飘云阁

 找回密码
 加入我们

QQ登录

只需一步,快速开始

查看: 8548|回复: 15

[公告] 通告,ID:王艺龙 在周易软件中添加后门 BanID处理!!

[复制链接]
  • TA的每日心情
    难过
    2024-3-10 19:49
  • 签到天数: 473 天

    [LV.9]以坛为家II

    发表于 2016-9-18 11:05:08 | 显示全部楼层 |阅读模式
    通告,ID:王艺龙 在周易软件中添加后门 BanID处理!

    大家下载过此人软件的都自行查杀下!!   底下有分析简记!!

    警告各位马贩子,悬崖勒马!!这里不是你们撒野之处!!











    文件名称:
    東方占卦.exe
    MD5:4653f66c406d93df4da2a3050db8a70e
    文件类型:exe
    出品公司:N/A
    版本:N/A
    壳或编译器信息:PACKER:UPolyX v0.5
    报毒名称:Virus.Win32.Ramnit.c
    子文件信息:
    東方占卦.exedumpFile /  2f41a4b245b950b4d8bcdc71aa555d97 /  EXE
    東方占卦.exe /  2f41a4b245b950b4d8bcdc71aa555d97 /  EXE





    关键行为:修改系统文件,添加注册表启动,遍历进程。有搜狗输入法的直接调用输入法截图功能。

    通过IE进程,自动下载。


    联网打开网址

    InternetOpenUrlA: http://**.133.40.**:128/wpad.dat, hInternet = 0x00cc0004, Flags = 0x80000010

    下载文件
            
    URLDownloadToFileW: http://ww****om/favicon.ico ---> C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
    URLDownloadToFileW: https://go****om/fwlink/?LinkId=141260 ---> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Kno4F.tmp

    连接指定站点
            
    InternetConnectA: ServerName = **.133.40.**, PORT = 128, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x80000010
    InternetConnectA: ServerName = ww****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000
    InternetConnectA: ServerName = go****om, PORT = 443, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00800000

    打开HTTP连接
            
    InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0), hSession = 0x00cc0004
    InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004

    建立到一个指定的套接字连接

    URL: fg****om, IP: **.133.40.**:443, SOCKET = 0x000000ac
    URL: go****om, IP: **.133.40.**:80, SOCKET = 0x000000b4
    URL: wpad, IP: **.133.40.**:128, SOCKET = 0x00000224
    URL: ww****om, IP: **.133.40.**:80, SOCKET = 0x000004ec
    URL: go****om, IP: **.133.40.**:443, SOCKET = 0x0000051c

    读取网络文件

    hFile = 0x00cc000c, BytesToRead =4010, BytesRead = 4010.

    发送HTTP包
            
    GET /wpad.dat HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0) Host: **.133.40.**:128 Cache-Control: no-cache
    GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Host: ww****om Connection: Keep-Alive

    打开HTTP请求
            
    HttpOpenRequestA: **.133.40.**:128/wpad.dat, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x80000010
    HttpOpenRequestA: ww****om:80/favicon.ico, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00600010
    HttpOpenRequestA: go****om:443/fwlink/?linkid=141260, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00c00010

    按名称获取主机地址

    gethostbyname: fg****om
    gethostbyname: go****om
    GetAddrInfoW: computer
    GetAddrInfoW: wpad
    GetAddrInfoW: ww****om
    GetAddrInfoW: go****om

    创建文件

    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe
    C:\Program Files\Microsoft\px4C.tmp
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe
    C:\Program Files\Microsoft\DesktopLayer.exe
    C:\Program Files\Microsoft\px4D.tmp
    C:\Program Files\Microsoft\DesktopLayerSrv.exe
    C:\Program Files\Microsoft\px4E.tmp
    C:\Program Files\Internet Explorer\dmlconf.dat
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{14DA2CC2-7D48-11E6-91BE-7B****28}.dat
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2D34.tmp
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\wpad[1].dat
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\{14DA2CC3-7D48-11E6-91BE-7B****28}.dat
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF502A.tmp
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\dnserrordiagoff[1]

    修改原系统的EXE文件
            
    C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll

    创建可执行文件
            
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe
    C:\Program Files\Microsoft\DesktopLayer.exe
    C:\Program Files\Microsoft\DesktopLayerSrv.exe
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
    C:\Documents and Settings\Administrator\Local Settings\Temp\Kno4F.tmp

    覆盖已有文件
            
    C:\Program Files\Microsoft\px4C.tmp
    C:\Program Files\Microsoft\px4D.tmp
    C:\Program Files\Microsoft\px4E.tmp
    C:\Program Files\Internet Explorer\dmlconf.dat
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\dnserrordiagoff[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\ErrorPageTemplate[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\httpErrorPagesScripts[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\noConnect[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[2]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\background_gradient[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\down[2]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\favcenter[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\tools[2]
    C:\Documents and Settings\Administrator\Local Settings\Temp\Kno4F.tmp

    复制文件
            
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe ---> C:\Program Files\Microsoft\DesktopLayer.exe
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe ---> C:\Program Files\Microsoft\DesktopLayer.exe
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe ---> C:\Program Files\Microsoft\DesktopLayer.exe

    内存映射方式修改可执行文件
            
    C:\Documents and Settings\Administrator\Application Data\SogouExplorer\Extension\com.sogou.snapTaker\0.4.2\npprintscreen.dll

    删除文件
            
    C:\Program Files\Microsoft\px4C.tmp
    C:\Program Files\Microsoft\px4D.tmp
    C:\Program Files\Microsoft\px4E.tmp
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2D34.tmp
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6P4O8QNJ\wpad[1].dat
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF502A.tmp
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\dnserrordiagoff[2]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\ErrorPageTemplate[2]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\errorPageStrings[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\httpErrorPagesScripts[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\noConnect[3]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\bullet[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\background_gradient[2]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\down[1]
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\favcenter[3]

    查找文件
            
    FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
    FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
    FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe
    FileName = C:\Program Files\Internet Explorer\IEXPLORE.EXE
    FileName = C:\Program Files\Internet Explorer\iexplore.exe
    FileName = C:\*.*
    FileName = C:\222c25ed\*.*
    FileName = C:\222c25ed\IE8-Setup-Full\*.*
    FileName = C:\222c25ed\IE8-Setup-Full\log\*.*
    FileName = C:\AnalyzeControl\*.*
    FileName = C:\DiskD\*.*
    FileName = C:\DiskX\*.*
    FileName = C:\DiskX\RECYCLER\*.*
    FileName = C:\Documents and Settings\*.*
    FileName = C:\Documents and Settings\Administrator\*.*

    设置特殊文件夹属性
            
    C:\DiskX\RECYCLER
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
    C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
    C:\Documents and Settings\Administrator\Local Settings\History
    C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
    C:\Documents and Settings\Administrator\Cookies
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache

    修改文件内容
            
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe ---> Offset = 0
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe ---> Offset = 0
    C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe ---> Offset = 0
    C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 0
    C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 65536
    C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 131072
    C:\Program Files\Microsoft\DesktopLayer.exe ---> Offset = 4096
    C:\Program Files\Microsoft\DesktopLayerSrv.exe ---> Offset = 0
    C:\Program Files\Internet Explorer\dmlconf.dat ---> Offset = 0
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{14DA2CC2-7D48-11E6-91BE-7B****28}.dat ---> Offset = 512
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{14DA2CC2-7D48-11E6-91BE-7B****28}.dat ---> Offset = 0
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2D34.tmp ---> Offset = 16383
    C:\Documents and Settings\Administrator\Local Settings\Temp\~DF2D34.tmp ---> Offset = 12288
    C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{14DA2CC2-7D48-11E6-91BE-7B****28}.dat ---> Offset = 3072

    创建进程

    ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    ImagePath = C:\Program Files\Internet Explorer\iexplore.exe, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:79873

    创建新文件进程
            
    ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦Srv.exe"
    ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrv.exe"
    ImagePath = C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe, CmdLine = "C:\Documents and Settings\Administrator\Local Settings\%temp%\****.exe_7zdump\東方占卦SrvSrvSrv.exe"
    ImagePath = C:\Program Files\Microsoft\DesktopLayer.exe, CmdLine = "C:\Program Files\Microsoft\DesktopLayer.exe"
    ImagePath = C:\Program Files\Microsoft\DesktopLayerSrv.exe, CmdLine = "C:\Program Files\Microsoft\DesktopLayerSrv.exe"

    创建本地线程
            
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2056, StartAddress = 20047ACA, Parameter = 00050034
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2060, StartAddress = 20047626, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2064, StartAddress = 2004781F, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2068, StartAddress = 2004790C, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2072, StartAddress = 20046EA8, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 2044, ProcessID = 1796, ThreadID = 2076, StartAddress = 20046EC2, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2160, StartAddress = 77DC845A, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2164, StartAddress = 7C947EBB, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2168, StartAddress = 7C930230, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2172, StartAddress = 7C949B6F, Parameter = 00000000
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2176, StartAddress = 77E56C7D, Parameter = 00196038
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2180, StartAddress = 5DE05ABD, Parameter = 00197F50
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2184, StartAddress = 5DE05BC0, Parameter = 001938A8
    TargetProcess: iexplore.exe, InheritedFromPID = 1960, ProcessID = 2152, ThreadID = 2188, StartAddress = 0122F74F, Parameter = 00000208


    作者留名:邱波 四川成都 QQ:421804914

    本帖子中包含更多资源

    您需要 登录 才可以下载或查看,没有账号?加入我们

    x

    评分

    参与人数 8威望 +44 飘云币 +20 收起 理由
    cfc1680 + 8 赞一个!
    katkat + 4 + 4 对于马贩子,绝不姑息!!
    一路吧 + 4 对于马贩子,绝不姑息!!
    我爱云阁 + 4 没有说的 就是支持
    晨小 + 4 赞一个!
    wgz001 + 8 + 8 对于马贩子,绝不姑息!!
    rNKsT61v + 8 + 8 对于马贩子,绝不姑息!!
    ZMZwise + 4 对于马贩子,绝不姑息!!

    查看全部评分

    PYG19周年生日快乐!
  • TA的每日心情
    开心
    2016-6-16 14:07
  • 签到天数: 10 天

    [LV.3]偶尔看看II

    发表于 2016-9-18 11:10:45 | 显示全部楼层
    支持版主工作,对于马贩子,绝不姑息!!
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    开心
    2019-3-25 15:21
  • 签到天数: 487 天

    [LV.9]以坛为家II

    发表于 2016-9-18 11:18:50 | 显示全部楼层
    对于马贩子,绝不姑息!! 支持胡总
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    开心
    2019-3-17 22:44
  • 签到天数: 132 天

    [LV.7]常住居民III

    发表于 2016-9-18 11:38:18 | 显示全部楼层
    楼主,好样的
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情

    昨天 10:25
  • 签到天数: 944 天

    [LV.10]以坛为家III

    发表于 2016-9-18 11:44:49 | 显示全部楼层
    严厉打击这些害虫
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    开心
    2023-11-25 12:12
  • 签到天数: 846 天

    [LV.10]以坛为家III

    发表于 2016-9-19 08:03:50 | 显示全部楼层
    对于放马的应该加大力度整治,直接封
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情

    3 天前
  • 签到天数: 743 天

    [LV.9]以坛为家II

    发表于 2016-9-19 15:14:02 | 显示全部楼层
            对于马贩子,绝不姑息!!
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    无聊
    2020-8-22 23:45
  • 签到天数: 330 天

    [LV.8]以坛为家I

    发表于 2016-9-19 21:06:35 | 显示全部楼层
    楼主检测得倒是挺详细,不过这个解决方法是一丁点也没有啊,我虽然不是因此软件中Srv,但却是实实在在的中了Srv,所以还得求版主大人给个解决方法.
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    开心
    2024-3-13 10:50
  • 签到天数: 402 天

    [LV.9]以坛为家II

    发表于 2016-9-20 14:37:02 | 显示全部楼层
    还是pyg小组及相关人员发布的软件可靠,那些注册个id进来就发布软件的的确得提高警惕。

    点评

    通常说来,看着他的等级只有1~2级然后发的软件很牛逼而且非转载你就得好好想想了。  详情 回复 发表于 2016-9-21 20:57
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

  • TA的每日心情
    无聊
    2020-8-22 23:45
  • 签到天数: 330 天

    [LV.8]以坛为家I

    发表于 2016-9-21 20:57:12 | 显示全部楼层
    sw081 发表于 2016-9-20 14:37
    还是pyg小组及相关人员发布的软件可靠,那些注册个id进来就发布软件的的确得提高警惕。

    通常说来,看着他的等级只有1~2级然后发的软件很牛逼而且非转载你就得好好想想了。
    PYG19周年生日快乐!
    回复 支持 反对

    使用道具 举报

    您需要登录后才可以回帖 登录 | 加入我们

    本版积分规则

    快速回复 返回顶部 返回列表