Full description

病毒:	Worm/Rbot.137217
发现日期:	13/12/2012
类型:	蠕虫
广泛传播:	是
病毒传播个案呈报：	低程度
感染/传播能力：	中等程度
破坏 / 损害程度：	中等程度
静态文件:	是
文件大小:	137.217 字节
MD5 校检和:	fbf35a9858ac6c862022281f0Ab21483
VDF 版本:	7.11.53.216 - donderdag 13 december 2012
IVDF 版本:	7.11.53.216 - donderdag 13 december 2012

况概描述 传播方法:
   • 局域网络

别名:
   • Symantec: W32.Spybot.Worm
   • Kaspersky: Backdoor.Win32.Rbot.aju
   • TrendMicro: WORM_RBOT.AIJ
   • Sophos: W32/Rbot-AYM
   • Grisoft: IRC/BackDoor.SdBot
   • VirusBuster: Worm.Rbot.DCG
   • Eset: Win32/Rbot
   • Bitdefender: Backdoor.RBot.BYV

平台/操作系统:
   • Windows 95
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

副作用:
   • 使用自置的电子邮件引擎
   • 记录按键
   • 注册表修改
   • 利用软件漏洞
   • 窃取信息
   • 第三方控件

文件它将本身复制到以下位置:
• %SYSDIR%\%七位数的随机字符串%.exe

它会删除其本身最初执行的副本。

注册表会添加以下注册表项，以便在系统重新引导后运行进程:

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
   • "GlobalSCAPE"="%七位数的随机字符串%.exe"

– HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
   • "GlobalSCAPE"="%七位数的随机字符串%.exe"

会添加以下注册表项目注册值:

– HKCU\Software\Microsoft\OLE
   • "GlobalSCAPE"="%七位数的随机字符串%.exe"

网络感染该恶意软件会尝试以下方式连接其他计算机来作广泛传播／感染。

它会将其本身的副本植入以下网络共享中:
   • IPC$
   • C$
   • C$\windows\system32
   • c$\winnt\system32
   • ADMIN$\system32\
   • ADMIN$

它使用以下登录信息来访问远程计算机:

–缓存用户名和密码。

– 以下用户名列表:
   • Ackerman; Adams; Addison; Adelstein; Adibe; Adorno; Ahlers; Alavi;
      Alcorn; Alda; Aleks; Allison; Alongi; Altavilla; Altenberger;
      Altenhofen; Amaral; Amatangelo; Ameer; Amsden; Anand; Andel; Ando;
      Andrelus; Andron; Anfinrud; Ansley; Anthony; Antos; Arbia; Arduini;
      Arellano; Aristotle; Arjas; Arky; Atkins; Augustus; Aurelius; Axelrod;
      Axworthy; Ayiemba; Aykroyd; Ayling; Azima; Bachmuth; Backus; Bady;
      Baglivo; Bagnold; Bailar; Bakanowsky; Baleja; Ballatori; Ballew;
      Baltz; Banta; Barabesi; Barajas; Baranczak; Baranowska; Barberi;
      Barbetti; Barneson; Barnett; Barriola; Barry; Bartholomew; Bartolome;
      Bartoo; Basavappa; Bashevis; Batchelder; Baumiller; Bayles; Bayo;
      Beacon; Beal; Bean; Beckman; Beder; Bedford; Behenna; Belanger;
      Belaoussof; Belfer; Belin-Collart; Bellavance; Bellhouse; Bellini;
      Belloc; Benedict-Dye; Bergson; Berke-Jenkins; Bernardo; Bernassola;
      Bernston; Berrizbeitia; Betti; Beynart; Biagioli; Bickel; Binion; Bir;
      Bisema; Bisho; Blackbourn; Blackwell; Blagg; Blakemore; Blanke; Bliss;
      Blizard; Bloch; Bloembergen; Bloemhof; Bloxham; Blyth; Bolger; Bolick;
      Bollinger; Bologna; Boner; Bonham; Boniface; Bontempo; Book;
      Bookbinder; Boone; Boorstin; Borack; Borden; Bossi; Bothman; Botosh;
      Boudin; Boudrot; Bourneuf; Bowers; Boxer; Boyajian; Boyes; Boyland;
      Boym; Boyne; Bracalente; Bradac; Bradach; Brecht; Breed; Brenan;
      Brennan; Brewer; Brewer; Bridgeman; Bridges; Brinton; Britz; Broca;
      Brook; Brzycki; Buchan; Budding; Bullard; Bunton; Burden; Burdzy;
      Burke; Burridge; Busetta; Byatt; Byerly; Byrd; Cage; Calnan; Cammelli;
      Cammilleri; Canley; Capanni; Caperton; Capocaccia; Capodilupo;
      Cappuccio; Capursi; Caratozzolo; Carayannopoulos; Carlin; Carlos;
      Carlyle; Carmichael; Caroti; Carper; Cartmill; Cascio; Case; Caspar;
      Castelda; Cavanagh; Cavell; Ceniceros; Cerioli; Chapman; Charles;
      Cheang; Cherry; Chervinsky; Chiassino; Chien; Childress; Childs;
      Chinipardaz; Chinman; Christenson; Christian; Christiano; Christie;
      Christopher; Chu; Chupasko; Church; Ciampaglia; Cicero; Cifarelli;
      Claffey; Clancy; Clark; Clement; Clifton; Clow; Coblenz; Coito;
      Coldren; Colella; Collard; Collis; Compton; Compton; Comstock;
      Concino; Condodina; Connors; Corey; Cornish; Cosmides; Counter;
      Coutaux; Crawford; Crocker; Croshaw; Croxen; Croxton; Cui; Currier;
      Cutler; Cvek; Cyders; daSilva; Daldalian; Daly; D'Ambra; Danieli;
      Dante; Dapice; D'arcangelo; Das; Dasgupta; Daskalu; David; Dawkins;
      DeGennaro; DeLaPena; del'Enclos; deRousse; Debroff; Dees; Defeciani;
      Delattre; Deleon-Rendon; Delger; Dell'acqua; Deming; Dempster; Demusz;
      Denault; Denham; Denison; Desombre; Deutsch; D'fini; Dicks;
      Diefenbach; Difabio; Difronzo; Dilworth; Dionysius; Dirksen; Dockery;
      Doherty; Donahue; Donner; Doonan; Dore; Dorf; Dosi; Doty; Doug;
      Dowsland; Drinker; D'souza; Duffin; Durrett; Dussault; Dwyer; Eardley;
      Ebeling; Eckel; Edley; Edner; Edward; Eickenhorst; Eliasson;
      Elmendorf; Elmerick; Elvis; Encinas; Enyeart; Eppling; Erbach; Erdman;
      Erdos; Erez; Espinoza; Estes; Etter; Euripides; Everett; Fabbris;
      Fagan; Faioes; Falco-Acosta; Falorsi; Faris; Farone; Farren; Fasso';
      Fates; Feigenbaum; Fejzo; Feldman; Fernald; Fernandes; Ferrante;
      Ferriell; Feuer; Fido; Field; Fink; Finkelstein; Finnegan; Fiorina;
      Fisk; Fitzmaurice; Flier; Flores; Folks; Forester; Fortes; Fortier;
      Fossey; Fossi; Francisco; Franklin-Kenea; Franz; Frazier-Davis; Freid;
      Freundlich; Fried; Friedland; Frisken; Frowiss; Fryberger; Frye;
      Fujii-Abe; Fuller; Furth; Fusaro; Gabrielli; Gaggiotti; Galeotti;
      Galwey; Gambini; Garfield; Garman; Garonna; Geller; Gemberling;
      Georgi; Gerrett; Ghorai; Gibbens; Gibson; Gilbert; Gili; Gill;
      Gillispie; Gist; Gleason; Glegg; Glendon; Goldfarb; Goncalves; Good;
      Goodearl; Goody; Gozzi; Gravell; Greenberg; Greenfeld; Griffiths;
      Grigoletto; Grummell; Gruner; Gruppe; Guenthart; Gunn; Guo; Haar;
      Hackman; Hackshaw; Haley; Halkias; Hallowell; Halpert; Hambarzumjan;
      Hamer; Hammerness; Hand; Hanssen; Harding; Hargraves; Harlow;
      Harrigan; Hartman; Hartmann; Hartnett; Harwell; Haviaras; Hawkes;
      Hayes; Haynes; Hazlewood; Heermans; Heft; Heiland; Hellman; Hellmiss;
      Helprin; Hemphill; Henery; Henrichs; Hernandez; Herrera; Hester;
      Heubert; Heyeck; Himmelfarb; Hind; Hirst; Hitchcock; Hoang; Hock;
      Hoffer; Hoffman; Hokanson; Hokoda; Holmes; Holoien; Holter; Holway;
      Holzman; Hooker; Hopkins; Horsley; Hoshida; Hostage; Hottle; Howard;
      Hoy; Huey; Huidekoper; Hungerford; Huntington; Hupp; Hurtubise;
      Hutchings; Hyde; Iaquinta; Ichikawa; Igarashi; Inamura; Inniss; Isaac;
      Isaievych; Isbill; Isserman; Iyer; Jacenko; Jackson; Jagers; Jagger;
      Jagoe; Jain; Jamil; Janjigian; Jarnagin; Jarrell; Jay; Jeffers;
      Jellis; Jenkins; Jespersen; Jewett; Johannesson; Johannsen; Johns;
      Jolly; Jorgensen; Jucks; Juliano; Julious; Kabbash; Kaboolian;
      Kafadar; Kalbfleisch; Kaligian; Kalil; Kalinowski; Kalman; Kamel;
      Kangis; Karpouzes; Kassower; Kasten; Kawachi; Kee; Keenan; Keepper;
      Keith; Kelker; Kelsey; Kempton; Kemsley; Kendall; Kerry; Keul; Khong;
      Kimmel; Kimmett; Kimura; Kindall; Kinsley; Kippenberger; Kirscht;
      Kittridge; Kleckner; Kleiman; Kleinfelder; Klemperer; Kling;
      Klinkenborg; Klint; Knuff; Kobrick; Koch; Kohn; Koivumaki; Kommer;
      Koniaris; Konrad; Kool; Korzybski; Kotter; Kovaks; Kraemer; Krailo;
      Krasney; Kraus; Kroemer; Krysiak; Kuenzli; Kumar; Kusman; Kuwabara;
      Labunka; Lafler; Laing; Lallemant; Landes; Lankes; Lantieri; Lanzit;
      Laserna; Lashley; Lawless; Lecar; Lecce; Leclercq; Leite; Lenard;
      l'Enclos; Lesser; Lessi; Liakos; Lidano; Liem; Light; Lightfoot; Lim;
      Linares; Linda; Linder; Line; Linehan; Linzee; Lippmann; Lipponen;
      Little; Litvak; Livernash; Livi; Livolsi; Lizardo; Locatelli;
      Longworth; Loss; Loveman; Lowenstein; Loza; Lubin; Lucas; Luciano;
      Luczkow; Luecke; Lunetta; Luoma; Lussier; Lutcavage; Luzader;
      Maccormac; Macdonald; Maceachern; Macintyre; Mackenney; MacMillan;
      Macy; Madigan; Maggio; Mahony; Maier; Maine-Hershey; Maisano;
      Malatesta; Maller; Malova; Manalis; Mandel; Manganiello; Mantovan;
      March; Marchbanks; Marcus; Margalit; Margetts; Marques; Martinez;
      Martochio; Marton; Marubini; Mass; Matalka; Matarazzo; Matsukata;
      Mattson; Mauzy; May; Mazzali; Mazziotta; Mcbride; Mccaffery; Mccall;
      Mcclearn; Mcdowell; Mcelroy; McFadden; Mcghee; Mcgoldrick; McIlroy;
      Mcintosh; Mckenna; Mclane; Mclaren; Mcnealy; Mcnulty; Meccariello;
      Memisoglu; Menzies; Merikoski; Merlani; Merminod; Merseth; Merz;
      Metelka; Metropolis; Meurer; Michelman; Middle; Mieher; Mills; Minh;
      Mini; Minichiello; Gonzalez; Mitropoulos; Mittal; Mocroft; Modestino;
      Moeller; Mohr; Moiamedi; Monque; Montilio; MooreDeCh.; Morani;
      Moreton; Morrison; Morrow; Mortimer; Mosher; Mosler; Mostafavi;
      Motooka; Mudarri; Muello; Mugnai; Mulkern; Mulroy; Mumford; Mussachio;
      Naddeo; Napolitano; Nardi; Nardone; Naviaux; Nayduch; Nelson; Nenna;
      Nesci; Neuman; Newfeld; Newlin; Nickerson; Nickoloff; Nisenson;
      Nitabach; Notman; Nuzum; Ocougne; Ogata; O'hagan; Oldford; Olsen;
      Olson; Olszewski; O'malley; Oman; O'meara; Opel; Oray; Orfield; Orsi;
      Ospina; Ostrowski; Ottaviani; Otten; Ouchida; Ovid; PaesDealmeida;
      Paine; Palayoor; Palepu; Pallara; Palmitesta; Panadero; Panizzon;
      Pantilla; Paoletti; Parmeggiani; Parris; Partridge; Pascucci;
      Patefield; Patrick; Pattullo; Pavetti; Pavlon; Pawloski; Paynter;
      Peabody; Pearlberg; Pederson; Peishel; Penny; Pereira; Perko; Perlak;
      Perlman; Perna; Perone; Perrimon; Peters; Petruzello; Pettibone;
      Pettit; Pfister; Pilbeam; Pinot; Plancon; Plant; Plasket; Plous;
      Pocobene; Poincaire; Pointer; Poirier; Polak; Polanyi; Politis; Poma;
      Poolman; Powers; Presper; Preucel; Prevost; Pritchard; Pritz;
      Proietti; Prothrow-Stith; Puccia; Pugh; Pynchon; Quaday; Quetin; Rabe;
      Rabkin; Radeke; Rajagopalan; Raney; Rangan; Rankin; Rapple; Rayport;
      Redden-Tyler; Reedquist; Cunningham; Reinold; Remak; Renick; Repetto;
      Resnik; Rhea; Richmond; Rielly; Rindos; Rineer; Rish; Rivera;
      Robinson; Rocha; Roesler; Rogers; Ronen; Row; Royal; Ruan; Ruderman;
      Ruescher; Rush; Ryu; Sabatello; Sadler; Safire; Sahu; Sali; Samson;
      Sanchez-Ramirez; Sanna; Sapers; Sarin; Sartore; Sase; Satin; Satta;
      Satterthwaite; Sawtell; Sayied; Scarponi; Scepan; Scharf; Scharlemann;
      Scheiner; Schiano; Schifini; Schilling; Schmitt; Schossberger;
      Schuman; Schutte; Schuyler; Schwan; Schwickrath; Scovel; Scudder;
      Seaton; Seeber; Segal; Sekler; Selvage; Sen; Sennett; Seterdahl;
      Sexton; Seyfert; Shaikh; Shakis; Shankland; Shanley; Shar; Shatrov;
      Shavelson; Shea; Sheats; Shepherd; Sheppard; Shepstone; Shesko; Shia;
      Shibata; Shimon; Siesto; Sigalot; Sigini; Signa; Silverman; Silvetti;
      Sinsabaugh; Sirilli; Sites; Skane; Skerry; Skoda; Sloan; Slowe;
      Smilow; Sniffen; Snodgrass; Socolow; Solon; Somers; Sommariva;
      Sorabella; Sorg; Sottak; Soukup; Soule; Soultanian; Spanier; Sparrow;
      Spaulding; Speizer; Spence; Sperber; Spicer; Spiegelhalter; Spiliotis;
      Spinrad; StMartin; Stalvey; Stam; Stang; Stassinopolus; States;
      Statlender; Stefani; Steiner; Stephanian; Stepniewska; Stewart-Oaten;
      Stiepock; Stillwell; Stock; Stockton; Stockwell; Stolzenberg; Stonich;
      Storer; Stott; Strange; Strauch; Streiff; Stringer; Sullivan; Sumner;
      Suo; Surdam; Sweeting; Sweetser; Swindle; Tagiuri; Tai; Talaugon;
      Tambiah; Tandler; Tanowitz; Tatar; Taveras; Tawn; Tcherepnin; Teague;
      Temes; Temmer; Tenney; Terracini; Than; Thavaneswaran; Theodos;
      Thibault; Thisted; Thomsen; Throop; Tierney; Till; Timmons; Tofallis;
      Tollestrup; Tolls; Tolman; Tomford; Toomer; Topulos; Torresi; Torske;
      Towler; Toye; Traebert; Trenga; Trewin; Tringali; Troiani; Troy;
      Truss; Tsiatis; Tsomides; Tsukurov; Tuck; Tudge; Tukan; Turano; Turek;
      Tuttle; Twells; Tzamarias; Ullman; Untermeyer; Upsdell; Urban;
      Urdang-Brown; Usdan; Uzuner; Vacca; Waite; Valberg; Valencia; Wales;
      Wallenberg; Walter; vanAllen; VanZwet; Vandenberg; Vanheeckeren;
      Warshafsky; Wasowska; Vasquez; Waugh; Weighart; Weingarten; Weinhaus;
      Weissbourd; Weissman; Velasquez; Welles; Welsh; Wengret; Venne;
      Verghese; Wescott; Wetzel; Whately; Whilton; White; Whitla; Whittaker;
      Viana; Viano; Wiedersheim; Wiener; Viens; Vignola; Wilder; Wilhelm;
      Wilk; Wilkin; Wilkinson; Villarreal; Willstatter; Wilson; Vitali;
      Viviani; Voigt; Wolk; VonHoffman; Woo; Wooden; Woods; Woods-Powell;
      Vorhaus; Votey; Yacono; Yamane; Yankee; Yarchuk; Yates; Ybarra;
      Yedidia; Yesson; Yetiv; Yoffe; Yoo; Youk-See; Zachary; Zahedi;
      Zangwill; Zegans; Zerbini; Zoldak; Zucconi; Zurn; Zwiers; Zytowski

– 以下密码列表:
   • 111; 123; 222; 321; 333; 333; 444; 888; 1234; 2003; 2004; 2005; 2600;
      4321; 4444; 12345; 54321; 123456; 654321; 1234567; 7654321; 7777777;
      12345678; 87654321; 88888888; 123456789; 987654321; 1234567890;
      2005xp; 2005XP; aaa; aaaa; abc; abc123; abcd; access; accounting;
      accounts; acer; Acer; ACER; adm; ADM; admin; admin; Admin; ADMIN;
      admin1; admin12; admin123; administrador; administrador;
      Administrador; ADMINISTRADOR; administrat; administrat; Administrat;
      ADMINISTRAT; administrateur; administrateur; Administrateur;
      ADMINISTRATEUR; administrator; administrator; Administrator;
      ADMINISTRATOR; admins; admins; Admins; ADMINS; alex; asd; asus; ASUS;
      backup; benq; benq; Benq; BENQ; bill; bitch; blank; bob; bob; brian;
      change; change; changeme; chris; cigar; cigar; Cigar; CIGAR; cisco;
      compaq; computer; control; creative; Creative; CREATIVE; data;
      database; database; databasepass; databasepassword; db1; db1234; db2;
      db2; dba; dbpass; dbpassword; default; default; dell; demo; domain;
      domainpass; domainpassword; eric; exchange; fred; fuck; Fuckyou;
      george; god; guest; guest; HANKOOK; hell; hello; home; homeuser; ian;
      ibm; IBM; ibm; icc; icc; internet; internet; intranet; java; jen; joe;
      john; kate; katie; lan; lee; linux; login; loginpass; luke; mail;
      main; mary; mike; neil; nissan; nissan; Nissan; NISSAN; nokia; none;
      null; oainstall; oem; oeminstall; oemuser; office; oracle; oracle;
      orainstall; orang; ORANG; outlook; owner; pass; pass1234; passwd;
      password; password1; pervert; peter; peter; private; pwd; qaz; qwe;
      qwerty; root; root; sam; samsung; Samsung; SAMSUNG; server; server;
      service; sex; siemens; slut; sony; sony; Sony; SONY; sql; sqlpass;
      staff; staff; student; student; sue; susan; system; teacher; teacher;
      technical; test; toshba; TOSHBA; toyota; toyota; Toyota; TOYOTA; unix;
      user; user; web; win2000; WIN2005; windows; winpass; winxp; WINXP;
      www; wwwadmin; xp2005; XP2005; xxx; zhou; zxc

漏洞攻击:
它会利用以下漏洞攻击:
– MS01-059 (通用即插即用中未经检查的缓冲区)
– MS02-018 (Internet 信息服务的修补程序)
– MS02-061 (SQL Server Web 中的权限提升)
– MS03-007 (Windows 组件中未经检查的缓冲区)
– MS03-026 (RPC 接口中的缓冲区溢出)
– MS03-039 (RPCSS 服务中的缓冲区溢出)
– MS03-049 (工作站服务中的缓冲区溢出)
– MS04-007 (ASN.1 漏洞)
– MS04-011 (LSASS 漏洞)
– VX05-006 (在使用 VERITAS Backup Exec Admin Plus Pack 选项时远程堆溢出)
– Bagle 后门 (端口 2745)
– Kuang 后门 (端口 17300)
– Mydoom 后门 (端口 3127)
– NetDevil 后门 (端口 903)
– Optix 后门 (端口 3140)
– SubSeven 后门 (端口 27347)
– DameWare 远程管理 (端口 6129)

IP 地址生成:
它会创建随机 IP 地址，但会保留自己地址的前两个八位位组。之后，它会尝试与所创建的地址建立连接。

感染进程:
在受影响的计算机上创建 TFTP 或 FTP 脚本，以便将恶意软件下载到远程位置。

远程执行:
–它会尝试在刚感染的计算机上安排远程执行恶意软件。因此，它会使用NetScheduleJobAdd 功能。

IRC 为了提供系统信息和远程控制，它会连接到以下 IRC 服务器:

服务器: normal.ser**********
端口: 7000
通道: #c
昵称: ER-%随机字符串%
密码: cpass.

– 此恶意软件能够搜集并发送类似如下信息:
    • 缓存密码
    • 截取屏幕图像
    • 从网络摄像机截取快照
    • 搜集的电子邮件地址
    • CPU 速度
    • 当前用户
    • 有关驱动程序的详细信息
    • 可用磁盘空间
    • 可用内存
    • 恶意软件运行时间
    • 有关网络的信息
    • 平台 ID
    • 运行中进程的信息
    • 内存大小
    • 系统目录
    • 用户名
    • 视窗目录
    • Windows 操作系统信息

– 而且，它能够进行此般操作:
    • 启动 DDoS ICMP 洪水攻击
    • 启动 DDoS SYN 洪水攻击
    • 启动 DDoS TCP 洪水攻击
    • 启动 DDoS UDP 洪水攻击
    • 关闭 DCOM
    • 关闭网络文件共享
    • 与 IRC 服务器断开连接
    • 下载文件
    • 编辑注册表
    • 启用 DCOM
    • 启用网络共享
    • 执行文件
    • 加入 IRC 通道
    • 结束进程
    • 离开 IRC 通道
    • 打开远程 Shell
    • 执行 DDoS 攻击
    • 执行网络扫描
    • 执行端口重定向
    • 注册服务
    • 重新引导系统
    • 发送电子邮件
    • 关闭系统
    • 开始记录按键
    • 启动传播例程
    • 终止进程
    • 自行更新
    • 上传文件
    • 访问网站

窃取它会尝试窃取以下信息:
– Windows 产品 ID

– 以下 CD 密钥:
   • Battlefield 1942; Battlefield 1942 (Road To Rome); Battlefield 1942
      (Secret Weapons of WWII); Battlefield Vietnam; Black and White;
      Command & Conquer Generals; Command and Conquer: Generals (Zero Hour);
      Command and Conquer: Red Alert 2; Command and Conquer: Tiberian Sun;
      Counter-Strike (Retail); Chrome; FIFA 2002; FIFA 2003; Freedom Force;
      Global Operations; Gunman Chronicles; Half-Life; Hidden & Dangerous 2;
      IGI 2: Covert Strike; Industry Giant 2; James Bond 007: Nightfire;
      Legends of Might and Magic; Medal of Honor: Allied Assault; Medal of
      Honor: Allied Assault: Breakthrough; Medal of Honor: Allied Assault:
      Spearhead; Nascar Racing 2002; Nascar Racing 2003; Need For Speed Hot
      Pursuit 2; Need For Speed: Underground; Neverwinter Nights;
      Neverwinter Nights (Hordes of the Underdark); Neverwinter Nights
      (Shadows of Undrentide); NHL 2003; NHL 2002; NOX; Rainbow Six III
      RavenShield; Shogun: Total War: Warlord Edition; Soldier of Fortune II
      - Double Helix; Soldiers Of Anarchy; The Gladiators; Unreal Tournament
      2003; Unreal Tournament 2004

– 它会使用网络嗅探器来检查以下字符串:
   • :.login; :,login; :!login; :@login; :$login; :%login; :^login;
      :*login; :-login; :+login; :/login; :\login; :=login; :?login;
      :'login; :`login; :~login; : login; :.auth; :,auth; :!auth; :@auth;
      :$auth; :%auth; :^auth; :&auth; :*auth; :-auth; :+auth; :/auth;
      :\auth; :=auth; :?auth; :'auth; :`auth; :~auth; : auth; :.id; :,id;
      :!id; :@id; :$id; :%id; :^id; :&id; :*id; :-id; :+id; :/id; :\id;
      :=id; :?id; :'id; :`id; :~id; : id; :.hashin; :!hashin; :$hashin;
      :%hashin; :.secure; :!secure; :.l; :!l; :$l; :%l; :.x; :!x; :$x; :%x;
      :.syn; :!syn; :$syn; :%syn
    • 按键

其他它会创建以下 Mutex:
• a3co1o

文件详细信息 编程语言:
该恶意软件程序是用 MS Visual C++ 编写的。

运行时压缩程序:
为了提高检测难度以及减小文件，它已使用以下运行时压缩程序进行压缩:
• UPX

Description inserted by Irina Boldea on dinsdag 26 september 2006
Description updated by Irina Boldea on dinsdag 26 september 2006

Terug . . . .

Mijn Account