Ransom.Shade (19.07.03)

petr0vic

https://c-t.work/s/690fb35e50314a

infected

Nocria

G DATA blocked 2x.
s.exe
-Behavior Monitoring

1. *** Actions ***
   
2. 
   
3. A packer was run on the program file, possibly to conceal malicious content.
   
4. The program has created files and folders that can be used to endanger the system.
   
5. The program is trying to create a startup item to launch a program automatically at system startup.
   
6. The program has created or manipulated an executable file.
   
7. The program has read data from its own program file.
   
8. The program created a copy of itself.
   
9. 
   
10. 
    
11. *** Quarantine ***
    
12. 
    
13. The following files were moved into quarantine:
    
14. C:\ProgramData\Windows\csrss.exe
    
15. C:\Users\promi\AppData\Local\Temp\BNZ.5d1c52292742c\s.exe
    

复制代码

-DeepRay

1. G DATA INTERNET SECURITY has blocked the execution of malicious software on your system.
   
2. The malicious software was identified by DeepRay as follows: Kryptik1
   
3. 
   
4. The following processes were therefore terminated by G DATA for security reasons:
   
5.         ----------------------------------------------------------------
   
6.         C:\Users\promi\AppData\Local\Temp\BNZ.5d1c52292742c\s.exe (PID 3412)
   

复制代码

s1.exe
-Behavior Monitoring

1. *** Actions ***
   
2. 
   
3. The program has created files and folders that can be used to endanger the system.
   
4. The program is trying to create a startup item to launch a program automatically at system startup.
   
5. The program has created or manipulated an executable file.
   
6. The program has read data from its own program file.
   
7. The program created a copy of itself.
   
8. 
   
9. 
   
10. *** Quarantine ***
    
11. 
    
12. The following files were moved into quarantine:
    
13. C:\ProgramData\Windows\csrss.exe
    
14. C:\Users\promi\AppData\Local\Temp\BNZ.5d1c52412d008\s1.exe

复制代码

-DeepRay

1. G DATA INTERNET SECURITY has blocked the execution of malicious software on your system.
   
2. The malicious software was identified by DeepRay as follows: Kryptik1
   
3. 
   
4. The following processes were therefore terminated by G DATA for security reasons:
   
5.         ----------------------------------------------------------------
   
6.         C:\Users\promi\AppData\Local\Temp\BNZ.5d1c52412d008\s1.exe (PID 5660)
   

复制代码

Jirehlov1234

卡巴

s1.exe - UDS:Trojan-Ransom.Win32.Shade

54ss

火绒
操作进程：C:\Program Files\Bandizip\Bandizip.exe
病毒路径：C:\Users\JOJO\Downloads\s\s1.exe
病毒名称：HEUR:VirTool/Obfuscator.gen!B
病毒ID：2D18551AEF762F90
操作结果：已处理

操作进程：C:\Program Files\Bandizip\Bandizip.exe
病毒路径：C:\Users\JOJO\Downloads\s\s.exe
病毒名称：HVM:VirTool/Obfuscator.gen!A
病毒ID：B27D4294CDE6A1EC
操作结果：已处理

wenshui1013

Cylance,

jiaobaoyun51

avira

petr0vic

极宝杀毒V1.7.4
s.exe        VTCloud.Win32:Malware-gen
s1.exe        HEUR/QVM20.1.4565.Malware.Gen

j2016

eav4.2清空

www-tekeze

火绒、智量都是清空。。

www-tekeze

费尔，Scan kill s1.exe，双击另一个报可疑。