#Python #Ransomware (2020-04-17)

QVM360

https://kafanealg.lanzous.com/ibipyra
infected

小Q机器人

卡巴斯基杀，360解压提示风险

a233

Avast
bp.exe FileRepMalware

UPX的建了个勒索信，然后就没了

Xw1nd极风

Norton
original Trojan.Gen.2
upx       WS.Reputation.1

TimelessTT

ESET 2x Python/Filecoder.Locky.C

54ss

BEST 又杀不掉了
只有禁止访问
也算Kill All吧
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp.exe=>main
Generic.Ransom.PyLocky.25973B5D
感染
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>( UnpackX )=>main
Generic.Ransom.PyLocky.25973B5D
感染
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp.exe=>Cryptomodule
Generic.Ransom.PyLocky.162DC116
感染
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>main
Generic.Ransom.PyLocky.25973B5D
感染
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>( UnpackX )=>Cryptomodule
Generic.Ransom.PyLocky.162DC116
感染
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>Cryptomodule
Generic.Ransom.PyLocky.162DC116
感染
BDTS
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>( UnpackX )=>main Generic.Ransom.PyLocky.25973B5D Moved to Quarantine
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp.exe=>main Generic.Ransom.PyLocky.25973B5D Moved to Quarantine
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>main Generic.Ransom.PyLocky.25973B5D Moved to Quarantine
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>( UnpackX )=>Cryptomodule Generic.Ransom.PyLocky.162DC116 Moved to Quarantine
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp.exe=>Cryptomodule Generic.Ransom.PyLocky.162DC116 Moved to Quarantine
C:\Users\ljsjo\Desktop\#Python #Ransomware (2020-04-16)\bp - upx.exe=>Cryptomodule Generic.Ransom.PyLocky.162DC116 Moved to Quarantine
KILL ALL

接下来又到了我第二喜欢的Python勒索双击环节bp.exe
BEST miss
似乎只加密桌面的文档文件？
BDTS
同上

a445441

运行后加密桌面部分文件后自动退出，微点MISS

病毒探索者

Malwarebytes
运行 upx-文件部分被加密

病毒探索者

App Check

1. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试1.txt.BlackPink,,Removed,RansomGuard
   
2. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试1.txt,,Restored,RansomGuard
   
3. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试2.pptx.BlackPink,,Removed,RansomGuard
   
4. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试2.pptx,,Restored,RansomGuard
   
5. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试3.pdf.BlackPink,,Removed,RansomGuard
   
6. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试3.pdf,,Restored,RansomGuard
   
7. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试4.docx.BlackPink,,Removed,RansomGuard
   
8. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试4.docx,,Restored,RansomGuard
   
9. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.docx.BlackPink,,Removed,RansomGuard
   
10. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.docx,,Restored,RansomGuard
    
11. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.pdf.BlackPink,,Removed,RansomGuard
    
12. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.pdf,,Restored,RansomGuard
    
13. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\13123.pdf.BlackPink,,Removed,RansomGuard
    
14. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\13123.pdf,,Restored,RansomGuard
    
15. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\213.png.BlackPink,,Removed,RansomGuard
    
16. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\213.png,,Restored,RansomGuard
    
17. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\2313.docx.BlackPink,,Removed,RansomGuard
    
18. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\2313.docx,,Restored,RansomGuard
    
19. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\563905E6614FC3D25A00F2B1C2F68460.png.BlackPink,,Removed,RansomGuard
    
20. 04/17/2020 11:49:57 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\563905E6614FC3D25A00F2B1C2F68460.png,,Restored,RansomGuard
    
21. 04/17/2020 11:49:57 下午,Ransomware Behavior Detected,File,C:\Users\virus\Downloads\#Python #Ransomware (2020-04-16)\bp - upx.exe,674a9c5db53ecab0c4f8015a636288e8,Blocked,RansomGuard
    
22. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试1.txt.BlackPink,,Removed,RansomGuard
    
23. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试1.txt,,Restored,RansomGuard
    
24. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试2.pptx.BlackPink,,Removed,RansomGuard
    
25. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试2.pptx,,Restored,RansomGuard
    
26. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试3.pdf.BlackPink,,Removed,RansomGuard
    
27. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试3.pdf,,Restored,RansomGuard
    
28. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试4.docx.BlackPink,,Removed,RansomGuard
    
29. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试4.docx,,Restored,RansomGuard
    
30. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.docx.BlackPink,,Removed,RansomGuard
    
31. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.docx,,Restored,RansomGuard
    
32. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.pdf.BlackPink,,Removed,RansomGuard
    
33. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\123.pdf,,Restored,RansomGuard
    
34. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\13123.pdf.BlackPink,,Removed,RansomGuard
    
35. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\13123.pdf,,Restored,RansomGuard
    
36. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\213.png.BlackPink,,Removed,RansomGuard
    
37. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\213.png,,Restored,RansomGuard
    
38. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\2313.docx.BlackPink,,Removed,RansomGuard
    
39. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\2313.docx,,Restored,RansomGuard
    
40. 04/17/2020 11:48:30 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\563905E6614FC3D25A00F2B1C2F68460.png.BlackPink,,Removed,RansomGuard
    
41. 04/17/2020 11:48:29 下午,File Created by Ransomware,File,C:\Users\virus\Desktop\测试5\563905E6614FC3D25A00F2B1C2F68460.png,,Restored,RansomGuard
    
42. 04/17/2020 11:48:29 下午,Ransomware Behavior Detected,File,C:\Users\virus\Downloads\#Python #Ransomware (2020-04-16)\bp.exe,13816d317482b33670c3fdacd2feb772,Blocked,RansomGuard

复制代码