Ransom.raxid

petr0vic

drweb 0/4

swizzer

petr0vic

swizzer 发表于 2026-4-20 16:49

Very informative messages from elastic

aikafans

冰盾1234拦截，但是已经被加密了
fsp杀了2和3，还是被加密了

嘿嘿不能说

ESET：干掉了本体和勒索信，但是没啥用

1. 2026/4/20 22:04:28;深度行为检测扫描程序;文件;C:\Users\123aaa\Desktop\Vir\1.exe;BH/Filecoder.H.3 特洛伊木马;已通过删除清除;123a\123aaa;;C618A5C441EA2430EE5B77AE1C67E8E624FB6AFF;;YWRiNzBhY2QtYjU3ZS00MDg5LTg1N2ItYTI0ZGIzYjY4MzQw
   
2. 
   
3. 2026/4/20 22:04:30;文件系统实时防护;文件;C:\Users\123aaa\Desktop\readme.txt;Win64/Filecoder.OW 特洛伊木马;已删除;123a\123aaa;在通过应用程序创建的新文件上发生了事件: C:\Users\123aaa\Desktop\Vir\1.exe (C618A5C441EA2430EE5B77AE1C67E8E624FB6AFF).;5E9F69402CA1D4EF3BA00D8F23176B7072CDD539;2026/4/20 22:04:20;bcE4h/9nLUWcoce9BQ4atA==

复制代码

啊松

1.exe and 3.exe were detected as malicious by Kaspersky UDS.
2.exe was detected as malicious by Kaspersky System Watcher, and the scheduled task was rolled back.
After double-clicking 4.exe, the file was encrypted; it was then detected as malicious by Kaspersky System Watcher and the file was restored.

ISAZre

卡巴全部拉黑，很快啊

啊松

火绒双击1.exe和2.exe文件被加密。其他应该也一样




360卫士加杀毒

双击1.exe拦截并且回滚部分图片文件







2.exe无论是否拦截开机启动项都会被加密文件








其余miss

UNknownOoo

HuoRong

1. Detection: Ransom/Rattrap.B
   
2. Path: C:\Users\UnknownOoo\Desktop\Vir\4.exe
   
3. Result: deleted
   
4. 
   
5. Process ID: 3868
   
6. Process Command line: "C:\Users\UnknownOoo\Desktop\Vir\4.exe"
   
7. Parent Process ID: 5996
   
8. Parent: C:\Windows\explorer.exe
   
9. Parent process Command line: C:\Windows\Explorer.EXE

复制代码

Ransomware was detected by ransomware trap, and a rollback was performed.

xjwtzq

奇安信扫描miss