Nome del virus: TR/Bagle.FU Scoperto: 28/03/2006 Tipo: Trojan In circolazione (ITW): No Numero delle infezioni segnalate: Basso Potenziale di propagazione: Basso Potenziale di danni: Medio File statico: Si Dimensione del file: 18.436 Byte Somma di controllo MD5: a962a1c4e2808210666f07870Bf3daa7 Versione VDF: 6.34.00.108
Generale Metodo di propagazione: • Nessuna propria procedura di propagazione Alias: • Symantec: W32.Beagle.DZ • Kaspersky: Trojan-Proxy.Win32.Mitglieder.ea • TrendMicro: TROJ_MITGLIED.AK Piattaforme / Sistemi operativi: • Windows 95 • Windows 98 • Windows 98 SE • Windows NT • Windows ME • Windows 2000 • Windows XP • Windows 2003 Effetti secondari: • Disattiva le applicazioni di sicurezza • Clona un file “maligno” • Abbassa le impostazioni di sicurezza • Modifica del registro File Si copia alla seguente posizione: • %APPDATA%\hidires\hidr.exe Cancella i seguenti file: • a2guard.exe • aavshield.exe • AckWin32.exe • ADVCHK.EXE • AhnSD.exe • airdefense.exe • ALERTSVC.EXE • ALMon.exe • ALOGSERV.EXE • ALsvc.exe • amon.exe • Anti-Trojan.exe • AntiVirScheduler • AntiVirService • ANTS.EXE • APVXDWIN.EXE • Armor2net.exe • ashAvast.exe • ashDisp.exe • ashEnhcd.exe • ashMaiSv.exe • ashPopWz.exe • ashServ.exe • ashSimpl.exe • ashSkPck.exe • ashWebSv.exe • aswUpdSv.exe • ATCON.EXE • ATUPDATER.EXE • ATWATCH.EXE • AUPDATE.EXE • AUTODOWN.EXE • AUTOTRACE.EXE • AUTOUPDATE.EXE • avciman.exe • Avconsol.exe • AVENGINE.EXE • avgamsvr.exe • avgcc.exe • AVGCC32.EXE • AVGCTRL.EXE • avgemc.exe • avgfwsrv.exe • AVGNT.EXE • avgntdd • avgntmgr • AVGSERV.EXE • AVGUARD.EXE • avgupsvc.exe • avinitnt.exe • AvkServ.exe • AVKService.exe • AVKWCtl.exe • AVP.EXE • AVP32.EXE • avpcc.exe • avpm.exe • AVPUPD.EXE • AVSCHED32.EXE • avsynmgr.exe • AVWUPD32.EXE • AVWUPSRV.EXE • AVXMONITOR9X.EXE • AVXMONITORNT.EXE • AVXQUAR.EXE • BackWeb-4476822.exe • bdmcon.exe • bdnews.exe • bdoesrv.exe • bdss.exe • bdsubmit.exe • bdswitch.exe • blackd.exe • blackice.exe • cafix.exe • ccApp.exe • ccEvtMgr.exe • ccProxy.exe • ccSetMgr.exe • CFIAUDIT.EXE • ClamTray.exe • ClamWin.exe • Claw95.exe • Claw95cf.exe • cleaner.exe • cleaner3.exe • CliSvc.exe • CMGrdian.exe • cpd.exe • DefWatch.exe • DOORS.EXE • DrVirus.exe • drwadins.exe • drweb32w.exe • drwebscd.exe • DRWEBUPW.EXE • ESCANH95.EXE • ESCANHNT.EXE • ewidoctrl.exe • EzAntivirusRegistrationCheck.exe • F-AGNT95.EXE • F-PROT95.EXE • F-Sched.exe • F-StopW.EXE • FAMEH32.EXE • FAST.EXE • FCH32.EXE • FireSvc.exe • FireTray.exe • FIREWALL.EXE • fpavupdm.exe • freshclam.exe • FRW.EXE • fsav32.exe • fsavgui.exe • fsbwsys.exe • fsdfwd.exe • FSGK32.EXE • fsgk32st.exe • fsguiexe.exe • FSM32.EXE • FSMA32.EXE • FSMB32.EXE • fspex.exe • fssm32.exe • gcasDtServ.exe • gcasServ.exe • GIANTAntiSpywareMain.exe • GIANTAntiSpywareUpdater.exe • GUARD.EXE • GUARDGUI.EXE • GuardNT.exe • HRegMon.exe • Hrres.exe • HSockPE.exe • HUpdate.EXE • iamapp.exe • iamserv.exe • ICLOAD95.EXE • ICLOADNT.EXE • ICMON.EXE • ICSSUPPNT.EXE • ICSUPP95.EXE • ICSUPPNT.EXE • IFACE.EXE • INETUPD.EXE • InocIT.exe • InoRpc.exe • InoRT.exe • InoTask.exe • InoUpTNG.exe • IOMON98.EXE • isafe.exe • ISATRAY.EXE • ISRV95.EXE • ISSVC.exe • JEDI.EXE • KAV.exe • kavmm.exe • KAVPF.exe • KavPFW.exe • KAVStart.exe • KAVSvc.exe • KAVSvcUI.EXE • KMailMon.EXE • KPfwSvc.EXE • KWatch.EXE • livesrv.exe • LOCKDOWN2000.EXE • LogWatNT.exe • lpfw.exe • LUALL.EXE • LUCOMSERVER.EXE • Luupdate.exe • MCAGENT.EXE • mcmnhdlr.exe • mcregwiz.exe • Mcshield.exe • MCUPDATE.EXE • mcvsshld.exe • MINILOG.EXE • MONITOR.EXE • MonSysNT.exe • MOOLIVE.EXE • MpEng.exe • mpssvc.exe • MSMPSVC.exe • myAgtSvc.exe • myagttry.exe • navapsvc.exe • NAVAPW32.EXE • NavLu32.exe • NAVW32.EXE • NDD32.EXE • NeoWatchLog.exe • NeoWatchTray.exe • NISSERV • NISUM.EXE • NMAIN.EXE • nod32.exe • nod32krn.exe • nod32kui.exe • NORMIST.EXE • notstart.exe • npavtray.exe • NPFMNTOR.EXE • npfmsg.exe • NPROTECT.EXE • NSCHED32.EXE • NSMdtr.exe • NssServ.exe • NssTray.exe • ntrtscan.exe • NTXconfig.exe • NUPGRADE.EXE • NVC95.EXE • Nvcod.exe • Nvcte.exe • Nvcut.exe • NWService.exe • OfcPfwSvc.exe • OUTPOST.EXE • PAV.EXE • PavFires.exe • PavFnSvr.exe • Pavkre.exe • PavProt.exe • pavProxy.exe • pavprsrv.exe • pavsrv51.exe • PAVSS.EXE • pccguide.exe • PCCIOMON.EXE • pccntmon.exe • PCCPFW.exe • PcCtlCom.exe • PCTAV.exe • PERSFW.EXE • pertsk.exe • PERVAC.EXE • PNMSRV.EXE • POP3TRAP.EXE • POPROXY.EXE • prevsrv.exe • PsImSvc.exe • QHM32.EXE • QHONLINE.EXE • QHONSVC.EXE • QHPF.EXE • qhwscsvc.exe • RavMon.exe • RavTimer.exe • Realmon.exe • REALMON95.EXE • Rescue.exe • rfwmain.exe • Rtvscan.exe • RTVSCN95.EXE • RuLaunch.exe • SAVAdminService.exe • SAVMain.exe • savprogress.exe • SAVScan.exe • SCAN32.EXE • ScanningProcess.exe • sched.exe • sdhelp.exe • SERVIC~1.EXE • SHSTAT.EXE • SiteCli.exe • smc.exe • SNDSrvc.exe • SPBBCSvc.exe • SPHINX.EXE • spiderml.exe • spidernt.exe • Spiderui.exe • SpybotSD.exe • SPYXX.EXE • SS3EDIT.EXE • stopsignav.exe • swAgent.exe • swdoctor.exe • SWNETSUP.EXE • symlcsvc.exe • SymProxySvc.exe • SymSPort.exe • SymWSC.exe • SYNMGR.EXE • TAUMON.EXE • TBMon.exe • TC.EXE • tca.exe • TCM.EXE • TDS-3.EXE • TeaTimer.exe • TFAK.EXE • THAV.EXE • THSM.EXE • Tmas.exe • tmlisten.exe • Tmntsrv.exe • TmPfw.exe • tmproxy.exe • TNBUtil.exe • TRJSCAN.EXE • Up2Date.exe • UPDATE.EXE • UpdaterUI.exe • upgrepl.exe • Vba32ECM.exe • Vba32ifs.exe • vba32ldr.exe • Vba32PP3.exe • VBSNTW.exe • vchk.exe • vcrmon.exe • VetTray.exe • VirusKeeper.exe • VPTRAY.EXE • vrfwsvc.exe • VRMONNT.EXE • vrmonsvc.exe • vrrw32.exe • VSECOMR.EXE • Vshwin32.exe • vsmon.exe • vsserv.exe • VsStat.exe • WATCHDOG.EXE • WebProxy.exe • Webscanx.exe • WEBTRAP.EXE • WGFE95.EXE • Winaw32.exe • winroute.exe • winss.exe • winssnotify.exe • WRADMIN.EXE • WRCTRL.EXE • xcommsvr.exe • zatutor.exe • ZAUINST.EXE • zlclient.exe • zonealarm.exe • _AVP32.EXE • _AVPCC.EXE • _AVPM.EXE Viene creato il seguente file: – %APPDATA%\hidires\m_hook.sys Ulteriori analisi hanno accertato che questo file è anch'esso un malware. Riconosciuto come: TR/Proxy.Mitglieder.EA Registro Viene aggiunta nel registro la seguente chiave con lo scopo di eseguire il processo dopo il riavvio: – [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • drvsyskit = %APPDATA%\hidires\hidr.exe Le seguenti chiavi di registro vengono aggiunte per caricare il servizio dopo il riavvio: – [HKLM\SYSTEM\CurrentControlSet\Services\m_hook] • Type = dword:00000001 • Start = dword:00000003 • ErrorControl = dword:00000000 • ImagePath = \??\%APPDATA%\hidires\m_hook.sys • DisplayName = Empty – [HKLM\SYSTEM\CurrentControlSet\Services\m_hook\Security] • Security = %valori esadecimali% – [HKLM\SYSTEM\CurrentControlSet\Services\m_hook\Enum] • 0 = Root\\LEGACY_M_HOOK\\0000 • Count = dword:00000001 • NextInstance = dword:00000001 – [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK] • NextInstance = dword:00000001 – [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\0000] • Service = m_hook • Legacy = dword:00000001 • ConfigFlags = dword:00000000 • Class = LegacyDriver • ClassGUID = {8ECC055D-047F-11D1-A537-0000F8753ED1} • DeviceDesc = Empty – [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_M_HOOK\0000\ Control] • *NewlyCreated* = dword:00000000 • ActiveService = m_hook Processi terminati Lista dei processi che vengono terminati: • a2guard.exe; aavshield.exe; AckWin32.exe; ADVCHK.EXE; AhnSD.exe; airdefense.exe; ALERTSVC.EXE; ALMon.exe; ALOGSERV.EXE; ALsvc.exe; amon.exe; Anti-Trojan.exe; AntiVirScheduler; AntiVirService; ANTS.EXE; APVXDWIN.EXE; Armor2net.exe; ashAvast.exe; ashDisp.exe; ashEnhcd.exe; ashMaiSv.exe; ashPopWz.exe; ashServ.exe; ashSimpl.exe; ashSkPck.exe; ashWebSv.exe; aswUpdSv.exe; ATCON.EXE; ATUPDATER.EXE; ATWATCH.EXE; AUPDATE.EXE; AUTODOWN.EXE; AUTOTRACE.EXE; AUTOUPDATE.EXE; avciman.exe; Avconsol.exe; AVENGINE.EXE; avgamsvr.exe; avgcc.exe; AVGCC32.EXE; AVGCTRL.EXE; avgemc.exe; avgfwsrv.exe; AVGNT.EXE; avgntdd; avgntmgr; AVGSERV.EXE; AVGUARD.EXE; avgupsvc.exe; avinitnt.exe; AvkServ.exe; AVKService.exe; AVKWCtl.exe; AVP.EXE; AVP32.EXE; avpcc.exe; avpm.exe; AVPUPD.EXE; AVSCHED32.EXE; avsynmgr.exe; AVWUPD32.EXE; AVWUPSRV.EXE; AVXMONITOR9X.EXE; AVXMONITORNT.EXE; AVXQUAR.EXE; BackWeb-4476822.exe; bdmcon.exe; bdnews.exe; bdoesrv.exe; bdss.exe; bdsubmit.exe; bdswitch.exe; blackd.exe; blackice.exe; cafix.exe; ccApp.exe; ccEvtMgr.exe; ccProxy.exe; ccSetMgr.exe; CFIAUDIT.EXE; ClamTray.exe; ClamWin.exe; Claw95.exe; Claw95cf.exe; cleaner.exe; cleaner3.exe; CliSvc.exe; CMGrdian.exe; cpd.exe; DefWatch.exe; DOORS.EXE; DrVirus.exe; drwadins.exe; drweb32w.exe; drwebscd.exe; DRWEBUPW.EXE; ESCANH95.EXE; ESCANHNT.EXE; ewidoctrl.exe; EzAntivirusRegistrationCheck.exe; F-AGNT95.EXE; F-PROT95.EXE; F-Sched.exe; F-StopW.EXE; FAMEH32.EXE; FAST.EXE; FCH32.EXE; FireSvc.exe; FireTray.exe; FIREWALL.EXE; fpavupdm.exe; freshclam.exe; FRW.EXE; fsav32.exe; fsavgui.exe; fsbwsys.exe; fsdfwd.exe; FSGK32.EXE; fsgk32st.exe; fsguiexe.exe; FSM32.EXE; FSMA32.EXE; FSMB32.EXE; fspex.exe; fssm32.exe; gcasDtServ.exe; gcasServ.exe; GIANTAntiSpywareMain.exe; GIANTAntiSpywareUpdater.exe; GUARD.EXE; GUARDGUI.EXE; GuardNT.exe; HRegMon.exe; Hrres.exe; HSockPE.exe; HUpdate.EXE; iamapp.exe; iamserv.exe; ICLOAD95.EXE; ICLOADNT.EXE; ICMON.EXE; ICSSUPPNT.EXE; ICSUPP95.EXE; ICSUPPNT.EXE; IFACE.EXE; INETUPD.EXE; InocIT.exe; InoRpc.exe; InoRT.exe; InoTask.exe; InoUpTNG.exe; IOMON98.EXE; isafe.exe; ISATRAY.EXE; ISRV95.EXE; ISSVC.exe; JEDI.EXE; KAV.exe; kavmm.exe; KAVPF.exe; KavPFW.exe; KAVStart.exe; KAVSvc.exe; KAVSvcUI.EXE; KMailMon.EXE; KPfwSvc.EXE; KWatch.EXE; livesrv.exe; LOCKDOWN2000.EXE; LogWatNT.exe; lpfw.exe; LUALL.EXE; LUCOMSERVER.EXE; Luupdate.exe; MCAGENT.EXE; mcmnhdlr.exe; mcregwiz.exe; Mcshield.exe; MCUPDATE.EXE; mcvsshld.exe; MINILOG.EXE; MONITOR.EXE; MonSysNT.exe; MOOLIVE.EXE; MpEng.exe; mpssvc.exe; MSMPSVC.exe; myAgtSvc.exe; myagttry.exe; navapsvc.exe; NAVAPW32.EXE; NavLu32.exe; NAVW32.EXE; NDD32.EXE; NeoWatchLog.exe; NeoWatchTray.exe; NISSERV; NISUM.EXE; NMAIN.EXE; nod32.exe; nod32krn.exe; nod32kui.exe; NORMIST.EXE; notstart.exe; npavtray.exe; NPFMNTOR.EXE; npfmsg.exe; NPROTECT.EXE; NSCHED32.EXE; NSMdtr.exe; NssServ.exe; NssTray.exe; ntrtscan.exe; NTXconfig.exe; NUPGRADE.EXE; NVC95.EXE; Nvcod.exe; Nvcte.exe; Nvcut.exe; NWService.exe; OfcPfwSvc.exe; OUTPOST.EXE; PAV.EXE; PavFires.exe; PavFnSvr.exe; Pavkre.exe; PavProt.exe; pavProxy.exe; pavprsrv.exe; pavsrv51.exe; PAVSS.EXE; pccguide.exe; PCCIOMON.EXE; pccntmon.exe; PCCPFW.exe; PcCtlCom.exe; PCTAV.exe; PERSFW.EXE; pertsk.exe; PERVAC.EXE; PNMSRV.EXE; POP3TRAP.EXE; POPROXY.EXE; prevsrv.exe; PsImSvc.exe; QHM32.EXE; QHONLINE.EXE; QHONSVC.EXE; QHPF.EXE; qhwscsvc.exe; RavMon.exe; RavTimer.exe; Realmon.exe; REALMON95.EXE; Rescue.exe; rfwmain.exe; Rtvscan.exe; RTVSCN95.EXE; RuLaunch.exe; SAVAdminService.exe; SAVMain.exe; savprogress.exe; SAVScan.exe; SCAN32.EXE; ScanningProcess.exe; sched.exe; sdhelp.exe; SERVIC~1.EXE; SHSTAT.EXE; SiteCli.exe; smc.exe; SNDSrvc.exe; SPBBCSvc.exe; SPHINX.EXE; spiderml.exe; spidernt.exe; Spiderui.exe; SpybotSD.exe; SPYXX.EXE; SS3EDIT.EXE; stopsignav.exe; swAgent.exe; swdoctor.exe; SWNETSUP.EXE; symlcsvc.exe; SymProxySvc.exe; SymSPort.exe; SymWSC.exe; SYNMGR.EXE; TAUMON.EXE; TBMon.exe; TC.EXE; tca.exe; TCM.EXE; TDS-3.EXE; TeaTimer.exe; TFAK.EXE; THAV.EXE; THSM.EXE; Tmas.exe; tmlisten.exe; Tmntsrv.exe; TmPfw.exe; tmproxy.exe; TNBUtil.exe; TRJSCAN.EXE; Up2Date.exe; UPDATE.EXE; UpdaterUI.exe; upgrepl.exe; Vba32ECM.exe; Vba32ifs.exe; vba32ldr.exe; Vba32PP3.exe; VBSNTW.exe; vchk.exe; vcrmon.exe; VetTray.exe; VirusKeeper.exe; VPTRAY.EXE; vrfwsvc.exe; VRMONNT.EXE; vrmonsvc.exe; vrrw32.exe; VSECOMR.EXE; Vshwin32.exe; vsmon.exe; vsserv.exe; VsStat.exe; WATCHDOG.EXE; WebProxy.exe; Webscanx.exe; WEBTRAP.EXE; WGFE95.EXE; Winaw32.exe; winroute.exe; winss.exe; winssnotify.exe; WRADMIN.EXE; WRCTRL.EXE; xcommsvr.exe; zatutor.exe; ZAUINST.EXE; zlclient.exe; zonealarm.exe; _AVP32.EXE; _AVPCC.EXE; _AVPM.EXE I seguenti servizi vengono disattivati: • Aavmker4; ABVPN2K; ADBLOCK.DLL; ADFirewall; AFWMCL; Ahnlab task Scheduler; alerter; AlertManger; AntiVir Service; AntiyFirewall; ARP.DLL; aswMon2; aswRdr; aswTdi; aswUpdSv; Ati HotKey Poller; avast! Antivirus; avast! Mail Scanner; avast! Web Scanner; AVEService; AVExch32Service; AvFlt; Avg7Alrt; Avg7Core; Avg7RsW; Avg7RsXP; Avg7UpdSvc; AvgCore; AvgFsh; AVGFwSrv; AvgFwSvr; AvgServ; AvgTdi; AVIRAMailService; AVIRAService; avpcc; AVUPDService; AVWUpSrv; AvxIni; awhost32; backweb client - 4476822; BackWeb Client - 7681197; backweb client-4476822; Bdfndisf; bdftdif; bdss; BlackICE; BsFileSpy; BsFirewall; BsMailProxy; CAISafe; ccEvtMgr; ccPwdSvc; ccSetMgr; ccSetMgr.exe; CONTENT.DLL; DefWatch; DNSCACHE.DLL; drwebnet; dvpapi; dvpinit; ewido security suite control; ewido security suite driver; ewido security suite guard; F-Prot Antivirus Update Monitor; F-Secure Gatekeeper Handler Starter; firewall; fsbwsys; FSDFWD; FSFW; FSMA; FTPFILT.DLL; FwcAgent; fwdrv; Guard NT; HSnSFW; HSnSPro; HTMLFILT.DLL; HTTPFILT.DLL; IMAPFILT.DLL; InoRPC; InoRT; InoTask; Ip6Fw; Ip6FwHlp; KAVMonitorService; KAVSvc; KLBLMain; KPfwSvc; KWatch3; KWatchSvc; MAILFILT.DLL; McAfee Firewall; McAfeeFramework; McShield; McTaskManager; mcupdmgr.exe; MCVSRte; Microsoft NetWork FireWall Services; MonSvcNT; MpfService; navapsvc; Ndisuio; NDIS_RD; Network Associates Log Service; nipsvc; NISSERV; NISUM; NNTPFILT.DLL; NOD32ControlCenter; NOD32krn; NOD32Service; Norman NJeeves; Norman Type-R; Norman ZANDA; Norton AntiVirus Server; NPDriver; NPFMntor; NProtectService; NSCTOP; nvcoas; NVCScheduler; nwclntc; nwclntd; nwclnte; nwclntf; nwclntg; nwclnth; NWService; OfcPfwSvc; Outbreak Manager; Outpost Firewall; OutpostFirewall; PASSRV; PAVAGENTE; PavAtScheduler; PAVDRV; PAVFIRES; PAVFNSVR; Pavkre; PavProc; PavProt; PavPrSrv; PavReport; PAVSRV; PCCPFW; PCC_PFW; PersFW; Personal Firewall; POP3FILT.DLL; PREVSRV; PROTECT.DLL; PSIMSVC; qhwscsvc; Quick Heal Online Protection; ravmon8; RfwService; SAVFMSE; SAVScan; SBService; schscnt; SECRET.DLL; SharedAccess; SmcService; SNDSrvc; SPBBCSvc; SpiderNT; SweepNet; SWEEPSRV.SYS; Symantec AntiVirus Client; Symantec Core LC; The_Hacker_Antivirus; Tmntsrv; TmPfw; tmproxy; tmtdi; tm_cfw; T_H_S_M; V3MonNT; V3MonSvc; Vba32ECM; Vba32ifs; Vba32Ldr; Vba32PP3; VBCompManService; VexiraAntivirus; VFILT; VisNetic AntiVirus Plug-in; vrfwsvc; vsmon; VSSERV; WinAntivirus; WinRoute; wuauserv; xcomm Tecnologia Rootkit È una tecnologia specifica del malware. Il malware si nasconde dalle utilità di sistema, dalle applicazioni di sicurezza e, alla fine, dall'utente. Nasconde il seguente: – I propri file – Il proprio processo – La propria chiave di registro – I seguenti file: • filesnames001.exe • filesnames002.exe • filesnames003.exe • filesnames004.exe • filesnames005.exe • filesnames006.exe – I seguenti processi: • filesnamec001.exe • filesnamec002.exe • filesnamec003.exe • filesnamec004.exe • filesnamec005.exe • filesnamec006.exe – Le seguenti chiavi di registro: • nkeyjej1 • nkeyjej2 – I seguenti valori di registro: • key000s01 • key000s02 • key000s03 • key000s04 • key000s05 Metodo utilizzato: • Nascosto dalle Windows API “Aggancia” le seguenti funzioni API: • NtCreateFile/ZwCreateFile • NtEnumerateKey/ZwEnumerateKey • NtEnumerateValueKey/ZwEnumerateValueKey • NtQueryDirectoryFile/ZwQueryDirectoryFile • NtQueryKey/ZwQueryKey • NtQuerySystemInformation/ZwQuerySystemInformation • NtQueryValueKey/ZwQueryValueKey Dettagli del file Software di compressione: Per complicarne l'individuazione e ridurre la dimensione del file, viene compresso con un software di compressione.
Descrizione inserita da Andrei Gherman su mercoledì 29 marzo 2006 Descrizione aggiornata da Andrei Gherman su giovedì 30 marzo 2006
Indietro
.
.
.
.