假外挂(MUSky系列) (16楼有新)

显示全部楼层 · 发表于 2009-4-1 23:53:51

to VB

显示全部楼层 · 发表于 2009-4-2 11:38:19

1cfa26c7094a9296f96a49aca059dd2c MUSky.exe3.8+
2a6e8f4bab9ff7dcb8fc53ccbda3f272 MUSky.exe3.9

TO KL

Detection will be included in the next update. Thank you for your help.

[ 本帖最后由 sam.to 于 2009-4-2 14:08 编辑 ]

显示全部楼层 · 发表于 2009-4-2 11:59:24

'TR/Drop.Agent.aew.13' [trojan]
'PCK/EncryptPE' [packer]

显示全部楼层 · 发表于 2009-4-2 13:00:58

Win32:Agent-ASW [Trj]

显示全部楼层 · 发表于 2009-4-2 23:57:40

93b04fa33c2a109fe843f514630f2868 musky.dll5.5
82dcfc540bbdaec2ea1c4e28f5939ac6 MU.dll5.1+
e3476f42e4b17f831d0669a5d13fce1a ReValueSys.exe3
to kl

Hello,

MU.dll5.1+ - Trojan.Win32.Agent.bzfk,

musky.dll5.5 - Trojan.Win32.Agent.bzfl,

MUSky.exe5.5 - Trojan.Win32.Agent2.hbi,

ReValueSys.exe_ - Backdoor.Win32.Agent.afgm

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.
The answer is relevant to the latest bases from update sources.

>
>
-----------------
Regards, Vitaly Butuzov
Virus Analyst, Kaspersky Lab.
10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia
Tel./Fax: + 7 (495) 797 8700
http://www.kaspersky.com http://www.viruslist.com

[ 本帖最后由 sam.to 于 2009-4-3 10:35 编辑 ]

显示全部楼层 · 发表于 2009-4-8 21:56:56

93f9b26bc3c3531b8637d932afe92182 MUSky.exe3.5
2ef2187f58ec21b7960bdcb81015e402 MUSky.exe3.9
ffeaf05cf4448c984e3e5e9ef89da420 MUSky.exe5.1
cd25acaea8aeedc875f38a8980c75bd2 Musky.dll3.8+
ce746adc005d23656c32fff1923b671b MUSky.exe3.6
to kl

显示全部楼层 · 发表于 2009-4-8 22:04:47

to js

显示全部楼层 · 发表于 2009-4-8 22:07:37

Starting the file scan:

Begin scan in 'D:\kafan\MUSky'
D:\kafan\MUSky\MUSky.exe5.1
[DETECTION] This file has been compressed using unusual runtime compression (PCK/EncryptPE). Please verify the origin of this file.
[NOTE]    A backup was created as '4a2fb072.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\MUSky\MUSky.exe3.5
[DETECTION] Is the TR/Drop.Agent.aew.8 Trojan
[NOTE]    A backup was created as '4b5a87db.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\MUSky\MUSky.exe3.6
[DETECTION] This file has been compressed using unusual runtime compression (PCK/EncryptPE). Please verify the origin of this file.
[NOTE]    A backup was created as '4a2fb073.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!
D:\kafan\MUSky\MUSky.exe3.9
[DETECTION] Is the TR/Drop.Agent.aew.19 Trojan
[NOTE]    A backup was created as '4a2fb074.qua'  ( QUARANTINE )
[NOTE]    The file was deleted!

End of the scan: 2009年4月8日  22:09
Used time: 00:02 Minute(s)

The scan has been done completely.

   1 Scanned directories
   5 Files were scanned
   4 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   4 files were deleted
   0 Viruses and unwanted programs were repaired
   4 Files were moved to quarantine
   0 Files were renamed
   0 Files cannot be scanned
   1 Files not concerned
   0 Archives were scanned
   0 Warnings
   4 Notes

显示全部楼层 · 发表于 2009-4-8 23:00:24

File ID ?Filename Size (Byte) Result
25316619    MU.dll5.1+    83 KB    MALWARE
25316620    musky.dll5.5    343 KB    MALWARE
25316621    ReValueSys.exe3    832 KB    MALWARE

Please find a detailed report concerning each individual sample below:?Filename Result
MU.dll5.1+    MALWARE

The file 'MU.dll5.1+' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.
?Filename Result
musky.dll5.5    MALWARE

The file 'musky.dll5.5' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Trojan. In general this kind of programs contains harmful functionality called payload. Detection will be added to our virus definition file (VDF) with one of the next updates.
?Filename Result
ReValueSys.exe3    MALWARE

The file 'ReValueSys.exe3' has been determined to be 'MALWARE'. Our analysts discovered that the file is a Security Privacy Risk (SPR). In particular it means that it is a program that might possibly be able to affect the security of your system, might trigger activities you might not want or might violate your privacy. Detection will be added to our virus definition file (VDF) with one of the next updates.

显示全部楼层 · 发表于 2009-4-8 23:12:54

all miss to dw

[病毒样本] 假外挂(MUSky系列) (16楼有新)

回复 10楼 sam.to 的帖子

本帖子中包含更多资源

回复 12楼 sam.to 的帖子

本帖子中包含更多资源

本帖子中包含更多资源

回复 16楼 sam.to 的帖子

回复 15楼 sam.to 的帖子

回复 16楼 sam.to 的帖子