fake（更新851楼）

ysclwjxv

支持一下，非常感谢楼主分享。

kurakimai

UPDATE

jayavira

322L
to eset

http://samples.nod32.com.hk/inde ... af7e6eb704be02122c1

hx1997

322L

2011-5-16 16:50:52        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        create process        G:\windows\system32\attrib.exe        allowed        0.*
2011-5-16 16:49:09        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\NetHood        allowed        0.*
2011-5-16 16:49:06        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder        allowed        0.*
2011-5-16 16:49:02        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip        allowed        0.*
2011-5-16 16:49:00        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.xml        allowed        0.*
2011-5-16 16:48:56        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.vbs        allowed        0.*
2011-5-16 16:48:54        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.vbp        allowed        0.*
2011-5-16 16:48:52        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.txt        allowed        0.*
2011-5-16 16:48:44        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.rar        allowed        0.*
2011-5-16 16:48:42        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.ppt        allowed        0.*
2011-5-16 16:48:40        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.png        allowed        0.*
2011-5-16 16:48:33        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.pdf        allowed        0.*
2011-5-16 16:48:31        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.msstyles        allowed        0.*
2011-5-16 16:48:30        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.mp3        allowed        0.*
2011-5-16 16:48:28        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.log        allowed        0.*
2011-5-16 16:48:26        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.js        allowed        0.*
2011-5-16 16:48:13        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.JPG        allowed        0.*
2011-5-16 16:48:12        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.ini        allowed        0.*
2011-5-16 16:48:10        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.inf        allowed        0.*
2011-5-16 16:48:08        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.html        allowed        0.*
2011-5-16 16:48:06        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.htm        allowed        0.*
2011-5-16 16:48:05        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.gif        allowed        0.*
2011-5-16 16:48:03        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.frm        allowed        0.*
2011-5-16 16:48:01        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.doc        allowed        0.*
2011-5-16 16:47:59        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.dll        allowed        0.*
2011-5-16 16:47:55        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.csv        allowed        0.*
2011-5-16 16:47:53        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.cls        allowed        0.*
2011-5-16 16:47:51        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.chm        allowed        0.*
2011-5-16 16:47:48        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.bas        allowed        0.*
2011-5-16 16:47:43        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        delete key        HKEY_USERS\SANDBOX_HX_VIRUS\user\current\software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.7z        allowed        0.*
2011-5-16 16:44:57        G:\Sandbox\HX\Virus\user\current\Temp\Adobe_Flash_Player.exe        nt load driver        \SystemRoot\system32\drivers\1453E8.sys        blocked        0.*
2011-5-16 16:44:49        G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\pusk.exe        create process        G:\Sandbox\HX\Virus\user\current\Temp\Adobe_Flash_Player.exe        allowed        0.*
2011-5-16 16:44:13        G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\pusk.exe        create process        G:\Sandbox\HX\Virus\user\all\Application Data\hARalSyaYNWv.exe        allowed        0.*

hx1997

322L的衍生物

ESET killed 1×, to 1×.
G:\Documents and Settings\Administrator.HX-C0987054243B\桌面\桌面.7z > 7ZIP > 1453E8.tmp - Win32/Olmasco.D 特洛伊木马
http://samples.nod32.com.hk/index.php?a=query&lang=2&md5=ae790f68abef50b913a804459509d2f1

留侯

322L，大蜘蛛：
pusk.exe 已感染：  Trojan.DownLoader2.59289

留侯

325L，衍生物，大蜘蛛也发现一个：
桌面\1453e8.tmp\data002 - infected with Trojan.Tdlbase.1
桌面\1453e8.tmp - BINARYRES container

另一个文件加了壳：
桌面\Adobe_Flash_Player.exe 已打包，方式： FLY-CODE
已上报！

kurakimai

回复 324楼 hx1997 的帖子

传说中的自杀行为

hx1997

回复 328楼 kurakimai 的帖子

放心我在沙盘里跑的~
Adobe_Flash_Player.exe这个还加驱，真邪恶

李不知

322L
金山KILL