#PACKAGE 0823

WHALE-FALL

360一扫 25/28   89.3%

www-tekeze

cloud01 发表于 2018-8-23 22:13
为什么你能跑到我前面去

眼疾手快，先占楼。。

cloud01

www-tekeze 发表于 2018-8-23 22:22
眼疾手快，先占楼。。

脸啊   没了

Picca

22:00 卡巴扫描 15 + 双击
2  PDM:Trojan.Win32.Badur.a
5  PDM:Trojan.Win32.Badur.a
6  常驻内存，调用ie访问恶意网址，卡巴阻止
14 PDM:Trojan.Win32.Generic
15 PDM:Trojan.Win32.Generic
16 自退出
18 PDM:Trojan.Win32.Generic
19 PDM:Trojan.Win32.Generic
20 停止工作
21 自退出
22 调用powershell,PDM:Exploit.Win32.Generic
23 自退出
24 C:\Users\AppData\Local\Temp\CCF6.tmp;UDS:Trojan-Banker.Win32.RTM.sb,然后本体退出
27 PDM:Exploit.Win32.Generic.nblk



*测试单个样本未重启，未使用高级清除

WHALE-FALL

WHALE-FALL 发表于 2018-8-23 22:20
360一扫 25/28   89.3%

1分钟后（云上报文件结果出来后）补杀1个  
PS：另附鉴定结果：3 低风险  27 暂未发现风险

WHALE-FALL

Tencent PCManager　虚拟机启动中１８／２８

静影沉璧

BD2019

时间：22:40-23:20

扫描：21/29

C:\Users\Administrator\Desktop\PACKAGE 0823\0823(26).exe	Trojan.GenericKD.40419202	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(8).exe	Trojan.Agent.DDKY	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(24).exe	Trojan.GenericKD.40422091	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(6).exe	Trojan.GenericKD.40421519	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(1).exe	Trojan.GenericKD.40420364	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(9).exe	Trojan.GenericKD.40421724	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(5).exe	Trojan.Autoruns.GenericKDS.31179032	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(4).exe	Trojan.Agent.DDJV	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(28).exe	Trojan.Agent.DDKY	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(20).exe	Gen:Suspicious.Cloud.8.Dm1@aq0AHEmi	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(2).exe	Trojan.Autoruns.GenericKDS.31179014	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(3).exe	Gen:Suspicious.Cloud.8.PL3@au4LhLfo	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(12).exe	Gen:Variant.Razy.381933	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(7).exe	Gen:Variant.Razy.381947	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(16).exe	Trojan.GenericKD.40422209	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(19).exe	Gen:Suspicious.Cloud.8.Fm1@aGPRXTji	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(21).exe	Gen:Variant.Razy.380846	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(10).exe	Trojan.GenericKD.40421687	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(15).exe	Trojan.GenericKD.40421473	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(17).exe	Trojan.Agent.DDKY	Deleted
C:\Users\Administrator\Desktop\PACKAGE 0823\0823(11).exe	Trojan.GenericKD.40421207	Deleted

双击：
The file c:\users\administrator\desktop\package 0823\0823(13).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

The file c:\users\administrator\desktop\package 0823\0823(14).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator\desktop\package 0823\0823(18).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.（该样本同时触发OTP，Ransomware remediation，Antivirus，ATD，处理了12分钟……）
The file c:\users\administrator\desktop\package 0823\0823(22).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator\desktop\package 0823\0823(23).exe is infected with Gen:Suspicious.Cloud.8.HGX@aurmQAai and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator\desktop\package 0823\0823(25).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator\desktop\package 0823\0823(29).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
剩余样本双击结果：
27号样本运行几分钟后自退，BD无反应。
Total：28/29 96.6%

www-tekeze

梦想起航. 发表于 2018-8-23 22:11
我就知道！！   金山0/28！！！！

安天智甲也是鸭蛋，等我试下管家和瑞星。。

www-tekeze

www-tekeze 发表于 2018-8-23 22:44
安天智甲也是鸭蛋，等我试下管家和瑞星。。

腾管无BD，only one 。。

Pluto爱卡戎

Comodo Internet Security 右键扫描出0个病毒，在Comodo container里运行，杀了14个文件
剩余15个样本