e99eec92a88be79f44ff558d935c7803898921ad0b046f7c3a9aeae9302426ec

显示全部楼层 · 发表于 2019-7-13 20:19:42

https://c-t.work/s/3edde9049aec43

https://www.virustotal.com/gui/f ... 9302426ec/detection

卡巴
13.07.2019 20.16.45;检测到恶意软件;PDM:Trojan.Win32.Generic;Media Foundation AAC Encoder;e:\test\7.13\2019-07-13 121022.exe;07/13/2019 20:16:45

显示全部楼层 · 发表于 2019-7-13 20:21:24

Ashampoo Anti-Virus

显示全部楼层 · 发表于 2019-7-13 20:24:11

火绒扫描 miss

显示全部楼层 · 发表于 2019-7-13 20:37:12

360

复制代码

显示全部楼层 · 发表于 2019-7-13 21:07:25

G DATA.

AVA 25.22714
GD 25.15542
*** Process ***
Process: 4416
File name: лпорпароаыв.exe
Path: C:\ProgramData\лпорпароаыв.exe
Publisher: Unknown publisher
Creation date: 2019年7月13日 21:03:06
Modification date: 2019年7月13日 20:05:03
Started by: 2019-07-13 121022.exe
Publisher: Unknown publisher
*** Actions ***
The virus scanner has detected that the file is malicious.
An unknown process was accessed.
*** Quarantine ***
The following files were moved into quarantine:
C:\ProgramData\лпорпароаыв.exe
C:\Users\promi\AppData\Local\Temp\BNZ.5d29d6853ae52\2019-07-13 121022.exe
The following registry entries were deleted:
YHKSCy4nJycnJgYvJyonKiYGp0InKnSiYmJwKycqJyomBrlycg/pcoJiYnKCoCwnKCYmJwiscnJycmJi0CgnKCYmJwiPcqJyomJicPdycnJyYmJwupLhXmMqKBp6NbZykuFeYyoHpy0nKCYmJwi3LycnJycmBscvJygmJicI5ygn2HDecoJiYnKCcI9y4oCWcoKA+3JycnJiYoC+csJyonKCAAA
Rules version: 5.0.152
OS: Windows 6.3 Service Pack 0.0 Build: 9600 - Workstation 64bit OS
dll version: 76935
"C:\ProgramData\лпорпароаыв.exe"
MD5: A07E1CC89F537053A1F15984347106A5
"C:\Users\promi\AppData\Local\Temp\BNZ.5d29d6853ae52\2019-07-13 121022.exe"
MD5: A07E1CC89F537053A1F15984347106A5

复制代码

显示全部楼层 · 发表于 2019-7-13 21:14:31

显示全部楼层 · 发表于 2019-7-13 21:37:55

智量Heur杀，火绒miss，有空双击。。

显示全部楼层 · 发表于 2019-7-13 22:29:14

McAfee ENS 10.6.1

Artemis!A07E1CC89F53

显示全部楼层 · 发表于 2019-7-13 23:19:48

显示全部楼层 · 发表于 2019-7-14 09:57:49

本帖最后由 www-tekeze 于 2019-7-14 10:00 编辑

www-tekeze 发表于 2019-7-13 21:37
智量Heur杀，火绒miss，有空双击。。

双击，首先被反攻击规则拦截，然后被智量主防连杀两次！

退出智量双击，被火绒主防杀！ PS：但杀的是释放的木马文件而不是本体。

[病毒样本] e99eec92a88be79f44ff558d935c7803898921ad0b046f7c3a9aeae9302426ec