所谓的“真正的百度云唯一最新可用……”是病毒，大家注意！52破解已屏蔽发帖者！

pdkl

本帖最后由 老灰猪 于 2017-4-25 13:28 编辑


52破解已屏蔽了原发帖者，不折不扣的病毒！
放毒死全家！！！

手工分析也证明是彻头彻尾的病毒。至于腾讯的查毒，我只能呵呵呵呵……

篡改首页：
http://u.hao524.com
http://hao643.com/

感染以下文件到系统，并植入驱动：
ipsec32.sys，ipsec64.sys,supporte6.exe

会给典型浏览器加尾巴：97175858_hao_pg，90058352_hao_pg



行为描述:        创建文件
详情信息:        C:\Windows\libegl.dll
C:\Windows\supporte6.exe
C:\Windows\ipsec32.sys
C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2KQWVTOD\api[1]
C:\Windows\SkinH_EL.dll
行为描述:        创建可执行文件
详情信息:        C:\Windows\libegl.dll
C:\Windows\supporte6.exe
C:\Windows\ipsec32.sys
C:\Windows\SkinH_EL.dll
行为描述:        查找文件
详情信息:        FileName = C:\Windows\libegl.zh-CN
FileName = C:\Windows\libegl.zh-Hans
FileName = C:\Windows\libegl.zh
FileName = C:\Windows\libegl.en-US
FileName = C:\Windows\libegl.en
FileName = C:\Windows\libegl.CHS
FileName = C:\Windows\libegl.CH
FileName = C:\ProgramData\Microsoft\Network\Connections\Pbk\rasphone.pbk
FileName = C:\ProgramData\Microsoft\Network\Connections\Pbk\*.pbk
FileName = C:\Windows\system32\Ras\*.pbk
FileName = C:\Users\Administrator\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk
FileName = C:\Users\Administrator\AppData\Roaming\Microsoft\Network\Connections\Pbk\*.pbk
FileName = C:\Windows
FileName = C:\Windows\*.*
FileName = C:\Users\Administrator\Desktop\QQ浏览器.lnk
行为描述:        设置特殊文件属性
详情信息:        C:\Windows\SkinH_EL.dll
行为描述:        删除文件
详情信息:        C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2KQWVTOD\api[1]
行为描述:        设置特殊文件夹属性
详情信息:        C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies
C:\Users\Administrator\AppData\Local\Microsoft\Windows\History\History.IE5
行为描述:        修改文件内容
详情信息:        C:\Windows\libegl.dll ---> Offset = 0
C:\Windows\supporte6.exe ---> Offset = 0
C:\Windows\ipsec32.sys ---> Offset = 0
C:\Windows\SkinH_EL.dll ---> Offset = 0
网络行为
行为描述:        联网打开网址
详情信息:        InternetOpenUrlA: http://u.****om/gameall/api?a=s&nm=ggggg&q=c116&v=1.0.0&s3=0&m=08-00-27-48-89-80, hInternet = 0x00cc0004, Flags = 0x00000001
行为描述:        打开HTTP连接
详情信息:        InternetOpenA: UserAgent: b70c, hSession = 0x00cc0004
行为描述:        建立到一个指定的套接字连接
详情信息:        URL: u.****om, IP: **.133.40.**:80, SOCKET = 0x00000388
行为描述:        发送HTTP包
详情信息:        GET /gameall/api?a=s&nm=ggggg&q=c116&v=1.0.0&s3=0&m=08-00-27-48-89-80 HTTP/1.1 User-Agent: b70c Host: u.****om
行为描述:        按名称获取主机地址
详情信息:        GetAddrInfoW: u.****om
注册表行为
行为描述:        修改注册表
详情信息:        \REGISTRY\USER\S-*\Software\Microsoft\Windows Script\Settings\JITDebug
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\EnableFileTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\EnableConsoleTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\FileTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\ConsoleTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\MaxFileSize
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASAPI32\FileDirectory
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\EnableFileTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\EnableConsoleTracing
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\FileTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\ConsoleTracingMask
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\MaxFileSize
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Tracing\b70c_RASMANCS\FileDirectory
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-*\RefCount
行为描述:        删除注册表键值
详情信息:        \REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\User_Feed_Synchronization-{DD45CED3-68D4-4258-9DB0-B2D0B36690C9}.job
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\User_Feed_Synchronization-{DD45CED3-68D4-4258-9DB0-B2D0B36690C9}.job.fp
其他行为
行为描述:        检测自身是否被调试
详情信息:        IsDebuggerPresent
行为描述:        创建互斥体
详情信息:        RasPbFile
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
行为描述:        常规加载驱动
详情信息:        \??\C:\Windows\ipsec32.sys
行为描述:        打开互斥体
详情信息:        Local\MSCTF.Asm.MutexDefault1
Local\_!MSFTHISTORY!_
Local\c:!users!administrator!appdata!local!microsoft!windows!temporary internet files!content.ie5!
Local\c:!users!administrator!appdata!roaming!microsoft!windows!cookies!
Local\c:!users!administrator!appdata!local!microsoft!windows!history!history.ie5!
Local\WininetStartupMutex
Local\WininetConnectionMutex
Local\WininetProxyRegistryMutex
RasPbFile
Local\!IETld!Mutex
行为描述:        查找指定窗口
详情信息:        NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
行为描述:        启动系统服务
详情信息:        [服务启动成功]: , ipsec32.sys, \??\C:\Windows\ipsec32.sys
行为描述:        窗口信息
详情信息:        Pid = 1508, Hwnd=0x1701ce, Text = 确定, ClassName = Button.
Pid = 1508, Hwnd=0x1a01e0, Text = 百度云出现免费试用后点免费试用,然后在点击软件上的一键无限试用！, ClassName = Static.
Pid = 1508, Hwnd=0x1a0114, Text = 信息：, ClassName = #32770.
Pid = 2748, Hwnd=0x1b0116, Text = 1：, ClassName = Static.
Pid = 2748, Hwnd=0x1d01c0, Text = load, ClassName = Button.
Pid = 2748, Hwnd=0x2401de, Text = 1, ClassName = Button.
Pid = 2748, Hwnd=0x1b01dc, Text = 2, ClassName = Button.
Pid = 2748, Hwnd=0x260168, Text = 3, ClassName = Button.
Pid = 2748, Hwnd=0x180166, Text = 4, ClassName = Button.
Pid = 2748, Hwnd=0x280112, Text = C:\Users\Administrator\Desktop, ClassName = MFCEditBrowse.
Pid = 1508, Hwnd=0x170306, Text = 请叫我大众男神i, ClassName = Afx:400000:b:10003:1900015:0.
Pid = 1508, Hwnd=0x160302, Text = 一键无限试用时间, ClassName = Button.
Pid = 1508, Hwnd=0x802ec, Text = 52pojie 请叫我大众男神i, ClassName = WTWindow.
Pid = 1508, Hwnd=0x1d0114, Text = 确定, ClassName = Button.
Pid = 1508, Hwnd=0x1901d2, Text = 运行时出错! 错误代码：4 错误信息：数组成员引用下标必须大于等于1 , ClassName = Static.
行为描述:        获取TickCount值
详情信息:        TickCount = 832109, SleepMilliseconds = 60000.
TickCount = 832125, SleepMilliseconds = 60000.
TickCount = 832140, SleepMilliseconds = 60000.
TickCount = 832156, SleepMilliseconds = 60000.
TickCount = 832171, SleepMilliseconds = 60000.
TickCount = 832218, SleepMilliseconds = 60000.
TickCount = 832234, SleepMilliseconds = 60000.
TickCount = 832250, SleepMilliseconds = 60000.
TickCount = 832265, SleepMilliseconds = 60000.
TickCount = 832281, SleepMilliseconds = 60000.
TickCount = 832296, SleepMilliseconds = 60000.
TickCount = 832312, SleepMilliseconds = 60000.
TickCount = 832359, SleepMilliseconds = 60000.
TickCount = 832375, SleepMilliseconds = 60000.
TickCount = 832390, SleepMilliseconds = 60000.
行为描述:        调整进程token权限
详情信息:        SE_SECURITY_PRIVILEGE
SE_SHUTDOWN_PRIVILEGE
SE_AUDIT_PRIVILEGE
行为描述:        打开事件
详情信息:        HookSwitchHookEnabledEvent
\KernelObjects\MaximumCommitCondition
MSFT.VSA.COM.DISABLE.2748
MSFT.VSA.IEC.STATUS.6c736db0
Local\MSCTF.CtfActivated.Default1
Local\MSCTF.AsmCacheReady.Default1
\SECURITY\LSA_AUTHENTICATION_INITIALIZED
Global\SvcctrlStartEvent_A3752DX
行为描述:        查找PE资源信息
详情信息:        (FindResourceExExW) hModule = 0x00000000, ResName: 95(ID), ResType: WIN32EXE
(FindResourceExExW) hModule = 0x00000000, ResName: 140(ID), ResType: WIN32EXE
(FindResourceExExW) hModule = 0x00000000, ResName: 97(ID), ResType: WIN32EXE
行为描述:        获取窗口截图信息
详情信息:        Foreground window Info: HWND = 0x001701ce, DC = 0xcc0109e6.
Foreground window Info: HWND = 0x00170306, DC = 0x9c010a8b.
Foreground window Info: HWND = 0x00170306, DC = 0xcc0109e6.
Foreground window Info: HWND = 0x00170306, DC = 0x5e0101db.
Foreground window Info: HWND = 0x001d0114, DC = 0xef01096b.

pdkl

行为描述:        可执行文件签名信息
详情信息:        C:\Windows\libegl.dll(签名验证: 未通过)
C:\Windows\supporte6.exe(签名验证: 未通过)
C:\Windows\ipsec32.sys(签名验证: 未通过)
C:\Windows\SkinH_EL.dll(签名验证: 未通过)
行为描述:        调用Sleep函数
详情信息:        [1]: MilliSeconds = 60000.
[2]: MilliSeconds = 60000.
[3]: MilliSeconds = 60000.
[4]: MilliSeconds = 60000.
[5]: MilliSeconds = 60000.
[6]: MilliSeconds = 0.
行为描述:        可执行文件MD5
详情信息:        C:\Windows\libegl.dll ---> 65b2f8a9e6d8975b740d3653d0b074bd
C:\Windows\supporte6.exe ---> ed9701d246f15c142110f67273441e69
C:\Windows\ipsec32.sys ---> 41c44e42120549e5222c3c6a2b5ad3b4
C:\Windows\SkinH_EL.dll ---> 147127382e001f495d1842ee7a9e7912
行为描述:        直接获取CPU时钟
详情信息:        EAX = 0xb1e55498, EDX = 0x0000027f
EAX = 0xee7592a9, EDX = 0x0000027f
EAX = 0xee7592f5, EDX = 0x0000027f
EAX = 0xf1289271, EDX = 0x0000027f
EAX = 0xf12892bd, EDX = 0x0000027f
EAX = 0xf1289309, EDX = 0x0000027f
EAX = 0xf1289355, EDX = 0x0000027f
EAX = 0xf12893a1, EDX = 0x0000027f
EAX = 0xf12893ed, EDX = 0x0000027f
EAX = 0xf1289439, EDX = 0x0000027f
EAX = 0xa328a3b5, EDX = 0x00000283
EAX = 0xa328a401, EDX = 0x00000283
EAX = 0xa328a44d, EDX = 0x00000283
EAX = 0xa328a499, EDX = 0x00000283
EAX = 0xa328a4e5, EDX = 0x00000283
行为描述:        创建系统服务
详情信息:        [服务创建成功]: ipsec32.sys, C:\Windows\ipsec32.sys
行为描述:        加载新释放的文件
详情信息:        Image: C:\Windows\libegl.dll.
Image: C:\Windows\supporte6.exe.
Image: C:\Windows\SkinH_EL.dll.


Microsoft, Internet, Windows, Users, 鐧惧害