Worm.Dropper

skystars

下载

a233

Avast扫描Miss
双击

skystars

诸葛亮杀毒kill
Trojan/Habo.Suspicious

skystars

360 miss
火绒 miss

jdsh

WD  运行后拦截

温馨小屋

卡巴，后知后觉，都加密完了PDM才弹出来，把主程序杀了但是文件没有回滚，桌面全加密了，选高级清除重启的时候在登录界面黑屏，进不去系统，估计系统文件也被加密了




一个半小时后，卡巴入库


28.07.2019 17.55.39;检测到的对象 ( 文件 ) 已移动至隔离;C:\Users\zry\Desktop\AdbeRdr_zh_CN.exe//#;Windows Explorer;C:\Users\zry\Desktop\AdbeRdr_zh_CN.exe//#;07/28/2019 17:55:39;UDS:Trojan-Ransom.Win32.Encoder





断网再次测试，这回拦截的稍微靠前一点，只加密了了一部分文件，我点了高级清除，界面没有任何反应，avp进程CPU高占用，但已经打不开程序，等了好几分钟之后才弹出高级清除提示，重启提示找不到用户配置文件无法登陆，明显是没有回滚

温馨小屋

BD，刚释放完那两个文件ATD就杀了，文件完好

Nocria

微点拦截，暂未发现文件被加密。

Nocria

G DATA （仅保留行为监控）

1. *** Actions ***
   
2. 
   
3. The program has created files and folders that can be used to endanger the system.
   
4. The program has saved files in the system folder.
   
5. The program has created or manipulated an executable file.
   
6. The attributes "system" and "hidden" are set for this program.
   
7. The program changed the creation or last change date of a file.
   
8. The program has read data from its own program file.
   
9. The program created a copy of itself.
   
10. The program has copied itself to the Windows folder.
    
11. An executable file was stored in a suspicious location.
    
12. The program has created or manipulated an executable file in the system folder.
    
13. The program writes to folders belonging to G DATA software.
    

复制代码

skystars

智量kill
Heur.ML.PE.A