多样本挂马综合包 - 第12次

IllusionWing

这个肯定是不定期的。。指不准那作者什么时候更新... 而且不保证质量


7_27


7_10 1x

7_9 大的
http://other.sotee.com/2009-07-09/46134.html
http://www.fileden.com/files/2009/6/20/2483234/fakeav.7z
7_8

7_7_2 40x

7_7 8x

7_6_3 2x

7_6_2 5x

7_6 6x

7_5 38x

7_4_2 31x

7_4  7x


[ 本帖最后由 IllusionWing 于 2009-7-27 17:01 编辑 ]

HC303

Begin scan in 'G:\virus\7_4.rar'
G:\virus\7_4.rar
  [0] Archive type: RAR
    --> a8.exe1
      [DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
    --> sb2.exe1
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> svchost.exe1
      [DETECTION] Is the TR/Crypt.FKM.Gen Trojan
    --> a9.exe1
      [DETECTION] Is the TR/Crypt.UPKM.Gen Trojan
    --> L6.exe1
      [DETECTION] Is the TR/Dropper.Gen Trojan
    --> S16.exe1
      [DETECTION] Is the TR/Hijacker.Gen Trojan

me.exe1

UNDER ANALYSIS

[ 本帖最后由 HC303 于 2009-7-4 15:25 编辑 ]

fatezero

卡巴 1个....
病毒 HEUR:Trojan.Win32.Generic        E:\download\7_4.rar/svchost.exe1//PE_Patch//UPack

kalynn84

Win32:Trojan-gen {Other}

huangqian202

费尔
2009-7-4 15:50:15,TrojanPSW.OnLineGames.wlu.kjdk,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>svchost.exe1,Manual scan
2009-7-4 15:50:15,TrojanPSW.OnLineGames.aytr.milo,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>S16.exe1,Manual scan
2009-7-4 15:50:15,Trojan.Cap97312.aieo,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>me.exe1,Manual scan
2009-7-4 15:50:15,TrojanDropper.Gen.cbot,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>L6.exe1,Manual scan
2009-7-4 15:50:15,Trojan.Gamania.gen,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>a9.exe1,Manual scan
2009-7-4 15:50:15,TrojanPSW.WOW.awq.rein,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>a8.exe1,Manual scan
微点杀毒
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>svchost.exe1,        Malware.Win32.Suspect.f,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>sb2.exe1,        Packed.Win32.Unknown.b,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>S16.exe1,        Trojan-PSW.Win32.OLGames.thu,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>me.exe1,        Backdoor.Win32.Wuca.a,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>L6.exe1,        Trojan-PSW.Win32.OLGames.tgc,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>a9.exe1,        Trojan-Dropper.Win32.Agent.gl,        成功删除
2009-07-04 15:44:23        C:\Documents and Settings\Administrator\桌面\7_4.rar>>a8.exe1,        Packed.Win32.Unknown.b,        成功删除

dreams521

原帖由 huangqian202 于 2009-7-4 15:54 发表
费尔
2009-7-4 15:50:15,TrojanPSW.OnLineGames.wlu.kjdk,木马,Administrator,C:\Documents and Settings\Administrator\桌面\7_4.rar>>svchost.exe1,Manual scan
2009-7-4 15:50:15,TrojanPSW.OnLineGames.aytr.m ...

用什么工具截取的这些文字?

sam.to

to kl

kingmuro

过卡巴6.0

kingmuro

a9.exe1;D:\My Documents\桌面\test\7_4;Trojan.PWS.Qqpass.origin;;
L6.exe1\data001;D:\My Documents\桌面\test\7_4\L6.exe1;Trojan.PWS.Gamania.origin;;
L6.exe1;D:\My Documents\桌面\test\7_4;Container contains infected objects;;
me.exe1;D:\My Documents\桌面\test\7_4;Trojan.Siggen.564;;
S16.exe1/data002\data001;D:\My Documents\桌面\test\7_4\S16.exe1/data002;Trojan.PWS.Wsgame.12323;;
data002;D:\My Documents\桌面\test\7_4;Container contains infected objects;;
S16.exe1;D:\My Documents\桌面\test\7_4;Container contains infected objects;;
svchost.exe1;D:\My Documents\桌面\test\7_4;Trojan.MulDrop.32527;;

dreams521