锁机样本请勿实机

迷惘的执著

https://pan.baidu.com/s/1KhP_tMylU4V78GWYc8E38A

1094947421

智量没报，管家没报。

command360

火绒kill

√×√×√√×

囧，360国际版扫描miss，双击被主防拦截，阻止后并没有被锁屏 囧囧

BE_HC

Norton

此样本反虚拟机

静影沉璧

BD2019
刚弹出锁机界面后，主防杀，恶意操作全部回滚

www-tekeze

火绒报了智量没报？ 有点少见，不过相信个把小时后就会报。。

√×√×√√×

BE_HC 发表于 2018-8-16 18:33
Norton

此样本反虚拟机

囧，我这里VBOX倒是可以正常跑起来 囧囧

DF快递

avast kill

c/mm

大蜘蛛
双击程序各种弹窗之后出来一个小猪的半屏锁机画面 显示一分钟后将自动关机电脑 ，部分拦截开机回正常桌面。

Preventive Protection event: Change protected value

sid: S-1-5-21-839627113-1048685324-2973982688-1001, cid: 6132/10564:\Device\HarddiskVolume3\Users\Desktop\QQ1787817805\多功能辅助.exe
context: start addr: 0x1d082ed, image: 0x400000:\Device\HarddiskVolume3\Users\Desktop\QQ1787817805\多功能辅助.exe
  hips: type: 9, action: deny [5]
  cmd: "C:\Users\Desktop\QQ1787817805\多功能辅助.exe"

  key: \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon, access: 0x0
  value: , type: sz
current content:
00000000: 25 00 31 00 00 00                               %.1...
new content:
00000000: 43 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 C.:.\.w.i.n.d.o.
00000010: 77 00 73 00 5c 00 53 00 79 00 73 00 57 00 6f 00 w.s.\.S.y.s.W.o.
00000020: 77 00 36 00 34 00 5c 00 31 00 2e 00 69 00 63 00 w.6.4.\.1...i.c.
00000030: 6f 00 00 00                                     o...
send user blocked alert


key: \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run, access: 0x0
  value: kiss770.cn, type: sz
new content:
00000000: 43 00 3a 00 5c 00 55 00 73 00 65 00 72 00 73 00 C.:.\.U.s.e.r.s.
00000010: 5c 00 63 00 62 00 38 00 32 00 31 00 37 00 5c 00 \.c.b.8.2.1.7.\.
00000020: 44 00 65 00 73 00 6b 00 74 00 6f 00 70 00 5c 00 D.e.s.k.t.o.p.\.
00000030: 51 00 51 00 31 00 37 00 38 00 37 00 38 00 31 00 Q.Q.1.7.8.7.8.1.
00000040: 37 00 38 00 30 00 35 00 5c 00 1a 59 9f 52 fd 80 7.8.0.5.\..Y.R..
00000050: 85 8f a9 52 2e 00 65 00 78 00 65 00 00 00       ...R..e.x.e...
send user blocked alert


key: \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run, access: 0x0
  value: System, type: sz
new content:
00000000: 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 C.:.\.P.r.o.g.r.
00000010: 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 a.m. .F.i.l.e.s.
00000020: 5c 00 53 00 79 00 73 00 74 00 65 00 6d 00 2e 00 \.S.y.s.t.e.m...
00000030: 64 00 6c 00 6c 00 00 00                         d.l.l...
send user blocked alert