8X#Ransomware

hsks

https://www.trendmicro.com/en_us ... erent-extortio.html

https://ws28.cn/f/4v54kzzr4vi
https://cowtransfer.com/s/66c8360523f941

Nocria

IKARUS emptied.

1. [05.03.2021 21:25:35] On-demand scan started: "user_defined"
   
2. [05.03.2021 21:25:35] Found, 0.32s, SigName: "Trojan-Ransom.FileCrypter", SigId: 319272124, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\1.exe"
   
3. [05.03.2021 21:25:35] Found, 0.47s, SigName: "Trojan-Ransom.FileCrypter", SigId: 318338557, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\2.exe"
   
4. [05.03.2021 21:25:35] Found, 0.15s, SigName: "Trojan.PDF.Phish", SigId: 320104171, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\3.pdf"
   
5. [05.03.2021 21:25:35] Found, 0.00s, SigName: "BZC.YAX.Nioc", SigId: 319477244, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\4.lnk"
   
6. [05.03.2021 21:25:35] Found, 0.00s, SigName: "Trojan-Ransom.FileCrypter", SigId: 319266100, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\5.exe"
   
7. [05.03.2021 21:25:35] Found, 0.00s, SigName: "Trojan-Downloader.PowerShell.Agent", SigId: 319713242, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\6.jpg"
   
8. [05.03.2021 21:25:35] Found, 0.00s, SigName: "Trojan.Win32.KillMBR", SigId: 319295670, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\7.exe"
   
9. [05.03.2021 21:25:35] Found, 0.297s, SigName: "Trojan.Crypt", SigId: 3460788, Type: "VIRUS", File: "C:\Users\promi\Desktop\8X\8.exe"
   
10. [05.03.2021 21:25:35] On-demand scan FINISHED: "user_defined"
    
11. [05.03.2021 21:25:35] ----------------------------------------------------
    
12. [05.03.2021 21:25:35] Directories scanned: 1
    
13. [05.03.2021 21:25:35] Files scanned: 8
    
14. [05.03.2021 21:25:35] Virus found: 8
    
15. [05.03.2021 21:25:35] ----------------------------------------------------

复制代码

正在缓冲

avast kill 5x
把记事本图标的快捷方式给双击了，好家伙，直接拦了漏洞攻击，但主程序还在

泉州晋江

卡巴斯基全杀

hsks

正在缓冲 发表于 2021-3-5 21:16
avast kill 5x
把记事本图标的快捷方式给双击了，好家伙，直接拦了漏洞攻击

3.pdf是钓鱼的

正在缓冲

hsks 发表于 2021-3-5 21:22
3.pdf是钓鱼的

双击的是4，3.pdf运行后进程自动消失

hsks

正在缓冲 发表于 2021-3-5 21:25
双击的是4，3.pdf运行后进程自动消失

嗯

Nocria

Malwarebytes killed 5x.

z68436425

ESET 剩两个都可以阻止

正在缓冲

hsks 发表于 2021-3-5 21:26
嗯

3.pdf是在sandboxie运行的，弹出几个进程后就消失了