Ransom.Shade (19.06.21)

petr0vic

https://c-t.work/s/b3ea4fcd70d34c

infected

极宝杀毒V1.7.4
1-1.exe        Heur.Destroy Disk.A
1.exe        HEUR/QVM20.1.0218.Malware.Gen

静影沉璧

MES

1.exe Artemis!DD8F071FCFB8

1-1.exe Real Protect-LS!77ab89a14441

petr0vic

火绒5.0公测
1-1.exe, Detection: HEUR:VirTool/Obfuscator.gen!B
1.exe, Detection: HEUR:VirTool/Obfuscator.gen!B

静影沉璧

Bitdefender 2020 beta

1.exe Potentially malicious application blocked

1-1.exe Potentially malicious application blocked

Nocria

G DATA
1.exe

1. The file was moved to quarantine.
   
2. 
   
3. File: C:\Users\promi\Desktop\1\1.exe
   
4. Virus: Win32.Trojan-Ransom.Shade.N8GTG1 (Engine B)
   
5. Engines: Engine A: AVA 25.22459, Engine B: GD 25.15368
   

复制代码

1-1.exe

1. AVA 25.22459
   
2. GD 25.15368
   
3. 
   
4. *** Process ***
   
5. 
   
6. Process: 4640
   
7. File name: 1-1.exe
   
8. Path: C:\Users\promi\Desktop\1\1-1.exe
   
9. 
   
10. Publisher: Unknown publisher
    
11. Creation date: 2019年6月21日 17:42:31
    
12. Modification date: 2019年6月21日 17:15:33
    
13. 
    
14. Started by: explorer.exe
    
15. Publisher: Microsoft Windows
    
16. 
    
17. 
    
18. *** Actions ***
    
19. 
    
20. A packer was run on the program file, possibly to conceal malicious content.
    
21. The program has created files and folders that can be used to endanger the system.
    
22. The program is trying to create a startup item to launch a program automatically at system startup.
    
23. The program has created or manipulated an executable file.
    
24. The program has read data from its own program file.
    
25. The program created a copy of itself.
    

复制代码

a233

Avast

Nocria

温馨小屋

www-tekeze

智量Heur清空。。。懒得开虚拟机了，关闭监控退出火绒实机双击，主防杀！没啥悬念。。

jdsh

WD