据说能感染RAR文件的磁碟机变种！

小飞侠.net

据说能感染RAR文件的磁碟机变种！

转自隔壁：

最近饱受ARP泛滥之苦 怀疑小区服务器被挂马
ht  p://y.gxgxy.net/setup.exe

该样本几乎每日更新

我怀疑服务器挂马或者顶级域内有机器中了ARP病毒。我觉得后者的可能性比较大，因为当中病毒机器关机后，中毒症状消失。这个病毒是“磁碟机”的新变种，safe360报成“dummycom”，卡巴报“Worm.Win32.AutoRun.cre”和“Virus.Win32.Xorer.du”，用了外壳程序的，破坏性很大，已经不通过~.exe文件传播了，会感染包括rar压缩文件在内的exe和html文件，已经搏斗2天了。创建%systemroot%\system32\com\lsass.exe等4个文件，干掉注册表内启动项和安全模式项，干掉主流所有杀软，访问包括“升”“360”“anti”关键字等会关闭窗口，kill IceSword进程，目前为止我见过最恶心的病毒了，不得不说，作者在这个病毒上用心良苦。病毒的感染性极强，连rar文件都不能幸免啊。最好是清空硬盘后重装。如果实在需要其它数据，务必做到format掉系统盘，在系统盘没有安装杀软并升级病毒库之前不打开其它盘。

目前样本查杀情况 请高手跟进 详细分析该病毒的行为


VirSCAN.org Scanned Report :
Scanned time   : 2008/03/02 02:52:36 (CST)
Scanner results: 22%的杀软(8/36)报告发现病毒
File Name      : 15656.rar
File Size      : 139349 byte
File Type      : RAR archive data, v1d, os
MD5            : 39e5ab28ef749e96e2347b1ba70db166
SHA1           : d47d002036e5ba477ab006052bb5a02e8891ccaa
Online report  : ht tp://virscan.org/report/c0189cc0d469bc252e3df5fc4ccf300b.html

Scanner        Engine Ver      Sig Ver           Sig Date    Time   Scan result
a-squared      3.0.0.126       2008.03.01        2008-03-01  3.30   -
安博士V3       2008.03.01.00   2008.03.01        2008-03-01  0.98   -
AntiVir        7.6.0.73        7.0.2.215         2008-02-29  2.46   TR/Drop.Xorer.C
Arcavir        1.0.4           200803011126      2008-03-01  2.95   -
AVAST          1.0.8           080301-0          2008-03-01  3.06   -
AVG            7.5.51.442      269.21.2/1305     2008-02-29  2.13   Agent.3.E
BitDefender    7.60825.984716  7.17816           2008-03-01  3.58   -
CA (VET)       9.0.0.143       31.3.5574         2008-02-29  6.53   -
ClamAV         0.92            6064              2008-03-02  0.12   -
Comodo         2.11            2.0.0.451         2008-03-01  0.86   -
CP Secure      1.1.0.715       2008.02.28        2008-02-28  3.85   -
Dr.WEB         4.44.0.9170     2008.03.01        2008-03-01  4.08   -
ewido          4.0.0.2         2008.03.01        2008-03-01  2.20   -
F-PROT         4.4.1.52        20080229          2008-02-29  1.62   -
F-SECURE       5.51.6100       2008.03.01.01     2008-03-01  3.65   -
飞塔           2.81-3.11       8.805             2008-03-02  2.07   Suspicious
ViRobot        20080229        2008.02.29        2008-02-29  0.38   -
IKARUS         T3.1.01.20      2008.02.26.70368  2008-02-26  1.53   Trojan-Dropper.Xorer.C
江民杀毒       10.00.650       2008.03.01        2008-03-01  1.34   -
卡巴斯基       5.5.10          2008.03.01        2008-03-01  5.30   -
金山毒霸       2007.6.20.249   2008.3.1          2008-03-01  2.29   -
迈克菲         5.2.00          5237              2008-02-25  2.06   -
Microsoft      1.3301          2008.03.01        2008-03-01  6.70   Virus:Win32/Xorer.F
MKS_VIR        2.01            2008.03.01        2008-03-01  3.34   -
NORMAN         5.91.10         5.90              2008-02-28  8.57   -
熊猫卫士       9.04.03.0001    2008.03.01        2008-03-01  2.83   -
趋势           8.500-1001      5.132.19          2008-03-01  0.09   -
Prevx          V2              20080302          2008-03-02  4.87   Agent.3.E
QuickHeal      9.00            2008.03.01        2008-03-01  3.74   -
瑞星           20.0            20.32.42.00       2008-02-22  3.04   -
SOPHOS         2.70.1          4.26              2008-02-26  2.69   -
赛门铁克       1.3.0.24        20080301.003      2008-03-01  0.32   -
nProtect       2008-03-01.00   1187789           2008-03-01  4.46   Trojan/W32.Agent.90549
The Hacker     6.2.9           v00229            2008-02-25  0.80   -
VBA32          3.12.6.2        20080229.2311     2008-02-29  4.14   -
VirusBuster    4.3.19:9        9.121.23/11.0     2008-02-25  1.97   Win32.Xorer.Gen

我今天下载后发现过卡巴斯基啦，NOD32启发爆！

文件 15656.rar 接收于 2008.03.01 19:51:47 (CET)
结果: 9/31 (29.04%)
ht tp://www.virustotal.com/zh-cn/analisis/602e2ce3fb162ac329556098b8d0cb7b

反病毒引擎 版本 最后更新 扫描结果
AhnLab-V3 2008.2.29.1 2008.02.29 -
AntiVir 7.6.0.73 2008.02.29 TR/Drop.Xorer.C
Authentium 4.93.8 2008.03.01 -
Avast 4.7.1098.0 2008.03.01 -
AVG 7.5.0.516 2008.02.29 Agent.3.E
BitDefender 7.2 2008.03.01 -
CAT-QuickHeal 9.50 2008.03.01 -
ClamAV 0.92.1 2008.03.01 -
DrWeb 4.44.0.09170 2008.03.01 -
eSafe 7.0.15.0 2008.02.28 suspicious Trojan/Worm
eTrust-Vet 31.3.5574 2008.02.29 -
Ewido 4.0 2008.03.01 -
FileAdvisor 1 2008.03.01 -
Fortinet 3.14.0.0 2008.03.01 -
F-Prot 4.4.2.54 2008.03.01 -
F-Secure 6.70.13260.0 2008.03.01 -
Ikarus T3.1.1.20 2008.03.01 -
Kaspersky 7.0.0.125 2008.03.01 -
McAfee 5242 2008.02.29 -
Microsoft 1.3301 2008.03.01 Virus:Win32/Xorer.F
NOD32v2 2913 2008.03.01 probably a variant of Win32/Genetik
Norman 5.80.02 2008.02.29 -
Panda 9.0.0.4 2008.03.01 Suspicious file
Rising 20.33.52.00 2008.03.01 Worm.Win32.DiskGen.gfc
Sophos 4.27.0 2008.03.01 -
Sunbelt 3.0.906.0 2008.02.28 -
Symantec 10 2008.03.01 -
TheHacker 6.2.9.229 2008.02.25 -
VBA32 3.12.6.2 2008.02.27 -
VirusBuster 4.3.26:9 2008.02.29 Win32.Xorer.Gen
Webwasher-Gateway 6.6.2 2008.03.01 Trojan.Drop.Xorer.C
附加信息
File size: 139349 bytes
MD5: 39e5ab28ef749e96e2347b1ba70db166
SHA1: d47d002036e5ba477ab006052bb5a02e8891ccaa
PEiD: -
packers: UPX
packers: UPX, RAR
packers: UPX, PE_Patch.UPX, UPX

zwl2828

--> 15656\setup.exe
          [DETECTION] Is the Trojan horse TR/Drop.Xorer.C

醉一生爱妍

醉一生爱妍

费尔已经出名了！磁碟机终于想要干掉他了

冷冷

SSM没有拦截注册表的提示

醉一生爱妍

有时候会MISS掉。。

woai_jolin

Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

setup.exe : Not detected by Sandbox (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: NO_MALWARE
    * Signature name: NO_VIRUS
    * Compressed: YES
    * TLS hooks: NO
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Decompressing UPX.
    * Application uses MFC.DLL.
    * Decompressing UPX3.
    * File length:       142264 bytes.
    * MD5 hash: 97786738b591bf62bf37e017795c75f5.

[ Changes to filesystem ]
    * Creates directory C:.
    * Creates directory C:\WINDOWS.
    * Creates directory C:\WINDOWS\TEMP.
    * Creates directory C:\WINDOWS\TEMP\RarSFX0.
    * Creates file C:\WINDOWS\TEMP\RarSFX0\Setup.exe.
    * Deletes file C:\WINDOWS\TEMP\RarSFX0.

[ Process/window information ]
    * Creates a dialogbox with caption "WinRAR ê&Ecirc;><cH?&ouml;".
    * Buttons found in dialogbox: id102[278,171]"O&Egrave;(&W)..." id1[211,222]"?&Aring;" id2[278,222]"&Ouml;^" .
    * Pressing button with id 1 "NULL".
    * Attemps to NULL C:\WINDOWS\TEMP\RarSFX0\Setup.exe NULL.
    * Creates process "C:\WINDOWS\TEMP\RarSFX0\Setup.exe".

[ Signature Scanning ]
    * C:\WINDOWS\TEMP\RarSFX0\Setup.exe (93696 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.

This file is not flagged as malicious by the Norman Sandbox Information Center. However, we can not guarantee that the file is harmless. If you still suspect the file to be malicious and if you urgently need to know for sure, please submit it to your local Norman support department for manual analysis.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

woai_jolin

Scan Log
Version of virus signature database: 2913 (20080301)
Date: 2008/3/2  Time: 9:04:34
Scanned disks, folders and files: G:\v\15656
G:\v\15656\setup.exe &raquo; UPX v12_m2 &raquo; RAR &raquo; Setup.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
G:\v\15656\setup.exe &raquo; RAR &raquo; Setup.exe - probably a variant of Win32/Genetik trojan - was a part of the deleted object
Number of scanned objects: 4
Number of threats found: 2
Time of completion: 9:04:35  Total scanning time: 1 sec (00:00:01)

吟赏烟霞

NOD32的结果：
C:\Downloads\15656.rar > RAR > 15656\setup.exe > UPX v12_m2 > RAR > Setup.exe - 可能是 Win32/Genetik 特洛伊木马 的变种
C:\Downloads\15656.rar > RAR > 15656\setup.exe > RAR > Setup.exe - 可能是 Win32/Genetik 特洛伊木马 的变种

冷冷

因为SBie重定向
所以很多时候SSM拦不到注册表的动作
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
以前试过设置SBIE注册表规则为只读，SSM就拦截了