Ransom.hellokitty (2023-11-18)

petr0vic

PYAS_Security

PYAS V2.9.2 本地引擎 Kill All
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.5/0.38461538461538464
File: C:\Users\Windows\Downloads\6\1.exe
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.5/0.3076923076923077
File: C:\Users\Windows\Downloads\6\2.exe
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.5/0.38461538461538464
File: C:\Users\Windows\Downloads\6\3.exe
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.904/0.5677966101694916
File: C:\Users\Windows\Downloads\6\4.exe
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.875968992248062/0.5491803278688525
File: C:\Users\Windows\Downloads\6\5.exe
==================================================
Engine: PYAS ML Engine
Detect: Suspicious
Levels: 0.904/0.5677966101694916
File: C:\Users\Windows\Downloads\6\6.exe
==================================================

pal家族

kaspersky kill all
今天，2023/11/19 1:55:24;E:\virus\6.exe;6.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Blocker.gen;木马;高;启发式分析;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护
今天，2023/11/19 1:55:32;E:\virus\2.exe;2.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Encoder.vhi;木马;高;确切;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护
今天，2023/11/19 1:55:32;E:\virus\1.exe;1.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Gen.awwp;木马;高;确切;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护
今天，2023/11/19 1:55:32;E:\virus\3.exe;3.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Gen.awwp;木马;高;确切;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护
今天，2023/11/19 1:55:32;E:\virus\5.exe;5.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Encoder.gen;木马;高;启发式分析;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护
今天，2023/11/19 1:55:32;E:\virus\4.exe;4.exe;E:\virus;文件;检测到;检测到恶意对象;检测到;VHO:Trojan-Ransom.Win32.Blocker.gen;木马;高;启发式分析;WinRAR 压缩文件管理器;WinRAR.exe;C:\Program Files\WinRAR\WinRAR.exe;C:\Program Files\WinRAR;11432;遥遥领先的笔记\72428;发起者;云保护

嘿嘿不能说

虽然生成了勒索信，但是目测是没有文件被加密。



全部被自动上传，但5.exe的结果为暂未发现风险。

GDHJDSYDH

EIS清空

petr0vic

withsecure client

biue

anthonyqian

BD

scan 5/6 (Gen:Suspicious.Cloud.2.lqW@a0!CAFp x2, DeepScan:Generic.Malware.Pf x3)

UNknownOoo

火绒
扫描：MISS ALL


X-Sec
扫描：2X

1. ---------------------
   
2. 2023/11/19 09:42:40 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\4.exe -- [xave-heur] Heur:Ransom.Generic
   
3. 2023/11/19 09:42:41 Threat Detected: C:\Users\UnknownOoo\Downloads\Compressed\6.exe -- [rame-cloud] Ransom.DeathRansom!8.1269D

复制代码

奇安信
扫描：ALL

1. QDE.V2.3.1LDCDDNAGQ.HP        AI引擎        dc6b5ea4add94241477f6839437a3be5        未清理
   
2.         C:\Users\UnknownOoo\Downloads\Compressed\1.exe
   
3. QDE.V2.3.7661O7ESH.JH        AI引擎        feb36f2412af1bfbd4ca3087f1bfca73        未清理
   
4.         C:\Users\UnknownOoo\Downloads\Compressed\6.exe
   
5. QDE.V2.3.7661O7ESH.JH        AI引擎        270edfe54fa35346a55c2f54a6fe19c5        未清理
   
6.         C:\Users\UnknownOoo\Downloads\Compressed\5.exe
   
7. QDE.V2.3.1LDCDDNAGQ.HP        AI引擎        c71f78e41c9dc4400379feb237c54324        未清理
   
8.         C:\Users\UnknownOoo\Downloads\Compressed\2.exe
   
9. QDE.V2.3.7661O7ESH.JH        AI引擎        feb36f2412af1bfbd4ca3087f1bfca73        未清理
   
10.         C:\Users\UnknownOoo\Downloads\Compressed\4.exe
    
11. QDE.V2.3.1LDCDDNAGQ.HP        AI引擎        dc6b5ea4add94241477f6839437a3be5        未清理
    
12.         C:\Users\UnknownOoo\Downloads\Compressed\3.exe
    

复制代码

装甲未被击穿

铁壳。文件信誉2天。