样本集奉上_94 (12.02)

www-tekeze

191196846 发表于 2018-12-2 22:31
VTSS

貌似很多样本跟往期重复了……我本机有缓存

我后来也发现了，应该就是和上一期，否则安天和管家杀不了那么多。。。
过程中是出了点问题，已经发出来了，将就下。。

c/mm

运行样本5  BG一样被过 虽然后来击杀主体 但是于事无补！






  除了C盘根目录下面的文档和照片完好无损，D盘 桌面 我的文档  图片等地方全部被加密然后被BG全部移除。。。空空如也！！



这货会联网（没有数字签名）拒绝访问然后触发Windows10 照片进程


防火墙默认放行WIN10 PHOTO程序运行没有任何对话框提示。。。。。


行为防御详细结果：

可疑文件： Samp(5)M.exe

路径： C:\Users\AO2222\Desktop\Samp(5)M.exe

详细信息

修改的文件
•    C:\Users\AO2222\Desktop\_HELP_instructions.bmp
•    C:\Users\AO2222\Desktop\_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-CE97-62C06195FFB0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-53CF-A46B8865B9E0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D066-1D0288CDF759.zepto
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\F46JGQHR-W5ZT-R81Q-B1BB-1A68450A77E0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\_6_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\F46JGQHR-W5ZT-R81Q-987D-1C8E202D03F1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-C175-520A11590AEF.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-AA38-596632D7D051.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D9D9-773363D4A3A3.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-EA2D-36DDAAD1AF04.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-C130-0E5CFE964F3E.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-023D-EEE3F354A1AB.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-3199-758D17D32DAF.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-932F-8BC47E18C7A2.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-BD68-8C9638220B7B.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-23BA-AE5D6D60BA2D.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-6FAE-B79DD73AFB33.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-DCDE-66681299B42A.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-39E8-F9B71B1AF4FB.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-F159-CB3E625D7DF0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-3725-28D356776E25.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-40E3-257C586A1BC1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-E84D-3469C46072D9.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-1EBB-3621EE9E7BC8.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-B2EB-C0FB8527740D.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-20DF-3C8802B11EEC.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-B862-FCCE03165228.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D123-92E59E3199F7.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-87DB-F8B89A60412C.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-53B5-CCB8F19A9879.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D7C2-E2AA731C95D0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-7A86-73F1021EBC78.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-BDD9-ED5AC99E3BE8.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-3F41-67A258D690E1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D0BF-99256CB4C1E2.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-7172-711CCC74EA88.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-BE20-2B1F05F31CFD.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-ACCD-3810CB7234F3.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-AB5A-9F21194ADD03.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-C1FB-3196C96148CF.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-1F54-ED9A61C146D8.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-2DBD-CDE579EFC044.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-DFFB-9D3A0E350605.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-1BFC-2AA72719AEF6.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-A076-F37B68B9D5DF.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D1A9-3FEA88F28EB1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-32F9-B19EF8085BDA.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\_5_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-B8F4-6E9841849EC8.zepto
•    C:\Users\AO2222\Pictures\download (1).jpeg
•    C:\Users\AO2222\Pictures\_4_HELP_instructions.html
•    C:\Users\AO2222\Desktop\u=4050742372,878204082&fm=26&gp=0.jpg
•    D:\u=4050742372,878204082&fm=26&gp=0.jpg
•    C:\Users\AO2222\Pictures\u=4050742372,878204082&fm=26&gp=0.jpg
•    D:\u=3629430347,781699922&fm=26&gp=0.jpg
•    D:\u=3523376988,1285761647&fm=26&gp=0.jpg
•    D:\u=2533686557,149265117&fm=26&gp=0.jpg
•    D:\download.jpeg
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Links\_3_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Links\F46JGQHR-W5ZT-R81Q-30DE-F909249E58A9.zepto
•    C:\Users\AO2222\Desktop\_2_HELP_instructions.html
•    D:\download (1).jpeg
•    C:\Users\AO2222\Desktop\asd - 副本 (2).txt
•    C:\ProgramData\Baidu\Common\F46JGQHR-W5ZT-R81Q-57D5-915AF2372EF8.zepto
•    C:\ProgramData\Baidu\Common\_1_HELP_instructions.html
•    C:\ProgramData\Baidu\Common\F46JGQHR-W5ZT-R81Q-9526-351D9AC08CE2.zepto
•    D:\asd.txt
•    C:\ProgramData\Foxit ContentPlatform\_0_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\F46JGQHR-W5ZT-R81Q-AD86-1F783E0C17A1.zepto
•    D:\asd - 副本.txt
•    D:\asd - 副本 (8).txt
•    D:\asd - 副本 (7).txt
•    D:\asd - 副本 (6).txt
•    D:\asd - 副本 (5).txt
•    D:\asd - 副本 (4).txt
•    D:\_0_HELP_instructions.html
•    D:\asd - 副本 (3).txt
•    D:\asd - 副本 (2).txt
•    C:\Users\AO2222\Desktop\Samp(5)M.exe

修改的注册表
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids : Paint.Picture (value = )
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids : htmlfile (value = )
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts : IE.AssocFile.HTM_.html (value = 0)
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids : htmlfile (value = )
•    HKEY_CURRENT_USER\\Control Panel\Desktop : WallpaperStyle (old value = 10 -> new value = 0)



重启击杀但是文件全部加密删除了！！




这是运行第2遍 结果依然重启还是没有回滚过来。。。。。

可疑文件： Samp(5)M.exe

路径： C:\Users\AO2222\Desktop\Samp(5)M.exe

详细信息

修改的文件
•    C:\Users\AO2222\Desktop\_HELP_instructions.bmp
•    C:\Users\AO2222\Desktop\_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad.zip
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-FA36-A8FCA9ED2CD1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-7E78-F6633609B2DA.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-60C5-C05B80EC2B66.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-5706-E0E2D0C09661.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-92E3-B9A047826718.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-183C-96AB6B5F70EC.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-C6C9-52A6722533B2.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-81E1-4D47C0DA80FE.zepto
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2018_03_12_lwzs.bmp
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2017_12_04_rengong.bmp
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2017_11_16_pdftoword.bmp
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2017_07_31_translate.bmp
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\_11_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2017_07_11_pdf2word.bmp
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad\2017_07_11_edit.bmp
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\F46JGQHR-W5ZT-R81Q-3792-5293CCA01E09.zepto
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\_10_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Icons\F46JGQHR-W5ZT-R81Q-E6A5-472BE99C6998.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-54F6-AD31E11708D1.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-256C-717FCDD3938B.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-4BE3-CC15353CA306.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-4B7D-3E533915385C.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-6F57-6626BFD34713.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-B0CE-16B16594E60E.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-03BB-2EBC3F59B9CC.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-A814-994801A6F1E7.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-7766-08949960EFC7.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-5F69-ABC29C045DF4.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-618A-2DD43BB7F828.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-FF56-343F80212FFE.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-95D9-6BADBA87E7F8.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-0146-3CC86634B1FD.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-ACFE-BD4C6F915F6F.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-5DFD-299DEDA5BA31.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-E3D0-E02BBA20B51C.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-A791-768804AF5DA0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D7F9-D451CDFCCFF0.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-4DC7-9C51121C9F7A.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-AEA6-5F153D744F84.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-2A98-CE1C01ECC2A9.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-458F-3156B22933BD.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-3E7A-030168593750.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-6EF4-D51E05DFB32E.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-78BE-BDC502483D2A.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-AA93-8DE135BA8380.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D2E8-4E8324D00642.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-6F86-7043D062C988.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-1CFA-A2D4614AA2AC.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D181-0BEB502FDA68.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-D8FF-2AE0B07A5BD6.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-4995-190E16FEB36D.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-CD19-F6D7480FF81F.zepto
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\phantomPDF.png
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-0541-34A6E8D77BDB.zepto
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\icon_remove.png
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\icon_pdf.png
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\icon_folder_open.png
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-3FDE-909D0B69B49B.zepto
•    C:\ProgramData\Foxit ContentPlatform\Assets\_9_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Assets\F46JGQHR-W5ZT-R81Q-4888-C636F8DABA97.zepto
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\contact_support_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\annotate_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\content_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\tutorials_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\sign_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\sharereview_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\scan_ocr_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\recent_files_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\organize_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\link_join_text.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\foxt_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\export_pdf.jpg
•    D:\HWIDGEN.zip
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\edit_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\customize_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\create_pdf.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\_8_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\images\content_right_bg.jpg
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\_7_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\version.xml
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Links\_6_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\Favorites\Links\F46JGQHR-W5ZT-R81Q-FD9B-8BDADB9DBE99.zepto
•    C:\Users\AO2222\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20181202\DatastoreBackup\_5_HELP_instructions.html
•    C:\Users\AO2222\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20181202\DatastoreBackup\schema.txt
•    C:\Users\AO2222\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20181202\_4_HELP_instructions.html
•    C:\Users\AO2222\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20181202\MicrosoftEdgeSettingsBackup.txt
•    C:\ProgramData\Foxit ContentPlatform\_3_HELP_instructions.html
•    C:\ProgramData\Foxit ContentPlatform\F46JGQHR-W5ZT-R81Q-BD56-C0451474ECEE.zepto
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\_2_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\advertisement\ad.db
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\js\DD_belatedPNG.js
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\js\_1_HELP_instructions.html
•    C:\Users\Public\Foxit Software\Foxit Reader\StartPage 9.50.1\start\zh-CN\js\nor.js
•    C:\ProgramData\Baidu\Common\F46JGQHR-W5ZT-R81Q-FDD4-A6DD56AD8A28.zepto
•    C:\ProgramData\Baidu\Common\_0_HELP_instructions.html
•    C:\ProgramData\Baidu\Common\F46JGQHR-W5ZT-R81Q-145F-8D29503DE4F8.zepto
•    D:\fdgdf.bmp
•    D:\fdgdfasdasddsa.jpg
•    D:\_0_HELP_instructions.html
•    D:\新建文本文档.txt
•    C:\Users\AO2222\Desktop\Samp(5)M.exe

修改的注册表
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids : Paint.Picture (value = )
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids : Paint.Picture (value = )
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids : htmlfile (value = )
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts : IE.AssocFile.HTM_.html (value = 0)
•    HKEY_CURRENT_USER\\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids : htmlfile (value = )
•    HKEY_CURRENT_USER\\Control Panel\Desktop : WallpaperStyle (old value = 10 -> new value = 0)

已提交给BG反正二奶机测试玩玩，损毁文件也无所谓，常在卡饭走

，

哪有不挨刀

ziyerain2015

S: 36/50，M: 19/32，T: 55/82      67%


webroot

记录微笑

c/mm 发表于 2018-12-2 23:03
运行样本5  BG一样被过 虽然后来击杀主体 但是于事无补！

所以说GD的云还是个好东西。
运行瞬间就把本体隔离了。

ziyerain2015

    Dome
S: 38/50，M: 22/32，T: 60/82      73%

YU2711

www-tekeze 发表于 2018-12-2 21:58
M的被我加壳处理过，但22楼说咖啡可以杀，不懂，他怎么中招的。。

搞乌龙了,我测到没加壳的........那咖啡有可能MISS了,现在云已经报了

alalei

SEP
S：42/50，M：29/32，T：71/82=86.59%
sample5m直接杀了

www-tekeze

YU2711 发表于 2018-12-2 23:33
搞乌龙了,我测到没加壳的........那咖啡有可能MISS了,现在云已经报了

   你这乌龙搞得。。。那咖啡主防也不咋的，不过楼上BG也翻车了。。

c/mm

whl2606555 发表于 2018-12-2 23:10
所以说GD的云还是个好东西。
运行瞬间就把本体隔离了。

双击背锅的有  安全被病毒串改系统（包括格式化 勒索 感染 破坏等）或者恶意终止杀毒进程图标的
AVG互联网安全  ZoneAlarm免费杀软和防火墙  DrWeb11.5（以前经常在论坛测试的） NOD32 10.0 很早测试被过了新版不知道怎样  G DATA 互联网安全25.4    Microsoft WD 1709的时候高阻止  McAfee R16
   Panda DOME 完全版 18.6.1 Sophos AV家庭版  Webroot 论坛3个月激活码试用了下

还没试用双击的 要不哪天试试
Avira Avira Comodo Emsisoft  F-Secure K7 Kaspersky   
eScan   360 大腾讯  VIPRE  Quick Heal Trend Micro Trustport Symantec

心心相印

c/mm 发表于 2018-12-2 23:03
运行样本5  BG一样被过 虽然后来击杀主体 但是于事无补！

这病毒确实太厉害了，bd防得住吗，能查杀吗