[09-06] 又一个下载木马的网站（第2版）

痛定思痛。 2024-04-20 11:16 42阅读 0赞

**endurer**　原创  
2006-09-06　第**2**版  
2006-09-02　第**1**版

网站 hxxp://www.94l\*\*\*m.com/ 首页会根据cookie的值打开网页：  
/------------  
hxxp://www.dudu\*\*w.com/web/dudu\*\*\*\*\*13.htm  
\------------/  
或  
/------------  
hxxp://www.dud\*\*uw.com/web/dudu\*\*\*\*\*12.htm  
\------------/

dudu\*\*\*\*\*13.htm 和 dudu\*\*\*\*\*12.htm 中有加密的VBScript脚本代码，该脚本代码利用 Microsoft.XMLHTTP 和 Scripting.FileSystemObject 下载文件会下载 hxxp://qidong.virussky.com/qidong.exe，保存为 IE临时文件夹中的 an85.com，并利用Shell.Application 对象 的 ShellExecute 方法 来运行。

<table> 
 <tbody> 
  <tr> 
   <td align="right">File: </td> 
   <td>qidong.exe </td> 
  </tr> 
  <tr> 
   <td align="right">Status: </td> 
   <td><font>INFECTED/MALWARE</font> </td> 
  </tr> 
  <tr> 
   <td align="right">MD5 </td> 
   <td>f932ee7f241695d5ee6527a231795468 </td> 
  </tr> 
  <tr> 
   <td align="right">Packers detected: </td> 
   <td> 
    <div>
      UPX 
    </div> </td> 
  </tr> 
  <tr> 
   <td align="center" colspan="2">Scanner results </td> 
  </tr> 
  <tr> 
   <td align="right">AntiVir </td> 
   <td>Found <font><strong>Heuristic/Malware (probable variant)</strong></font> </td> 
  </tr> 
  <tr> 
   <td align="right">ArcaVir </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">Avast </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">AVG Antivirus </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">BitDefender </td> 
   <td>Found <strong><font>Generic.Malware.BE!g.66E35076</font></strong> </td> 
  </tr> 
  <tr> 
   <td align="right">ClamAV </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">Dr.Web </td> 
   <td>Found <strong><font>Trojan.Update</font></strong></td> 
  </tr> 
  <tr> 
   <td align="right">F-Prot Antivirus </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">Fortinet </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">Kaspersky Anti-Virus </td> 
   <td>Found <strong><font>Trojan-Downloader.Win32.Agent.aqr</font></strong> </td> 
  </tr> 
  <tr> 
   <td align="right">NOD32 </td> 
   <td>Found probably unknown <strong><font>NewHeur_PE</font></strong><strong><font> (probable variant)</font></strong> </td> 
  </tr> 
  <tr> 
   <td align="right">Norman Virus Control </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">UNA </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">VirusBuster </td> 
   <td>Found nothing</td> 
  </tr> 
  <tr> 
   <td align="right">VBA32 </td> 
   <td>Found nothing</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <thead> 
  <tr> 
   <td>Antivirus</td> 
   <td>Version</td> 
   <td align="center">Update</td> 
   <td>Result</td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>7.1.1.11</td> 
   <td align="center">09.06.2006</td> 
   <td>TR/Dldr.Agent.aqr.15</td> 
  </tr> 
  <tr> 
   <td>Authentium</td> 
   <td>4.93.8</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>4.7.844.0</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>AVG</td> 
   <td>386</td> 
   <td align="center">09.06.2006</td> 
   <td>Downloader.Agent.FGL</td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>7.2</td> 
   <td align="center">09.06.2006</td> 
   <td>Generic.Malware.BE!g.66E35076</td> 
  </tr> 
  <tr> 
   <td>CAT-QuickHeal</td> 
   <td>8.00</td> 
   <td align="center">09.05.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>devel-20060426</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>DrWeb</td> 
   <td>4.33</td> 
   <td align="center">09.06.2006</td> 
   <td>Trojan.Update</td> 
  </tr> 
  <tr> 
   <td>eTrust-InoculateIT</td> 
   <td>23.72.117</td> 
   <td align="center">09.05.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-Vet</td> 
   <td>30.3.3064</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ewido</td> 
   <td>4.0</td> 
   <td align="center">09.05.2006</td> 
   <td>Downloader.Agent.aqr</td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>2.77.0.0</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot</td> 
   <td>3.16f</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot4</td> 
   <td>4.2.1.29</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ikarus</td> 
   <td>0.2.65.0</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Kaspersky</td> 
   <td>4.0.2.24</td> 
   <td align="center">09.06.2006</td> 
   <td>Trojan-Downloader.Win32.Agent.aqr</td> 
  </tr> 
  <tr> 
   <td>McAfee</td> 
   <td>4845</td> 
   <td align="center">09.05.2006</td> 
   <td>Downloader-AWE</td> 
  </tr> 
  <tr> 
   <td>Microsoft</td> 
   <td>1.1560</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>NOD32v2</td> 
   <td>1.1741</td> 
   <td align="center">09.06.2006</td> 
   <td>probably unknown NewHeur_PE virus</td> 
  </tr> 
  <tr> 
   <td>Norman</td> 
   <td>5.90.23</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Panda</td> 
   <td>9.0.0.4</td> 
   <td align="center">09.05.2006</td> 
   <td>Trj/Delf.ABZ</td> 
  </tr> 
  <tr> 
   <td>Sophos</td> 
   <td>4.09.0</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Symantec</td> 
   <td>8.0</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>TheHacker</td> 
   <td>5.9.8.205</td> 
   <td align="center">09.06.2006</td> 
   <td>Posible_Worm322</td> 
  </tr> 
  <tr> 
   <td>UNA</td> 
   <td>1.83</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>3.11.1</td> 
   <td align="center">09.05.2006</td> 
   <td>Trojan-Downloader.Win32.Agent.aqr</td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>4.3.7:9</td> 
   <td align="center">09.06.2006 </td> 
   <td>no virus found</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <thead> 
  <tr> 
   <td><span style="TEXT-DECORATION: underline">Aditional Information</span></td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>File size: 31744 bytes</td> 
  </tr> 
  <tr> 
   <td>MD5: f932ee7f241695d5ee6527a231795468</td> 
  </tr> 
  <tr> 
   <td>SHA1: 6414ec3d64ede47a4eec4cd07166380b223431da</td> 
  </tr> 
  <tr> 
   <td>packers: UPX, embedded</td> 
  </tr> 
 </tbody> 
</table>