[中国制造] 每日网马上报 (28日更新：2009.07.27) 179x

悠柚

G Data miss 27

angir

MP主防MISS 40.
其中有部分运行后蓝屏，重启，MP没有拦截成功。。。
有些运行后连接一个IP，然后就没动作了，下载/上传量为0。。。
有些运行后在某些目录下建立*.exe，然后就没动作，可能是keylogger。。。
有些运行后释放衍生物，衍生物被MP杀后本体消失。。。
有些运行后直接删除本体。。。
有2个是捆绑了安装文件
一些dll/sys后缀的文件没有测试，不过MP更新了本地特征库后杀了几个。。。
所以MP真正的拦截率不只是那么底，因为有些样本运行后的动作没有威胁或者不满足MP的行为库。。
MP miss的样本直接上报官方。。
呼呼~累死偶了

[ 本帖最后由 angir 于 2009-7-16 13:11 编辑 ]

aerbeisi

IKARUS全灭！

will

更新~

悠柚

ArcaBit miss 57

幸福的猪猪

avira miss 2x，heuristics 2x，to kill。

We received the following archive files:

File ID	?Filename	Size (Byte)	Result
25400378	four.rar	284.57 KB	OK

A listing of files contained inside archives alongside their results can be found below:

File ID	?Filename	Size (Byte)	Result
25400379	187BB2F0@18.exe	18 KB	MALWARE
25400380	2D7FA84C@230.dll	230.51 KB	MALWARE
25400381	748CD32B@159.exe	159.93 KB	MALWARE
25400382	AF90EB99@143.exe	143 KB	MALWARE

Please find a detailed report concerning each individual sample below:

?Filename	Result
187BB2F0@18.exe	MALWARE

The file '187BB2F0@18.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

?Filename	Result
2D7FA84C@230.dll	MALWARE

The file '2D7FA84C@230.dll' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.

?Filename	Result
748CD32B@159.exe	MALWARE

The file '748CD32B@159.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Crypted.

?Filename	Result
AF90EB99@143.exe	MALWARE

The file 'AF90EB99@143.exe' has been determined to be 'MALWARE'.
Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.




kaba miss 41x，to kill！（不开启发式扫描）



[ 本帖最后由 幸福的猪猪 于 2009-7-17 15:55 编辑 ]

llydmissile

MVSE 8.5i
引擎 5400.1152
DAT Beta DAT 5000 Build timestamp: 2009-07-17 02:17:22 UTC

miss 16
To McAfee

angir

MP特征漏192。。
斗争中，是否测主防
昨天的教训太深刻了。。。

[ 本帖最后由 angir 于 2009-7-17 12:38 编辑 ]

angir

测完主防回来了。。。
主防miss32个，其中大部分是*.dll文件。。（偶没测）
MS都是运行后没有反应，没有生成物。。。
还有几个很凶狠的，运行不给你运，删除不给你删，压缩又拒绝。。。偶直接用红伞盖住了。。。（抱歉MP）
主防miss的To MP
ps:这次样本的质量不是很高，绝大部分都是删除verclsid.exe，MP很敏感，拒绝后本体就进MP隔离区了。。。

will

网马嘛，基本上都是生成器批量生成的，没啥意思…
跑一跑，把漏报的上报就行了…
算是支援其他用户吧~  呵呵