Trojan-PSW.Win32.Maran.cx

王朝百科·作者佚名 2010-02-19

宽屏版字体: 小|中|大|超大

 病毒名称： Trojan-PSW.Win32.Maran.cx

中文名称：马瑞恩

病毒类型：木马类

文件 MD5： 6F57803D1B0C2F772D72CEA6D0523754

公开范围：完全公开

危害等级： 3

文件长度：加壳后 110,592 字节，脱壳后 258,048 字节

感染系统： Win9X 以上系统

开发工具： Borland Delphi 6.0 - 7.0

加壳类型 : Upack 0.3.9 beta2s -> Dwing

命名对照： BitDefender [  Generic.Malware.FB.F6352C32 ]

病毒描述：

 该病毒运行后，衍生病毒文件到系统目录下。添加注册表系统服务项以随系统引导病毒体。

修改注册表 LSP项，当用户连接网络时，即挂载病毒体。将病毒DLL文件注入IE与系统进程中，

当用户访问指定页面时，即获取用户游戏帐号信息。

行为分析：

 1 、衍生下列副本与文件：

%WinDir%lsass.exe

%System32%md6media.dllSize: 210,944

%System32%driversws2ifsl.sys

2 、新建注册表键值：

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWS2IFSLDisplayName

Value: String: "Windows 套接字 2 .0 Non-IFS 服务提供程序支持环境 "

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWS2IFSLImagePath

Value: Type: REG_EXPAND_SZ Length: 41 (0x29) bytes

SystemRootSystem32driversws2ifsl.sys.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesVGADownDisplayName

Value: String: "Vedio Adapter"

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesVGADownImagePath

Value: Type: REG_EXPAND_SZ Length: 21 (0x15) bytes

%WinDirlsass .exe.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2

ParametersProtocol_Catalog9Catalog_Entries00000000012PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2Parameters

Protocol_Catalog9Catalog_Entries00000000013PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

C:WINDOWSSystem32md6media.dll

3 、修改下列注册表键值：

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2

ParametersProtocol_Catalog9Catalog_Entries00000000001PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%WinDir%System32md6media.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2Parameters

Protocol_Catalog9Catalog_Entries00000000004PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32

svpsp.dll

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWinSock2Parameters

Protocol_Catalog9Catalog_Entries00000000006PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32

svpsp.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

4 、删除下列注册表键值：

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesShellHWDetectionDisplayName

Value: String: "Shell Hardware Detection"

HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesShellHWDetectionImagePath

Value: Type: REG_EXPAND_SZ Length: 45 (0x2d) bytes

%SystemRoot%System32svchost.exe -k netsvcs.

5 、自动生成 bat 文件，用来删除自身。

6 、当用户访问下列 URL 时， md6media.dll 盗取帐号与密码信息：

[url=http://tw.g*m*ni*.com]http://tw.g*m*ni*.com

[url=https://tw.gash.g*m*ni*.com/memberindex.aspx]https://tw.gash.g*m*ni*.com/memberindex.aspx

[url=https://tw.gash.g*m*ni*.com/gashlogin.aspx]https://tw.gash.g*m*ni*.com/gashlogin.aspx

[url=https://tw.gash.g*m*ni*.com/updatemainaccountpassword.aspx]https://tw.gash.g*m*ni*.com/updatemainaccountpassword.aspx

[url=https://tw.gash.g*m*ni*.com/updateserviceaccountpassword.aspx]https://tw.gash.g*m*ni*.com/updateserviceaccountpassword.aspx

[url=http://tw.gashcard.g*m*ni*.com]http://tw.gashcard.g*m*ni*.com

[url=https://tw.login.g*m*ni*.com]https://tw.login.g*m*ni*.com

注： % System% 是一个可变路径。病毒通过查询操作系统来决定当前 System 文件夹的位置。 Windows2000/NT 中默认的安装路径是 C:WinntSystem32 ， windows95/98/me 中默认的安装路径是 C:WindowsSystem ， windowsXP 中默认的安装路径是 C:WindowsSystem32 。 

--------------------------------------------------------------------------------

清除方案：

  1 、使用安天木马防线可彻底清除此病毒 ( 推荐 )

2 、手工清除请按照行为分析删除对应文件，恢复相关系统设置。

(1) 使用安天木马防线 “进程管理”关闭病毒进程：

lsass.exe

(2) 删除并恢复病毒添加与修改的注册表键值：

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WS2IFSLDisplayName

Value: String: "Windows 套接字 2 .0 Non-IFS 服务提供

程序支持环境 "

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WS2IFSLImagePath

Value: Type: REG_EXPAND_SZ Length: 41 (0x29) bytes

SystemRootSystem32driversws2ifsl.sys.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

VGADownDisplayName

Value: String: "Vedio Adapter"

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

VGADownImagePath

Value: Type: REG_EXPAND_SZ Length: 21 (0x15) bytes

%WinDirlsass .exe.

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WinSock2ParametersProtocol_Catalog9Catalog_Entries

000000000012PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WinSock2ParametersProtocol_Catalog9Catalog_Entries

000000000013PackedCatalogItem

Value: Type: REG_BINARY Length: 888 (0x378) bytes

C:WINDOWSSystem32md6media.dll0)

恢复下列注册表键值为 old 值：

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WinSock2ParametersProtocol_Catalog9Catalog_Entries

000000000001PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%WinDir%System32md6media.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WinSock2Parameters Protocol_Catalog9Catalog_Entries

000000000004PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32

svpsp.dll

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices

WinSock2ParametersProtocol_Catalog9Catalog_Entries

000000000006PackedCatalogItem

New: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32

svpsp.dll

Old: Type: REG_BINARY Length: 888 (0x378) bytes

%SystemRoot%system32mswsock.dll

(3) 删除病毒释放文件：

%WinDir%lsass.exe

%System32%md6media.dll Size: 210,944

%System32%driversws2ifsl.sys