TR/Proxy.Cimuz.BG.1 - Trojan

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	TR/Proxy.Cimuz.BG.1
Descoperit pe data de:	19/10/2005
Tip:	Troian
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	39.281 Bytes
MD5:	F09B6F7DB845AF2C7B013D2E848DDDC2
Versiune VDF:	6.32.00.43

General Metoda de raspandire:
   • Nu are rutina proprie de raspandire

Alias:
   • Symantec: Trojan.Repsamo
   • Kaspersky: Trojan-Proxy.Win32.Cimuz.bg
   • TrendMicro: TROJ_REPSAMO.D
   • Bitdefender: Trojan.MZU

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Inchide aplicatiile de securitate
   • Descarca fisiere
   • Reduce setarile de securitate
   • Modificari in registri

Fisiere Se copiaza in urmatoarea locatie:
   • %SYSDIR%\mdms.exe

Sterge urmatoarele fisiere:
   • C:\ccccccccccccccccoemrciermicomeriocmeiormcioermo
   • C:\cc5y456 455 4 54cccccccoemrciermicomeriocmeiormcioermo
   • C:\zzzzzzzzzzzzzzzzzzzzzzz222

Poate afecta urmatoarele fisiere:
   • %PROGRAM FILES%\McAfee.com\Personal Firewall\MpfUi.Dll"
   • %PROGRAM FILES%\Kaspersky Lab\Kaspersky Anti-Hacker\perfiloc.dll"
   • %PROGRAM FILES%\Tiny Firewall Pro\SnortImp.dll"
   • %PROGRAM FILES%\McAfee.com\Personal Firewall\Localized.DLL"
   • %PROGRAM FILES%\Agnitum\Outpost Firewall\Engine.dll"
   • %PROGRAM FILES%\Norton Internet Security Professional\FRERules.dll"
   • %PROGRAM FILES%\Kerio\Personal Firewall 4\kfe.dll"
   • %PROGRAM FILES%\Zone Labs\ZoneAlarm\vsruledb.dll"

Este creat fisierul:

– %SYSDIR%\winacpi.dll Este folosit pentru a ascunde procesul de Task Manager. Detectat ca: TR/Drop.Agen.bd.A.1

– Adresele sunt urmatoarele:
   • http://ozonung.biz/**********/?%combinatie de caractere aleatoare%
   • http://votreenton.biz/**********/?%combinatie de caractere aleatoare%
   • http://troonety.biz/**********/?%combinatie de caractere aleatoare%
   • http://breenten.biz/**********/?%combinatie de caractere aleatoare%
   • http://zurrusco.com/**********/?%combinatie de caractere aleatoare%
   • http://freelife4ever.com/**********/?%combinatie de caractere aleatoare%
   • http://213.21.215.186/**********/?%combinatie de caractere aleatoare%
Fisierul este stocat pe hard disc la: %necunoscut% Acest fisier poate contine si alte locatii de descarcare si poate servi ca sursa de noi amenintari.

Registrii sistemului Urmatoarea cheie este adaugata in registri, in mod repetat, pentru a porni procesul dupa reboot.

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "SysMemory manager"="%SYSDIR%\mdms.exe"

Creeaza urmatoarea valoare, pentru a trece de Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%SYSDIR%\mdms.exe"="%SYSDIR%\mdms.exe:*:Enabled:mdm_sysag"

Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKCR\*\shellex\ContextMenuHandlers\sysacpildap]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCU\Software\mzs]
– [HKCU\Software\mzs\mdms]
– [HKCU\Software\mzs\mdms\mzu]
   • "cid"=%numar hexazecimal%
   • "newhost"=dword:00000001
   • "pt"=dword:%numar hexazecimal%
   • "fc"=dword:%numar hexazecimal%
   • "fu"="http://213.21.215.**********/zubox429/gotcha.php"
   • "fa"=dword:00000001

– [HKCR\acpi.acpi.1]
   • @="acpi Class"

– [HKCR\acpi.acpi.1\CLSID]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCR\acpi.ext]
   • @="acpi Class"

– [HKCR\acpi.ext\CLSID]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCR\acpi.ext\CurVer]
   • @="acpi.acpi.1"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}]
   • @="acpi"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32]
   • @="%SYSDIR%\winacpi.dll"
   • "ThreadingModel"="Apartment"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\ProgID]
   • @="acpi.1"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\Programmable]
– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\TypeLib]
   • @="{5E2121E1-0300-11D4-8D3B-444553540000}"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\
   VersionIndependentProgID]
   • @="acpi"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}]
– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0]
   • @="SimpleExt 1.0 Type Library"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\0]
– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\0\win32]
   • @="%SYSDIR%\winacpi.dll"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\FLAGS]
   • @="0"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\HELPDIR]
   • @="%SYSDIR%\"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}]
   • @="ISimpleShlExt"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\
   ProxyStubClsid]
   • @="{00020424-0000-0000-C000-000000000046}"
   •

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\
   ProxyStubClsid32]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\TypeLib]
   • @="{5E2121E1-0300-11D4-8D3B-444553540000}"
   • "Version"="1.0"

Terminarea proceselor Lista cu procesele oprite:
   • ehmas.exe; gcasServ.exe; gcasDtServ.exe; kpf4gui.exe; NPROTECT.EXE;
      MpfService.exe; outpost.exe; ZAPRO.EXE; amon.exe; kpf4ss.exe;
      firewall.exe; zonealarm.exe

Tehnologie Rootkit Este o tehnologie specifica malware. Acesta se ascunde de programele sistemului, de aplicatiile de securitate si in cele din urma, de utilizator.

Ascunde urmatoarele:
– Propriul proces

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Borland C++).

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit urmatorul program de arhivare:
• FSG

Pentru o descriere scurta click aici.

Descriere introdusa de Andrei Gherman la Mon, 24 Oct 2005 09:43 (GMT+1)
Descriere actualizata de Andrei Gherman la Fri, 28 Oct 2005 16:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back