|
Paczki, malware, złośliwe pliki, linki itp.
|
22.02.2013, 12:27
94 samples by Barti18
Emsi 85/94 (90,42%) Dodano: 22 lut 2013, 12:14 2013-02-22-tomatto007.7z Emsi 564/582 (96,9%)
EIS 12 HITMAN
22.02.2013, 15:26
1344 Malware By BudbarareHell
Treść widoczna jedynie dla zarejestrowanych użytkowników sg Sporo adwaru i innego pupu
Jag ser mig om och ser
Mitt hem försvinna bort Min tid där hemma känns Nu alldeles för kort 
22.02.2013, 15:36
BudbarareHell napisał(a): 1344 Malware By BudbarareHell Avast v8:895/1344 (66,5%) skan PNP włączony Avast v8+MBAM 981/1344 (72,99%)
0x DEADBEEF
22.02.2013, 16:51
Ransomware Urausy
Avast! V7, sent to virus lab.
Comodo Internet Security 6.1
22.02.2013, 19:57
3 fresh samples
avira 1/3 94 samples by Barti18 79/94 2013-02-22-tomatto007.7z 540/582 1344 Malware By BudbarareHell 935/1344
WIN11
Ventura 
23.02.2013, 00:15
[Aby zobaczyć linki, zarejestruj się tutaj] Win32.GenericPWS.Y/Spybot by Barti18 0/1 3 fresh samples by spywar 0/3 Ransomware Urausy by Waves97 0/1 94 samples by Barti18 61/94 (64,89%) 582 files 2013-02-22-tomatto007 367/582 (63,06%) 1344 Malware By BudbarareHell 781/1344 (58,11%)
Podwójne dno polega na tym, że ukrywa trzecie i czwarte...
23.02.2013, 11:46
582 files 2013-02-22-tomatto007
537/582 (92,26%) Ransomware Urausy by Waves97 1/1 3 fresh samples by spywar 1/3 94 samples by Barti18 72/94 (76,59%)
Emsisoft
23.02.2013, 17:03
Trojan MSIL SPY
[Aby zobaczyć linki, zarejestruj się tutaj] Treść widoczna jedynie dla zarejestrowanych użytkowników
GarciaDefender ( Beta tester+Volunteer Bitdefender Team+Virus analyst beginner )
--------------------------------------------------------------------------------------------------------- Bitdefender Internet Security 2013
23.02.2013, 17:21
Trojan MSIL SPY : Avast! V8, sent to virus lab.
Comodo Internet Security 6.1
23.02.2013, 17:28
garciadefender napisał(a): Trojan MSIL SPY KIS 2013 nie wykrywazagrożenia
••• KASPERSKY Internet Security 2018 | ZEMANA AntiMalware 2 •••
23.02.2013, 19:29
garciadefender napisał(a): Trojan MSIL SPY Emsi ; Trojan.MSIL.Spy.Keylogger.AMN (A)
EIS 12 HITMAN
23.02.2013, 20:56
garciadefender napisał(a): Trojan MSIL SPY [Aby zobaczyć linki, zarejestruj się tutaj] [Aby zobaczyć linki, zarejestruj się tutaj] Nie może się biedak uruchomić mimo, że Kaspersky ma wyłączone skanowanie AV i nie jest w KSN  Normalnie przy skanowaniu (max) też nic nie wykrywa.
KIS/EIS/MKS, MBAM, HitmanPro, Eset Online, WF+uBlock
23.02.2013, 21:48
myciu1974 napisał(a):garciadefender napisał(a): Trojan MSIL SPY A listing of files alongside their results can be found below: File ID Filename Size (Byte) Result 4039214 Psy%20movie.exe 0 Byte KNOWN CLEAN Please find a detailed report concerning each individual sample below: Filename Result Psy%20movie.exe KNOWN CLEAN The file ''Psy%20movie.exe'' has been determined to be ''KNOWN CLEAN''. In particular this means that we could not find any malicious content. Please note that the file is part of ''Wireshark 1.8.2.0''.
WIN11
Ventura
23.02.2013, 21:53
KIS/EIS/MKS, MBAM, HitmanPro, Eset Online, WF+uBlock
23.02.2013, 22:10
Coś nie chce działać na natywnym jak są jakieś progzy zabezpieczające: a po restarcie tylko się skopiował, bez uruchomienia:
[Aby zobaczyć linki, zarejestruj się tutaj] i nic się nie dzieje: [Aby zobaczyć linki, zarejestruj się tutaj] Edit: [Aby zobaczyć linki, zarejestruj się tutaj] Kasperczak nie dezynfekował systemu, czyli toto nie zrobiło nic poważnego.
KIS/EIS/MKS, MBAM, HitmanPro, Eset Online, WF+uBlock
23.02.2013, 22:18
Sobie dziala
Mutex Name: JeSuisUneDanseuseEtoile Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Groove  athMutex:YoNgf9TlAyd0477wzgfiTWi4XXU=Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Local\ZonesCounterMutex Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Local\ZoneAttributeCacheCounterMutex Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Local\ZonesCacheCounterMutex Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Local\ZonesLockedCacheCounterMutex Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: JeSuisUneDanseuseEtoile Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: RasPbFile Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: Global\.net clr networking Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Name: SHIMLIB_LOG_MUTEX Desired Access: DELETE READ_CONTROL SYNCHRONIZE WRITE_DAC WRITE_OWNER MUTEX_MODIFY_STATE Rejestr Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: AppData Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Cache Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Personal Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\MountPoints2\{3259504d-e161-11e0-bf1d-806d6172696f} Value: BaseClass Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\MountPoints2\{3259504b-e161-11e0-bf1d-806d6172696f} Value: BaseClass Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\MountPoints2\{3259504a-e161-11e0-bf1d-806d6172696f} Value: BaseClass Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Common Documents Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Desktop Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Common Desktop Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Value: Common AppData Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Local AppData Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: ProxyBypass Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: IntranetName Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: UNCAsIntranet Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: AutoDetect Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: ProxyBypass Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: IntranetName Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: UNCAsIntranet Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Internet Settings\ZoneMap Value: AutoDetect Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Cookies Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Shel lNoRoam\MUICache Value: C:\Documents and Settings\Administrator\Local Settings\Temp\updater.exe Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: AppData Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Cache Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Run Value: Launcher Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Value: Launcher Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Explorer\Shell Folders Value: Startup Key Name: \REGISTRY\USER\S-1-5-21-299502267-926492609-1801674531-500\Software\Microsoft\Windows\Curr entVersion\Run Value: updater Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Value: updater Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Value: Seed Key Name: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG Siec 212.27.63.169 212.27.63.169 212.27.63.169 10.20.25.247 10.20.25.247 10.20.25.247 GET /dwn/launcher.txt GET /dwn/launcher.txt GET DNS DNS Requests Request heavencorp.free.fr
Jag ser mig om och ser
Mitt hem försvinna bort Min tid där hemma känns Nu alldeles för kort
23.02.2013, 22:29
Ale co robi?, uruchomiłeś go na natywnym bez zabezpieczeń, czy podajesz logi z sandboxa?
Logi są wyżej już.
KIS/EIS/MKS, MBAM, HitmanPro, Eset Online, WF+uBlock
23.02.2013, 22:33
Uruchomiony bez zabezpieczen doatkowo tak jak w pprzypadku podrbek av linkwanych przezemnie uruchamia update.exe
Jag ser mig om och ser
Mitt hem försvinna bort Min tid där hemma känns Nu alldeles för kort |
|
« Starszy wątek | Nowszy wątek »
|
