posted by Kwan's 2010. 5. 17. 12:26

1. 사이트

한국 E 스포츠 협회 : http://www.xrogamer.or.kr 
대명 리조트 : http://www.xaemyungresort.com/asp/main.asp0
프루나 : http://www.xruna.com
프루나 서치 : http://vxd.xruna.com/search/search_list3.asp0
CJ 엔터테인먼트 : http://www.xjent.co.kr
SSO KBS : http://sso.xbs.co.kr
시네마 Kbs : http://xnema.kbs.co.kr
씨네통 : http://www.xnetong.com
게임타임 : http://www.xametime.co.kr/main.asp
 
2. 유포 사이트

1. 한국 E 스포츠 협회
http://61.100.9.219/club/xod.asp  ~> 서버 살아있음!
http://61.100.7.171/css/xib.asp ~> 서버 죽음!
http://97.xx.8x.1x8/xM.asp ~> 서버 살아있음!

2. 대명 리조트
http://61.100.9.219/club/xod.asp ~> 서버 살아있음!

3. 프루나
http://61.100.9.219/club/xod.asp  ~> 서버 살아있음!

4.프루나 서치
http://vxd.xruna.com/search/xearch_list3.asp ~> 서버 살아있음!

5. CJ 엔터테인먼트
http://61.100.7.171/css/xib.asp ~> 서버 죽음!
http://ac.gemmir.com/t/xime.asp ~> 서버 죽음!

6. SSO KBS
http://202.133.245.100/xxam.asp ~> 서버 살아있음!

7. 시네마 Kbs
http://220.95.233.16/ads/xime.asp ~> 서버 죽음!

8. 씨네통
http://97.74.87.198/xM.asp ~> 서버 살아있음!
http://www.kpma.or.kr/css/MG.asp0 ~> 서버 살아있음!

9. 게임타임

http://adsys.gametime.co.kr/include/topbenner_s2.asp ~> 서버 살아있음!
http://koreachangup.chosun.com/css/ads.asp ~> 서버 살아있음!

최종파일 :

god.asp , lib.asp : http://x1.100.1.93/css/isa.exe ~> 서버 살아있음!

time.asp : http://www.xobot114.com/cafe/help/box.exe ~> 서버 살아있음!

GM.asp , MG.asp : http://x1.100.1.93/admin/G.exe ~> 서버 살아있음!

sxxxxh_xxx3.asp : http://xile.ygfamily.com/php/i./c.exe ~> 서버 살아있음!

exam.asp : http://xwww.erounmall.com/cache/tmp/514.exe ~> 서버 살아있음!
 
ads.asp : http://xoreachangup.chosun.com/1.exe ~> 서버 살아있음! (XOR 변형 필요)

[바이러스 토탈]

검사 파일: god.asp 전송 시각: 2010.05.17 01:17:28 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Virus.JS.Downloader.QJ!IK
AhnLab-V3 2010.05.16.00 2010.05.15 JS/Downloader
AntiVir 8.2.1.242 2010.05.16 JS/Drop.A.5851
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.16 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 Trojan.Script.407264
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 Trojan.Script.407264
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Script.407264
Ikarus T3.1.1.84.0 2010.05.17 Virus.JS.Downloader.QJ
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan-Downloader.JS.Agent.fhk
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Script.407264
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 JS/Agent-MZX
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 JS.S.Agent.5851
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5851 bytes
MD5...: 51e7b5fe2fa7ef45de3b3671ba91b011
SHA1..: e6e7dd63b6de5b8b24c5a91d001d23a01de8186b
SHA256: 1d373a0cd0b239795370655695fb7db3138ab1aa1a4cb4df676f72150d82a7b9
검사 파일: GM.asp 전송 시각: 2010.05.17 01:17:38 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 -
AntiVir 8.2.1.242 2010.05.16 -
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-RN
Avast5 5.0.332.0 2010.05.16 JS:Downloader-RN
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:Downloader-RN
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 -
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 -
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5989 bytes
MD5...: 51c8357eff5e42b3143bd7c98e6ebc1e
SHA1..: 7627baf4a5e8e92dd6b20c4692402e79977d510f
SHA256: 2ec43de2fb19f5233450115aa3b75a394735599e8bd370f390f663a58696e88d
검사 파일: god.asp 전송 시각: 2010.05.17 01:17:46 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Virus.JS.Downloader.QJ!IK
AhnLab-V3 2010.05.16.00 2010.05.15 JS/Downloader
AntiVir 8.2.1.242 2010.05.16 JS/Drop.A.5851
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.16 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 Trojan.Script.407264
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 Trojan.Script.407264
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Script.407264
Ikarus T3.1.1.84.0 2010.05.17 Virus.JS.Downloader.QJ
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan-Downloader.JS.Agent.fhk
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Script.407264
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 JS/Agent-MZX
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 JS.S.Agent.5851
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5851 bytes
MD5...: 51e7b5fe2fa7ef45de3b3671ba91b011
SHA1..: e6e7dd63b6de5b8b24c5a91d001d23a01de8186b
SHA256: 1d373a0cd0b239795370655695fb7db3138ab1aa1a4cb4df676f72150d82a7b9
검사 파일: sxxxxh_xxx3.asp 전송 시각: 2010.05.17 01:21:27 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 JS/Downloader
AntiVir 8.2.1.242 2010.05.16 JS/Drop.A.5851
Antiy-AVL 2.0.3.7 2010.05.14 Trojan/JS.Agent
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.16 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:Downloader-QJ
Ikarus T3.1.1.84.0 2010.05.17 Trojan-Downloader.JS.Agent
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan-Downloader.JS.Agent.fhk
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 -
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5777 bytes
MD5...: a485b05d5035a168bb7fc3fd38220500
SHA1..: 3685084e053db302445caae2bfd63762ebf3b97b
SHA256: 58c9bbeb8f83242d054b71c3863fe87aba222142409d3b6f5f19e3705ca67bc4
검사 파일: time.asp 전송 시각: 2010.05.17 01:21:37 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 JS/Agent
AntiVir 8.2.1.242 2010.05.16 JS/Agent.fhj.5915
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.16 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:Downloader-QJ
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan-Downloader.JS.Agent.fhj
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 JS/Agent-MZX
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 JS.S.Agent.5915
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5915 bytes
MD5...: e3b64d8ce979fa63217059b0282133cd
SHA1..: 39b332155b7afd4a7e28ccac991550623d2244c0
SHA256: 0c8a3166567a7596f795790209d661e78ab2ac669d6b34bdaf906ba1e35ea399
검사 파일: exam.asp 전송 시각: 2010.05.17 01:22:03 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 -
AntiVir 8.2.1.242 2010.05.16 -
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.16 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:Downloader-QJ
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 -
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 -
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5902 bytes
MD5...: 8ec3cab47c3e8d7268c24c6f38badb0d
SHA1..: 183e038cac1869814347d31235b804a42d99de0b
SHA256: fe879654e5f88fbedf9d0379dc3860f94b9bdc1e1e9ffd11ed7d7ec3373a2bd1
검사 파일: MG.asp 전송 시각: 2010.05.17 01:25:30 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 -
AntiVir 8.2.1.242 2010.05.16 HTML/Crypted.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:Downloader-RN
Avast5 5.0.332.0 2010.05.16 JS:Downloader-RN
AVG 9.0.0.787 2010.05.16 Script/Exploit
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:Downloader-RN
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 -
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.17 -
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5869 bytes
MD5...: fe08120c7b461c030a8921173eecb022
SHA1..: fa2d931502a0a67e30564c7124053784f9566fc6
SHA256: 5dd43a0b8584668a66861b6e3c89ddf3c12a6d3f8f1d6796921e5c332abe7ee4
검사 파일: ads.asp 전송 시각: 2010.05.17 01:25:24 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 -
AntiVir 8.2.1.242 2010.05.16 JS/Redirector.5946
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 JS:CVE-2010-0806-AF
Avast5 5.0.332.0 2010.05.16 JS:CVE-2010-0806-AF
AVG 9.0.0.787 2010.05.16 -
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 -
ClamAV 0.96.0.3-git 2010.05.16 JS.Exploit-3
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 JS:CVE-2010-0806-AF
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan.JS.Agent.blf
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.BehavesLike.JS.BufferOverflow.D
Microsoft 1.5703 2010.05.17 -
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 JS/Exploit.DR
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 -
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 -
Sophos 4.53.0 2010.05.17 -
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 5954 bytes
MD5...: edadff7a5a455341a877f142d8e95474
SHA1..: 1d004d5eb69bf04d39273fd4e4412e7075f612cf
SHA256: 59424da373e7496ded9b6237ba25eb6165557e950c5b7d5ee0dbba9616ef7cf9
검사 파일: isa.exe 전송 시각: 2010.05.17 01:27:47 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Trojan.Peed!IK
AhnLab-V3 2010.05.16.00 2010.05.15 Malware/Win32.Heur.h4
AntiVir 8.2.1.242 2010.05.16 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.16 Win32:Malware-gen
AVG 9.0.0.787 2010.05.16 Generic17.CAMN
BitDefender 7.2 2010.05.17 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.17 Win32.SuspectCrc
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan.Win32.Pincav.aaci
McAfee 5.400.0.1158 2010.05.17 PWS-Mmorpg!pd
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.17 Trojan:Win32/Malagent
NOD32 5119 2010.05.17 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.16 Trj/CI.A
PCTools 7.0.3.5 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Packer.Win32.UnkPacker.b
Sophos 4.53.0 2010.05.17 Sus/UnkPack-C
Sunbelt 6311 2010.05.17 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 53248 bytes
MD5...: fd71b8a61f60869bd7ed144a685d8f0c
SHA1..: 5c8245ef4222b4d6b89327ac6c03103e83ea4d96
SHA256: 935ad48441eeedcf7e25289b25e1414e9854593ae88c7fe099f22f8b25172a01
검사 파일: box.exe 전송 시각: 2010.05.17 01:27:57 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Trojan.Peed!IK
AhnLab-V3 2010.05.16.00 2010.05.15 Malware/Win32.Heur.h4
AntiVir 8.2.1.242 2010.05.16 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.16 Win32:Malware-gen
AVG 9.0.0.787 2010.05.16 Generic17.CAGA
BitDefender 7.2 2010.05.17 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.17 Trojan.Siggen1.29725
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.17 Trojan.Peed
Jiangmin 13.0.900 2010.05.16 Trojan/Pincav.eta
Kaspersky 7.0.0.125 2010.05.17 Trojan.Win32.Pincav.aabq
McAfee 5.400.0.1158 2010.05.17 PWS-LDPinch!dv
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.17 Trojan:Win32/Malagent
NOD32 5119 2010.05.17 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.16 Trj/CI.A
PCTools 7.0.3.5 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.Win32.Generic.5204A82F
Sophos 4.53.0 2010.05.17 Sus/UnkPack-C
Sunbelt 6311 2010.05.17 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 53248 bytes
MD5...: a30fc2768e75f68ef44343f08fd15b47
SHA1..: 889dfa9a43afc7c9bc518e11689753b71f2d4c24
SHA256: 8d05acf3084cf9c8118dd1f33cd3fecae66c276b8121004432c8d262f1faa239
검사 파일: G.exe 전송 시각: 2010.05.17 01:28:08 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 Dropper/Killav.104032
AntiVir 8.2.1.242 2010.05.16 -
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 W32/OnlineGames.DV.gen!Eldorado
Avast 4.8.1351.0 2010.05.16 Win32:Trojan-gen
Avast5 5.0.332.0 2010.05.16 Win32:Trojan-gen
AVG 9.0.0.787 2010.05.16 Dropper.Generic2.JMD
BitDefender 7.2 2010.05.17 -
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.17 Trojan.PWS.Gamania.24318
eSafe 7.0.17.0 2010.05.16 Suspicious File
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 W32/OnlineGames.DV.gen!Eldorado
F-Secure 9.0.15370.0 2010.05.17 -
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Win32:Trojan-gen
Ikarus T3.1.1.84.0 2010.05.17 -
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 -
McAfee 5.400.0.1158 2010.05.17 -
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.LooksLike.Win32.SuspiciousPE.F
Microsoft 1.5703 2010.05.17 TrojanDropper:Win32/Frethog.K
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 Suspicious file
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 Trojan.Win32.Generic.5204B340
Sophos 4.53.0 2010.05.17 Mal/EncPk-OD
Sunbelt 6311 2010.05.17 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 Cryp_ACProt
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 Cryp_ACProt
VBA32 3.12.12.5 2010.05.14 -
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 104032 bytes
MD5...: 00420ede432ed70c6e0afecff02b9c36
SHA1..: 52f25ee55a23853d709641bf71574834c48ce311
SHA256: 1a0fc735eb5da8c91cdfd27643282d88689741d66d54cc617def08c4d1a10501
검사 파일: c.exe 전송 시각: 2010.05.17 01:30:15 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Trojan.Peed!IK
AhnLab-V3 2010.05.16.00 2010.05.15 Malware/Win32.Heur.h4
AntiVir 8.2.1.242 2010.05.16 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.16 Win32:Malware-gen
AVG 9.0.0.787 2010.05.16 Generic17.CAGA
BitDefender 7.2 2010.05.17 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.17 Trojan.Siggen1.29725
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.17 Trojan.Peed
Jiangmin 13.0.900 2010.05.16 Trojan/Pincav.eta
Kaspersky 7.0.0.125 2010.05.17 Trojan.Win32.Pincav.aabq
McAfee 5.400.0.1158 2010.05.17 PWS-LDPinch!dv
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.17 Trojan:Win32/Malagent
NOD32 5119 2010.05.17 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.16 Trj/CI.A
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 High Risk Cloaked Malware
Rising 22.47.06.04 2010.05.16 Trojan.Win32.Generic.5204A82F
Sophos 4.53.0 2010.05.17 Sus/UnkPack-C
Sunbelt 6311 2010.05.17 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 53248 bytes
MD5...: a30fc2768e75f68ef44343f08fd15b47
SHA1..: 889dfa9a43afc7c9bc518e11689753b71f2d4c24
SHA256: 8d05acf3084cf9c8118dd1f33cd3fecae66c276b8121004432c8d262f1faa239
검사 파일: 514.exe 전송 시각: 2010.05.17 01:30:20 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Trojan.Peed!IK
AhnLab-V3 2010.05.16.00 2010.05.15 Malware/Win32.Heur.h4
AntiVir 8.2.1.242 2010.05.16 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.16 Win32:Malware-gen
AVG 9.0.0.787 2010.05.16 Generic17.CAMR
BitDefender 7.2 2010.05.17 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.17 -
eSafe 7.0.17.0 2010.05.16 -
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.17 Trojan.Peed
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 Trojan.Win32.Pincav.aack
McAfee 5.400.0.1158 2010.05.17 PWS-Mmorpg!pd
McAfee-GW-Edition 2010.1 2010.05.16 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.17 Trojan:Win32/Malagent
NOD32 5119 2010.05.17 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.16 Trj/CI.A
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 High Risk Cloaked Malware
Rising 22.47.06.04 2010.05.16 Trojan.Win32.Generic.5204B11E
Sophos 4.53.0 2010.05.17 Sus/UnkPack-C
Sunbelt 6311 2010.05.17 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 53248 bytes
MD5...: 7a605076c916dbe48c3e4dd67411a643
SHA1..: f64ee054a392de9e98f3f8b22fe7d5c39e18bc37
SHA256: 4b9a72252ab86d78c804287400ddff1e0b31c7de5b8b6c523d2953856f844dd0
검사 파일: 1.exe_xor 전송 시각: 2010.05.17 01:32:39 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.16.00 2010.05.15 ASD.Prevention
AntiVir 8.2.1.242 2010.05.16 TR/Downloader.Gen
Antiy-AVL 2.0.3.7 2010.05.14 -
Authentium 5.2.0.5 2010.05.16 -
Avast 4.8.1351.0 2010.05.16 Win32:Rootkit-gen
Avast5 5.0.332.0 2010.05.16 Win32:Rootkit-gen
AVG 9.0.0.787 2010.05.16 Win32/PEPatch.BM
BitDefender 7.2 2010.05.17 Generic.Malware.FBg.5DCBA1EB
CAT-QuickHeal 10.00 2010.05.15 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.16 -
Comodo 4859 2010.05.16 -
DrWeb 5.0.2.03300 2010.05.17 Trojan.PWS.Wsgame.20571
eSafe 7.0.17.0 2010.05.16 Suspicious File
eTrust-Vet 35.2.7490 2010.05.15 -
F-Prot 4.5.1.85 2010.05.16 -
F-Secure 9.0.15370.0 2010.05.17 Generic.Malware.FBg.5DCBA1EB
Fortinet 4.1.133.0 2010.05.16 -
GData 21 2010.05.17 Win32:Rootkit-gen
Ikarus T3.1.1.84.0 2010.05.17 Win32.SuspectCrc
Jiangmin 13.0.900 2010.05.16 -
Kaspersky 7.0.0.125 2010.05.17 -
McAfee 5.400.0.1158 2010.05.17 Suspect-02!4C073148EB0A
McAfee-GW-Edition 2010.1 2010.05.16 Artemis!4C073148EB0A
Microsoft 1.5703 2010.05.17 Trojan:Win32/Meredrop
NOD32 5119 2010.05.17 -
Norman 6.04.12 2010.05.16 -
nProtect 2010-05-16.01 2010.05.16 -
Panda 10.0.2.7 2010.05.16 Suspicious file
PCTools 7.0.3.5 2010.05.17 -
Prevx 3.0 2010.05.17 -
Rising 22.47.06.04 2010.05.16 -
Sophos 4.53.0 2010.05.17 Mal/Behav-112
Sunbelt 6311 2010.05.17 -
Symantec 20101.1.0.89 2010.05.17 -
TheHacker 6.5.2.0.280 2010.05.14 -
TrendMicro 9.120.0.1004 2010.05.16 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.17 -
VBA32 3.12.12.5 2010.05.14 Malware-Cryptor.Win32.Krap
ViRobot 2010.5.15.2318 2010.05.16 -
VirusBuster 5.0.27.0 2010.05.16 -
 
추가 정보
File size: 20480 bytes
MD5...: 4c073148eb0ada6ca31e43816d1d402c
SHA1..: c02449696c974ddde708f3e7afc1c573380e99c5
SHA256: 4ec7b8fa64f0cffa559c0f765816f99426bb5f6b1f8341d87e01b5439afed77f

 관련글 : 프루나 무비서치 악성코드 유포중 !!

댓글을 달아 주세요

posted by Kwan's 2010. 5. 13. 18:36

내가 발견한 시각은 오늘 아침 9시경이었다. 예전에도 유포했다 월요일에 없어졌던 서버였지만 오늘 다시 보니 time out 위장되어 있는 사이트였다. 프루나라는 메인 페이지에서는 이 링크를 볼수없다. 여담이지만 이렇게 프루나에 꼭꼭 숨겨놓아서 어떤 사용자를 감염 시킨다는지 이해가 가지 않았다.
사진과 같이 프루나 메인페이지에서는 젼혀 search_list3.asp 가 보이지 않으므로 정상 접속에는 이상이 없다.


이 접속 경로는 http://vxd.prxxa.com/search/search_list3.asp 이쪽으로 되어있으며 이것 또한 익스플로러로 접속시 time out 이라는 문구만 보일뿐 세부 코드는 보이지 않는다!
하지만 도구를 통해서 본다면 세부 코드가 나오는 것으로 볼수있다.
이것 또한 처음에는 제대로 변환 할수 없다 .. 이사이트에 소스중 window.document.write(x); ~> window.alert(x); 로 바꾼다면 제대로 디코더가 된 코드를 볼수있다. 이 코드를 변환한다면 비로서 최종파일이 보인다.
디코더 결과 이 프루나 search_list3.asp는 
최종파일 :  http://file.ygfamily.com/php/i./c.exe0  연결 되는것을 볼수있다.
그동안 코드와는 달리 ygfamily 로 연결이 되고 있었다.
현재 이 악성코드들은 전부 V3 에서 잡을수 있으며 모두 업데이트가 완료가 되었다.
또한 악성코드들은 이스트 소프트 와 안철수연구소로 신고하였다.


정리를 하자면
http://vod.pxxna.com/search/search_list3.asp0 에서 유포중이며
최종파일 : http://file.xxfamily.com/php/i./c.exe0 받는다.

[안철수연구소]
1 search_list3.0sp ~> V3 : JS/Downloader(추가 : 2010.05.13.03)
2 c.exe ~> V3 : Win-Trojan/Injector.53248.Z(추가 : 2010.05.12.00)

[이스트 소프트] = 알약
오늘 DB 에서 업데이트!

검사 파일: search_list3.0sp 전송 시각: 2010.05.13 00:12:59 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 -
AhnLab-V3 2010.05.13.00 2010.05.12 -
AntiVir 8.2.1.242 2010.05.12 JS/Drop.A.5851
Antiy-AVL 2.0.3.7 2010.05.12 -
Authentium 5.2.0.5 2010.05.13 -
Avast 4.8.1351.0 2010.05.12 JS:Downloader-QJ
Avast5 5.0.332.0 2010.05.12 JS:Downloader-QJ
AVG 9.0.0.787 2010.05.13 Script/Exploit
BitDefender 7.2 2010.05.13 -
CAT-QuickHeal 10.00 2010.05.12 -
ClamAV 0.96.0.3-git 2010.05.12 -
Comodo 4829 2010.05.12 -
DrWeb 5.0.2.03300 2010.05.13 -
eSafe 7.0.17.0 2010.05.11 -
eTrust-Vet None 2010.05.12 -
F-Prot 4.5.1.85 2010.05.12 JS/Crypted.GA.gen
F-Secure 9.0.15370.0 2010.05.13 -
Fortinet 4.1.133.0 2010.05.12 -
GData 21 2010.05.13 JS:Downloader-QJ
Ikarus T3.1.1.84.0 2010.05.12 -
Jiangmin 13.0.900 2010.05.12 -
Kaspersky 7.0.0.125 2010.05.13 Trojan-Downloader.JS.Agent.fhk
McAfee 5.400.0.1158 2010.05.13 -
McAfee-GW-Edition 2010.1 2010.05.13 Heuristic.BehavesLike.JS.Exploit.A
Microsoft 1.5703 2010.05.12 -
NOD32 5110 2010.05.12 -
Norman 6.04.12 2010.05.12 -
nProtect 2010-05-12.01 2010.05.12 -
Panda 10.0.2.7 2010.05.12 -
PCTools 7.0.3.5 2010.05.12 -
Rising 22.47.02.04 2010.05.12 Trojan.DL.Script.JS.Agent.qx
Sophos 4.53.0 2010.05.13 -
Sunbelt 6296 2010.05.13 -
Symantec 20101.1.0.89 2010.05.13 -
TheHacker 6.5.2.0.279 2010.05.11 -
TrendMicro 9.120.0.1004 2010.05.12 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.13 -
VBA32 3.12.12.4 2010.05.12 -
ViRobot 2010.5.12.2312 2010.05.12 -
VirusBuster 5.0.27.0 2010.05.12 -
 
추가 정보
File size: 5777 bytes
MD5   : a485b05d5035a168bb7fc3fd38220500
SHA1  : 3685084e053db302445caae2bfd63762ebf3b97b
SHA256: 58c9bbeb8f83242d054b71c3863fe87aba222142409d3b6f5f19e3705ca67bc4
검사 파일: c.0xe 전송 시각: 2010.05.13 00:13:04 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.10 Trojan.Peed!IK
AhnLab-V3 2010.05.13.00 2010.05.12 Win-Trojan/Injector.53248.Z
AntiVir 8.2.1.242 2010.05.12 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.12 Trojan/Win32.Pincav.gen
Authentium 5.2.0.5 2010.05.13 -
Avast 4.8.1351.0 2010.05.12 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.12 Win32:Malware-gen
AVG 9.0.0.787 2010.05.13 -
BitDefender 7.2 2010.05.13 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.12 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.12 -
Comodo 4829 2010.05.12 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.13 -
eSafe 7.0.17.0 2010.05.11 -
eTrust-Vet 35.2.7484 2010.05.12 -
F-Prot 4.5.1.85 2010.05.12 -
F-Secure 9.0.15370.0 2010.05.13 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.12 -
GData 21 2010.05.13 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.12 Trojan.Peed
Jiangmin 13.0.900 2010.05.12 -
Kaspersky 7.0.0.125 2010.05.13 Trojan.Win32.Pincav.zrz
McAfee 5.400.0.1158 2010.05.13 Generic.dx!sra
McAfee-GW-Edition 2010.1 2010.05.13 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.12 Trojan:Win32/Malagent
NOD32 5110 2010.05.12 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.12 -
nProtect 2010-05-12.01 2010.05.12 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.12 Generic Trojan
PCTools 7.0.3.5 2010.05.12 -
Prevx 3.0 2010.05.13 High Risk Cloaked Malware
Rising 22.47.02.04 2010.05.12 Packer.Win32.UnkPacker.b
Sophos 4.53.0 2010.05.13 Sus/UnkPack-C
Sunbelt 6296 2010.05.13 Trojan.Win32.Generic!BT
Symantec 20101.1.0.89 2010.05.13 -
TheHacker 6.5.2.0.279 2010.05.11 Trojan/Pincav.zrz
TrendMicro 9.120.0.1004 2010.05.12 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.13 -
VBA32 3.12.12.4 2010.05.12 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.12.2312 2010.05.12 -
VirusBuster 5.0.27.0 2010.05.12 -
 
추가 정보
File size: 53248 bytes
MD5   : 7dc283909f9af5493de63aae1453a807
SHA1  : 0b9d820a6563bce957c04f60545b467c1d029d3f
SHA256: c3c7dc6df3a5b802d71834046b6f87e655bb29cf9030f879f8375c9e65363e7e

댓글을 달아 주세요

posted by Kwan's 2010. 5. 11. 22:22

1. 사이트

한국 E 스포츠 협회 : http://www.e-sports.or.kr
대명 리조트 :
http://www.daemyungresort.com/asp/main.asp
프루나 :
http://www.pruna.com
CJ 엔터테인먼트 :
http://www.cjent.co.kr
KBS :
http://sso.kbs.co.kr
조아라 : http://www.joara.com/main.html

주전자 닷컴 :
http://zuzunza.joins.com

2. 유포 사이트

1. 한국 E 스포츠 협회
http://211.218.126.144/css/top.asp ~> 서버 죽음! (V3 : JS/Downloader 추가 : 2010.04.23.02)
http://61.100.7.171/css/lib.asp ~> 서버 죽음!  (V3 : JS/Downloader 추가 : 2010.04.23.02)

 2. 대명 리조트
http://61.100.7.171/css/lib.asp ~> 서버 죽음!
(V3 : JS/Downloader 추가 : 2010.04.23.02)

3. 프루나
http://ac.gemmir.com/t/time.js ~> 서버 죽음!
http://ac.gemmir.com/t/time.asp ~> 서버 죽음!(V3 : JS/Agent 추가 : 2010.04.19.02)

4. CJ 엔터테인먼트
http://61.100.7.171/css/lib.asp ~> 서버 죽음! (V3 : JS/Downloader 추가 : 2010.04.23.02)

5. KBS
http://202.133.245.100/exam.asp ~> 서버 죽음! (V3 : 분석중)

6. 조아라
http://www.gamejil.com/data/css.htm ~> 서버 살아있음! (V3 : 분석중)

7. 주전자 닷컴
http://211.234.118.207/main.html ~> 서버 살아있음 (V3 : 분석중)
http://211.234.118.207/rl.jpg ~> 서버 살아있음 (V3 : 분석중)
http://211.234.118.207/ytl.jpg ~> 서버 살아있음 (V3 : 분석중)
http://211.234.118.207/yt1.jpg ~> 서버 살아있음 (V3 : 분석중)

최종파일 :
top.asp , lib.asp : http://61.100.1.93/css/isa.exe ~> 서버 살아있음 !
(
V3 : Win-Trojan/Pincav.54784.U(추가 : 2010.05.01.00)

time.asp :
http://www.robot114.com/cafe/help/box.exe ~> 서버 죽음 !  (V3 : Win-Trojan/Magania.53248.AA(추가 : 2010.05.07.07)

exam.asp : http://211.76.154.8/vipasp/logo/57.exe ~> 서버 살아있음 !   (V3 : Win-Trojan/Pincav.53248.AZ 추가 : 2010.05.09.00)

css.htm : http://www.gamejil.com/data/data.exe ~> 서버 살아있음 !
                                                          (V3 : 분석중) : XOR 변형이 필요합니다!

main.html ~> yt1.jpg  http://junggomania.nefficient.co.kr/test.exe ~> 서버 살아있음 ! (V3 : 분석중) 

[바이러스 토탈] 

검사 파일: isa.exe 전송 시각: 2010.05.10 00:46:48 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 Trojan.Peed!IK
AhnLab-V3 2010.05.09.00 2010.05.08 Win-Trojan/Pincav.54784.U
AntiVir 8.2.1.236 2010.05.09 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.07 Trojan/Win32.Pincav.gen
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.09 Win32:Malware-gen
AVG 9.0.0.787 2010.05.09 Generic17.BKEJ
BitDefender 7.2 2010.05.10 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.08 Trojan.Pincav.ywu
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.10 Trojan.Siggen1.24430
eSafe 7.0.17.0 2010.05.09 Win32.PWS.Mmorpg
eTrust-Vet 35.2.7474 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.09 W32/Pincav.YWU!tr
GData 21 2010.05.10 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.10 Trojan.Peed
Jiangmin 13.0.900 2010.05.09 Trojan/Pincav.eta
Kaspersky 7.0.0.125 2010.05.09 Trojan.Win32.Pincav.ywu
McAfee 5.400.0.1158 2010.05.09 PWS-Mmorpg!oq
McAfee-GW-Edition 2010.1 2010.05.09 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.09 Trojan:Win32/Malagent
NOD32 5099 2010.05.10 Win32/PSW.Gamania.NCP
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.09 Generic Trojan
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 High Risk Cloaked Malware
Rising 22.46.06.04 2010.05.09 Trojan.Win32.Generic.5202C6D7
Sophos 4.53.0 2010.05.09 Troj/Dload-HL
Sunbelt 6283 2010.05.10 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 Trojan/Pincav.ywu
TrendMicro 9.120.0.1004 2010.05.09 TSPY_MAGANIA.KI
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 TSPY_MAGANIA.KI
VBA32 3.12.12.4 2010.05.06 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.8.2306 2010.05.09 Trojan.Win32.Pincav.54784.C
VirusBuster 5.0.27.0 2010.05.09 Trojan.PWS.Gamania.BBV
 
추가 정보
File size: 54784 bytes
MD5...: a19b540af7132a86e866be1152256f07
SHA1..: 77715cc29b8911598f5f43bb0b17687267ea75f5
SHA256: 1d109b0ebfebc3d3c960bb7e4ef2917d64c4fef515ab031f1f15d522f0aa7fde
검사 파일: box.exe 전송 시각: 2010.05.10 00:46:56 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 Trojan.Win32.Pincav!IK
AhnLab-V3 2010.05.09.00 2010.05.08 Win-Trojan/Magania.53248.AA
AntiVir 8.2.1.236 2010.05.09 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.07 -
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 Win32:Rootkit-gen
Avast5 5.0.332.0 2010.05.09 Win32:Rootkit-gen
AVG 9.0.0.787 2010.05.09 -
BitDefender 7.2 2010.05.10 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.08 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.10 Trojan.Siggen1.28028
eSafe 7.0.17.0 2010.05.09 -
eTrust-Vet 35.2.7474 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.09 -
GData 21 2010.05.10 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.10 Trojan.Win32.Pincav
Jiangmin 13.0.900 2010.05.09 Trojan/Pincav.ewu
Kaspersky 7.0.0.125 2010.05.09 Trojan.Win32.Pincav.zor
McAfee 5.400.0.1158 2010.05.09 PWS-Mmorpg!pa
McAfee-GW-Edition 2010.1 2010.05.09 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.09 Trojan:Win32/Malagent
NOD32 5099 2010.05.10 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.09 Trj/CI.A
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 High Risk Cloaked Malware
Rising 22.46.06.04 2010.05.09 Trojan.Win32.Generic.5203053E
Sophos 4.53.0 2010.05.09 Sus/UnkPack-C
Sunbelt 6283 2010.05.10 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 Trojan/Kryptik.dxi
TrendMicro 9.120.0.1004 2010.05.09 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.8.2306 2010.05.09 Trojan.Win32.Pincav.53248.U
VirusBuster 5.0.27.0 2010.05.09 -
 
추가 정보
File size: 53248 bytes
MD5...: ef0a929469019e21809bf2b3ca1a9be8
SHA1..: 6581aa9311056612a1a42de323e8b1d0478b4a96
SHA256: ad8a92588c3b10d0191cc8c6b1a7a979c9927f872756a6c5e2e39286741e80fd
검사 파일: 57.exe 전송 시각: 2010.05.10 00:47:04 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 Trojan.Peed!IK
AhnLab-V3 2010.05.09.00 2010.05.08 Win-Trojan/Pincav.53248.AZ
AntiVir 8.2.1.236 2010.05.09 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.07 -
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 Win32:Malware-gen
Avast5 5.0.332.0 2010.05.09 Win32:Malware-gen
AVG 9.0.0.787 2010.05.09 Generic17.BVCK
BitDefender 7.2 2010.05.10 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.08 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.10 -
eSafe 7.0.17.0 2010.05.09 -
eTrust-Vet 35.2.7474 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.09 -
GData 21 2010.05.10 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.10 Trojan.Peed
Jiangmin 13.0.900 2010.05.09 Trojan/Pincav.ewu
Kaspersky 7.0.0.125 2010.05.09 Trojan.Win32.Pincav.zph
McAfee 5.400.0.1158 2010.05.09 PWS-Mmorpg!pa
McAfee-GW-Edition 2010.1 2010.05.09 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.09 Trojan:Win32/Malagent
NOD32 5099 2010.05.10 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.09 Trj/CI.A
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 High Risk Cloaked Malware
Rising 22.46.06.04 2010.05.09 Trojan.Win32.Generic.520303BB
Sophos 4.53.0 2010.05.09 Sus/UnkPack-C
Sunbelt 6283 2010.05.10 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.09 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.8.2306 2010.05.09 Trojan.Win32.Pincav.53248.W
VirusBuster 5.0.27.0 2010.05.09 -
 
추가 정보
File size: 53248 bytes
MD5...: 03cf9da736a31756cca52595788a4396
SHA1..: 496889dcca7e74de7a936b7287dd3d60ad9d6c8d
SHA256: 675ecc107bf056e259f9585236fdbbc7e9ed3d05e9873405e571599c5f66c425
검사 파일: data.exe 전송 시각: 2010.05.10 00:49:34 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 -
AhnLab-V3 2010.05.09.00 2010.05.08 -
AntiVir 8.2.1.236 2010.05.09 -
Antiy-AVL 2.0.3.7 2010.05.07 -
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 -
Avast5 5.0.332.0 2010.05.09 -
AVG 9.0.0.787 2010.05.09 -
BitDefender 7.2 2010.05.10 -
CAT-QuickHeal 10.00 2010.05.08 -
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 -
DrWeb 5.0.2.03300 2010.05.10 -
eSafe 7.0.17.0 2010.05.09 -
eTrust-Vet 35.2.7474 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 -
Fortinet 4.1.133.0 2010.05.09 -
GData 21 2010.05.10 -
Ikarus T3.1.1.84.0 2010.05.10 -
Jiangmin 13.0.900 2010.05.09 -
Kaspersky 7.0.0.125 2010.05.09 -
McAfee 5.400.0.1158 2010.05.09 -
McAfee-GW-Edition 2010.1 2010.05.09 -
Microsoft 1.5703 2010.05.09 -
NOD32 5099 2010.05.10 -
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 -
Panda 10.0.2.7 2010.05.09 -
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 -
Rising 22.46.06.04 2010.05.09 -
Sophos 4.53.0 2010.05.09 -
Sunbelt 6283 2010.05.10 -
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.09 -
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 -
ViRobot 2010.5.8.2306 2010.05.09 -
VirusBuster 5.0.27.0 2010.05.09 -
 
추가 정보
File size: 20992 bytes
MD5...: 81b9fb99a58f0e41f1d6c8784dc04397
SHA1..: cd7e5e3b06bdc35e139e307eed89a9f755105997
SHA256: 9df598a6cac3057c277f27e1f02b25b11c4ca648257ab1d182f8266f15a82bf6
검사 파일: DATA.EXE_xor 전송 시각: 2010.05.10 00:50:26 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 -
AhnLab-V3 2010.05.09.00 2010.05.08 ASD.Prevention
AntiVir 8.2.1.236 2010.05.09 TR/Vilsel.acwl.7
Antiy-AVL 2.0.3.7 2010.05.07 -
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 Win32:Rootkit-gen
Avast5 5.0.332.0 2010.05.09 Win32:Rootkit-gen
AVG 9.0.0.787 2010.05.09 Win32/PEPatch.BM
BitDefender 7.2 2010.05.10 Generic.Malware.FBg.E55EA39E
CAT-QuickHeal 10.00 2010.05.08 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.2.03300 2010.05.10 Trojan.PWS.Wsgame.origin
eSafe 7.0.17.0 2010.05.09 Suspicious File
eTrust-Vet None 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 Generic.Malware.FBg.E55EA39E
Fortinet 4.1.133.0 2010.05.09 W32/Vilsel.ACWL!tr
GData 21 2010.05.10 Win32:Rootkit-gen
Ikarus T3.1.1.84.0 2010.05.10 -
Jiangmin 13.0.900 2010.05.09 Trojan/Vilsel.gqc
Kaspersky 7.0.0.125 2010.05.09 Trojan.Win32.Vilsel.acwl
McAfee 5.400.0.1158 2010.05.09 Suspect-02!3EA6444D45E6
McAfee-GW-Edition 2010.1 2010.05.09 Artemis!3EA6444D45E6
Microsoft 1.5703 2010.05.09 Trojan:Win32/Meredrop
NOD32 5099 2010.05.10 probably a variant of Win32/PSW.OnLineGames.OUF
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 -
Panda 10.0.2.7 2010.05.09 W32/Spamta.QO.worm
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 -
Rising 22.46.06.04 2010.05.09 -
Sophos 4.53.0 2010.05.09 -
Sunbelt 6283 2010.05.10 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.09 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 Malware-Cryptor.Win32.Krap
ViRobot 2010.5.8.2306 2010.05.09 -
VirusBuster 5.0.27.0 2010.05.09 -
 
추가 정보
File size: 20992 bytes
MD5...: 3ea6444d45e625c2c03887850257a54b
SHA1..: c273744e80632b3f7133a0dca417e99c7bca9f4e
SHA256: c9481aee4d3a87634284f2af34728dab5737b71a1f518dd1aea0a282e2f3d1ef
검사 파일: test.exe 전송 시각: 2010.05.10 00:49:41 (UTC)
안티바이러스 엔진 버전 정의 날짜 검사 결과
a-squared 4.5.0.50 2010.05.09 Trojan.Peed!IK
AhnLab-V3 2010.05.09.00 2010.05.08 Malware/Win32.Heur.h4
AntiVir 8.2.1.236 2010.05.09 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.7 2010.05.07 -
Authentium 5.2.0.5 2010.05.09 -
Avast 4.8.1351.0 2010.05.09 -
Avast5 5.0.332.0 2010.05.09 -
AVG 9.0.0.787 2010.05.09 -
BitDefender 7.2 2010.05.10 Trojan.Peed.Gen
CAT-QuickHeal 10.00 2010.05.08 (Suspicious) - DNAScan
ClamAV 0.96.0.3-git 2010.05.09 -
Comodo 4800 2010.05.09 -
DrWeb 5.0.2.03300 2010.05.10 Trojan.Siggen1.28134
eSafe 7.0.17.0 2010.05.09 -
eTrust-Vet 35.2.7474 2010.05.07 -
F-Prot 4.5.1.85 2010.05.09 -
F-Secure 9.0.15370.0 2010.05.10 Trojan.Peed.Gen
Fortinet 4.1.133.0 2010.05.09 -
GData 21 2010.05.10 Trojan.Peed.Gen
Ikarus T3.1.1.84.0 2010.05.10 Trojan.Peed
Jiangmin 13.0.900 2010.05.09 -
Kaspersky 7.0.0.125 2010.05.09 Trojan.Win32.Pincav.zqo
McAfee 5.400.0.1158 2010.05.09 -
McAfee-GW-Edition 2010.1 2010.05.09 Heuristic.LooksLike.Heuristic.BehavesLike.Win32.Downloader.B
Microsoft 1.5703 2010.05.09 Trojan:Win32/Malagent
NOD32 5099 2010.05.10 a variant of Win32/Kryptik.DXI
Norman 6.04.12 2010.05.09 -
nProtect 2010-05-09.01 2010.05.09 Trojan.Peed.Gen
Panda 10.0.2.7 2010.05.09 Trj/CI.A
PCTools 7.0.3.5 2010.05.07 -
Prevx 3.0 2010.05.10 High Risk Cloaked Malware
Rising 22.46.06.04 2010.05.09 Trojan.Win32.Generic.52031ABB
Sophos 4.53.0 2010.05.09 Sus/UnkPack-C
Sunbelt 6283 2010.05.10 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.05.10 -
TheHacker 6.5.2.0.277 2010.05.10 -
TrendMicro 9.120.0.1004 2010.05.09 PAK_Generic.001
TrendMicro-HouseCall 9.120.0.1004 2010.05.10 -
VBA32 3.12.12.4 2010.05.06 Malware-Dropper.Win32.Inject.gen
ViRobot 2010.5.8.2306 2010.05.09 -
VirusBuster 5.0.27.0 2010.05.09 -
 
추가 정보
File size: 52736 bytes
MD5...: 59fa3bd14812eeb10fb978a16d01614b
SHA1..: cd60891c7b11534c264a1378d4ac5d660b732b82
SHA256: 73e0a9a30910bb47e5c9b44964fc6b73a3f5688c54a4ef0e03020721dbafea61

 

모든샘플은 안철수연구소와 이스트 소프트에 신고합니다.

 

[안철수연구소]

1 rl.jpg ~> 분석중
2 exam.asp ~> 분석중
3 ytl.jpg ~> 분석중
4 yt1.jpg ~> 분석중
5 data.exe ~> 분석중 
6 css.htm ~> 분석중
7 time.js ~> 분석중
8 test.exe ~> 분석중
9 NACookieManage.aspx ~> 분석중
10 57.exe ~> V3 : Win-Trojan/Pincav.53248.AZ(추가 : 2010.05.09.00)
11 box.exe ~>V3 : Win-Trojan/Magania.53248.AA(추가 : 2010.05.07.07) 
12 isa.exe ~> V3 : Win-Trojan/Pincav.54784.U(추가 : 2010.05.01.00)
13 lib.asp ~> V3 : JS/Downloader(추가 : 2010.04.23.02)
14 time.asp ~> V3 : JS/Agent(추가 : 2010.04.19.02)

 [이스트 소프트]

오늘 DB에 추가 할 예정!

자세한정보 : http://cafe.naver.com/malzero/56184

댓글을 달아 주세요