#Galaxy #Ransomware（7.26）

a233

Windows Defender
Trojan:Win32/Wacatac.B!ml

心心相印

11111111111445 发表于 2021-7-26 11:31
360云拉黑了，avast kill

360云拉黑挺快的，是它自己抓到样本的吗？还是别人上报给他的？

11111111111445

心心相印 发表于 2021-7-26 11:45
360云拉黑挺快的，是它自己抓到样本的吗？还是别人上报给他的？

应该是有人上报了吧，不太清楚

aboringman

Norton：Heur.AdvML.C

swizzer

智量双击kill。
WIBD:HEUR.Ransom.F

1. 2021-07-26 12:28:58|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\PyQt5\QtCore.pyd|Heur.ML.PE.B
   
2. 2021-07-26 12:29:15|D:\IDM\Program\1DED78A44A6A508EDE0D043BDF0FBDFE.exe|WIBD:HEUR.Ransom.F
   
3. 2021-07-26 12:29:18|D:\IDM\Program\1DED78A44A6A508EDE0D043BDF0FBDFE.exe|WIBD:HEUR.Ransom.F
   
4. 2021-07-26 12:29:26|C:\Users\John Smith\Desktop\Excel 2016.lnk|威胁回滚(恢复)
   
5. 2021-07-26 12:29:26|C:\Users\John Smith\Desktop\腾讯QQ.lnk|威胁回滚(恢复)
   
6. 2021-07-26 12:29:26|C:\Users\John Smith\Desktop\Word 2016.lnk|威胁回滚(恢复)
   
7. 2021-07-26 12:29:26|C:\Users\John Smith\Desktop\AppCheck Anti-Ransomware.lnk|威胁回滚(恢复)
   
8. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\altgraph-0.17.dist-info\top_level.txt|威胁回滚(恢复)
   
9. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\base_library.zip|威胁回滚(恢复)
   
10. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pip-21.1.3.dist-info\entry_points.txt|威胁回滚(恢复)
    
11. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pip-21.1.3.dist-info\LICENSE.txt|威胁回滚(恢复)
    
12. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pip-21.1.3.dist-info\top_level.txt|威胁回滚(恢复)
    
13. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pyinstaller-4.4.dist-info\entry_points.txt|威胁回滚(恢复)
    
14. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pyinstaller-4.4.dist-info\LICENSE.txt|威胁回滚(恢复)
    
15. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pyinstaller-4.4.dist-info\metadata.json|威胁回滚(恢复)
    
16. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\pyinstaller-4.4.dist-info\top_level.txt|威胁回滚(恢复)
    
17. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\setuptools-47.1.0.dist-info\dependency_links.txt|威胁回滚(恢复)
    
18. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\setuptools-47.1.0.dist-info\entry_points.txt|威胁回滚(恢复)
    
19. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\setuptools-47.1.0.dist-info\top_level.txt|威胁回滚(恢复)
    
20. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\logo100.gif|威胁回滚(恢复)
    
21. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\logo.eps|威胁回滚(恢复)
    
22. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\logoLarge.gif|威胁回滚(恢复)
    
23. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\logo64.gif|威胁回滚(恢复)
    
24. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo100.gif|威胁回滚(恢复)
    
25. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo150.gif|威胁回滚(恢复)
    
26. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo.eps|威胁回滚(恢复)
    
27. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\logoMed.gif|威胁回滚(恢复)
    
28. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo175.gif|威胁回滚(恢复)
    
29. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo200.gif|威胁回滚(恢复)
    
30. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\pwrdLogo75.gif|威胁回滚(恢复)
    
31. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\tk\images\tai-ku.gif|威胁回滚(恢复)
    
32. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_ARC4.pyd|威胁回滚(隔离)
    
33. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_Salsa20.pyd|威胁回滚(隔离)
    
34. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_chacha20.pyd|威胁回滚(隔离)
    
35. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_raw_aes.pyd|威胁回滚(隔离)
    
36. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_raw_aesni.pyd|威胁回滚(隔离)
    
37. 2021-07-26 12:29:26|C:\Users\John Smith\AppData\Local\Temp\_MEI41202\Crypto\Cipher\_raw_arc2.pyd|威胁回滚(隔离)
    
38. 
    

复制代码

蓝雨风暴

EMSI和MBAM扫描均报告安全。

看楼上GD B引擎杀就有种不祥的预感，EMSI的A引擎果然哑火了

ANY.LNK

Microsoft Defender：Trojan:Win32/Wacatac.B!ml

louise90

卡巴入库

Hello,

This file is already detected by our internal bases:
1DED78A44A6A508EDE0D043BDF0FBDFE - Trojan-Ransom.Win32.Gen.abry
Detection will be included in the next update.

wwwab

louise90 发表于 2021-7-26 15:19
卡巴入库

我四楼都说明上报了

Hello,

This file is already detected by our internal bases:
Trojan-Ransom.Win32.Gen.abry
Detection will be included in the next update.

846472713

360