Ransomware legionlocker2.0

anthonyqian

来自 anyrun

发帖时VT 15 / 69

https://wws.lanzous.com/ibNp3nqcdla
诺顿默认启发不杀，调整为主动后报Heur.AdvML.A

Virus4

诺顿这个报毒，是引擎叫AdvancedMachineLearning吗

温馨小屋

Norton双击SONAR杀，并且B杀了一个衍生物，但是任务管理器被禁用了。


Filename: tgvnaw9utg9ja2vymi4w.exe
Threat name: SONAR.Heuristic.170Full Path: Not Available

____________________________

____________________________


On computers as of
2021/4/6 at 21:48:34

Last Used
2021/4/6 at 21:48:34

Startup Item
No

Launched
Yes

SONAR Protection monitors for suspicious program activity on your computer.


____________________________


tgvnaw9utg9ja2vymi4w.exe Threat name: SONAR.Heuristic.170
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
tgvnaw9utg9ja2vymi4w.exe

____________________________

File Actions

File: c:\Users\nortonltsc\Desktop\ tgvnaw9utg9ja2vymi4w.exe Threat Removed
____________________________

Network Actions

Event: Auto-Protect triggered (Performed by c:\users\nortonltsc\desktop\tgvnaw9utg9ja2vymi4w.exe, PID:7448) No action taken
____________________________

System Settings Actions

Event: Process start (Performed by c:\users\nortonltsc\desktop\tgvnaw9utg9ja2vymi4w.exe, PID:7448) No action taken
Event: PE file creation: c:\Users\nortonltsc\AppData\Local\Temp\ legionlocker2.0.exe (Performed by c:\users\nortonltsc\desktop\tgvnaw9utg9ja2vymi4w.exe, PID:7448) No action taken
Event: Process start: c:\Windows\SysWOW64\ cmd.exe, PID:8120 (Performed by c:\users\nortonltsc\desktop\tgvnaw9utg9ja2vymi4w.exe, PID:7448) No action taken
Event: Process start: c:\users\nortonltsc\desktop\ tgvnaw9utg9ja2vymi4w.exe, PID:7448 (Performed by c:\users\nortonltsc\desktop\tgvnaw9utg9ja2vymi4w.exe, PID:7448) No action taken
____________________________


File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

心醉咖啡

火绒扫描miss

温馨小屋

BD杀衍生物，然后程序崩溃了。

Trojan.BAT.Agent.JC

yg19

诺顿的AdvML机学启发分A B C （D?）几个报法，具体也不清楚是模型名称还是暴露时间（官方自己也没说）

温馨小屋

yg19 发表于 2021-4-6 21:53
诺顿的AdvML机学启发分A B C （D?）几个报法，具体也不清楚是模型名称还是暴露时间（官方自己也没说）

B应该是本地的，C是云联动的，A我不敢开

温馨小屋

卡巴

事件: 检测到恶意对象
用户: DESKTOP-RQ926HD\NortonLTSC
用户类型: 活动用户
应用程序名称: explorer.exe
应用程序路径: C:\Windows
组件: 文件反病毒
结果说明: 检测到
类型: 木马
名称: HEUR:Trojan.Win32.Generic
精确度: 启发式分析
威胁级别: 高
对象类型: 文件
对象名称: data0002.res
对象路径: C:\Users\NortonLTSC\Desktop\TGVnaW9uTG9ja2VyMi4w.exe//
MD5: 0A69E026476874DD1FADE041C5E76F92
原因: 机器学习
数据库发布日期: 今天，2021/4/6 17:06:00

正在缓冲

avast扫描不认为它是恶意软件，但是双击就认为是了

anthonyqian

yg19 发表于 2021-4-6 21:53
诺顿的AdvML机学启发分A B C （D?）几个报法，具体也不清楚是模型名称还是暴露时间（官方自己也没说）

据我观察，A只有主动启发模式下才会报。如果报C杀，基本上同时也会入库杀。D杀很罕见了，好像去年有碰到过。