본문 바로가기

security/악성코드 유포

지난주 악성코드 유포지 6곳 !!

1. 사이트 !!

씨X통 : http://www.cixxxxng.com
레이XX 클럽 : http://www.rxxexx.co.kr 
옐XX X 택배 : http://www.yeXXXXXX.co.kr
강XX센X : http://www.stXXXXX.or.kr 外 다수
한국XXXXX연합회 : http://www.kXuXXX.or.kr 外 다수
부산XX 外 다수 : http://www.XXXbuXXX.com/

2. 유포지 !!

씨X통 : http://6X.1XX.1.8X/test.asp

레이XX 클럽 : http://2XX.1XX.9X.2X2/V.asp
                    http://2XX.2XX.12X.5X/help.asp

옐XX X XX : http://2XX.2XX.12X.5X/help.asp

강XXXX , 한국XXXXXXX회 外 다수 : http://www.XXiayuaXcom/XX/yahoo.js
                                                              http://www.XXayuaXcom/XX/ad.htm
                                                              http://www.XXayuaXcom/XX/news.html
                                                              http://www.XXayuaXcom/XX/count.html

부산XX 外 다수 : http://XXle.XXangq.co.kr/dXXX/report/sb/index.htm
                        http://XXle.XXangq.co.kr/dXXX/report/sb/6.htm
                        http://XXle.XXangq.co.kr/dXXX/report/sb/ie.jpg
                        http://XXle.XXangq.co.kr/dXXX/report/sb/iee.jpg

3. 최종파일 !!

test.asp , help.asp : http://loXX.XXnbt.info/pXXXX/chong.exe

V.asp : http://XXablade.com/XXder/d.exe

ad.htm : http://www.XXxny.com/image/s.exe

iee.jpg : http://loXX.XXnbt.info/pXXXX/chong.exe

4. 바이러스 토탈

test.asp : http://www.virustotal.com/file-scan/report.html?id=b5d1054496c0f85de2231776787c925d28fcc4e72153d0bc2df5c281e15b4a9c-1283822614

help.asp : http://www.virustotal.com/file-scan/report.html?id=10eb7191ad67287469f44e5db73c463337d154715df5717f57355f7413ddef99-1283822619

V.asp : http://www.virustotal.com/file-scan/report.html?id=b5d1054496c0f85de2231776787c925d28fcc4e72153d0bc2df5c281e15b4a9c-1283823361

yahoo.js : http://www.virustotal.com/file-scan/report.html?id=38fb192a31fc9795d7cd0c8de199c22fd639b85a3fcef6adb3a6c8fa747a84de-1283823366

ad.htm : http://www.virustotal.com/file-scan/report.html?id=71020f01ab7a9c6d44ff720850b08303e3fe8860fa3d6f1c819dd806d08cb832-1283823433

news.html : http://www.virustotal.com/file-scan/report.html?id=dcb0f56c127a107f67d4362472c451dbfb399dabffe673cdbe4204084b32ff7f-1283823445

count.html : http://www.virustotal.com/file-scan/report.html?id=dd04ba376ca8412f26a2d8077ab23c35209cd0e0c03f16fbf2620c36bd2c4370-1283823527

index.htm : http://www.virustotal.com/file-scan/report.html?id=d24618283f09b057665df60c03e5d378c145278deb797ff09f00d15d8f71067c-1283615067

6.htm : http://www.virustotal.com/file-scan/report.html?id=b97bcb2e3e2cd3dab79ca94939e0818865a8f474dce1a45ca1f8bfcf9320769c-1283615053

ie.jpg : http://www.virustotal.com/file-scan/report.html?id=96fd35784055780ef28cd6615c798c0e3d68a9ebb97393a456594b571b55251c-1283615058

iee.jpg : http://www.virustotal.com/file-scan/report.html?id=05d0a7cd5111df398f40b8f31d8d357c38d4a3338f213bc8cb338d6083258ff4-1283615063

pop.exe : http://www.virustotal.com/file-scan/report.html?id=fdade277f556797331f91af8228f19cbb659c4f559d9fe38800008a752ef1e78-1283823544

d.exe : http://www.virustotal.com/file-scan/report.html?id=9be1f0e3a083386396648e20aa4dc066a545453c70afa7ba12e53029f8352e87-1283823684

s.exe : http://www.virustotal.com/file-scan/report.html?id=3ecca9e0be88d46ca8ff5263af7218a6d8fa4fc2fb26a72d8818caafe866b18c-1283823692

chong.exe : http://www.virustotal.com/file-scan/report.html?id=bd1460158f28299155929a498c0bd31e592a0d51ce69d0d3b5df9693d6e96434-1283823807

5. 국내 업체 진단 사항 !!

이스트 소프트 , 네이버 : 분석 및 악성 파일 DB에 추가 예정 !!

[안철수연구소]

1. count.html ~> 분석중
2. chong.exe ~> V3 : Win-Trojan/Downloader.73728.FP(추가 : 2010.09.05.00)
3. d.exe ~> V3 : Dropper/Onlinegamehack.63434(추가 : 2010.09.05.00)
4. help.asp ~> V3 : JS/Cve-2010-0806(추가 : 2010.09.05.00)
5. yahoo.js ~> V3 : JS/Iframe(추가 : 2010.09.05.00)
6. ad.htm ~> V3 : JS/Cve-2010-0806(추가 : 2010.09.05.00)
7. news.html ~> V3 : JS/Exploit(추가 : 2010.09.05.00)
8. s.exe ~> V3 : Dropper/Onlinegamehack.40960(추가 : 2010.09.05.00)
9. test.asp ~> V3 : JS/Cve-2010-0806(추가 : 2010.09.05.00)
10. V.asp ~> V3 : JS/Cve-2010-0806(추가 : 2010.09.05.00)
11. pop.exe ~> V3 : Win-Trojan/Agent.64623(추가 : 2010.09.01.02)

흠.. 이번주에는 yahoo.js가 많이 난리를 쳤더라고요.. 최종파일 위치만 항상 바뀌고 ..
역시 취약점의 끝은 어디인지 ~ 관리가 절실한거 같습니다.
아무튼 태풍도 이번에는 빗겨가고 서울은 화창하고 무덥네요.. 비 한번 쏟아지면 좋은데..
서울에 계신분은 더운데 무더위 잘 보내시고 ~ 지방분들은 태풍에 피해가 없길 바라며 글을 마칩니다.
오늘도 모두 즐거운 하루 보내세요~