微点交流论坛 - 反病毒 - 【转】Backdoor.Win32.IRCBot.gen分析

微点交流论坛 » 反病毒 » 【转】Backdoor.Win32.IRCBot.gen分析

反病毒小菜
新手上路

积分 21
发帖 15
注册 2008-3-3

#1 【转】Backdoor.Win32.IRCBot.gen分析

Backdoor.Win32.IRCBot.gen分析
病毒标签：
病毒名称： Backdoor.Win32.IRCBot.gen
病毒类型：后门
文件 MD5： 3869F45A7C01D8FE2F5D2DD3199FB2DF
公开范围：完全公开
危害等级： 4
文件长度： 82,432 字节
感染系统： Windows98以上版本
开发工具： Microsoft Visual C++ 6.0
加壳类型： EXECryptor

病毒描述：
　　该病毒运行后复制自身到%System32%目录下，连接多个IRC服务器，通过接收服务
器发出的指令，下载病毒文件，并通过MSN自动给当前在线的好友传送病毒文件，病毒
运行完毕后删除自身。

　　　　　　　　

行为分析：
本地行为：

　　文件运行后会释放以下文件：
　　%System%msthost.exe 82,432 字节

　　创建启动项
　　HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
　　\Windows\CurrentVersion\Run
　　键值: MS Host
　　字符串: "msthost.exe"

网络行为:　　
　　
　　协议：TCP

　　IRC服务器IP地址列表：
　　202.67.153.***
　　195.149.74.**
　　195.137.213.**
　　64.34.203.***
　　64.34.193.***
　　64.34.193.***
　　64.34.168.***
　　64.34.166.***等。

　　域名列表为：
　　server1.c***.net
　　…….
　　Server30.c***.net

　　端口：8888

　　创建房间名：##pool P00L

　　登陆密码：gsaxx00

　　对目标主机的操作：
　　连接网络下载病毒文件
　　http://216.69.181.***/Binary/OLE/2.exe
　　http://mashup.dd****.kasserver.com/downloads/lux/lux7.exe
　　（Backdoor.Win32.IRCBot.gen）
　　http://www.timbercreeks*******.com/regdata/engx2.txt

　　文件内容如下：
　　checkout my newest pic before I upload!!
　　hey over there... check out my new photo!
　　when youre around accept.. its my new default pic.
　　u seen this crazy shit?
　　holy shit this new pic is hot as fuck!
　　I just made this design for a friend. U like it?
　　I think I had sex with them :X What should i do?
　　You don't think I had sex with them... rite?
　　Is it horrible if I only remember the sex?
　　Is this really a pic of you?
　　Would you have had a threesome with them?
　　Wow! I can't believe I had a threesome with them!
　　You see these crazy people? Almost havin sex on the dance floor!
　　How hot is this?
　　Damn this is sexy!
　　u want to see something really funny? Take a look!
　　I cant stop laughing!
　　do you like this picture I took?
　　could I have had sex with them?
　　new party pictures

WOW it was insane!
　　You want to see something insanely funny? accept this. OMG

　　Do you like sexyness? accept this and you will find out

　　Beer-More Beer-dancing is a bad idea. Look what happaned!
　　want to see my new pics? Take a look.
　　I just found this nasty pic.. its just wrong,
　　but you need to see it!
　　Just look at the new shirt I got

　　This is my newest webcam.. The pic quality on it alrite?
　　I think I just found an old picture of you...want it? here it is!
　　dont freakout when you see this picture
　　you might scream when you see this picture lol
　　plz dont kill me for sending you this picture,
　　you've got to see it!
　　haha this picture of you is HILARIOUS!
　　let me introduce you to my newest friend

accept already
　　Wow I got so fucked last night. Just look at the pic!
　　just found new myspace pics! here
　　crazy facebook pics accept ;]
　　You didn't have sex with them... or did u?
　　I think I slept with them!
　　Could I have slept with them?
　　this person looks like you. It's just freaky.
　　watch out.. this picture im sending you is sooooo nasty!!
　　do I look good with this new mix?
　　Hey! ya wanna see my new pic?
　　Someone just tagged me in this picture. Man am I wasted.
　　did I send you my new pic? if not here it is

　　How do we look together?
　　this picture is so amazing I cannot believe it!!!
　　want me to tag you in this picture on facebook?
　　Fucks sake this is really you?
　　can I add your picture to my new album?
　　Does my new hair style look good?
　　checkout the newest faster car.. it is incredible!
　　do I look good in this picture?
　　Hi, remember this picture of you? I think u were wasted :X
　　You look so sexy in this picture!
　　do you like dogs? Just look at the one my parents adopted.
　　Damn this is some good pole dancing!
　　can I post this picture of us to my new blog?
　　This is so hot I want it badly, just look already!
　　I got a new car!! look at the pics!
　　Man this girl got soo fucked last night!
　　do you know this person on this picture? I think you do

　　I think you will faint when you see this pic
　　I was so drunk at this party.. check it out lol
　　I can't believe I am in this picture look!
　　My lord last night was crazy. Look at the pic I snapped!
　　haha you're gonna laugh hard when you see this
　　I took this pic on my vacation

　　this is so nasty...
　　I'm pretty sure I just slept with them :X What do i do?
　　I look so fat in this pic

　　your mom is in this picture lol
　　I like this picture of you a lot

　　并根据在文件中随机选择语句发送给MSN好友，同时发送压缩包文件photo94.zip
转自：
http://www.newjian.com/msn_bingdu/200803132707.html

注： %System32% 是一个可变路径。病毒通过查询操作系统来决定当前 System文件夹的
位置。
　　
　　　　%Windir% 　　　　　　　　　　 WINDODWS所在目录
　　　　%DriveLetter%　　　　　　　　逻辑驱动器根目录
　　　　%ProgramFiles%　　　　　　　系统程序默认安装目录
　　　　%HomeDrive% 　　　　　　　　　当前启动的系统的所在分区
　　　　%Documents and Settings% 　　　当前用户文档根目录
　　　　%Temp% 　　　　　　　　　　　　\Documents and Settings
　　　　　　　　　　　　　　　　　　　\当前用户\Local Settings\Temp
　　　　%System32% 　　　　　　　　　　系统的 System32文件夹
　　　　
　　　　Windows2000/NT中默认的安装路径是C:\Winnt\System32
　　　　windows95/98/me中默认的安装路径是C:\Windows\System
　　　　windowsXP中默认的安装路径是C:\Windows\System32　

※ ※ ※ 本文纯属【反病毒小菜】个人意见，与【微点交流论坛】立场无关※ ※ ※

2008-3-13 19:46

论坛跳转:

可打印版本 | 推荐 | 订阅 | 收藏

[ 联系我们 - 东方微点 ] 北京东方微点信息技术有限责任公司福建东方微点信息安全有限责任公司闽ICP备05030815号