为了表示歉意，我重新上报一个kaba启发的样本

FLogo

RT，由于我接触病毒样本的时间不是很长，有时会照成不必要的误会与麻烦！
这次上报一个kaba启发的病毒样本，我想绝对是病毒！

to kaba kill,waiting for reply。。。

Hello,

123.exe_ - Backdoor.Win32.Hupigon.gbsf

This file is already detected. Please update your antivirus bases.


文件 123.rar 接收于 2009.02.18 08:34:31 (CET)

Email:

反病毒引擎	版本	最后更新	扫描结果
a-squared	4.0.0.93	2009.02.18	Virus.Win32.Hupigon.AMD!IK
AhnLab-V3	5.0.0.2	2009.02.18	-
AntiVir	7.9.0.83	2009.02.17	BDS/Hupigon.Gen
Authentium	5.1.0.4	2009.02.18	W32/Banload.B.gen!Eldorado
Avast	4.8.1335.0	2009.02.17	Win32:KillAV-KL
AVG	8.0.0.237	2009.02.17	BackDoor.Prosti.AF
BitDefender	7.2	2009.02.18	Trojan.Patched.BI
CAT-QuickHeal	10.00	2009.02.18	(Suspicious) - DNAScan
ClamAV	0.94.1	2009.02.18	-
Comodo	982	2009.02.17	-
DrWeb	4.44.0.09170	2009.02.18	-
eSafe	7.0.17.0	2009.02.17	-
eTrust-Vet	31.6.6362	2009.02.17	-
F-Prot	4.4.4.56	2009.02.17	W32/Banload.B.gen!Eldorado
F-Secure	8.0.14470.0	2009.02.18	-
Fortinet	3.117.0.0	2009.02.18	-
GData	19	2009.02.18	Trojan.Patched.BI
Ikarus	T3.1.1.45.0	2009.02.18	Virus.Win32.Hupigon.AMD
K7AntiVirus	7.10.630	2009.02.14	-
Kaspersky	7.0.0.125	2009.02.18	-
McAfee	5529	2009.02.17	New Malware.bl
McAfee+Artemis	5529	2009.02.17	New Malware.bl
Microsoft	1.4306	2009.02.18	VirTool:Win32/DelfInject.gen!L
NOD32	3863	2009.02.18	-
Norman	6.00.06	2009.02.17	-
nProtect	2009.1.8.0	2009.02.18	Trojan.Patched.BI
Panda	10.0.0.10	2009.02.17	Suspicious file
PCTools	4.4.2.0	2009.02.17	-
Prevx1	V2	2009.02.18	-
Rising	21.17.21.00	2009.02.18	Packer.Win32.Rycrypt.a
SecureWeb-Gateway	6.7.6	2009.02.17	Trojan.Backdoor.Hupigon.Gen
Sophos	4.38.0	2009.02.18	Mal/Behav-058
Sunbelt	3.2.1855.2	2009.02.17	VIPRE.Suspicious
Symantec	10	2009.02.18	-
TheHacker	6.3.2.2.259	2009.02.18	-
TrendMicro	8.700.0.1004	2009.02.18	Mal_MLWR-1
VBA32	3.12.8.13	2009.02.18	MalwareScope.Trojan-PSW.Game.16
ViRobot	2009.2.18.1612	2009.02.18	-
VirusBuster	4.5.11.0	2009.02.17	-

附加信息

File size: 340019 bytes

MD5...: f282a07ff51605219f8751d057bd798b

SHA1..: e0d05665748a2882a2d341f8972ae6f147df7a36

SHA256: b7732f03d1be7107c1ac24aa84882cc56418e5be0ab2d0a8cada201654d29daa

SHA512: 09948ea5e5ebccf6bf8f7f93b2afa88a7515a23e7b08d4174477782bbadd5c14 a16677a7be30655d5281c6a8a1f1b8389c463084cfc215f7bebedd27df9fb363

ssdeep: 6144:a2LEygMMxceMFgOtgVcjt8K6ahTIruwHlAnsmGcXF8m287283Y4:a2wyhMe zgUgVcjtWYErysmNFD

PEiD..: -

TrID..: File type identification RAR Archive (83.3%) REALbasic Project (16.6%)

PEInfo: -

[ 本帖最后由 FLogo 于 2009-2-19 07:02 编辑 ]

ledled

to VB

cliffboy

小a miss

cliffboy

运行以后
16位 ms-dos 子系统
cpu无效指令

The EQs

根本就不是PE文件，怎么可能会生成文件。。。。

wsmurderer

哎

淡青呀有

怎么看着像灰鸽子.

wrq

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... 68&t=1234961611
Information:  Contains a recognition pattern of the (harmful) BDS/Hupigon.Gen back-door program  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.83, VDF 7.1.2.42

Sherry.ai

兄弟你又发错了吧

328397663

2009-2-19 0:28:22        检测到威胁: Backdoor.Win32.Hupigon.gbsf        C:\Documents and Settings\Administrator\桌面\123.rar/123.exe               
2009-2-19 0:28:22        已删除: Backdoor.Win32.Hupigon.gbsf        C:\Documents and Settings\Administrator\桌面\123.rar/123.exe