PKEicBwp0DM.exe VT(18/66) 44.exe VT(18/65)

Agu

PKEicBwp0DM.exe
掛馬網址：avuctekintekstil.com/mBWUTiWqfh/
VT(18/66)：https://www.virustotal.com/#/fil ... 5a1c67efa/detection

44.exe
掛馬網址：marketingshared.com.mx/nrCI
VT(18/65)：https://www.virustotal.com/#/fil ... 60a425a69/detection

樣本載點(SHA-256前六碼8FE765、9BDA4D，密碼infected)：
https://we.tl/t-m7h3zaElA4

測試：
Malwarebytes - Miss All

静影沉璧

Avira-kill all
08/31/2018,12-34-25        [INFO]        FP 报告文件 'C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\44.exe' 的“无误报”状态
08/31/2018,12-34-25        [INFO]        文件已通过 Protection Cloud扫描。 SHA256 = C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\44.exe
08/31/2018,12-34-25        [INFO]        C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\44.exe
08/31/2018,12-34-25        [INFO]        [DETECTION] file contains 'TR/Crypt.EPACK.9bda4d'
08/31/2018,12-34-26        [INFO]        FP 报告文件 'C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\PKEicBwp0DM.exe' 的“无误报”状态
08/31/2018,12-34-26        [INFO]        文件已通过 Protection Cloud扫描。 SHA256 = C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\PKEicBwp0DM.exe
08/31/2018,12-34-26        [INFO]        C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\PKEicBwp0DM.exe
08/31/2018,12-34-26        [INFO]        [DETECTION] file contains 'TR/Crypt.EPACK.8fe765'
08/31/2018,12-34-39        [INFO]        repair.rdf loaded (version: 1.0.44.28)
08/31/2018,12-34-41        [INFO]        Repair of Generic started.
08/31/2018,12-34-56        [INFO]        Repair of Generic finished successfully.
08/31/2018,12-34-56        [INFO]        Repair of TR/Crypt.EPACK.9bda4d started.
08/31/2018,12-35-15        [ERROR]        Error in calling script function Repair: Runtime error. Script file is invalid!
08/31/2018,12-35-15        [ERROR]        Repair of TR/Crypt.EPACK.9bda4d failed.
08/31/2018,12-35-15        [INFO]        C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\44.exe
08/31/2018,12-35-15        [INFO]        [ACTION] Clean
08/31/2018,12-35-15        [INFO]        Repair of TR/Crypt.EPACK.8fe765 started.
08/31/2018,12-35-35        [ERROR]        Error in calling script function Repair: Runtime error. Script file is invalid!
08/31/2018,12-35-35        [ERROR]        Repair of TR/Crypt.EPACK.8fe765 failed.
08/31/2018,12-35-35        [INFO]        C:\Users\Administrator\Desktop\Malware@8FE765 9BDA4D\PKEicBwp0DM.exe
08/31/2018,12-35-35        [INFO]        [ACTION] Clean

Miostartos

McAfee miss all

静影沉璧

KIS：PKEicBwp0DM.exe运行后不见本体（疑似自删），释放衍生物C:\Windows\System32\diagramkey.exe 该衍生物被卡巴斯基kill
另一个44.exe被主防杀

Kaspersky用户

SEP下载智能分析KILL1：WS.Reputation.1，自动防护KILL1：Heur.AdvML.B。

静影沉璧

BD2019：
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\malware@8fe765 9bda4d\44.exe is infected with Gen:Suspicious.Cloud.8.lu0@aiuoYZci and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.
The file c:\users\administrator.sxcsxc-ajkjjubr\desktop\malware@8fe765 9bda4d\pkeicbwp0dm.exe is infected with Gen:Suspicious.Cloud.8.lu0@aGW05Ppi and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

275751198

360  双免测

静影沉璧

Avast——kill all

hansyu

STCn1000 发表于 2018-8-31 12:40
McAfee miss all

McAfee kill all
44.exe  Suspect!e254ec339325
pkeicbwp0dm.exe  RealProtect-EC!24B1963A3F19

hansyu

STCn1000 发表于 2018-8-31 12:40
McAfee miss all

编辑掉