Trojan.FakeAlerts.FreeTube

显示全部楼层 · 发表于 2016-1-23 13:14:14

本帖最后由断簪于 2016-1-23 14:27 编辑

来自KernelMode.info

This trojan gets pushed by PUP install bundlers.

It initially downloads and runs FreeYoutubeDownloader11012016.exe which is an Inno Setup downloader.

This downloader uses winhttp to send a GET request to http://request.analytics-system.com/getgeo (which gets your GeoIP country location).（也就是说这玩意会检测国家）

If it is not US it downloads hxxp://youtubedownloadernew.com/othr/Setup.exe - this seems to be completely benign.

However if it is US is downloads hxxp://youtubedownloadernew.com/down/Setup.exe which is the benign version with one difference: it includes an additional .exe (Box.exe) that pops a fake alert to get you to call a fake tech support company, and the main application .exe runs it every 2 minutes.

Included: the downloader, and both setups (Setup (5).exe is the version that pops the fakealerts, Setup (6).exe is benign)
Setup（5）.exe才是真正的毒
Unpacked versions of both setups have been included for your convenience.

The phone number for the fake tech support is hardcoded in two places in Box.exe as: 1-888-479-3649.

http://pan.baidu.com/s/1mhtgseW
解压密码：国际通用

显示全部楼层 · 发表于 2016-1-23 13:18:21

显示全部楼层 · 发表于 2016-1-23 13:20:30

显示全部楼层 · 发表于 2016-1-23 13:20:33

NIS：

显示全部楼层 · 发表于 2016-1-23 13:30:18

过ESS8

显示全部楼层 · 发表于 2016-1-23 13:46:57

本帖最后由狐狸糊涂于 2016-1-23 13:55 编辑

过BD扫描，过BD双击。

显示全部楼层 · 发表于 2016-1-23 13:55:43

卡巴斯基可选择扫描;未检测到威胁;

显示全部楼层 · 发表于 2016-1-23 14:20:39

狐狸糊涂发表于 2016-1-23 13:46
过BD扫描，过BD双击。

这玩意会检测国家

显示全部楼层 · 发表于 2016-1-23 14:36:04

触发补充规则~

显示全部楼层 · 发表于 2016-1-23 15:31:09

xu126yx 发表于 2016-1-23 14:36
触发补充规则~

弄得我都想玩TF了

[病毒样本] Trojan.FakeAlerts.FreeTube

评分

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源