Devos Ransomware x1 (3/31)

wwwab

AdobeIPCBroker.exe => not detect-worthy
AdobeIPCBrokerCustomHook.exe => not detect-worthy
api-ms-win-core-console-l1~.dll => not detect-worthy
api-ms-win-core-console-l1~.dll => not detect-worthy
api-ms-win-core-datetime-l~.dll => not detect-worthy
api-ms-win-core-debug-l1-1~.dll => not detect-worthy
api-ms-win-core-errorhandl~.dll => not detect-worthy
api-ms-win-core-file-l1-1-~.dll => not detect-worthy
api-ms-win-core-file-l1-2-~.dll => not detect-worthy
api-ms-win-core-file-l2-1-~.dll => not detect-worthy
api-ms-win-core-handle-l1-~.dll => not detect-worthy
api-ms-win-core-heap-l1-1-~.dll => not detect-worthy
api-ms-win-core-interlocke~.dll => not detect-worthy
api-ms-win-core-kernel32-l~.dll => not detect-worthy
api-ms-win-core-libraryloa~.dll => not detect-worthy
api-ms-win-core-localizati~.dll => not detect-worthy
api-ms-win-core-memory-l1-~.dll => not detect-worthy
api-ms-win-core-namedpipe-~.dll => not detect-worthy
api-ms-win-core-processenv~.dll => not detect-worthy
api-ms-win-core-processthr~.dll => not detect-worthy
api-ms-win-core-processthr~.dll => not detect-worthy
api-ms-win-core-profile-l1~.dll => not detect-worthy
api-ms-win-core-rtlsupport~.dll => not detect-worthy
api-ms-win-core-string-l1-~.dll => not detect-worthy
api-ms-win-core-synch-l1-1~.dll => not detect-worthy
api-ms-win-core-synch-l1-2~.dll => not detect-worthy
api-ms-win-core-sysinfo-l1~.dll => not detect-worthy
api-ms-win-core-sysinfo-l1~.dll => not detect-worthy
api-ms-win-core-timezone-l~.dll => not detect-worthy
api-ms-win-core-util-l1-1-~.dll => not detect-worthy
API-MS-Win-core-xstate-l2-~.dll => not detect-worthy
api-ms-win-crt-conio-l1-1-~.dll => not detect-worthy
api-ms-win-crt-convert-l1-~.dll => not detect-worthy
api-ms-win-crt-environment~.dll => not detect-worthy
api-ms-win-crt-filesystem-~.dll => not detect-worthy
api-ms-win-crt-heap-l1-1-0.dll => not detect-worthy
api-ms-win-crt-locale-l1-1~.dll => not detect-worthy
api-ms-win-crt-math-l1-1-0.dll => not detect-worthy
api-ms-win-crt-multibyte-l~.dll => not detect-worthy
api-ms-win-crt-private-l1-~.dll => not detect-worthy
api-ms-win-crt-process-l1-~.dll => not detect-worthy
api-ms-win-crt-runtime-l1-~.dll => not detect-worthy
api-ms-win-crt-stdio-l1-1-~.dll => not detect-worthy
api-ms-win-crt-string-l1-1~.dll => not detect-worthy
api-ms-win-crt-time-l1-1-0.dll => not detect-worthy
api-ms-win-crt-utility-l1-~.dll => not detect-worthy
api-ms-win-downlevel-kerne~.dll => not detect-worthy
api-ms-win-downlevel-kerne~.dll => not detect-worthy
api-ms-win-eventing-provid~.dll => not detect-worthy
boost_system-vc100-mt-1_59.dll => not detect-worthy
CodeParsingDLL.dll => not detect-worthy
config.ini => not detect-worthy
controllor.dll => not detect-worthy
CRClient.dll => not detect-worthy
cr_win_client_config.cfg => not detect-worthy
D3DCompiler_43.dll => not detect-worthy
d3dx9_43.dll => not detect-worthy
drmd.dll => not detect-worthy
Engine.dll => not detect-worthy
ground => not detect-worthy
IPCBox.pimx => not detect-worthy
libcui40.dll => not detect-worthy
Machining.exe => not detect-worthy
mfc100u.dll => not detect-worthy
msvcp100.dll => not detect-worthy
msvcp140.dll => not detect-worthy
msvcp140_1.dll => not detect-worthy
msvcp140_2.dll => not detect-worthy
msvcp140_atomic_wait.dll => not detect-worthy
msvcp140_codecvt_ids.dll => not detect-worthy
msvcr100.dll => not detect-worthy
Options.dll => not detect-worthy
StartupOptions.xml => not detect-worthy
TmEvent.dll => not detect-worthy
ToolList.ini => not detect-worthy
Tool_mill.ini => not detect-worthy
tracegen.exe => not detect-worthy
triangulation.dll => not detect-worthy
ucrtbase.dll => not detect-worthy
uninst.exe => not detect-worthy
UserManual_ch.html => not detect-worthy
UserManual_en.html => not detect-worthy
vccorlib140.dll => not detect-worthy
vcruntime140.dll => not detect-worthy
xdf.dll => not detect-worthy

Sophos：全部不值得检测

漂洋过海123

火绒解压后上报压缩包的：

该样本暂未发现可疑行为，不做报毒处理，感谢您的反馈。

秋日之殇

漂洋过海123 发表于 2022-4-8 16:03
火绒解压后上报压缩包的：

解压后双击主程序不就直接开始加密文件了？

swizzer

漂洋过海123 发表于 2022-4-8 16:03
火绒解压后上报压缩包的：

这就需要@火绒工程师  了

火绒工程师

漂洋过海123 发表于 2022-4-8 16:03
火绒解压后上报压缩包的：

您好，该样本火绒是可以查杀的，请问该处理结果的来源是哪里？

swizzer

火绒工程师 发表于 2022-4-8 17:20
您好，该样本火绒是可以查杀的，请问该处理结果的来源是哪里？

https://bbs.kafan.cn/forum.php?m ... 463&fromuid=1068458

https://bbs.kafan.cn/forum.php?m ... 871&fromuid=1068458


希望官方可以对样本进行进一步分析并处理真正的Payload而不是简单拉黑母体

wwwab

火绒工程师 发表于 2022-4-8 17:20
您好，该样本火绒是可以查杀的，请问该处理结果的来源是哪里？

https://bbs.huorong.cn/thread-101682-1-1.html

说了是解压后的不是解压前的

你拿的是解压前的扫，不是解压后的扫

https://bbs.kafan.cn/forum.php?m ... 94&pid=50739169

火绒工程师

swizzer 发表于 2022-4-8 17:25
https://bbs.kafan.cn/forum.php?m ... 463&fromuid=1068458

https://bbs.kafan.cn/forum.php?m ... 8 ...

该问题我们会持续跟进解决，感谢您的反馈。

火绒工程师

wwwab 发表于 2022-4-8 17:30
https://bbs.huorong.cn/thread-101682-1-1.html

说了是解压后的不是解压前的

针对此问题我们会再次进行确认，感谢您的反馈

lvzhiwei

看了那个黑dll，eset ，红伞，微软居然还没入库，金山，腾讯也没入库，瑞星入的最早，然后江民也入库了。搞不懂这些厂商的入库原则