收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 安全区 › 病毒样本 分享&分析区 › 卡巴不认识的后门 据称过过微点
123下一页
返回列表 发新帖
楼主: Nblock
 收起左侧

[病毒样本] 卡巴不认识的后门 据称过过微点

[复制链接]
woai_jolin
发表于 2008-6-12 14:05:27 | 显示全部楼层
Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

server.exe : INFECTED with W32/Malware (Signature: W32/Smalldrp.RVD)


[ DetectionInfo ]
    * Sandbox name: W32/Malware
    * Signature name: W32/Smalldrp.RVD
    * Compressed: NO
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * Accesses executable file from resource section.
    * File length:        93184 bytes.
    * MD5 hash: e42b8dac36d5f7684bb91ab87574eba4.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\Kvmon.exe.
    * Creates file C:\WINDOWS\Kvmon.dll.

[ Changes to registry ]
    * Accesses Registry key "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system".
    * Accesses Registry key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup".

[ Process/window information ]
    * Creates a mutex Myfutex.
    * Creates process "svchost.exe".
    * Checks if privilege "SeDebugPrivilege" is available.
    * Enables privilege SeDebugPrivilege.
    * Modifies memory in process svchost.exe.
    * Creates a thread in process svchost.exe.
    * Will inject library C:\WINDOWS\Kvmon.dll into remote processes.

[ Signature Scanning ]
    * C:\WINDOWS\Kvmon.exe (93184 bytes) : W32/Smalldrp.RVD.
    * C:\WINDOWS\Kvmon.dll (66560 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************

[ 本帖最后由 woai_jolin 于 2008-6-12 14:08 编辑 ]
回复

举报

woai_jolin
发表于 2008-6-12 14:08:33 | 显示全部楼层
AhnLab-V3---
AntiVir--BDS/Graybird.D0A2D110
Authentium---
Avast--Win32:Trojan-gen {Other}
AVG---
BitDefender--Dropped:Generic.Graybird.D0A2D110
CAT-QuickHeal---
ClamAV--PUA.Elirt
DrWeb--BackDoor.Dong
eSafe---
eTrust-Vet---
Ewido---
F-Prot--W32/Hupigon.C.gen!Eldorado
F-Secure--W32/Malware
FileAdvisor---
Fortinet---
Ikarus--Trojan-Dropper.Win32.Mudrop.bn
Kaspersky--Heur.Trojan.Generic
McAfee--New Malware.ab
Microsoft---
NOD32v2--probably unknown NewHeur_PE virus
Norman--W32/Smalldrp.RVD
Panda--Suspicious file
Prevx1--Trojan.Yabe
Rising--Suspicious.Backdoor.Win32.Delgen.a
Sophos--Sus/DelpDldr-A
Sunbelt---
Symantec---
TheHacker---
VBA32--suspected of Backdoor.XiaoBird.1
VirusBuster---
Webwasher-Gateway--Trojan.Backdoor.Graybird.D0A2D110
附加信息
MD5: e42b8dac36d5f7684bb91ab87574eba4
SHA1: b9c185b28653ee229752485e956ea9789971fc95
SHA256: 5522389e900dc228357f8956c596ab98f45ceb46c59920f0eb16afe91c9549d2
SHA512: 95c3251c1129d809cdf3c3138818b88cb1e660adc9c84a714ac478797e35f6b5963d6d7ac7a784ff90ffd7c28a61cc76ebef0ac6bae46e177fbb76ea32b6280f
回复

举报

woai_jolin
发表于 2008-6-12 14:08:51 | 显示全部楼层
Hello,

Thanks for taking the time to submit your samples to the Norman
Sandbox Information Center.  Customer delight is our top priority at
Norman.  With that in mind we have developed Sandbox Solutions for
organizations that are committed to speedy analysis and debugging.

Norman Sandbox Solutions give your organization the opportunity to
analyze files immediately in your own environment.

To find out how to bring the power of Norman Sandbox into your test
environments follow the links below.

Norman Sandbox Solutions
http://www.norman.com/Product/Sandbox-products/

Norman Sandbox Analyzer
http://www.norman.com/Product/Sandbox-products/Analyzer/

Norman Sandbox Analyzer Pro
http://www.norman.com/Product/Sandbox-products/Analyzer-pro/

Norman SandBox Reporter
http://www.norman.com/Product/Sandbox-products/Reporter/

SETUP.EXE : INFECTED with W32/Malware (Signature: NO_VIRUS)


[ DetectionInfo ]
    * Sandbox name: W32/Malware
    * Signature name: NO_VIRUS
    * Compressed: YES
    * TLS hooks: YES
    * Executable type: Application
    * Executable file structure: OK

[ General information ]
    * File might be compressed.
    * Decompressing ASPack.
    * Drops files in %WINSYS% folder.
    * Accesses executable file from resource section.
    * File length:       344576 bytes.
    * MD5 hash: bad9ee20bad306b278a4c261b8ac8fda.

[ Changes to filesystem ]
    * Creates file C:\WINDOWS\System32\Ly_Server2008.exe.
    * Creates file C:\WINDOWS\uninstal.bat.
    * Deletes file "c:\sample.exe".
    * Deletes file %0.
    * Creates file C:\WINDOWS\System32\Ly_Server2008.DLL.
    * Creates file C:\DOCUME~1\SANDBOX\blabla.dat.

[ Changes to registry ]
    * Accesses Registry key "HKCU\Software\Borland\Locales".
    * Accesses Registry key "HKLM\Software\Borland\Locales".
    * Accesses Registry key "HKCU\Software\Borland\Delphi\Locales".
    * Sets value "ImagePath"="C:\WINDOWS\System32\Ly_Server2008.exe" in key "HKLM\System\CurrentControlSet\Services".
    * Sets value "DisplayName"="ÄÁÃñÔ¶³Ì¹ÜÀíÈí¼þ" in key "HKLM\System\CurrentControlSet\Services".
    * Accesses Registry key "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp".
    * Creates key "HKCU\Software\Microsoft\Internet Connection Wizard".
    * Sets value "Completed"="" in key "HKCU\Software\Microsoft\Internet Connection Wizard".
    * Sets value "Check_Associations"="no" in key "HKCU\Software\Microsoft\Internet Explorer\Main".

[ Network services ]
    * Opens URL: about:blank.
    * Connects to "about:blank" on port 80 (TCP).
    * Opens URL: about:blank/.

[ Process/window information ]
    * Creates a mutex Ly_Server2008.exe.
    * Attempts to access service "".
    * Creates service " ()" as "C:\WINDOWS\System32\Ly_Server2008.exe".
    * Creates process "Ly_Server2008.exe".
    * Creates process "CMD.EXE".
    * Creates process "IEXPLORE.EXE"".
    * Modifies memory in process IEXPLORE.EXE".
    * Creates a thread in process IEXPLORE.EXE".
    * Will inject library C:\WINDOWS\System32\Ly_Server2008.DLL into remote processes.

[ Signature Scanning ]
    * C:\WINDOWS\System32\Ly_Server2008.exe (344576 bytes) : no signature detection.
    * C:\WINDOWS\uninstal.bat (76 bytes) : no signature detection.
    * C:\WINDOWS\System32\Ly_Server2008.DLL (698368 bytes) : W32/Hupigon.GQN.
    * C:\DOCUME~1\SANDBOX\blabla.dat (4096 bytes) : no signature detection.



(C) 2004-2006 Norman ASA. All Rights Reserved.

The material presented is distributed by Norman ASA as an information source only.


************************************
Sent from an unmonitored email address.
Please DO NOT reply.
************************************
回复

举报

woai_jolin
发表于 2008-6-12 14:11:47 | 显示全部楼层
AhnLab-V32008.6.11.02008.06.11Win-Trojan/Hupigon.Gen
AntiVir7.8.0.552008.06.12BDS/Hupigon.Gen
Authentium5.1.0.42008.06.12W32/Hupigon.L.gen!Eldorado
Avast4.8.1195.02008.06.11Win32:Hupigon-CWJ
AVG7.5.0.5162008.06.11BackDoor.Generic2.VEX
BitDefender7.22008.06.12Backdoor.Hupigon.E
CAT-QuickHeal9.502008.06.11-
ClamAV0.92.12008.06.12Trojan.Hupigon-1309
DrWeb4.44.0.091702008.06.11BackDoor.IRC.Sdbot.1881
eSafe7.0.15.02008.06.11-
eTrust-Vet31.6.58672008.06.11Win32/Pigeon.FJ
Ewido4.02008.06.11Backdoor.Hupigon.cgy
F-Prot4.4.4.562008.06.12W32/Hupigon.L.gen!Eldorado
F-Secure6.70.13260.02008.06.12Backdoor.Win32.Hupigon.mmt
Fortinet3.14.0.02008.06.12-
GData2.0.7306.10232008.06.12Backdoor.Win32.Hupigon.mmt
IkarusT3.1.1.26.02008.06.12Backdoor.Win32.Hupigon.ani
Kaspersky7.0.0.1252008.06.12Backdoor.Win32.Hupigon.mmt
McAfee53152008.06.11BackDoor-AWQ
Microsoft1.36042008.06.12Backdoor:Win32/Hupigon
NOD32v231792008.06.11a variant of Win32/Hupigon
Norman5.80.022008.06.11-
Panda9.0.0.42008.06.11Bck/Hupigon.AIJ
Prevx1V22008.06.12System Back Door
Rising20.48.30.002008.06.12Backdoor.Gpigeon.GEN
Sophos4.30.02008.06.12Mal/GrayBird
Sunbelt3.0.1145.12008.06.05-
Symantec102008.06.12Backdoor.Graybird!Gen
TheHacker6.2.92.3442008.06.12-
VBA323.12.6.72008.06.12OScope.Backdoor.XiaoBird.50C1
VirusBuster4.3.26:92008.06.11Backdoor.Hupigon.HIF
Webwasher-Gateway6.6.22008.06.12Trojan.Backdoor.Hupigon.Gen
回复

举报

黄金马甲出租
发表于 2008-6-12 15:48:03 | 显示全部楼层
LZ也标题党.
回复

举报

飞兔儿
发表于 2008-6-12 15:49:37 | 显示全部楼层
看来微点很厉害 啊  
回复

举报

电影结束了
发表于 2008-6-12 15:50:04 | 显示全部楼层

本帖子中包含更多资源

您需要 登录 才可以下载或查看，没有帐号？快速注册

x
回复

举报

kkgh
发表于 2008-6-12 17:39:41 | 显示全部楼层
费尔杀
回复

举报

ch00962610
发表于 2008-6-12 18:37:54 | 显示全部楼层
用G DATA AntiVirus检测病毒
版本 18.5.8071.731
病毒特征库日期 2008/6/12
开始时间： 2008/6/12 18:37
引擎： 引擎A (AVK 18.4105), 引擎B (AVKB 18.305)
启发式： 开启
档案文件： 开启
系统区域： 开启

检测系统区域...
检测以下目录和文件：
  C:\Documents and Settings\祝俊杰\桌面\Evil.rar

对象： SETUP.EXE
        在压缩档案中： C:\Documents and Settings\祝俊杰\桌面\Evil.rar
        状态： 检测到病毒
        病毒： Backdoor.Win32.Hupigon.mmt (引擎A)
对象： Evil.rar
        路径: C:\Documents and Settings\祝俊杰\桌面
        状态： 移动文件到隔离区
        病毒： Backdoor.Win32.Hupigon.mmt (引擎A)

检测执行时间： 2008/6/12 18:37
    1个文件已检测
    1个受感染文件
    0个可疑文件被发现
回复

举报

seamonkey
发表于 2008-6-12 18:55:04 | 显示全部楼层
瑞星病毒查杀结果报告

清除病毒种类列表：
病毒： Suspicious.Backdoor.Win32.Delgen.a
病毒： Backdoor.Gpigeon.GEN
回复

举报

下一页 »
123下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2024-4-28 09:30 , Processed in 0.100932 second(s), 15 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表