wVMbTht.exe第12次更新（高质量）

Sherry.ai

很经典的样本
今天被我抓到

[ 本帖最后由 935623508 于 2009-4-4 15:41 编辑 ]

allinwonderi

生成

到system32下

Elcondorposa

TO AVIRA
Filename Result
wV8MbTht.exe  UNDER ANALYSIS

wsmurderer

程序：
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\WV8MBTHT.EXE
木马程序生成以下文件：
1) C:\WINDOWS\SYSTEM32\NQSSTT76.EXE
是否删除木马程序及其衍生物?

ledled

VirusBuster found nothing

Sherry.ai

...又把源文件上传了一遍
一个0字节另一个MD5重复

allinwonderi

倒，没仔细看。不过是那个源文件生成的哦。
生成物是本体吧早知道就不放上来了，MS只换个文件名。

[ 本帖最后由 allinwonderi 于 2009-3-6 19:55 编辑 ]

Sherry.ai

呵呵~下次注意吧

Palkia

to rs

allinwonderi

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00274015.

We received the following archive files:
File ID          Filename         Size (Byte)         Result
25280625          wV8MbTht.rar         49.02 KB         OK
25280622                   49.06 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename         Size (Byte)         Result
25280221          p0fCq6jx.exe          66 KB          MALWARE
4039214          p0fCq6jx.exe.a_a          0 Byte          KNOWN CLEAN


Please find a detailed report concerning each individual sample below:
Filename         Result          p0fCq6jx.exe          MALWARE

The file 'p0fCq6jx.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.Agent.nos. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.
Filename         Result          p0fCq6jx.exe.a_a          KNOWN CLEAN