen [trojan]'
     
112.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(4).exe'.
     
113.         Action performed: Delete file
     
114.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
115. 
     
116. 2018/6/11, 21:05:46 [Real-Time Protection] Malware found
     
117.         The pattern of 'TR/Dropper.MSIL.8dcd44 (Cloud) [TR/Dropper.MSIL.8dcd44]'
     
118.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(3).exe'.
     
119.         Action performed: Delete file
     
120.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
121. 
     
122. 2018/6/11, 21:04:41 [Real-Time Protection] Malware found
     
123.         The pattern of 'TR/Agent.77b49c (Cloud) [TR/Agent.77b49c]'
     
124.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(1).exe'.
     
125.         Action performed: Delete file
     
126.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
127. 
     
128. 2018/6/11, 21:04:31 [Real-Time Protection] Malware found
     
129.         The pattern of 'TR/Dropper.VB.183df9 (Cloud) [TR/Dropper.VB.183df9]'
     
130.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(23).exe'.
     
131.         Action performed: Delete file
     
132.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
133. 
     
134. 2018/6/11, 21:04:28 [Real-Time Protection] Malware found
     
135.         The pattern of 'HEUR/AGEN.1010044 [heuristic]'
     
136.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(22).exe'.
     
137.         Action performed: Delete file
     
138.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
139. 
     
140. 2018/6/11, 21:04:25 [Real-Time Protection] Malware found
     
141.         The pattern of 'TR/AD.MalwareCrypter.14c974 (Cloud) [TR/AD.MalwareCrypter.14c974]'
     
142.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(21).exe'.
     
143.         Action performed: Delete file
     
144.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
145. 
     
146. 2018/6/11, 21:04:22 [Real-Time Protection] Malware found
     
147.         The pattern of 'TR/AD.BDSNanoCoreClient.Y (Cloud) [TR/AD.BDSNanoCoreClient.Y]'
     
148.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(20).exe'.
     
149.         Action performed: Delete file
     
150.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
151. 
     
152. 2018/6/11, 21:04:16 [Real-Time Protection] Malware found
     
153.         The pattern of 'DR/Delphi.c57a73 (Cloud) [DR/Delphi.c57a73]'
     
154.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(19).exe'.
     
155.         Action performed: Delete file
     
156.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
157. 
     
158. 2018/6/11, 21:04:13 [Real-Time Protection] Malware found
     
159.         The pattern of 'TR/Dropper.MSIL.6ee58c (Cloud) [TR/Dropper.MSIL.6ee58c]'
     
160.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(18).exe'.
     
161.         Action performed: Delete file
     
162.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
163. 
     
164. 2018/6/11, 21:04:07 [Real-Time Protection] Malware found
     
165.         The pattern of 'TR/Dropper.VB.8970af (Cloud) [TR/Dropper.VB.8970af]'
     
166.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(17).exe'.
     
167.         Action performed: Delete file
     
168.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
169. 
     
170. 2018/6/11, 21:04:01 [Real-Time Protection] Malware found
     
171.         The pattern of 'HEUR/AGEN.1028369 [heuristic]'
     
172.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(16).exe'.
     
173.         Action performed: Delete file
     
174.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
175. 
     
176. 2018/6/11, 21:03:55 [Real-Time Protection] Malware found
     
177.         The pattern of 'TR/Crypt.EPACK.8990b0 (Cloud) [TR/Crypt.EPACK.8990b0]'
     
178.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(15).exe'.
     
179.         Action performed: Delete file
     
180.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
181. 
     
182. 2018/6/11, 21:03:52 [Real-Time Protection] Malware found
     
183.         The pattern of 'TR/Dropper.VB.92c243 (Cloud) [TR/Dropper.VB.92c243]'
     
184.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(14).exe'.
     
185.         Action performed: Delete file
     
186.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
187. 
     
188. 2018/6/11, 21:03:49 [Real-Time Protection] Malware found
     
189.         The pattern of 'TR/Dropper.VB.b65970 (Cloud) [TR/Dropper.VB.b65970]'
     
190.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(13).exe'.
     
191.         Action performed: Delete file
     
192.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
193. 
     
194. 2018/6/11, 21:03:43 [Real-Time Protection] Malware found
     
195.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
     
196.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(12).exe'.
     
197.         Action performed: Delete file
     
198.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
199. 
     
200. 2018/6/11, 21:03:40 [Real-Time Protection] Malware found
     
201.         The pattern of 'TR/Dropper.MSIL.c97930 (Cloud) [TR/Dropper.MSIL.c97930]'
     
202.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(11).exe'.
     
203.         Action performed: Delete file
     
204.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
205. 
     
206. 2018/6/11, 21:03:34 [Real-Time Protection] Malware found
     
207.         The pattern of 'TR/Dropper.VB.ab4935 (Cloud) [TR/Dropper.VB.ab4935]'
     
208.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(9).exe'.
     
209.         Action performed: Delete file
     
210.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
211. 
     
212. 2018/6/11, 21:03:28 [Real-Time Protection] Malware found
     
213.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
     
214.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(8).exe'.
     
215.         Action performed: Delete file
     
216.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
217. 
     
218. 2018/6/11, 21:03:22 [Real-Time Protection] Malware found
     
219.         The pattern of 'DR/Delphi.b3a388 (Cloud) [DR/Delphi.b3a388]'
     
220.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(7).exe'.
     
221.         Action performed: Delete file
     
222.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
223. 
     
224. 2018/6/11, 21:03:18 [Real-Time Protection] Malware found
     
225.         The pattern of 'HEUR/APC (Cloud) [HEUR/APC]'
     
226.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(6).exe'.
     
227.         Action performed: Delete file
     
228.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
229. 
     
230. 2018/6/11, 21:03:15 [Real-Time Protection] Malware found
     
231.         The pattern of 'TR/Dropper.Gen [trojan]'
     
232.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(4).exe'.
     
233.         Action performed: Delete file
     
234.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
235. 
     
236. 2018/6/11, 21:03:01 [Real-Time Protection] Malware found
     
237.         The pattern of 'TR/Dropper.MSIL.baf5a3 (Cloud) [TR/Dropper.MSIL.baf5a3]'
     
238.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(3).exe'.
     
239.         Action performed: Delete file
     
240.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
241. 
     
242. 2018/6/11, 21:02:52 [Real-Time Protection] Malware found
     
243.         The pattern of 'TR/Agent.c5e1ca (Cloud) [TR/Agent.c5e1ca]'
     
244.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(1).exe'.
     
245.         Action performed: Delete file
     
246.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
247. 
     
248. 2018/6/11, 21:02:24 [Real-Time Protection] Malware found
     
249.         The pattern of 'TR/PSW.Separ.rghte [trojan]'
     
250.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(5).exe'.
     
251.         Action performed: Delete file
     
252.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
253. 
     
254. 2018/6/11, 21:02:23 [Real-Time Protection] Malware found
     
255.         The pattern of 'TR/AD.Nanocore.lqmhg [trojan]'
     
256.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(10).exe'.
     
257.         Action performed: Delete file
     
258.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
259. 
     
260. 2018/6/11, 21:02:23 [Real-Time Protection] Malware found
     
261.         The pattern of 'TR/AD.Nanocore.lqmhg [trojan]'
     
262.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Modified Samples\(10).exe'.
     
263.         Action performed: Delete file
     
264.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
265. 
     
266. 2018/6/11, 21:02:22 [Real-Time Protection] Malware found
     
267.         The pattern of 'TR/PSW.Separ.rghte [trojan]'
     
268.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(5).exe'.
     
269.         Action performed: Delete file
     
270.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
271. 
     
272. 2018/6/11, 21:02:22 [Real-Time Protection] Malware found
     
273.         The pattern of 'TR/AD.Nanocore.lqmhg [trojan]'
     
274.         detected in file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\PACKAGE 0611\Samples\(10).exe'.
     
275.         Action performed: Delete file
     
276.         User SID: S-1-5-21-3774652721-2607747548-2788097174-1001
     
277. 
     

复制代码

ELOHIM

SCEP  06/11 20:50
S(4/23) + M(5/23) = Total(9/46)  39.1%

B100D1E55

ESET 17533

S(21/23) + M(21/23) = Total(42/46)  91.3%
等下测双击

剩余2和12

2跑出来报错，没观测到行为，ESET LiveGrid上显示可信：



12号ESET内存检测fareit同时检测僵尸网络

救命稻草

瑞星社区扫描版21:23
Samples(20/23) + M(16/23) = Total(36/46)  78.26%

ccboxes

卡巴斯基 0611 20:26
Miss样本将上传云沙盒鉴定，不过该沙盒可以选择不分享样本到VT等，不算违反规则。
扫描
Samples(19/23) + M(9/23) = Total(28/46)

综合
Samples(22/23) + M(20/23) = Total(42/46)

值得注意的：

2/M2 似乎是毒，但在我的电脑上跑不出行为，Miss
13/M13 23/M23 是同一个盗号木马的两个马甲，会延时，等了五分钟卡巴击杀
M15 反沙盘反虚拟机，然而之后并没有其他行为，Miss
M17 在双击之前就被拉黑了，无法测试主防，就不算Miss了
M19 盗号木马，依然在我的电脑上哑火，运行十几秒就自退，无行为无衍生物 Miss

现在想测个主防太难了，样本一个个都是大爷，条件不满足就自退；好歹运行起来，还要躺5分钟再搞事，不过根据我的经验，延时应该对主防完全无效。

聆听落雨

诺顿NS  06 11 21:16

Samples(17/23) + M(17/23) = Total(34/46)  73.9%

温馨小屋

Bitdefender


Samples(6/23) + M(6/23) = Total(12/46)  26%

ELOHIM

温馨小屋 发表于 2018-6-11 21:35
Bitdefender

16#刚刚微软云杀了。
有些样本也有一些报错的提示，但是微软照样杀。
小心障眼法。