勒索 1X

hsks

changed hash
before：https://www.virustotal.com/gui/f ... dda2fd528c04dc37afb

Komeiji-Reimu

警告：此样本会操作共享文件夹，因此虚拟机测试要当心





卡巴斯基kill   

1. 组件: 文件反病毒
   
2. 结果说明: 检测到
   
3. 类型: 木马
   
4. 名称: VHO:Trojan-Ransom.Win32.Agent.gen
   
5. 精确度: 启发式分析
   
6. 威胁级别: 高
   
7. 对象类型: 文件
   
8. 对象名称: df65.exe
   
9. 对象的 MD5: A7D49EDEDC1D14CA74248CA0520ADDC0
   
10. 原因: 云保护

复制代码

360扫描miss
双击：

阻止后并没有被加密







Avast双击kill




华为 低误报模式

扫描kill Win32.Ransomware.Generic， 看来很容易


智量双击kill





火绒6

双击kill

1. 病毒名称：Ransom/BTCware.d
   
2. 病毒ID：4C80C42EA2CA9CE0
   
3. 病毒路径：C:\Users\Marisa\Desktop\df65\df65.exe
   
4. 操作类型：执行
   
5. 操作结果：已处理，删除文件
   

复制代码

冰盾






由于行为明显，应该不难查杀

留下的信

ATTENTION!!!!

Your computer ID:  jeonsoft-2AFFD49FDB7F37D3AAAED6-ROB

ATTENTION to representatives jeonsoft!!!!

Your system has been tested for security and unfortunately your system was vulnerable.
We specialize in file encryption and industrial (economic or corporate) espionage.
We don't care about your files or what you do, nothing personal - it's just business.
We recommend contacting us as your confidential files have been stolen and will be
sold to interested parties unless you pay to remove them from our clouds and auction,
or decrypt your files.

For more detailed information write to us: amsomarpostbe@mail.com and widemoucerpco@mail.com
Telegram: https://t.me/Black4Over

Your computer ID: jeonsoft-2AFFD49FDB7F37D3AAAED6-ROB

dght432

想找个勒索测卡巴的hips都没办法找到，最近的勒索卡巴扫描杀的好厉害

Komeiji-Reimu

dght432 发表于 2024-7-15 19:47
想找个勒索测卡巴的hips都没办法找到，最近的勒索卡巴扫描杀的好厉害

加壳之后测

ANY.LNK

微软：机器学习同时报告了2个报毒名
Trojan:Win32/Sabsik.FL.A!ml
Trojan:Win32/Caynamer.A!ml

biue

腾讯电脑管家 miss

Komeiji-Reimu

biue 发表于 2024-7-15 19:54
腾讯电脑管家 miss

能不能双击一下

御坂14857号

EIS

YU2711

Avira

Komeiji-Reimu

御坂14857号 发表于 2024-7-15 19:58
EIS

御坂妹妹都来了

还是说你是此方