2011. 11. 15. 16:10, 악성코드 상세분석
01.exe(3BDC8A7D5A8DDD71E58A5E85AFE43C27) 2011/01/xx
주요 핵심 루틴
1. exception
2. Anti - AntiVirus(AYAgent.aye SkyMon.exe),
(CreateToolhelp32Snapshot -> Process32First -> _stricmp -> OpenProcess -> TerminateProcess) 프로세스 종료 루틴
3. WFP unlock - sfc_os.dll #5
4. MoveFileExA ComRes.dll -> ComResA.dll
5. CreateFile(FindResourceA) -> ComRes.dll
6. delete itself (wsprintfA -> WinExec)
ps. dummy API - lstrcmpA
주요 핵심 루틴
1. exception
2. Anti - AntiVirus(AYAgent.aye SkyMon.exe),
(CreateToolhelp32Snapshot -> Process32First -> _stricmp -> OpenProcess -> TerminateProcess) 프로세스 종료 루틴
3. WFP unlock - sfc_os.dll #5
4. MoveFileExA ComRes.dll -> ComResA.dll
5. CreateFile(FindResourceA) -> ComRes.dll
6. delete itself (wsprintfA -> WinExec)
ps. dummy API - lstrcmpA
'악성코드 상세분석' 카테고리의 다른 글
| 625 mbr악성코드 간이 분석.. (625 mbr malware simple analysis) (0) | 2013.07.17 |
|---|---|
| Bootkit 심층분석 (0) | 2012.09.12 |
| ahnurl.sys 루트킷 드라이버 분석 (0) | 2012.04.06 |
| spoo1sv.exe 분석내용(이미지 포함) (1) | 2011.11.09 |
| spoo1sv.exe (1) | 2011.11.07 |
Comments, Trackbacks
