Full description

病毒:	WORM/Koobface.J
发现日期:	13/12/2012
类型:	蠕虫
广泛传播:	是
病毒传播个案呈报：	低程度
感染/传播能力：	低程度
破坏 / 损害程度：	低程度至中程度
静态文件:	是
文件大小:	331.776 字节
MD5 校检和:	77be30318b2cdcb8c9708ba1ef04f5c0
VDF 版本:	7.11.53.216 - 2012년 12월 13일 목요일
IVDF 版本:	7.11.53.216 - 2012년 12월 13일 목요일

况概描述 传播方法:
   • 无内置传播例程

别名:
   • Kaspersky: Net-Worm.Win32.Koobface.hdz
   • F-Secure: Net-Worm.Win32.Koobface.hdz
   • Microsoft: Trojan:Win32/Koobface
   • Eset: Win32/Koobface.NDI

平台/操作系统:
   • Windows 2000
   • Windows XP
   • Windows Vista
   • Windows 7

副作用:
   • 关闭安全应用程序
   • 下载恶意文件
   • 注册表修改

文件它将本身复制到以下位置:
   • %WINDIR%\andy138.exe

创建以下文件:

– 非恶意文件:
   • %WINDIR%\fdgg34353edfgdfdf
   • %WINDIR%\bk23567.dat

– C:\3.reg 检测为: TR/REG.Koobface.89

注册表会添加以下注册表项，以便在系统重新引导后运行进程:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "xuri49tkd"="%WINDIR%\andy138.exe"

会删除以下注册表项的注册值:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "syspptray"=-
   • "sysfbtray"=-

会添加以下注册表项目注册值:

– [HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
   • "DisableAntiSpyware"=dword:00000001

– [HKCR\Mime\Database\Content Type\application/xhtml+xml]
   • "CLSID"="{25336920-03F9-11cf-8FD0-00AA00686F13}"
   • "Extension"=".xml"
   • "Encoding"=hex:08,00,00,00

后门程序 访问服务器:
以下所有内容:
   • 195.28.**********?action=fbgen&v=136&crc=669
   • 76.12.**********?action=fbgen&v=136&crc=669
   • 782cockta**********?action=fbgen&v=136&crc=669
   • 99**********?action=fbgen&v=136&crc=669
   • alimt**********?action=fbgen&v=136&crc=669
   • bigcoun**********?action=fbgen&v=136&crc=669
   • bizz**********?action=fbgen&v=136&crc=669
   • bmt**********?action=fbgen&v=136&crc=669
   • boxer**********?action=fbgen&v=136&crc=669
   • braitm**********?action=fbgen&v=136&crc=669
   • cedele**********?action=fbgen&v=136&crc=669
   • cfscons**********?action=fbgen&v=136&crc=669
   • christm**********?action=fbgen&v=136&crc=669
   • clarksh**********?action=fbgen&v=136&crc=669
   • counter.xtsd20**********?action=fbgen&v=136&crc=669
   • dancin**********?action=fbgen&v=136&crc=669
   • dip-a-d**********?action=fbgen&v=136&crc=669
   • djmu**********?action=fbgen&v=136&crc=669
   • draco-il**********?action=fbgen&v=136&crc=669
   • dreamch**********?action=fbgen&v=136&crc=669
   • ebesu**********?action=fbgen&v=136&crc=669
   • elect**********?action=fbgen&v=136&crc=669
   • emse**********?action=fbgen&v=136&crc=669
   • entertainme**********?action=fbgen&v=136&crc=669
   • eurobaustoff.marke**********?action=fbgen&v=136&crc=669
   • foods**********?action=fbgen&v=136&crc=669
   • frankne**********?action=fbgen&v=136&crc=669
   • godsho**********?action=fbgen&v=136&crc=669
   • gross**********?action=fbgen&v=136&crc=669
   • grupoc**********?action=fbgen&v=136&crc=669
   • hills**********?action=fbgen&v=136&crc=669
   • igles**********?action=fbgen&v=136&crc=669
   • indiana**********?action=fbgen&v=136&crc=669
   • infor**********?action=fbgen&v=136&crc=669
   • jugen**********?action=fbgen&v=136&crc=669
   • kerten**********?action=fbgen&v=136&crc=669
   • ledtlon**********?action=fbgen&v=136&crc=669
   • lene.aa**********?action=fbgen&v=136&crc=669
   • lifec**********?action=fbgen&v=136&crc=669
   • losek**********?action=fbgen&v=136&crc=669
   • mahjo**********?action=fbgen&v=136&crc=669
   • marios**********?action=fbgen&v=136&crc=669
   • mgmmdi**********?action=fbgen&v=136&crc=669
   • mswcon**********?action=fbgen&v=136&crc=669
   • my3boys.hittin**********?action=fbgen&v=136&crc=669
   • ottoma**********?action=fbgen&v=136&crc=669
   • pngse**********?action=fbgen&v=136&crc=669
   • polis**********?action=fbgen&v=136&crc=669
   • prostr**********?action=fbgen&v=136&crc=669
   • pvpont**********?action=fbgen&v=136&crc=669
   • raur**********?action=fbgen&v=136&crc=669
   • rdsch**********?action=fbgen&v=136&crc=669
   • rememberwhenohio.netf**********?action=fbgen&v=136&crc=669
   • renog**********?action=fbgen&v=136&crc=669
   • rentsa**********?action=fbgen&v=136&crc=669
   • s172760532.onl**********?action=fbgen&v=136&crc=669
   • s220405294.onlin**********?action=fbgen&v=136&crc=669
   • scambus**********?action=fbgen&v=136&crc=669
   • shann**********?action=fbgen&v=136&crc=669
   • silkroa**********?action=fbgen&v=136&crc=669
   • stellar**********?action=fbgen&v=136&crc=669
   • swimandscuba.netf**********?action=fbgen&v=136&crc=669
   • thecon**********?action=fbgen&v=136&crc=669
   • tommie**********?action=fbgen&v=136&crc=669
   • usedca**********?action=fbgen&v=136&crc=669
   • webster**********?action=fbgen&v=136&crc=669
   • welov**********?action=fbgen&v=136&crc=669
   • www.agap**********?action=fbgen&v=136&crc=669
   • www.aic**********?action=fbgen&v=136&crc=669
   • www.associaz**********?action=fbgen&v=136&crc=669
   • www.bastak**********?action=fbgen&v=136&crc=669
   • www.beauti**********?action=fbgen&v=136&crc=669
   • www.cayge**********?action=fbgen&v=136&crc=669
   • www.cheryl**********?action=fbgen&v=136&crc=669
   • www.edilt**********?action=fbgen&v=136&crc=669
   • www.heran**********?action=fbgen&v=136&crc=669
   • www.ilterrazzo**********?action=fbgen&v=136&crc=669
   • www.its-**********?action=fbgen&v=136&crc=669
   • www.limen**********?action=fbgen&v=136&crc=669
   • www.musi**********?action=fbgen&v=136&crc=669
   • www.oneonon**********?action=fbgen&v=136&crc=669
   • www.ricksmusi**********?action=fbgen&v=136&crc=669
   • www.sevenpi**********?action=fbgen&v=136&crc=669
   • www.suzann**********?action=fbgen&v=136&crc=669
   • www.tcab**********?action=fbgen&v=136&crc=669
   • www.vinfinit**********?action=fbgen&v=136&crc=669
   • xrysan**********?action=fbgen&v=136&crc=669
   • yanisl**********?action=fbgen&v=136&crc=669
   • yasary**********?action=fbgen&v=136&crc=669

这是通过用 PHP 脚本执行 HTTP POST 方法来完成的。

远程控制功能:
    • 下载文件

其他通过访问以下网站来检查 Internet 连接:
• www.google.com

설명 삽입자 Mihai Dilimot 2011년 4월 1일 금요일
설명 업데이트 Mihai Dilimot 2011년 4월 1일 금요일

뒤로 . . . .

내 계정