勒索 1x

显示全部楼层 · 发表于 2024-8-4 18:53:46

---------- Ransomware ----------
Your files have been encrypted by Ransomware!
They can only be decrypted by paying us a ransom in cryptocurrency.
Encrypted files have the .ran extension.
IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable.
Contact us at the following email address to discuss payment.
1p2k7qcs@anonaddy.com
Your ID: VNDTWGXOJLJARRMDAEJB
---------- Ransomware ----------

复制代码

显示全部楼层 · 发表于 2024-8-4 18:55:40

WD KILL

复制代码

显示全部楼层 · 发表于 2024-8-4 18:58:06

智量双击后拦截

Time FilePath VirusName
2024-08-04 18:57:03 C:\$Recycle.Bin\S-1-5-21-290300138-800033358-3269160303-1003\Decryption Instructions.txt 威胁回滚(恢复)
2024-08-04 18:57:03 C:\$Recycle.Bin\S-1-5-21-290300138-800033358-3269160303-1001\Decryption Instructions.txt 威胁回滚(恢复)
2024-08-04 18:57:03 C:\$Recycle.Bin\S-1-5-18\Decryption Instructions.txt 威胁回滚(恢复)
2024-08-04 18:57:03 C:\$Recycle.Bin\Decryption Instructions.txt 威胁回滚(恢复)
2024-08-04 18:57:03 C:\Decryption Instructions.txt 威胁回滚(恢复)
2024-08-04 18:56:49 C:\Users\VM\Desktop\Encrypt.exe WIBD:HEUR.Ransom.F

复制代码

显示全部楼层 · 发表于 2024-8-4 18:59:59

本帖最后由 Ink丶泽林格于 2024-8-4 19:01 编辑

360 kill

显示全部楼层 · 发表于 2024-8-4 19:00:59

御坂14857号发表于 2024-8-4 18:58
智量双击后拦截

智量good

显示全部楼层 · 发表于 2024-8-4 19:02:08

显示全部楼层 · 发表于 2024-8-4 19:02:25

本帖最后由 aboringman 于 2024-8-4 20:33 编辑

双击，迅速触发恶意行为监控（应该是先偷袭了诱饵），无文件被加密

病毒名称：Ransom/Rattrap.A
病毒路径：C:\Users\Killer\Desktop\8ed24ddbcd88141fb1934ea20761b97d7cbdcb4e5042f6e1d893ed817a5b4a89\Encrypt.exe
操作结果：已处理

复制代码

显示全部楼层 · 发表于 2024-8-4 19:07:14

卡巴扫描miss 双击PDM:Trojan.Win32.Generic

显示全部楼层 · 发表于 2024-8-4 19:25:16

显示全部楼层 · 发表于 2024-8-4 19:52:35

BD ATD 1X

[病毒样本] 勒索 1x