Board logo

标题: 【转】Backdoor.Win32.IRCBot.gen分析 [打印本页]

作者: 反病毒小菜     时间: 2008-3-13 19:46    标题: 【转】Backdoor.Win32.IRCBot.gen分析

Backdoor.Win32.IRCBot.gen分析
病毒标签:
病毒名称: Backdoor.Win32.IRCBot.gen
病毒类型: 后门
文件 MD5: 3869F45A7C01D8FE2F5D2DD3199FB2DF
公开范围: 完全公开
危害等级: 4
文件长度: 82,432 字节
感染系统: Windows98以上版本
开发工具: Microsoft Visual C++ 6.0
加壳类型: EXECryptor

病毒描述:
  该病毒运行后复制自身到%System32%目录下,连接多个IRC服务器,通过接收服务
器发出的指令,下载病毒文件,并通过MSN自动给当前在线的好友传送病毒文件,病毒
运行完毕后删除自身。

        

行为分析:
本地行为:

  文件运行后会释放以下文件:
  %System%msthost.exe 82,432 字节

  创建启动项
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
  \Windows\CurrentVersion\Run
  键值: MS Host
  字符串: "msthost.exe"

网络行为:  
  
  协议:TCP

  IRC服务器IP地址列表:
  202.67.153.***
  195.149.74.**
  195.137.213.**
  64.34.203.***
  64.34.193.***
  64.34.193.***
  64.34.168.***
  64.34.166.***等。

  域名列表为:
  server1.c***.net
  …….
  Server30.c***.net

  端口:8888

  创建房间名:##pool P00L

  登陆密码:gsaxx00

  对目标主机的操作:
  连接网络下载病毒文件
  http://216.69.181.***/Binary/OLE/2.exe
  http://mashup.dd****.kasserver.com/downloads/lux/lux7.exe
  (Backdoor.Win32.IRCBot.gen)
  http://www.timbercreeks*******.com/regdata/engx2.txt

  文件内容如下:
  checkout my newest pic before I upload!!
  hey over there... check out my new photo!
  when youre around accept.. its my new default pic.
  u seen this crazy shit?
  holy shit this new pic is hot as fuck!
  I just made this design for a friend. U like it?
  I think I had sex with them :X What should i do?
  You don't think I had sex with them... rite?
  Is it horrible if I only remember the sex?
  Is this really a pic of you?
  Would you have had a threesome with them?
  Wow! I can't believe I had a threesome with them!
  You see these crazy people? Almost havin sex on the dance floor!
  How hot is this?
  Damn this is sexy!
  u want to see something really funny? Take a look!
  I cant stop laughing!
  do you like this picture I took?
  could I have had sex with them?
  new party pictures :) WOW it was insane!
  You want to see something insanely funny? accept this. OMG :)
  Do you like sexyness? accept this and you will find out ;)
  Beer-More Beer-dancing is a bad idea. Look what happaned!
  want to see my new pics? Take a look.
  I just found this nasty pic.. its just wrong,
  but you need to see it!
  Just look at the new shirt I got ;)
  This is my newest webcam.. The pic quality on it alrite?
  I think I just found an old picture of you...want it? here it is!
  dont freakout when you see this picture
  you might scream when you see this picture lol
  plz dont kill me for sending you this picture,
  you've got to see it!
  haha this picture of you is HILARIOUS!
  let me introduce you to my newest friend :) accept already
  Wow I got so fucked last night. Just look at the pic!
  just found new myspace pics! here
  crazy facebook pics accept ;]
  You didn't have sex with them... or did u?
  I think I slept with them!
  Could I have slept with them?
  this person looks like you. It's just freaky.
  watch out.. this picture im sending you is sooooo nasty!!
  do I look good with this new mix?
  Hey! ya wanna see my new pic?
  Someone just tagged me in this picture. Man am I wasted.
  did I send you my new pic? if not here it is :)
  How do we look together?
  this picture is so amazing I cannot believe it!!!
  want me to tag you in this picture on facebook?
  Fucks sake this is really you?
  can I add your picture to my new album?
  Does my new hair style look good?
  checkout the newest faster car.. it is incredible!
  do I look good in this picture?
  Hi, remember this picture of you? I think u were wasted :X
  You look so sexy in this picture!
  do you like dogs? Just look at the one my parents adopted.
  Damn this is some good pole dancing!
  can I post this picture of us to my new blog?
  This is so hot I want it badly, just look already!
  I got a new car!! look at the pics!
  Man this girl got soo fucked last night!
  do you know this person on this picture? I think you do ;)
  I think you will faint when you see this pic
  I was so drunk at this party.. check it out lol
  I can't believe I am in this picture look!
  My lord last night was crazy. Look at the pic I snapped!
  haha you're gonna laugh hard when you see this
  I took this pic on my vacation:)
  this is so nasty...
  I'm pretty sure I just slept with them :X What do i do?
  I look so fat in this pic :(
  your mom is in this picture lol
  I like this picture of you a lot :)
  并根据在文件中随机选择语句发送给MSN好友,同时发送压缩包文件photo94.zip
转自:
http://www.newjian.com/msn_bingdu/200803132707.html

注: %System32% 是一个可变路径。病毒通过查询操作系统来决定当前 System文件夹的
位置。
  
    %Windir%             WINDODWS所在目录
    %DriveLetter%          逻辑驱动器根目录
    %ProgramFiles%          系统程序默认安装目录
    %HomeDrive%           当前启动的系统的所在分区
    %Documents and Settings%    当前用户文档根目录
    %Temp%             \Documents and Settings
                    \当前用户\Local Settings\Temp
    %System32%           系统的 System32文件夹
    
    Windows2000/NT中默认的安装路径是C:\Winnt\System32
    windows95/98/me中默认的安装路径是C:\Windows\System
    windowsXP中默认的安装路径是C:\Windows\System32 




欢迎光临 微点交流论坛 (http://bbs.micropoint.com.cn/) bbs.micropoint.com.cn