#3 (18.11.24)

petr0vic

infected

Avira Pro
miss 3.exe -> del files from non system disk D (3.exe creates .bat file)

BE_HC

Norton Kill All（开启主动启发

1. Resolved Threats:
   
2. Heur.AdvML.B
   
3. Type: Anomaly
   
4. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
   
5. Categories: Heuristic Virus
   
6. Status: Fully Resolved
   
7. -----------
   
8. 1 Infected File
   
9. C:\Users\DrClef\Desktop\3\2.exe - Deleted
   
10. 1 Browser Cache
    
11. 
    
12. Heur.AdvML.B
    
13. Type: Anomaly
    
14. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
    
15. Categories: Heuristic Virus
    
16. Status: Fully Resolved
    
17. -----------
    
18. 1 Infected File
    
19. C:\Users\DrClef\Desktop\3\3.exe - Deleted
    
20. 1 Browser Cache
    
21. 
    
22. Heur.AdvML.B
    
23. Type: Anomaly
    
24. Risk: High (High Stealth, High Removal, High Performance, High Privacy)
    
25. Categories: Heuristic Virus
    
26. Status: Fully Resolved
    
27. -----------
    
28. 1 Infected File
    
29. C:\Users\DrClef\Desktop\3\1.exe - Deleted
    
30. 1 Browser Cache

复制代码

BE_HC

CCAV Scan &Run MISS All
Norton SONAR 1x （关闭主动启发

1.exe --- SONAR.Heuristic.170


2.exe
随机打开一个windows应用程序（疑似注入）然后连接8.8.8.8 ？

1. 访问这几个网站（好像都打不开
   
2. http://carfax.com//y0x4ghkfqp/index.php
   
3. http://zepter.com//y0x4ghkfqp/index.php

复制代码

3.exe
详情见此帖子（MD5不同但行为相似，附上bat用于删文件的衍生物

https://bbs.kafan.cn/thread-2137334-1-1.html

dreams521

1. 25.11.2018 00.21.49;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\3\2.exe;C:\Users\Administrator\Desktop\3\2.exe;Trojan.Win32.Nymaim.bmiw;木马程序;11/25/2018 00:21:49
   
2. 25.11.2018 00.21.49;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\3\3.exe;C:\Users\Administrator\Desktop\3\3.exe;UDS:Trojan-Ransom.Win32.Encoder.sb;木马程序;11/25/2018 00:21:49
   
3. 25.11.2018 00.21.49;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\3\1.exe;C:\Users\Administrator\Desktop\3\1.exe;Trojan-Spy.Win32.Stealer.enm;木马程序;11/25/2018 00:21:49
   

复制代码

YU2711

Trend Micro Scan Miss All
运行
1.exe


2.exe


3.exe

小Q机器人

智量和卡巴斯基都成功拦截

taroyoo

2.exe is infected with Gen:Suspicious.Cloud.2.PiW@aS3Dndi

Kaspersky用户

AVAST扫描KILL1，运行后IDP击杀2个。

www-tekeze

智量清空，火绒kill 2X 。

www-tekeze

www-tekeze 发表于 2018-11-25 01:19
智量清空，火绒kill 2X 。

火绒miss #3，双击，调用cmd，删文件时首先被自定义规则拦截，很快被主防报勒索，over 。。