掛馬樣本包(4X) #180925

Agu

two.exe
掛馬網址：mandala.mn/update/two.exe
VT(15/68)：https://www.virustotal.com/#/fil ... bbc4e25db/detection

sop.exe
掛馬網址：mandala.mn/update/sop.exe
VT(13/68)：https://www.virustotal.com/#/fil ... 4c6e0955b/detection

tulo1.exe
掛馬網址：mosoksoaxmalsksa.com/MXE/lodpos.php?l=tulo1.xt2
VT(11/66)：https://www.virustotal.com/#/fil ... 0d26c05d5/detection

0773.exe
掛馬網址：alysiumeventsandhospitality.co.uk/p
VT(11/67)：https://www.virustotal.com/#/fil ... 9a7653e94/detection

樣本載點(密碼infected)：
（主要）https://we.tl/t-AJldNkuOfT
（備份）https://1.bitsend.jp/download/65 ... .html?setLang=zh-tw

測試：
Panda Dome - 執行4X

j2016

wd
扫描杀1
双击 秒3

100%
我给电脑配的智量，都不开机启动，也不开启实时，目前还没作为辅杀用过，因为没机会

YU2711

Trend Micro
掛馬網址全封鎖
樣本包執行阻止3X

1. 名稱:        0773.exe
   
2. 來源:        ObjectVideo Natural
   
3. 版本:        10.5.86.40
   
4. 版權所有:        © 2011 ObjectVideo Natural, Inc. All Rights Reserved.
   
5. 偵測到的資源或程序 ID:        C:\Users\diakov\Downloads\Compressed\MalwarePack#180925\0773.exe
   
6. 處理行動:        已終止
   
7. 名稱:        sop.exe
   
8. 來源:        未知
   
9. 版本:        
   
10. 版權所有:        
    
11. 偵測到的資源或程序 ID:        C:\Users\diakov\Downloads\Compressed\MalwarePack#180925\sop.exe
    
12. 處理行動:        已終止
    
13. 安全威脅:        HEU_CDPLCEXT
    
14. 來源類型:        安全威脅
    
15. 受影響的檔案:        C:\Users\USER\AppData\Roa…\sop.exe
    
16. 處理行動:        已移除
    
17. 偵測方式:        關聯掃瞄
    
18. 名稱:        two.exe
    
19. 來源:        未知
    
20. 版本:        
    
21. 版權所有:        
    
22. 偵測到的資源或程序 ID:        C:\Users\diakov\Downloads\Compressed\MalwarePack#180925\two.exe
    
23. 處理行動:        已終止
    
24. 
    

复制代码

cect258

• 卡巴斯基KIS 2019  
• 4个挂马网页 全部拦截。
• 4个样本  全部解压KILL  有一个KILL完需要重启机器。
  

Jerry.Lin

1. Scan Log
   
2. Version of detection engine: 18106P (20180924)
   
3. Date: 2018/9/25  Time: 7:44:25
   
4. Scanned disks, folders and files: C:\Users\zhong\Downloads\Compressed\MalwarePack#180925
   
5. C:\Users\zhong\Downloads\Compressed\MalwarePack#180925\0773.exe - a variant of Win32/GenKryptik.CMAT trojan - cleaned by deleting [1]
   
6. C:\Users\zhong\Downloads\Compressed\MalwarePack#180925\sop.exe - a variant of Generik.FYMQRET trojan - cleaned by deleting [1]
   
7. C:\Users\zhong\Downloads\Compressed\MalwarePack#180925\tulo1.exe - a variant of Win32/GenKryptik.CMBP trojan - cleaned by deleting [1]
   
8. C:\Users\zhong\Downloads\Compressed\MalwarePack#180925\two.exe - a variant of Generik.MLNSGWW trojan - cleaned by deleting [1]
   
9. Number of scanned objects: 4
   
10. Number of threats found: 4
    
11. Number of cleaned objects: 4
    
12. Time of completion: 7:44:49  Total scanning time: 24 sec (00:00:24)
    
13. 
    
14. Notes:
    
15. [1] Object has been deleted as it only contained the virus body.
    

复制代码

1. VirusTotal Smart Scanner
   
2. Scan Time: 2018-09-25114418
   
3. Scan Duration: 8 seconds
   
4. Scan Target: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\MalwarePack#180925
   
5. Number of Scan Files: 4
   
6. Number of Infected Files: 4
   
7. Sensitivity: 80
   
8. Scan PE only: True
   
9. Auto_Upload: True
   
10. Threats:
    
11. Trojan.Banker                   sha256: 5cc9103bde73f45a4e4d097182d9c8ddccf5f205b5852f4b24930369a7653e94    Path: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\MalwarePack#180925\0773.exe
    
12. Trojan.Generic                  sha256: b0b44f91f7ca8bb8a9133e21e372aca05be9c2d178bcec5df33a9b5bbc4e25db    Path: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\MalwarePack#180925\two.exe
    
13. Trojan.Spy                      sha256: 476a1bbb43ce8984d49a34fc83cad1572c90fc5ff8b1ebb1a392e7c0d26c05d5    Path: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\MalwarePack#180925\tulo1.exe
    
14. Trojan.Generic                  sha256: c196abc207b3672939e5174b468280398683e1fd4a551bf6bc0858f4c6e0955b    Path: C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\MalwarePack#180925\sop.exe
    

复制代码

stupid1man

紅傘


1. two.exe
不攔截掛馬網址：mandala.mn/update/two.exe
右鍵掃描檔案報HEUR/APC

2. sop.exe
Avira Browser Safety 攔截掛馬網址：mandala.mn/update/sop.exe右鍵掃描檔案報AUC report URL: http://mandala.mn/update/sop.exe failed with error 0x5B4, httpCode: 0xC8

3. tulo1.exe
不攔截掛馬網址：mosoksoaxmalsksa.com/MXE/lodpos.php?l=tulo1.xt2右鍵掃描檔案報HEUR/APC.Griffin

4. 0773.exe
掛馬網址無法瀏覽（403）：alysiumeventsandhospitality.co.uk/p
右鍵掃描檔案報TR/AD.Emotet.B

www-tekeze

火绒：2/8，智量：7/8 。。

Miostartos

看了眼VT。
Norton又不用测了。高级机器启发简直不给活路

陆北

金山 神马都没杀出


火绒扫出一个

心心相印

fssa clean all