|
| W32/Netsky.25353@mm |
|
| 바이러스 종류 |
|
|
|
실행환경
|
|
|
|
| 발견일 |
|
|
|
제작지 |
|
|
|
| 위험등급 |
|
|
|
확산방법 |
|
|
|
| 바이러스 크기 |
|
|
|
첨부파일 |
|
| (임의의문자열).zip(25,475 bytes) 외 다수 |
|
|
| 메일제목 |
|
|
|
| 증상요약 |
|
|
|
| 치료방법 |
|
터보백신Ai, 터보백신 Online, 터보백신 2001 제품군으로 치료가능.
터보백신 Ai를 사용하시고 아웃룩을 사용하신 다면 반드시 이메일 감시기를
실행하시기 바랍니다.
 
|
|
|
|
| |
|
이 웜은 이메일을 통하여 2월 25일 부터 전파되었으며 국내에는
2월 26일 부터 전파되기 시작한 것으로 추정된다.
웜을 포함한 이메일은 아래와 같은 내용을 가지고 있다.
[메일 제목]
Delivery Failed
Here is it
I''m back!
Question
Re: Re: Re: Re: re: take it error
Re: excuse me
Re: excuse me
Re: hello
Re: hey exception
Re: hi
Re: important
Re: information
Re: unknown dear
Status
Yep Re: does it
believe me
goodmorning
hello
hey trust me
hi read it immediatelly
illegal...
important
info
its me
last chance!
lol
moin
notice!
notification denied!
private
question
report
something for you
stolen
warning fake?
what''s up
you?
[메일 내용]
현재 까지 알려진 것중 다음에서 선택 된다.
*lol*
;-)
<...>
<09580985869gj>
Antispam is turned off. See file!
Authentification required. Read the att...
File is bad.
File is damaged.
File is self-decryting.
I''ve found your bill!
I don''t know your document!
I have your password!
I wait for an answer!
Instant patches.
Login required! Read the attachment!
Microsoft
Transaction failed. Show the doc!
You are infected. Read the details!
Your bill.
Your provider will be disabled!
a crazy doc about you
abuse?
account?
already?
another pic, have fun! ... :->
are you a photographer?
are you a teacherin the picture?
are you cranky?
are you the naked one?
are you the naked person!
are you the one?
attachi#
be mad?
best?
bob the builder
child or adult?
child porn?
classroom test of you?
copyright?
correct it!
did you ask me for that?
did you know from this document?
did you know that?
did you see her already?
did you sent it to me?
do not give up!
do not open the attachment!
do not show this anyone!
do not use my document!
do not visit the pages on the list I se...
do you have an orgasm in the picture?
do you have sex in the picture?
do you have the bug also?
do you have?
do you know the thief?
do you know this????
do you think so?
doc about me?
doc?
docs?
does it belong to you?
does it belong to you?
does it match?
does it matter?
drugs? ...
excellent!
explain!
fast food...
feel free to use it.
forgotten?
from the chatter (my photo!)
from your lover ;-)
gonna?
good work!
great job!
great xxx!
great!
greetings
help attached
her.
here is it.
here is my advice.
here is my photo!
here is the $%%454$
here is the
here is the document.
here is the next one!
here is yours!
here, the cheats
here, the introduction
here, the serials
how?
i am desperate
i am speachless about your document!
i don''t think so.
i don''t want your xxx pics!
i found that about you!
i found this document about you.
i have received this.
i hope thats not true!
i know your document!
i like your doc!
i lost that
i need you!
i saw you last week!
i wait for your comment about it.
i want more...
i''ve found it about you
illegal st. of you?
important?
in your mind?
incest?
information about you?
instruct me about this!
is that criminal?
is that possible?
is that the reality?
is that true?
is that your TAN?
is that your account?
is that your account?
is that your attachment?
is that your beast?
is that your car?
is that your car?
is that your cd?
is that your creditcard?
is that your domain?
is that your family?
is that your finger?
is that your message?
is that your name?
is that your photo?
is that your porn pic?
is that your privacy?
is that your slip?
is that your website?
is that your wife?
is that your work?
is that yours?
is the pic a fake?
is this information about you?
it''s a secret!
it''s so similar as yours!
its private from me
kill him on the picture!
kill the writer of this document!
let it!
lets talk about it!
love letter?
man or women?
meaning of that?
message?
misc. and so on. see you!
modifications?
money?
msg
my advice....
never!
new patch is available!
ok...
old photos about you?
only encrypted!
pages?
personal message!
picture?
poor quality!
possible?
pretty pic about you?
pwd?
read it immediately!
read the details.
really?
reply
schoolfriend?
see this!
see your name!
solve the problem!
something about you!
something is going ...
something is going wrong!
something is not ok
stuff about you?
such as yours?
take it easy!
tell me more about your document!
test it
that is interesting...
that''s a funny text.
that''s not the truth?
thats wrong!
the information is wrong!
the truth?
this file is bad!
this is an attachment message!
this is nothing for kids!
time to fear?
trial?
try this patch!
what do you think about it?
what means that?
what still?
what?
who?
why should I?
why?
wrong calculation! (see the attachment!...
xxx ?
xxx about you?
xxx service
yes.
you are a bad writer
you are bad
you are naked in this document!
you are sexy in this doc!
you cannot hide yourself! (see photo)
you earn money, see the attachment!
you feel the same.
you have a sexy body in the pic!
you have done a mistake in the document...
you have tried to steal!
you look like an ape!
you look like an rat?
you won the rk!
your TAN number?
your account is expired!
your are naked?
your attachment? verify it.
your body?
your design is not good!
your document is not good
your document is silly!
your eyes?
your face?
your hero in the picture?
your icq number?
your job? (I found that!)
your lie is going around the world!
your name is wrong!
your personal record?
your photo is poor
yours?
[첨부파일]
다음중에서 선택 되어 진다. 원형과 마찬가지로 확장자가 scr, pif, exe, zip 등이 붙을수 있다.
그러나 zip으로 첨부된 경우에 압축을 해제 하면
txt, rtf, doc, htm 중간 확장자가 붙어 이중 확장자의 형태를 띈다.
( 예 : wife.txt.scr)
454543403
aboutyou
associal
attach2
attachment
auction
bill
birth
card
class_photos
concert
creditcard
death
description
details
dinner
disco
doc
doc_ang
document
final
found
freaky
friend
id
image
important
incest
information
injection
intimate stuff
jokes
letter
location
mail2
mails
masturbation
material
me
message
misc
moonlight
more
msg
msg2
music
myaunt
mydate
naked1
naked2
news
nomoney
note
nothing
number_phone
object
old_photos
part2
party
paypal
pic
portmoney
poster
posting
privacy
product
ps
ranking
regards
regid
release
response
schock
secrets
sexual
sexy
shower
story
stuff
swimmingpool
talk
tear
textfile
topseller
transfer
trash
undefinied
unfolds
update
violence
visa
warez
webcam
website
wife
word_doc
worker
your_stuff
yours
yours
(웜이 발송한 메일의 예)
1. 메일 제목 do not use this creditcard!
본문 내용
I have your password!
첨부파일 이름
old_photos.zip (25KB)
2. 메일 제목 exception
본문 내용
your name is wrong!
첨부파일 이름
note.zip (25KB)
3.메일 제목 Re: does it?
본문 내용
do not give up!
첨부파일 이름
wife.zip (25KB)
4. 메일 제목 its me
본문 내용
i have received this.
첨부파일 이름
unfolds.zip (25KB)
5. 메일 제목 wrong calculation! (see the attachment!)
본문 내용
your attachment? verify it.
첨부파일 이름
auction.rtf.pif
6. 메일 제목 yes.
본문 내용
illegal st. of you?
첨부파일 이름
letter.com.
[특징]
첨부파일은 wife.zip(25,475 bytes) 외 다수 이며, 압축을 해제 하면 워드 패드 아이콘을 하고 있다.
처음 실행시에 다음과 같이 윈도우 시스템 폴더(win 2000, NT : c:\Wint\system32, win XP : c:\windows\system32)
에 있는 winlogon.exe 파일 이름과 똑같은 이름으로 윈도우 폴더 (win 2000, NT : c:\Wint, win XP : c:\windows)에
생성되어 마치 정상 프로그램 인 것 처럼 속인다.
또한, 다음처럼 레지스트를 수정하여 다음 부팅시 실행되도록 조작한다.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
항목에
(win2000, NT의 경우)
ICQ Net = c:\winnt\winlogon.exe -stealth
(WinXP의 경우)
ICQ Net = c:\windows\winlogon.exe -stealth
다음으로 .HTM, .HTML,, .TXT, .WAB 확장자를 지닌 파일에서 메일 주소를 수집하여 웜이 첨부된 메일을 발송한다
마지막으로 레지스트리에 Mydoom, Mimail, Bagle, 등이 생성한 값과 몇가지 레지스트리 값이 삭제 된다.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
항목에
Taskmon
Explorer
system.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
항목에
Taskmon
Explorer
KasperskyAv
system.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
항목에
system
또한 p2p 공유프로그램을 이용할때는 다음과 같은 이름으로 확산 된다.
1000 Sex and more.rtf.exe
3D Studio Max 3dsmax.exe
ACDSee 9.exe
Adobe Photoshop 9 full.exe
Adobe Premiere 9.exe
Ahead Nero 7.exe
Best Matrix Screensaver.scr
Clone DVD 5.exe
Cracks & Warez Archive.exe
Dark Angels.pif
Dictionary English - France.doc.exe
DivX 7.0 final.exe
Doom 3 Beta.exe
E-Book Archive.rtf.exe
Full album.mp3.pif
Gimp 1.5 Full with Key.exe
How to hack.doc.exe
IE58.1 full setup.exe
Keygen 4 all appz.exe
Learn Programming.doc.exe
Lightwave SE Update.exe
MS Service Pack 5.exe
Magix Video Deluxe 4.exe
Microsoft Office 2003 Crack.exe
Microsoft WinXP Crack.exe
Norton Antivirus 2004.exe
Opera.exe
Partitionsmagic 9.0.exe
Porno Screensaver.scr
RFC Basics Full Edition.doc.exe
Screensaver.scr 26KB
Serials.txt.exe 26KB
Smashing the stack.rtf.exe
Star Office 8.exe
Teen Porn 16.jpg.pif
The Sims 3 crack.exe
Ulead Keygen.exe
Virii Sourcecode.scr
Visual Studio Net Crack.exe
Win Longhorn Beta.exe
WinAmp 12 full.exe
WinXP eBook.doc.exe
Windows Sourcecode.doc.exe
XXX hardcore pic.jpg.exe
마지막으로 다음 ip 의 트레픽이 증가 될 수 있다.
145.253.2.171
151.189.13.35
193.141.40.42
193.189.244.205
193.193.144.12
193.193.158.10
194.25.2.129
194.25.2.130
194.25.2.131
194.25.2.132
194.25.2.133
194.25.2.134
195.185.185.195
195.20.224.234
212.185.252.136
212.185.252.73
212.185.253.70
212.44.160.8
212.7.128.162
212.7.128.165
213.191.74.19
217.5.97.137
62.155.255.16
|
|
|
|
| |
|
|
| 무단전재ㆍ배포금지 |
에브리존에서 제공하는 모든 컨텐츠 정보에 대한 저작권은 에브리존의 소유이며 관련법의 보호를 받습니다.
에브리존의 사전 허가 없이 에브리존 컨텐츠를 무단으로 전재, 배포를 금지되어 있습니다.
이를 위반하는 경우 손해배상의 대상 또는 민.형사상의 법적 소송 대상이 될 수 있습니다.
* 에브리존 정보 이용 문의 : greenking@everyzone.com |
|
|
|
|
