EXE样本5X_202

显示全部楼层 · 发表于 2020-3-25 23:15:19

RT，未改后缀请小心食用，后果自负。。

载点：https://www.lanzous.com/ian9aah 密码：infected

1.exe
https://www.virustotal.com/gui/file/c59d091df1523f2d8780f22328334ff75da7773d81b7e1074440da4d53e8091f/detection

2.exe
https://www.virustotal.com/gui/file/9bc7924e798540229be85fa18b097e7899ebb2c09f98eb1de6b99f135444a2da/detection

3.exe
https://www.virustotal.com/gui/file/6b31a0bc19ddee50506b0f2c012d08329e5d8fe5a139b2abb6a534d3e01c0969/detection

4.exe
https://www.virustotal.com/gui/file/6fe43863e02d4a6fb20cbb2c2ad39368abef81636f597da94f7234af2dea47e4/detection

5.exe
https://www.virustotal.com/gui/file/ddce4a200880ca97517c1f9a29ea96108cd8697557479abf82f88b0d8b29131d/detection

显示全部楼层 · 发表于 2020-3-25 23:20:38

本帖最后由 SayWhat13 于 2020-3-25 23:24 编辑

malwarebytes
File: 11
Trojan.GuLoader.VB, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\MD5\1.EXE, No Action By User, 9169, 803428, 1.0.21348, , ame,
MachineLearning/Anomalous.100%, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ASPACK\2.EXE, No Action By User, 0, 392687, 1.0.21348, , shuriken,
Generic.Malware/Suspicious, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ORIGINAL\2.EXE, No Action By User, 0, 392686, 1.0.21348, , shuriken,
MachineLearning/Anomalous.97%, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ASPACK\4.EXE, No Action By User, 0, 392687, 1.0.21348, , shuriken,
MachineLearning/Anomalous.95%, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ASPACK\1.EXE, No Action By User, 0, 392687, 1.0.21348, , shuriken,
MachineLearning/Anomalous.97%, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ASPACK\3.EXE, No Action By User, 0, 392687, 1.0.21348, , shuriken,
MachineLearning/Anomalous.97%, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\UPX\2.EXE, No Action By User, 0, 392687, 1.0.21348, , shuriken,
Trojan.GuLoader.VB, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ORIGINAL\1.EXE, No Action By User, 9169, 803428, 1.0.21348, , ame,
Trojan.Crypt.MSIL, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\MD5\5.EXE, No Action By User, 5158, 803742, 1.0.21348, AC17DCD84F1B1509B388F907, dds, 00647414
Trojan.Crypt.MSIL, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\ORIGINAL\5.EXE, No Action By User, 5158, 803742, 1.0.21348, AC17DCD84F1B1509B388F907, dds, 00647414
Trojan.MalPack.VMP, C:\USERS\PRESTON\DESKTOP\EXE样本5X_202\VMPROTECT\1.VMP.EXE, No Action By User, 7386, 803698, 1.0.21348, 000000000000000000000003, dds, 00647414

miss:
aspack: none
md5:2 3 4
original:3 4
upx: 1 3 4
vmprotect: 2 3 4
ZProtect乱序代码: 1 2 3 4
ZProtect虚拟代码: 1 2 3 4

显示全部楼层 · 发表于 2020-3-25 23:25:09

本帖最后由 LSPD 于 2020-3-25 23:27 编辑

Avira 清空

显示全部楼层 · 发表于 2020-3-25 23:28:43

本帖最后由 a233 于 2020-3-25 23:38 编辑

Avast
流式更新没连上，扫描的结果可能跟实际有偏差
Original 4/5
MD5 3/5
UPX 0/4
ZProtect虚拟代码 3/4
ZProtect乱序代码 3/4
ASPack 0/4
VMP 1/4
双击就不了，上报

显示全部楼层 · 发表于 2020-3-25 23:29:40

火绒0

显示全部楼层 · 发表于 2020-3-25 23:53:54

QVM360 发表于 2020-3-25 23:29
火绒0

瑞星安全云终端：俺也一样
似乎火绒和瑞星的离线查杀率差不多（可能火绒稍微强一点），因为这俩同为瑞星系吗？

显示全部楼层 · 发表于 2020-3-25 23:59:10

LSPD 发表于 2020-3-25 23:25
Avira 清空

监控清空吗？厉害啊

显示全部楼层 · 发表于 2020-3-26 00:03:49

杰伦Ｊ时代发表于 2020-3-25 23:59
监控清空吗？厉害啊

大部分是双击

显示全部楼层 · 发表于 2020-3-26 00:08:22

LSPD 发表于 2020-3-26 00:03
大部分是双击

厉害啊

显示全部楼层 · 发表于 2020-3-26 00:19:48

补个图
难兄难弟.jpg

[病毒样本] EXE样本5X_202

评分

本帖子中包含更多资源