Ransom (18.11.29)

petr0vic

https://transfer.sh/4ypDj/2.7z

infected

dreams521

1. 29.11.2018 21.43.53;检测到的对象 ( 处理内存 ) 已删除;c:\users\administrator\desktop\2\1.exe;c:\users\administrator\desktop\2\1.exe;PDM:Trojan.Win32.Generic;木马程序;11/29/2018 21:43:53
   
2. 29.11.2018 21.42.41;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\2\2.exe;C:\Users\Administrator\Desktop\2\2.exe;UDS:Trojan-Ransom.Win32.Shade.sb;木马程序;11/29/2018 21:42:41
   

复制代码

con16

comodo
kill all

Jerry.Lin

火绒 SCAN MISS ALL


KILL ALL

1. 2018/11/29,21:59:14 [INFO] The file 'c:\program files\winrar\winrar.exe' was scanned with the Protection Cloud. SHA256 = BF52372A39A0992E72B1DEB9039BDF5B4EDE4E877BAAAA3BEB5E21BEB49FDDF4
   
2. 2018/11/29,21:59:23 [INFO] The file 'c:\users\zhong\downloads\compressed\virus test\卡饭\2\1.exe' was scanned with the Protection Cloud. SHA256 = 65D730FB48DDD67AEF2BD7072C1D29B072B086D0B48F8AAE23BD33D9A6A61B99
   
3. 2018/11/29,21:59:40 [INFO] FP reports status 'NO False Positive' for file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\2\1.exe'
   
4. 2018/11/29,21:59:40 [INFO] The file 'C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\2\1.exe' has been uploaded to the Protection Cloud and analyzed. SHA256 = 65D730FB48DDD67AEF2BD7072C1D29B072B086D0B48F8AAE23BD33D9A6A61B99
   
5. 2018/11/29,21:59:41 [DETECTION] Detection by Protection Cloud: TR/Crypt.EPACK.Gen2! SHA256 = 65D730FB48DDD67AEF2BD7072C1D29B072B086D0B48F8AAE23BD33D9A6A61B99
   
6.   C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\2\1.exe
   
7.       [INFO] The file will be copied to quarantine!
   
8. 2018/11/29,21:59:45 [INFO] FP reports status 'NO False Positive' for file 'c:\users\zhong\downloads\compressed\virus test\卡饭\2\2.exe'
   
9. 2018/11/29,21:59:45 [INFO] The file 'c:\users\zhong\downloads\compressed\virus test\卡饭\2\2.exe' was scanned with the Protection Cloud. SHA256 = 5A6F7F14E2D0F54EF283F66FDDE99E3477513F8CD00A56623866ED91930C50ED
   
10. 2018/11/29,21:59:45 [DETECTION] Detection by Protection Cloud: TR/Crypt.EPACK.5a6f7f! SHA256 = 5A6F7F14E2D0F54EF283F66FDDE99E3477513F8CD00A56623866ED91930C50ED
    
11.   C:\Users\zhong\Downloads\Compressed\VIRUS TEST\卡饭\2\2.exe
    
12.       [INFO] The file will be copied to quarantine!
    

复制代码

ELOHIM

scep v1047 scan miss all.

YouYouok

網頁攔截

YU2711

Trend Micro

ziyerain2015

扫描各1个，WEBROOT和熊猫
双击，WEBROOT提示修改注册表阻止防御成功
双击，熊猫2.EXE过几秒防御成功。

ttdown

Win10 WD，解压不报，右键扫描解压后的目录也不报，但是......当我加压这个目录时，WD竟然报毒了！清空了待压缩的这个目录！以上解压、扫描、压缩过程在一分钟内完成的。

YouYouok 发表于 2018-11-29 22:31
網頁攔截

MBAM把这个网盘拉黑了，不是针对这个样本的拦截
你要测，得先排除（或临时关闭web防护），把加密压缩包下载下来再扫描