[原创]vista下W32/Suspicious_U.gen木马分析
文章作者：peter_yu信息来源：邪恶八进制信息安全团队（[url]www.eviloctal.com[/url]）
号称安全性能有极大提高的vista终于遭遇病毒，中毒后会使许多系统服务无法启动，系统几乎瘫痪。
Antivirus Version Update Result
AntiVir 7.3.1.37 02.18.2007 TR/Dldr.Agent.beh.6
Authentium 4.93.8 02.16.2007 Possibly a new variant of W32/CrazyCrunch-based!Maximus
Avast 4.7.936.0 02.18.2007 no virus found
AVG 386 02.18.2007 no virus found
BitDefender 7.2 02.19.2007 no virus found
CAT-QuickHeal 9.00 02.16.2007 (Suspicious) - DNAScan
DrWeb None 02.18.2007 no virus found
eSafe 7.0.14.0 02.18.2007 no virus found
eTrust-Vet 30.4.3410 02.18.2007 no virus found
Ewido 4.0 02.18.2007 Downloader.Agent.beh
Fortinet 2.85.0.0 02.19.2007 suspicious
F-Prot 4.2.1.29 02.16.2007 W32/CrazyCrunch-based!Maximus
F-Secure 6.70.13030.0 02.18.2007 no virus found
Ikarus T3.1.0.31 02.18.2007 no virus found
Kaspersky 4.0.2.24 02.19.2007 no virus found
McAfee 4965 02.16.2007 no virus found
Microsoft 1.2204 02.19.2007 no virus found
Norman 5.80.02 02.16.2007 no virus found
Panda 9.0.0.4 02.18.2007 Suspicious file
Prevx1 V2 02.19.2007 Spyware.Spy.Sheriff
Sophos 4.14.0 02.19.2007 Mal/Packer
Sunbelt 2.2.907.0 02.17.2007 VIPRE.Suspicious
TheHacker 6.1.6.059 02.16.2007 no virus found
UNA 1.83 02.16.2007 no virus found
VBA32 3.11.2 02.18.2007 Trojan-Downloader.Win32.Agent.beh
VirusBuster 4.3.19:9 02.18.2007 novirus:Packed/Upack
看壳：Upack 0.3.9 beta2s -> Dwing
脱壳：PolyEnE 0.01+ by Lennart Hedlund *
taskmang.exe : Not detected by Sandbox (Signature: W32/Suspicious_U.gen)
[ General information ]
* File length: 7401 bytes.
* MD5 hash: ddd07b45182a411e71d75f3a8f1c16a4.
写HKEY_CLASSES_ROOT
MTBase
ntdll.ZwCreateSection
ntdll.ZwMapViewOfSection
ntdll.ZwUnmapViewOfSection
lstrcmpiA
20001A71 |. 68 D0410020 push 200041D0 ; ASCII "\shell\open\command"
ZwMapViewOfSection用来建立物理内存和当前进程的一段物理内存的联系
ntdll.ZwCreateSection映射文件
20002C7E |. 68 1C440020 push 2000441C ; ASCII " HTTP/1.1",CR,LF,"Host: "
20002C92 |. 68 04440020 push 20004404 ; ASCII CR,LF,"Connection: Close",CR,LF,CR,LF
获取bios版本
[attach]5485[/attach]
[attach]5486[/attach]
[attach]5487[/attach]
写注册表
[attach]5488[/attach]
[attach]5489[/attach]
[attach]5490[/attach]
献丑了，实在是在EST这牛人云集的地方无地自容了…………
页:
[1]