syfwxmh 来又一强毒过卡巴4D防御

显示全部楼层 · 发表于 2009-4-11 23:26:50

原帖由 ximo 于 2009-4-11 23:24 发表
没权限下样本
没样本，没真相。。。

死摸...剑盟群共享里有

vvv.rar

显示全部楼层 · 发表于 2009-4-11 23:26:52

很好玩..

显示全部楼层 · 发表于 2009-4-11 23:26:56

原帖由 cici584522 于 2009-4-11 23:24 发表

可怜的娃。。你要拿什么杀软测试。。我给你

裸机。。。

显示全部楼层 · 发表于 2009-4-11 23:27:19

原帖由 ximo 于 2009-4-11 23:26 发表

裸机。。。

真是个可怜的孩子

显示全部楼层 · 发表于 2009-4-11 23:27:56

有想研究的可以看看

Analysed by sysanalyzer
哈哈，运行时间设为30s

Processes:
PID       ParentPID       User       Path
--------------------------------------------------

Ports:
Port       PID       Type       Path
--------------------------------------------------

Explorer Dlls:
DLL Path       Company Name       File Description
--------------------------------------------------
No changes Found

IE Dlls:
DLL Path       Company Name       File Description
--------------------------------------------------
No changes Found

Loaded Drivers:
Driver File       Company Name       Description
--------------------------------------------------

Monitored RegKeys
Registry Key       Value
--------------------------------------------------

Kernel31 Api Log

--------------------------------------------------
***** Installing Hooks *****
71a274df    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\WinSock2\Parameters)
71a280c4    RegOpenKeyExA (Protocol_Catalog9)
71a2777e    RegOpenKeyExA (00000006)
71a2764d    RegOpenKeyExA (Catalog_Entries)
71a27cea    RegOpenKeyExA (000000000001)
71a27cea    RegOpenKeyExA (000000000002)
71a27cea    RegOpenKeyExA (000000000003)
71a27cea    RegOpenKeyExA (000000000004)
71a27cea    RegOpenKeyExA (000000000005)
71a27cea    RegOpenKeyExA (000000000006)
71a27cea    RegOpenKeyExA (000000000007)
71a27cea    RegOpenKeyExA (000000000008)
71a27cea    RegOpenKeyExA (000000000009)
71a27cea    RegOpenKeyExA (000000000010)
71a27cea    RegOpenKeyExA (000000000011)
71a27cea    RegOpenKeyExA (000000000012)
71a27cea    RegOpenKeyExA (000000000013)
71a27cea    RegOpenKeyExA (000000000014)
71a27cea    RegOpenKeyExA (000000000015)
71a22623    WaitForSingleObject(798,0)
71a287c6    RegOpenKeyExA (NameSpace_Catalog5)
71a2777e    RegOpenKeyExA (00000004)
71a2835b    RegOpenKeyExA (Catalog_Entries)
71a284ef    RegOpenKeyExA (000000000001)
71a284ef    RegOpenKeyExA (000000000002)
71a284ef    RegOpenKeyExA (000000000003)
71a22623    WaitForSingleObject(790,0)
71a11af2    RegOpenKeyExA (HKLM\System\CurrentControlSet\Services\Winsock2\Parameters)
71a1198e    GlobalAlloc()
7c80b719    ExitThread()
40123c    LoadLibraryA(advapi32)=77da0000
401253    LoadLibraryA(ntdll)=7c920000
40126b    LoadLibraryA(user32)=77d10000
4018c7    RegOpenKeyExA (HKCU\Software\Microsoft\Active Setup\Installed Components\)
4018d4    RegDeleteKeyA ({5C866437-FC0B-FAE8-6D9C-920BD098F52B})
4014b4    GetCommandLineA()
751d309d    GetCurrentProcessId()=1044
751cc24e    RegOpenKeyExA (HKLM\Software\Microsoft\Advanced INF Setup)
401505    LoadLibraryA(advpack)=751c0000
751cb5bd    LoadLibraryA(advapi32.dll)=77da0000
40155d    CreateMutex()!voxA.I)
7c865b34    GetCurrentProcessId()=1044
401b0e    OpenProcess(pid=1452)
401c37    WriteProcessMemory(h=7e8,len=d0f)
401c37    WriteProcessMemory(h=7e8,len=296)
401c37    WriteProcessMemory(h=7e8,len=c5)
401c37    WriteProcessMemory(h=7e8,len=168)
401c37    WriteProcessMemory(h=7e8,len=3c)
401c37    WriteProcessMemory(h=7e8,len=9b)
401c37    WriteProcessMemory(h=7e8,len=243)
401c37    WriteProcessMemory(h=7e8,len=e6)
401c37    WriteProcessMemory(h=7e8,len=24e)
401c37    WriteProcessMemory(h=7e8,len=20a)
401c37    WriteProcessMemory(h=7e8,len=f74)
401be3    CreateRemoteThread(h=7e8, start=31d0000)
400216    ExitProcess()
***** Injected Process Terminated *****

DirwatchData

--------------------------------------------------
WatchDir Initilized OK
Watching C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp
Watching C:\WINDOWS
Watching C:\Program Files
Created: C:\WINDOWS\Prefetch\VVV.EXE-050EBA85.pf
Modifed: C:\WINDOWS\Prefetch\VVV.EXE-050EBA85.pf
Created: C:\WINDOWS\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf
Modifed: C:\WINDOWS\Prefetch\SNIFF_HIT.EXE-1AB02EA8.pf
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET4121.tmp
Created: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\JET3.tmp

显示全部楼层 · 发表于 2009-4-11 23:28:52

..真是个有意思的..

显示全部楼层 · 发表于 2009-4-11 23:29:06

时间应该再长一些~~动作少了一些

显示全部楼层 · 发表于 2009-4-11 23:29:35

原帖由 cici584522 于 2009-4-11 23:27 发表

真是个可怜的孩子

居然说墨子是可怜的娃。。。。。。。。。

显示全部楼层 · 发表于 2009-4-11 23:29:53

原帖由 syfwxmh 于 2009-4-11 23:29 发表
时间应该再长一些~~动作少了一些

把网络接通。。动作就多了。。赏你个硬盘炸弹

显示全部楼层 · 发表于 2009-4-11 23:30:29

看到了过来围观ximo

[病毒样本] syfwxmh 来 又一强毒过卡巴4D防御

[病毒样本] syfwxmh 来又一强毒过卡巴4D防御