File size: 132303 bytes
MD5: 583f86d285d644ad34727456297a32bd
SHA1: 857f638baa9cb1c97984c2dc88c168e4a06e0842
加花,UPX,隐藏入口点,达到免杀,不过对于的启发式和虚拟脱壳技术没用
一句话:表面免杀,的确,程序能运行,不过运行后也被杀,所以结果一样
思路还不错,利用宿主Svchost反弹连接
哎,不说了...
一些资料:
rocess:
Path: C:\Documents and Settings\admin\桌面\server.exe
PID: 1404
Registry Group: Services
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\netctrl
Registry value: Info
Type: REG_SZ
Value: 0;1*40?&9/07=?>789?:22751;7?< Process:
Path: C:\Documents and Settings\admin\桌面\server.exe
PID: 1404
Registry Group: Services
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\netctrl\Parameters
Process:
Path: C:\Documents and Settings\admin\桌面\server.exe
PID: 1404
Registry Group: Services
Object:
Registry key: HKLM\SYSTEM\CurrentControlSet\Services\netctrl\Parameters
Registry value: ServiceDll
Type: REG_EXPAND_SZ
Value: C:\winnt\system32\syst.dll
Parent process:
Path: C:\Documents and Settings\admin\桌面\server.exe
PID: 1404
Child process:
Path: C:\WINNT\system32\CMD.EXE
Information: Windows NT Command Processor (Microsoft Corporation)
Command line:cmd /c del "C:\Documents and Settings\admin\桌面\server.exe"
Process:
Path: C:\WINNT\system32\svchost.exe
PID: 1144
Information: Generic Host Process for Win32 Services (Microsoft Corporation)
Network information:
IP address: 61.156.7.6
Trusted zone: No
Protocol: IP
Process:
Path: C:\WINNT\system32\svchost.exe
PID: 1144
Information: Generic Host Process for Win32 Services (Microsoft Corporation)
Network information:
IP address: 219.146.4.130
Trusted zone: No
Protocol: IP
还带了个SOCK5后门,呵呵
年轻人,D调点..我也大不了你几岁.
