GLM之手

rgajhggfrsh

elastic拦截成勒索行为，重启还是无限进自动修复，没想到企业级edr也寄了

驭龙

昨天虚拟机出问题，无法连接网络，就没测试。

今天来晚了，结果Avira已经由algo引擎查杀


修改文件指纹以后，双击样本，Avira的APC发威，报告勒索？

虽然是TR开头的报法，但确实是APC，看来APC应该是结合avast的云？
APC的上传和检测日志：

[2026-09-06 22:27:07.354] [info] [BaseScan] [thread id: 2060] [ProtectionCloud] The file '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' was unknown in the Protection Cloud. SHA256: '3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5' Requestor: 'RealtimeProtection' Flags: '{Upload needed}' Status: successful
[2026-09-06 22:27:07.669] [info] [Core] [thread id: 2060] [ProtectionCloud] Starting upload of file 'C:\Users\ltqi\Downloads\def_behavior_test_v5.exe'
[2026-09-06 22:27:10.528] [info] [Core] [thread id: 2060] [ProtectionCloud] Upload of file 'C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' was successful
[2026-09-06 22:27:20.872] [info] [BaseScan] [thread id: 2060] [ProtectionCloud] The file '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' has been uploaded to the Protection Cloud and analyzed. SHA256: '3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5' Requestor: 'RealtimeProtection' Flags: '{Detected}{Upload done}' Status: successful
[2026-09-06 22:27:20.872] [info] [BaseScan] [thread id: 2060] [ProtectionCloud] The file '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' was scanned with the Protection Cloud. SHA256: '3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5' Requestor: 'RealtimeProtection' Flags: '{Detected}{Upload done}' Status: successful
[2026-09-06 22:27:20.872] [info] [BaseScan] [thread id: 2060] [ProtectionCloud] Detection by Protection Cloud: '{TR/APC.Ransomware}' File: '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' SHA256:'3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5'
[2026-09-06 22:27:22.207] [info] [BaseScan] [thread id: 2060] [FalsePositiveCloud] The file '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' has been checked with the false positive checker. Is false positive: false SHA256:3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5'. File size:'435250'. Status: successful
[2026-09-06 22:27:22.207] [warning] [BaseScan] [thread id: 2060] [Detection] The file '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' was detected. Detection name: TR/APC.Ransomware
[2026-09-06 22:27:22.208] [info] [RealTimeProtection] [thread id: 2060] [Mitigation] Add to protection path \Device\HarddiskVolume2\Users\ltqi\Downloads\def_behavior_test_v5.exe
[2026-09-06 22:27:22.208] [info] [RealTimeProtection] [thread id: 2060] [Mitigation] Copy the detected file to quarantine: \\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe
[2026-09-06 22:27:22.218] [info] [Quarantine] [thread id: 2060] File with original location [\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe] was copied to quarantined file [C:\ProgramData\Avira\Endpoint Protection SDK\quarantine\dce175a6.qua]
[2026-09-06 22:27:22.218] [info] [RealTimeProtection] [thread id: 2060] [Mitigation] Copy file to quarantine succeed
[2026-09-06 22:27:22.218] [info] [RealTimeProtection] [thread id: 2060] [Mitigation] Execute mitigation actions for the detected file: \\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe
[2026-09-06 22:27:22.218] [warning] [RealTimeProtection] [thread id: 2060] [Detection] Detection found - PID: 5400 Name: TR/APC.Ransomware Mitigation: 47 Cached: 0 Source: 2570 File: def_behavior_test_v5.exe
[2026-09-06 22:27:22.218] [warning] [EndpointProtection] [thread id: 2060] Detection found: 'TR/APC.Ransomware' Path: '\\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe' Sha256: '3f7abae05f97949c03d9e9a0064096c2d14780c2620ae918ccc7089d770937c5' Quarantine Group Id '03215e90-f0b8-488a-8941-fc0c43a1bc8d'
[2026-09-06 22:27:22.335] [info] [RealTimeProtection] [thread id: 2736] [Sensor] Do CmdLineScan for file C:\Program Files (x86)\Avira\Security\Avira.Spotlight.UI.Application.exe
[2026-09-06 22:27:22.627] [info] [RealTimeProtection] [thread id: 4848] [Mitigation] Generic remediation is skipped. Reason: Disabled by configuration option
[2026-09-06 22:27:22.633] [info] [Remediation] [thread id: 4848] Remediation of TR/APC.Ransomware started.
[2026-09-06 22:27:23.092] [info] [RealTimeProtection] [thread id: 4848] [Configuration] Insert path in file and folder protection list: c:\users\ltqi\downloads\def_behavior_test_v5.exe (persistent: false)
[2026-09-06 22:27:23.118] [info] [RealTimeProtection] [thread id: 4848] [Configuration] Insert path in file and folder protection list: c:\users\ltqi\DOWNLO~1\DEF_BE~1.EXE (persistent: false)
[2026-09-06 22:27:23.137] [info] [Remediation] [thread id: 4848] Original file won't be deleted, skipping quarantine, result=true
[2026-09-06 22:27:25.281] [info] [Remediation] [thread id: 4848] Remediation of TR/APC.Ransomware finished successfully.
[2026-09-06 22:27:25.294] [info] [RealTimeProtection] [thread id: 4848] [Mitigation] Remediate file \\?\C:\Users\ltqi\Downloads\def_behavior_test_v5.exe was successful

c199529

腾讯电脑管家18

不报毒