Java Ransomware (?) FSCRY x1

anthonyqian

来自Anyrun。

首次上传VT是在四天前，但是目前检测率还是只有5/66，只有卡巴斯基报了。ESET missed。

应该是只会加密(?) png txt jpg文件。

https://cowtransfer.com/s/b8ce52017cd94d

aboringman

1. 2022-06-14 12:20:11     恶意软件(QVM20.1.97BF.Malware.Gen)MD5:4e2dc880aa036e46bdada8450d25d622    已删除此文件，如果您发现误删，可从隔离区恢复此文件。        d:\test\9999.bin

复制代码

onedrive

诺顿：下载智能分析

Filename: 9999.bin
Threat name: WS.Reputation.1Full Path: C:\Users\realpc\Downloads\Compressed\9999.bin\9999.bin

____________________________

____________________________


On computers as of 
2022/6/14 at 12:30:22

Last Used 
2022/6/14 at 12:32:22

Startup Item 
No

Launched 
No

Threat type: Insight Network Threat. There are many indications that this file is untrustworthy and therefore not safe


____________________________


9999.bin Threat name: WS.Reputation.1
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

Medium
This file risk is medium.


____________________________


Source: External Media

Source File:
9999.bin

____________________________

File Actions

File: C:\Users\realpc\Downloads\Compressed\9999.bin\ 9999.bin Removed
____________________________


File Thumbprint - SHA:
db3dec6fc542d0d1e7e00233812984c3698a54bcc2a4d124e0a7075794e162c5
File Thumbprint - MD5:
4e2dc880aa036e46bdada8450d25d622

swizzer

未见加密行为

anthonyqian

swizzer 发表于 2022-6-14 12:40
未见加密行为

Anyrun上倒是有比较明显的行为

谁谁谁

腾管16.0：1x

开开心心卖手机

Avast miss

JuMin

咖啡 1X

心醉咖啡

毒霸扫描miss

anthonyqian

ESET

The detection for this threat will be included in the next update of detection engine, expected version: 25434.

9999.bin - Java/Filecoder.AV trojan