Ransom.b6 (2023-06-17)

岩浆膏cream

dght432 发表于 2023-6-17 23:54
360扫描miss，双击重启没发现文件被加密

右键以管理员身份运行了吗

dght432

岩浆膏cream 发表于 2023-6-18 00:01
右键以管理员身份运行了吗

就是管理员运行，但是没看见有图片被加密，360也没拦截

swizzer

HMPA failed...

a27573

swizzer 发表于 2023-6-18 01:10
HMPA failed...

这个挺少见啊

swizzer

a27573 发表于 2023-6-18 01:15
这个挺少见啊

主要是这玩意儿每次调用certutil只加密一个文件多步主防恐怕得单独加规则/训模型才能顶得住这种加密方式

GDHJDSYDH

陈冠希丶 发表于 2023-6-17 22:34
wd kill

大厂都miss的情况下，微软居然如此之硬

AEht

智量双击kill，回滚成功！


瑞星之剑nb！

wwwab

ChatGPT Kill

The given code appears to be a batch script that executes a ransomware attack. It first checks if the script is running with administrative privileges and prompts for elevation if not. Then, it proceeds with encrypting files on the user's desktop. The encrypted files are renamed with a ".B6" extension. It displays a ransom message, demanding a $300 ransom in Bitcoin and providing an email address to send the payment and personal decryption key. The script waits for the user to enter the correct decryption key before initiating the decryption process.

It is important to note that ransomware attacks are illegal and unethical. This type of code should never be used maliciously or without proper authorization.

aikafans

往生全凭佛接引 发表于 2023-6-17 23:17
我双击了，360miss

啊，这。。。

pal家族

上报卡巴之后卡巴杀了。
Hello,

New malicious software was found in the attached file. Its detection will be included in the next update.
Thank you for your help.

Trojan-Ransom.BAT.Agent.dj


Best regards, Kirill, Malware Analyst Team Lead