基本介紹
- 外文名：Win32.Troj.DownLoader.se.1367552
- 病毒類型：木馬下載器
- 威脅級別：★★☆☆☆
- 病毒長度：1367552
病毒行為
該木馬運行後，讀取資源，釋放檔案到%systemRoot%\system\1sass.exe，調用cmd啟動該檔案。然後創建一個批處理檔案刪除自身。
1sass.exe行為分析
將自身註冊為系統服務，並以服務的方式啟動
添加的相關註冊表項為：
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRIVERS_MANAGEMENT\0000]
"Service"="Drivers Management"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Manage Drivers installed"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DRIVERS_MANAGEMENT\0000\Control]
"*NewlyCreated*"=dword:00000000
"ActiveService"="Drivers Management"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Drivers Management]
"Type"=dword:00000110
"Start"=dword:00000002
"ErrorControl"=dword:00000000
"ImagePath"=hex(2):43,00,3a,00,5c,00,57,00,49,00,4e,00,44,00,4f,00,57,00,53,00,\
5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,5c,00,31,00,73,00,61,00,73,00,73,\
00,2e,00,65,00,78,00,65,00,00,00
"DisplayName"="Manage Drivers installed"
"ObjectName"="LocalSystem"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Drivers Management\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Drivers Management\Enum]
"0"="Root\\LEGACY_DRIVERS_MANAGEMENT\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001
該服務啟動後首先會連線黑客網站http://nb.******.com/list.txt下載一個病毒列表的文本檔案,
然後根據該列表中的網址下載其他的木馬並運行，分析其下載的檔案，發現為一個遠程控制軟體。
