MSRT November: Dofoil

显示全部楼层 · 发表于 2011-11-26 10:07:15

本帖最后由一晴空于 2011-11-26 10:09 编辑

details
不适用
警戒级别
严重
以下是病毒分析：
TrojanDownloader:Win32/Dofoil is a configurable downloader.Dofoil will attempt to receive control instructions from a remote server. The response contains encrypted configuration data containing download URLs and execution options, as visible in a partially decrypted Dofoil configuration shown below:

Figure 1. Partially decrypted Dofoil configuration
The current generation of Dofoil can be purchased on illicit online marketplaces. Prices are advertised in US dollar equivalent WebMoney values. Depending on the version purchased, the price ranges between 150-250 $US for the main malware component. The cost for plugins ranges from an additional 25-150 $US. One example plugin is a password stealing component which targets many FTP, IM, poker and email clients.

Whilst often seen as an attachment as part of a spam campaign, the MMPC has observed Win32/Dofoil distributed and installed via other mechanisms such as by exploit. In the wild Win32/Dofoil variants are employed to download rogue security software such as Trojan:Win32/FakeSysdef and spam capable malware such as Trojan:Win32/Danmec.L .
summary

：社工厉害，小心钓鱼
因时间原因，没有翻译，另外，分析当前病毒形式，破坏性病毒似乎已经没有钓鱼病毒那么受欢迎了（国外。。。。）

显示全部楼层 · 发表于 2011-11-26 10:50:40

表示没看懂

显示全部楼层 · 发表于 2011-11-26 11:20:26

神马东西？我也没看懂

显示全部楼层 · 发表于 2011-11-26 11:57:59

看不懂

显示全部楼层 · 发表于 2011-11-26 16:55:24

看不懂好深奥

显示全部楼层 · 发表于 2011-11-26 17:15:59

眼花缭乱！

显示全部楼层 · 发表于 2011-11-26 20:45:57

木马流行的意思？

显示全部楼层 · 发表于 2011-11-26 21:45:14

本帖最后由 accp.taotao 于 2011-11-26 21:45 编辑

从图看来，貌似是一个木马病毒下载器。居然还把下载地址加密了。。
各种嗅探，各种上传数据…… 狠！！

楼主回来答疑啊。。

显示全部楼层 · 发表于 2011-11-26 22:58:34

好久不见，这东西原来拿来买卖呃...

显示全部楼层 · 发表于 2011-11-26 23:09:49

社工钓鱼，没有一定了解和防范的，基本无解～

[一般话题] MSRT November: Dofoil

评分

评分