كرم P2P.HAREX.A
تاریخ : دوشنبه، 10 شهريور ماه ، 1382
موضوع : امنيت
با سلام خدمت همه عزيزان. طبق وعده اي كه داده بودم اولين مقاله رو در مورد اخرين كرم هاي اينترنتي فرستادم. P2P.HAREX.A يك كرم اينترنتي است كه توسط فايلهاي اشتراك گذاشته شده در كامپيوتر گسترش پيدا مي كنه. اين كرم يك فايل PE EXE ويندوزه و حداكثر حجمش (هنگامي كه توسط PE Patch Telockفشرده ميشه) 15 كيلو بايته.
اين كرم وقت نصب يه زير كاتالوگ رو به اسم "os32 " در شاخه ويندوز مي سازه و خودش رو با استفاده از نامهاي زير مي نويسه: Website Hacker.exe Html Hacker.exe Blowfish Decrypter.exe Upx Unpacker.exe Upx Unscrambler.exe Upx Decrypter.exe Upx Encrypter.exe PeCompact Unpacker.exe 32lite Unpacker.exe 624 Unpacker.exe aPack Unpacker.exe aplib Unpacker.exe avpack Unpacker.exe axe Unpacker.exe diet Unpacker.exe epack Unpacker.exe lglz Unpacker.exe lzexe Unpacker.exe megalite Unpacker.exe pack Unpacker.exe pklite Unpacker.exe pk smart Unpacker.exe pmode Unpacker.exe pro-pack Unpacker.exe rjcrush Unpacker.exe rucc Unpacker.exe syspack Unpacker.exe vacuum Unpacker.exe wwpack Unpacker.exe XE Unpacker.exe Xpack Unpacker.exe Aspack Unpacker.exe cExe Unpacker.exe pc shrinker Unpacker.exe Fsg Unpacker.exe Neolite Unpacker.exe Pe Diminisher Unpacker.exe Petite Unpacker.exe Gpx Unpacker.exe Gupx Unpacker.exe WWPack32 Unpacker.exe Hotmail hacker.exe aim hacker.exe msn hacker.exe mirc hacker.exe irc hacker.exe pirch hacker.exe outlook express hacker.exe outlook hacker.exe email hacker.exe pop hacker.exe smtp hacker.exe ssh hacker.exe telnet hacker.exe windows hacker.exe dos hacker.exe linux hacker.exe unix hacker.exe mac hacker.exe network hacker.exe nmapnt32.exe nmap.exe win32 hacker.exe win16 hacker.exe hacker.exe Borland c++ Crack.exe Microsoft C Crack.exe Microsoft C++ Crack.exe Microsoft Crack.exe Macromedia Crack.exe Windows Crack.exe Xp Crack.exe 2k Crack.exe 98 Crack.exe Encryption Crack.exe Fbi hack.exe Cia Hack.exe Whitehouse Camera.exe The Sims Superstar cheats.exe Wild Rides Water Park Factory cheats.exe Next Generation Tennis 2003 cheats.exe Finding Nemo cheats.exe Naval Campaigns Guadalcanal cheats.exe Squad Battles Advance of the Reich cheats.exe Enter the Matrix cheats.exe Rise of Nations cheats.exe Grand Theft Auto Vice City cheats.exe Magnetic cheats.exe Big Mutha Truckers cheats.exe Robocop cheats.exe Bloodrayne cheats.exe The Sims Superstar crack.exe Wild Rides Water Park Factory crack.exe Next Generation Tennis 2003 crack.exe Finding Nemo crack.exe Naval Campaigns Guadalcanal crack.exe Squad Battles Advance of the Reich crack.exe Enter the Matrix crack.exe Rise of Nations crack.exe Grand Theft Auto Vice City crack.exe Magnetic crack.exe Big Mutha Truckers crack.exe Robocop crack.exe Bloodrayne crack.exe The Sims Superstar update.exe Wild Rides Water Park Factory update.exe Next Generation Tennis 2003 update.exe Finding Nemo update.exe Naval Campaigns Guadalcanal update.exe Squad Battles Advance of the Reich cheats.exe Enter the Matrix cheats.exe Rise of Nations cheats.exe Grand Theft Auto Vice City cheats.exe Magnetic cheats.exe Big Mutha Truckers cheats.exe Robocop cheats.exe Bloodrayne cheats.exe The Sims Superstar crack.exe Wild Rides Water Park Factory crack.exe Next Generation Tennis 2003 crack.exe Finding Nemo crack.exe Naval Campaigns Guadalcanal crack.exe Squad Battles Advance of the Reich crack.exe Enter the Matrix crack.exe Rise of Nations crack.exe Grand Theft Auto Vice City crack.exe Magnetic crack.exe Big Mutha Truckers crack.exe Robocop crack.exe Bloodrayne crack.exe The Sims Superstar update.exe Wild Rides Water Park Factory update.exe Next Generation Tennis 2003 update.exe Finding Nemo update.exe Naval Campaigns Guadalcanal update.exe Squad Battles Advance of the Reich update.exe Enter the Matrix update.exe Rise of Nations update.exe Grand Theft Auto Vice City update.exe Magnetic update.exe Big Mutha Truckers update.exe Robocop update.exe Bloodrayne update.exe زير كاتالوگ اين كرم خودش رو در رجيستري ويندوز بصورت Local Content system file shares Kazaa and iMesh. ثبت مي كنه و به شكل زير وارد ميشه : HKCU>Software>Kazaa>LocalContent HKCU>Software>Kazaa>Transfer dir0 = 012345:%Windir%>system>os32> HKCU>Software>iMesh>Client>LocalContent dir0 = 012345:%Windir%>system>os32> اين كرم فايل 'cnets.Ocatch.com' رو از يه سرور از طريق اينترنت داونلود مي كنه. اين فايل شامل كاتالوگ فهرست ريشه, زير اسم 'Win32.exe' است . هنگامي كه اين فايل داونلود ميشه, كرم اونو بصورت exe در مياره. در اين صورت فايل 'Win32.exe' مثل يك نسخه جديد از كرم HAREX عمل ميكنه.
|