CreateMutex
까보면 다나와~

온라인 게임 드롭퍼
01.exe(3BDC8A7D5A8DDD71E58A5E85AFE43C27) 2011/01/xx

주요 핵심 루틴
1. exception
2. Anti - AntiVirus(AYAgent.aye SkyMon.exe),
 (CreateToolhelp32Snapshot -> Process32First -> _stricmp -> OpenProcess -> TerminateProcess) 프로세스 종료 루틴
3. WFP unlock - sfc_os.dll #5
4. MoveFileExA ComRes.dll -> ComResA.dll
5. CreateFile(FindResourceA) -> ComRes.dll
6. delete itself (wsprintfA -> WinExec)

ps. dummy API - lstrcmpA
  Comments,   0  Trackbacks
댓글 쓰기