又一个独狼样本

落华无痕

样本（密码infected）：https://www.lanzous.com/i2xy7ta

dreams521

1. 21.01.2019 21.43.06;检测到的对象 ( 文件 ) 已删除;C:\Users\Administrator\Desktop\E7E4D3EE\E7E4D3EE.sys;C:\Users\Administrator\Desktop\E7E4D3EE\E7E4D3EE.sys;HEUR:Trojan.Win32.Generic;木马程序;01/21/2019 21:43:06
   

复制代码

www-tekeze

火绒报Rootkit，智量Heur杀。。

www-tekeze

ESET KILL 。

con16

cav kill

c/mm

avast

YU2711

红伞 KILL

1. 2019/1/21,21:57:03 [INFO] Engine version:  8.3.52.162
   
2. 2019/1/21,21:57:03 [INFO] VDF version:  8.15.18.140
   
3. 2019/1/21,21:57:03 [INFO] APC version:  2.9.0.45
   
4. 2019/1/21,21:57:03 [INFO] RDF version:  14.0.5.170
   
5. 2019/1/21,21:57:03 [INFO] Real-Time Protection Version: 15.00.43.20
   
6. 2019/1/21,21:57:04 [INFO] Device Protection is disabled
   
7. 2019/1/21,22:11:27 [INFO] FP reports status 'NO False Positive' for file 'C:\IDM\idm\Downloads\Compressed\E7E4D3EE\E7E4D3EE.sys'
   
8. 2019/1/21,22:11:27 [DETECTION] Contains suspicious code HEUR/AGEN.1033490!
   
9.   C:\IDM\idm\Downloads\Compressed\E7E4D3EE\E7E4D3EE.sys
   
10.       [INFO] The file will be copied to quarantine!
    

复制代码

wenshui1013

G Data

pre

BD Kill
日志
Feature:
Antivirus

The file F:\AppData\E7E4D3EE.sys is infected with Gen:Variant.Trojan.Rovnix.1 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

ATP_synthase

www-tekeze 发表于 2019-1-21 21:44
火绒报Rootkit，智量Heur杀。。

火绒报毒名厉害，sign thief,盗用签名