#Ransomware

显示全部楼层 · 发表于 2023-12-3 21:16:31

秋日之殇发表于 2023-12-3 21:14
看厂家策略吧，但是解密程序是无害的。按道理是不该被检测的，至少不该被当成木马。

我的kart主程序现在还被判断为病毒木马程序

显示全部楼层 · 发表于 2023-12-3 21:18:29

本帖最后由 GreatMOLA 于 2023-12-3 21:28 编辑

误执行后的应急处置方法：加密扩展名为.Kuiper。使用搜索程序定位加密后的文件目录，将decrypt程序放进加密文件父目录后执行即可自动解密包括子目录内的所有文件。

Deep Instinct

Check Point

击杀Windows环境下的加密程序，解密程序被放过。

勒索信：

Your network has been compromised! All your important data has been encrypted!

There is only one way to get your data back to normal:

1. Contact us as soon as possible to avoid damages and losses from your business.
2. Send to us any encrypted file of your choice and your personal key.
3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files.
4. Pay the amount required in order to restore your network back to normal.
5. We will then send you our software to decrypt and will guide you through the whole restoration of your network.

We prefer Monero (XMR) - FIXED PRICE
We accept Bitcoin (BTC) - 20% extra of total payment!

============================================================================================================================

WARNING!
Do not rename encrypted data.
Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.

============================================================================================================================

Contact information:

In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html
Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9

============================================================================================================================

Your personal id: 5253413d61383435363139643033313737623939626262326461643136633130653135373a34303938

--------- Kuiper Team ------------ ;)

显示全部楼层 · 发表于 2023-12-3 21:20:12

hhjjjjjj123 发表于 2023-12-3 21:16
我的kart主程序现在还被判断为病毒木马程序

截图看一下

显示全部楼层 · 发表于 2023-12-3 21:20:59

BEST
C:\Users\123456\Desktop\bins\ransom.exe 是恶意软件 Gen:Suspicious.Cloud.1.LAW@ay4tWk
C:\Users\123456\Desktop\bins\encrypt-win32.exe 是恶意软件 Gen:Suspicious.Cloud.1.cAW@auczuhf
HyperDetect 机器学习检测到威胁. 文件已删除。
C:\Users\123456\Desktop\bins\decrypt-win32.exe 是恶意软件 Gen:Illusion.ML.Skyline.9.1010101

显示全部楼层 · 发表于 2023-12-3 21:25:06

本帖最后由 hhjjjjjj123 于 2023-12-3 21:26 编辑

秋日之殇发表于 2023-12-3 21:20
截图看一下

[img][/img]

显示全部楼层 · 发表于 2023-12-3 21:30:07

hhjjjjjj123 发表于 2023-12-3 21:25
[/img]

这个是360的问题，能运行吗？如果无法运行就页面上提一下误报吧。

显示全部楼层 · 发表于 2023-12-3 21:31:31

本帖最后由 hhjjjjjj123 于 2023-12-3 21:32 编辑

秋日之殇发表于 2023-12-3 21:30
这个是360的问题，能运行吗？如果无法运行就页面上提一下误报吧。

误报很多的无所谓，不主动查杀阻止，毕竟有卡巴的签名。想要精准的查杀还是要花银子，哈哈

显示全部楼层 · 发表于 2023-12-3 22:41:36

显示全部楼层 · 发表于 2023-12-4 12:03:51

anthonyqian 发表于 2023-12-3 20:44
ESET 云杀2个Win的，剩余其他平台的上报了
------------------

Detection will be included in the next update:
encrypt-linux - HEUR:Trojan-Ransom.Linux.Agent.gen
freebsd.arm64 - HEUR:Trojan-Ransom.Linux.Agent.gen
freebsd.x64 - HEUR:Trojan-Ransom.Linux.Agent.gen
freebsd.x86 - HEUR:Trojan-Ransom.Linux.Agent.gen
mac.arm64 - HEUR:Trojan-Ransom.OSX.Agent.gen
mac.x64 - HEUR:Trojan-Ransom.OSX.Agent.gen
ransom.linux.bin - HEUR:Trojan-Ransom.Linux.Agent.gen

Best regards, Pavel Sinenko, Malware Analyst

@秋日之殇

显示全部楼层 · 发表于 2023-12-6 11:21:47

金山毒霸kill 3x

[病毒样本] #Ransomware

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

评分

本帖子中包含更多资源