#PACKAGE 0830

killmatt01

www-tekeze 发表于 2018-8-30 22:07
收到，这个文件太大，上传花了些时间。

额 上传文件似乎没有明显的进度条？

www-tekeze

killmatt01 发表于 2018-8-30 22:10
额 上传文件似乎没有明显的进度条？

是啊，没进度条只是告知已加入上传队列，不够人性化。。。但有个简单办法，删这个样本，上传完就能删否则告诉你文件正在使用无法删，你可以随便上传个样本试试。

www-tekeze

a445441 发表于 2018-8-30 20:09
win7系统拦截能力不是一般的差 不同系统 拦截效果相差很大

我虚拟机是32位8.1，微点主防也不咋的，不同系统表现相差这么大，微点官方知道吧，他们是如何解释的？

Jerry.Lin

ESET
22/24

飞碟1234

23:45

MFTP  7/24

www-tekeze

√×√×√√× 发表于 2018-8-30 20:53
囧，你要的火绒双击来了，扫出6个，去掉24号样本是个dll，还剩17个样本，双击结果就拦了1、13、14号样本 ...

早跟你说了，火绒得自己加点规则，拦截cmd和powershell是必须的，联网控制也必须开启，有这两项很多病毒木马都得残废。。。看下我的结果吧。。。

#2加驱、联网；  #3联网；  #5调用cmd、联网；  #9、#11、#12无法运行，提示相同只上一个图；  #17、#19、#20、#22调用cmd；  #18运行出错；  #8反虚拟机，实机里会联网。

当然这种并不算拦截成功，只是演示下罢了。。。

小飞侠.net

火绒安全---（ Windows 7 Ultimate with SP1 简体中文旗舰版....）：

病毒库：2018-08-30 18:42
开始时间：2018-08-31 02:39
总计用时：00:00:18
扫描对象：306个
扫描文件：24个
发现风险：6个
已处理风险：0个
发现系统修复项：0个
处理系统修复项：0个

病毒详情

风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(15).exe, 病毒名：Trojan/VBInject.b, 病毒ID：[e4beee39ea2e9885], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(16).exe, 病毒名：VirTool/Kovter.p, 病毒ID：[e92bbf97494898d2], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(21).exe, 病毒名：Trojan/VBInject.b, 病毒ID：[e4beee39ea2e9885], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(4).exe, 病毒名：HackTool/Vbinder, 病毒ID：[c2478fb1dc169ce1], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(7).exe, 病毒名：Trojan/MSIL.Obfuscated.bo, 病毒ID：[95c9571141e82cc1], 处理结果：已忽略
风险路径：C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830\0830(23).exe, 病毒名：Ransom/Cerber.t, 病毒ID：[7aae945e7838180], 处理结果：已忽略

文件名称: C:\Users\xfxnet2000\Desktop\MX Player Pro\175418360\145802370\479704092\AVTest100\PACKAGE 0830.zip
文件大小: 19.4 MB (20,356,775 字节)
修改时间: 2018年08月31日，02:37:30
MD5: D8369F31F60EA9EBE3A2E7D67A331CF1
SHA1: F4CFC743216398D6FADCEC41B68D59D54D467DF2
SHA256: D36BDA8C42AB1BF59FF50C2A945B0A7ABFD14C09D7517CD57BFE378E58CCAE16
CRC32: 34BEBE37
计算时间: 0.59s

静影沉璧

BD2019：
扫描：9/24

C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(23).exe=>(heurC)	Zum.Ransom.Philadelphia.1	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(13).exe	Trojan.Agent.DDSJ	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(23).exe=>(Dropped 0)=>(AutoIT Script)=>(unicode)	Trojan.Ransom.Philadelphia.D	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(23).exe=>(Dropped 0)=>(AutoIT r)=>(AutoIT Script)=>(unicode)	Trojan.Ransom.Philadelphia.D	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(7).exe	Gen:Variant.Razy.378118	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(23).exe=>(AutoIT r)=>(AutoIT Script)=>(unicode)	Trojan.Ransom.Philadelphia.D	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(14).exe	Gen:Heur.PonyStealer.2	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(4).exe	Gen:Variant.Binder.1	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(1).exe	Trojan.GenericKD.40434172	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(10).exe	Gen:Suspicious.Cloud.4.Wm1@aGGruJqi	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(15).exe	Gen:Variant.Kovter.1	Deleted
C:\Users\Administrator.SXCSXC-AJKJJUBR\Desktop\PACKAGE 0830\0830(21).exe	Gen:Suspicious.Cloud.8.0m1@a0u4Wudi	Deleted

双击：
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(2).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(6).exe is infected with Gen:Suspicious.Cloud.8.TGX@a0R8Csdi and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(8).exe is infected with Gen:Variant.Razy.385050 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(9).exe is infected with Trojan.GenericKD.40437033 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(11).exe is infected with Atc4.Detection and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(12).exe is infected with Trojan.GenericKD.40436896 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(16).exe is infected with Trojan.Agent.DDXC and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(17).exe is infected with Trojan.Agent.DDWX and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(18).exe is infected with Trojan.GenericKD.40436910 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(19).exe is infected with Trojan.GenericKD.40436275 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\package 0830\0830(20).exe is infected with Trojan.GenericKD.40436676 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
0830（5）运行后自删本体，之后衍生物被BD拦截
剩余样本双击结果：
22号样本运行后自删本体，BD无反应
3号样本miss
24号样本改.exe后仍然无法运行
Total：21/24=87.5%

Miostartos

renyifei 发表于 2018-8-30 19:58
macfee 7/24....

双击中

这才过一个晚上检测率飙升到21/24就剩11，23和24了

renyifei

STCn1000 发表于 2018-8-31 09:15
这才过一个晚上检测率飙升到21/24就剩11，23和24了

macfee的云相应很快的，毕竟这两年云化了