TR/PSW.Maran.B.2 - Trojan

In alte limbi

Scurta descriere

Descriere completa

Statistici

Nume:	TR/PSW.Maran.B.2
Descoperit pe data de:	14/09/2006
Tip:	Troian
ITW:	Nu
Numar infectii raportate:	Scazut
Potential de raspandire:	Scazut
Potential de distrugere:	Scazut spre mediu
Fisier static:	Da
Marime:	45.376 Bytes
MD5:	8d0A7f99f9fafbe2f0bee1e54177e7f5
Versiune VDF:	6.35.01.115
Versiune IVDF:	6.35.01.116

General Metoda de raspandire:
   • Nu are rutina proprie de raspandire

Alias:
   • F-Secure: Trojan-PSW.Win32.Maran.f
   • Bitdefender: Trojan.PWS.Maran.B

Sistem de operare:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Efecte secundare:
   • Creeaza fisiere
   • Creeaza un fisier malware
   • Modificari in registri

Fisiere Sterge copia initiala a virusului.

Sunt create fisierele:

– %SYSDIR%\mssbupx.dll Analiza ulterioara a relevat ca si acest fisier este malware. Detectat ca: TR/PSW.Maran.F

– %SYSDIR%\sporder.dll
– %SYSDIR%\delmeml.bat Fisierul batch este folosit pentru stergerea unui fisier.

Registrii sistemului Urmatoarele chei sunt adaugate in registrii sistemului:

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000001]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000002]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000003]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000004]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000005]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000006]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000007]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000008]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000009]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000010]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000011]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000012]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9\Catalog_Entries\000000000013]
   • "PackedCatalogItem"=%valori hex%

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9]
   • "Serial_Access_Num"=dword:00000006
   • "Next_Catalog_Entry_ID"=dword:000003f6

Urmatoarea cheie din registri este modificata:

– [HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\
   Protocol_Catalog9]
   Noua valoare:
   • "Num_Catalog_Entries"=dword:0000000d

– [HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL]
   Noua valoare:
   • "Start"=dword:00000003

Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: Delphi.

Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Pentru o descriere scurta click aici.

Descriere introdusa de Monica Ghitun la Thu, 14 Sep 2006 14:00 (GMT+1)
Descriere actualizata de Andrei Ivanes la Fri, 13 Oct 2006 10:39 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back