这个文章本身一个月前就该写了但是由于种种原因拖到现在~~
auto.exe 这个病毒是一个8位随机的.下载器,会载每个盘下建立AutoRun.Inf和auto.exe 在system32下生成2个8位随机名的病毒一个exe一个dll查杀祥见
http://www.newjian.net/Anti-virus/anti_virus_798.html
脱壳祥见http://www.newjian.net/auto_bingduzhuansha/200710141308.html
脱壳后vc编写~
004021CF /. 55 push ebp ;OD载入
004021D0 |. 8BEC mov ebp,esp
004021D2 |. 6A FF push -1
004021D4 |. 68 30314000 push auto.00403130
004021D9 |. 68 50234000 push auto.00402350
; jmp to msvcrt._except_handler3; SE 句柄安装
004021DE |. 64:A1 00000000 mov eax,dword ptr fs:[0]
004021E4 |. 50 push eax
004021E5 |. 64:8925 00000000 mov dword ptr fs:[0],esp
004021EC |. 83EC 68 sub esp,68
004021EF |. 53 push ebx
004021F0 |. 56 push esi
往下找到004022FE函数~
004022F3 |> \50 push eax ; /Arg4
004022F4 |. 56 push esi ; |Arg3
004022F5 |. 53 push ebx ; |Arg2
004022F6 |. 53 push ebx ; |/pModule
004022F7 |. FF15 50304000 call dword ptr ds:[403050]
; |\GetModuleHandleA
004022FD |. 50 push eax ; |Arg1
004022FE |. E8 02F3FFFF call auto.00401605
; \auto.00401605 ;进入,这个是名字算法的关键~
00402303 |. 8945 98 mov [local.26],eax
004016D6 |. 56 push esi ; /Timeout => 1. ms
004016D7 |. FFD3 call ebx ; \Sleep
004016D9 |. 56 push esi ; /Timeout => 1. ms
004016DA |. FFD3 call ebx ; \Sleep
;好多睡觉.函数~等待
004016DC |. BF 10D04000 mov edi,auto.0040D010
; ASCII "kowinIe" ;初始字符串~
004016E1 |. 8D85 E8FEFFFF lea eax,[local.70]
004016E7 |. 57 push edi
004016E8 |. 50 push eax
004016E9 |. E8 7F040000 call auto.00401B6D
;进去计算~
004016EE |. 8D85 E8FEFFFF lea eax,[local.70]
00401B6D /$ 55 push ebp
00401B6E |. 8BEC mov ebp,esp
00401B70 |. 81EC 08010000 sub esp,108
00401B76 |. 53 push ebx
00401B77 |. 56 push esi
00401B78 |. 57 push edi
00401B79 |. E8 9FFFFFFF call auto.00401B1D
;进去GetVolumeInformationA获.得C:\的驱动器序列号~
00401B7E |. 8B35 90304000 mov esi,dword ptr ds:[403090]
; kernel32.lstrlenA
00401B84 |. 6A 01 push 1
00401B86 |. 5F pop edi
00401B1D /$ 55 push ebp
00401B1E |. 8BEC mov ebp,esp
00401B20 |. 51 push ecx
00401B21 |. 56 push esi
00401B22 |. 8B35 78304000 mov esi,dword ptr ds:[403078] ; kernel32.Sleep
00401B28 |. 6A 01 push 1 ; /Timeout = 1. ms
00401B2A |. FFD6 call esi ; \Sleep
00401B2C |. 6A 01 push 1 ; /Timeout = 1. ms
00401B2E |. FFD6 call esi ; \Sleep
00401B30 |. 33C0 xor eax,eax
00401B32 |. 6A 0A push 0A ; /pFileSystemNameSize = 0000000A
00401B34 |. 50 push eax ; |pFileSystemNameBuffer => NULL
00401B35 |. 50 push eax ; |pFileSystemFlags => NULL
00401B36 |. 8D4D FC lea ecx,[local.1] ; |
00401B39 |. 50 push eax ; |pMaxFilenameLength => NULL
00401B3A |. 51 push ecx ; |pVolumeSerialNumber
00401B3B |. 6A 0C push 0C ; |MaxVolumeNameSize = C (12.)
00401B3D |. 50 push eax ; |VolumeNameBuffer => NULL
00401B3E |. 68 E0DB4000 push auto.0040DBE0 ; |RootPathName = "c:\"
00401B43 |. FF15 70304000 call dword ptr ds:[403070] ; \GetVolumeInformationA
00401B49 |. 8B45 FC mov eax,[local.1]
00401B4C |. 5E pop esi
00401B4D |. 3D 2B050000 cmp eax,52B
;比较获取的序列号.大小不低于52B 不然就把23E73E6替换序列号
00401B52 |. 73 07 jnb short auto.00401B5B
00401B54 |. B8 E6733E02 mov eax,23E73E6
00401B59 |. C9 leave
00401B5A |. C3 retn
00401B5B |> 83F8 F0 cmp eax,-10
;比较获取的序列号大小.不高于-10 不然就把5F5E100替换序列号
00401B5E |. 76 0B jbe short auto.00401B6B
00401B60 |. 33D2 xor edx,edx
00401B62 |. B9 00E1F505 mov ecx,5F5E100
00401B67 |. F7F1 div ecx
00401B69 |. 8BC2 mov eax,edx
00401B6B |> C9 leave
00401B6C \. C3 retn
这是处理初始字符的后面也.用到,就是把字符串的ascii的和,他这有个bug只计算前7位的和
00401B94 |. /7E 12 jle short auto.00401BA8
00401B96 |> |8B45 0C /mov eax,[arg.2]
00401B99 |. |50 |push eax
00401B9A |. |0FBE0C03 |movsx ecx,byte ptr ds:[ebx+eax]
00401B9E |. |03F9 |add edi,ecx
;加和~
00401BA0 |. |43 |inc ebx
00401BA1 |. |FFD6 |call esi
; lstrlen
00401BA3 |. |48 |dec eax
00401BA4 |. |3BD8 |cmp ebx,eax
00401BA6 |.^|7C EE \jl short auto.00401B96
00401BA8 |> \8B1D 78304000 mov ebx,dword ptr ds:[403078]
; kernel32.Sleep
00401BCC |. 0FAF7D FC imul edi,[local.1]
;注意这里将刚才算的和和C:\的序.列号相成~生成服务号,就是病毒注册服务的名字~
00401BD0 |. 57 push edi ; /<%x>
00401BD1 |. 8D85 F8FEFFFF lea eax,[local.66] ; |
00401BD7 |. 68 E4DB4000 push auto.0040DBE4
; |format = "%x"
00401BDC |. 50 push eax ; |s
00401BDD |. E8 94050000 call auto.00402176
; \sprintf 用sprintf转换成16进.制~
00401BE8 |. 83C4 0C add esp,0C
00401BEB |. 8D85 F8FEFFFF lea eax,[local.66]
00401BF1 |. 50 push eax
; /StringOrChar = "fb000e3a" 这个生成的是服务号~
00401BF2 |. FFD7 call edi
; \CharUpperA转换成大写~
解析 auto.exe 8位随机算法 之二
http://www.newjian.net/auto_bingduzhuansha/200710141310.html
您的位置: