每日样本

东方妖妖梦

230f4

猥琐大叔

电脑发烧友

KIS  玩玩卡巴的应用程序控制

Trojan.Win32.Neurevt.wpr

1446547521

1446547521

aboringman

AVG：

扫描：killed；

"";"Trojan horse Generic37.AHFR, c:\Users\kiiler\Desktop\新建文件夹\84965d5fb47cf4349f46da7c087363e2.exe";"Healed, Moved to Virus Vault";"File or Directory";"2016/1/31, 12:39:43"
"";", C:\Users\kiiler\Desktop\新建文件夹\84965d5fb47cf4349f46da7c087363e2.exe";"Object was blocked";"Process";"2016/1/31, 12:39:43"

双击：关闭监控，实机双击，IDP被过，但样本没有留下可疑痕迹，看来是不喜欢我的系统。。。。。。

230f4

aboringman 发表于 2016-1-31 12:43
AVG：

扫描：killed；

hxxps://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Neurevt

Short description

The trojan serves as a backdoor. It can be controlled remotely. It uses techniques common for rootkits.

The trojan hooks the following Windows APIs:

DnsQuery_W (Dnsapi.dll) getaddrinfo (ws2_32.dll) GetAddrInfoW (ws2_32.dll)
HttpSendRequestW (Wininet.dll) PR_Write (nspr4.dll) SHGetFolderPathW (Shell32.dll)
KiFastSystemCall (ntdll.dll) ZwCreateFile (ntdll.dll) ZwOpenFile (ntdll.dll) ZwDeleteFile (ntdll.dll)
ZwSetInformationFile (ntdll.dll) ZwQueryDirectoryFile (ntdll.dll) ZwOpenDirectoryObject (ntdll.dll)
ZwEnumerateValueKey (ntdll.dll) ZwCreateKey (ntdll.dll)
ZwSetValueKey (ntdll.dll) ZwDeleteValueKey (ntdll.dll) ZwOpenProcess (ntdll.dll)
ZwTerminateProcess (ntdll.dll) ZwSuspendProcess (ntdll.dll) ZwQuerySystemInformation (ntdll.dll)
ZwQueryInformationThread (ntdll.dll) ZwCreateThread (ntdll.dll) ZwResumeThread (ntdll.dll)
ZwSuspendThread (ntdll.dll) ZwSetContextThread (ntdll.dll) ZwTerminateThread (ntdll.dll)
ZwProtectVirtualMemory (ntdll.dll) ZwAllocateVirtualMemory (ntdll.dll) LdrLoadDll (ntdll.dll)
ZwDeviceIoControlFile (ntdll.dll) ZwQueueApcThread (ntdll.dll)

Spreading on removable media

The trojan may create copies of itself on removable drives.

The trojan collects the following information:

computer name operating system version user name
information about the operating system and system settings CPU information FTP account information
antivirus software detected on the affected machine the list of installed software login user names for certain applications/services
login passwords for certain applications/services contact name(s)

The trojan attempts to send gathered information to a remote machine. The HTTP protocol is used.

Other information

The trojan hides its presence in the system.

aboringman

230f4 发表于 2016-1-31 13:00
hxxps://www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Win32/Neurevt

Sho ...

Backdoor么，有意思。

欧阳宣

mcafee
Fareit-FCZ!84965D5FB47C