Hunter Work ---- 46

ryota

Log is generated by FreShow.
[wide]http://www.jsp369.cn/a1.htm
    [frame]http://www.regedit369.cn/index.htm
        [frame]http://www.regedit369.cn/Ms06014.htm
            [object]http://d.yuku369.cn/max.exe
        [frame]http://www.regedit369.cn/cuteqq.htm
            [frame]http://www.regedit369.cn/Ajax.htm
                [object]http://d.yuku369.cn/max.exe
            [frame]http://www.regedit369.cn/Ms06014.htm
                [object]http://d.yuku369.cn/max.exe
            [script]http://www.regedit369.cn/Real11.gif
                [object]http://d.yuku369.cn/max.exe
            [script]http://www.regedit369.cn/Real.gif
                [object]http://d.yuku369.cn/max.exe
            [frame]http://www.regedit369.cn/Bfyy.htm
                [object]http://d.yuku369.cn/max.exe
            [frame]http://www.regedit369.cn/Lz.htm
                [object]http://d.yuku369.cn/max.exe
        [frame]http://www.regedit369.cn/flash.htm
            [frame]http://www.regedit369.cn/ilink.html
                [object]http://www.regedit369.cn/i16.swf
                [object]http://www.regedit369.cn/i28.swf
                [object]http://www.regedit369.cn/i45.swf
                [object]http://www.regedit369.cn/i47.swf
                [object]http://www.regedit369.cn/i64.swf
                [object]http://www.regedit369.cn/i115.swf
            [frame]http://www.regedit369.cn/flink.html
                [object]http://www.regedit369.cn/f16.swf
                [object]http://www.regedit369.cn/f28.swf
                [object]http://www.regedit369.cn/f45.swf
                [object]http://www.regedit369.cn/f47.swf
                [object]http://www.regedit369.cn/f64.swf
                [object]http://www.regedit369.cn/f115.swf

max.exe 连接到 http://d.yuku369.cn/d.txt
下载33只木马

h**p://jan1.fdsjan.cn/max0.exe
h**p://jan1.fdsjan.cn/max1.exe
h**p://jan1.fdsjan.cn/max2.exe
h**p://jan1.fdsjan.cn/max3.exe
h**p://jan1.fdsjan.cn/max4.exe
h**p://jan1.fdsjan.cn/max5.exe
h**p://jan1.fdsjan.cn/max6.exe
h**p://jan1.fdsjan.cn/max7.exe
h**p://jan1.fdsjan.cn/max8.exe
h**p://jan1.fdsjan.cn/max9.exe
h**p://jan1.fdsjan.cn/max10.exe
h**p://jan1.fdsjan.cn/max11.exe
h**p://jan1.fdsjan.cn/max12.exe
h**p://jan1.fdsjan.cn/max13.exe
h**p://www.fdsjan.cn/max14.exe
h**p://www.fdsjan.cn/max15.exe
h**p://www.fdsjan.cn/max16.exe
h**p://www.fdsjan.cn/max18.exe
h**p://www.fdsjan.cn/max19.exe
h**p://www.fdsjan.cn/max20.exe
h**p://www.fdsjan.cn/max21.exe
h**p://www.fdsjan.cn/max22.exe
h**p://www.fdsjan.cn/max24.exe
h**p://www.fdsjan.cn/max25.exe
h**p://www.fdsjan.cn/max26.exe
h**p://www.fdsjan.cn/max27.exe
h**p://www.fdsjan.cn/max28.exe
h**p://www.fdsjan.cn/max29.exe
h**p://www.fdsjan.cn/max30.exe
h**p://www.fdsjan.cn/max31.exe
h**p://www.fdsjan.cn/max32.exe
h**p://www.fdsjan.cn/max34.exe
h**p://www.fdsjan.cn/max35.exe

所有样本共计46例（估计只能下到45个）

附件不是样本，是所有样本的迅雷下载列表，便于样本采集

[ 本帖最后由 ryota 于 2008-6-21 17:09 编辑 ]

sbbdms

http://bbs.kafan.cn/viewthread.php?tid=273244&extra=page%3D1

有一些是不是一样了

不过还是逮到14个

打包

sbbdms

Kaspersky miss all
TO KL

nosferatu

Starting the file scan:

Begin scan in 'C:\Documents and Settings\Administrator\桌面\f115'
C:\Documents and Settings\Administrator\桌面\f115\Ajax.htm
      [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\f115.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\f16.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\f28.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\f45.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\f47.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\flink.html
      [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent.SI
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i115.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i16.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i28.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i45.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i47.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\i64.swf
  [0] Archive type: SWC
  --> Object
      [DETECTION] Contains detection pattern of the exploits EXP/Flash.Gen
      [NOTE]      The file was deleted!
C:\Documents and Settings\Administrator\桌面\f115\ilink.html
      [DETECTION] Contains detection pattern of the Java script virus JS/Dldr.Agent.SI
      [NOTE]      The file was deleted!


End of the scan: 星期六 2008年6月21日  17:24
Used time: 00:12 min

The scan has been done completely.

      1 Scanning directories
     14 Files were scanned
     14 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     14 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
     14 Notes

傻猪猪米走鸡

E:\virus\f115.rar » RAR » f115.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » Ajax.htm - is OK
E:\virus\f115.rar » RAR » ilink.html - is OK
E:\virus\f115.rar » RAR » i16.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » i28.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » i45.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » i47.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » i64.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » i115.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » flink.html - is OK
E:\virus\f115.rar » RAR » f16.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » f28.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » f45.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar » RAR » f47.swf - SWF/Exploit.CVE-2007-0071 trojan
E:\virus\f115.rar:Zone.Identifier - is OK

qigang

觉得和某某发帖重复。

28654621

D:\download\f115.rar>>Ajax.htm        Script.HttpDownloader.i        病毒        还未处理
就认识一个