BLOGMATION

Analisa Virus Flyfff666

*Nama File : Twilight.exe
*Version Info :
- CompiledScript: AutoIt v3 Script : 3, 3, 0, 0
- File Version : 3, 3, 0, 0
- Language : English (United Kingdom)
*Sumber : MorphostLab Virus Collection – Januari 2010
*Nama Virus :
- Kudosoft VirLab : Flyff666
- Morphost Expert : n/a
- Smadav 2010 Rev 8.0 : n/a
- Ansav 2.035 Upd 106 : W32/Autoit.36
- Pcmav 2.3 Build 1 : n/a
- Pcmav Ragnaro Beta 1 : n/a
- CMC PH#3-1 : n/a
- EuraAV 1.8.0.6: n/a
*Ukuran : 270.336 bytes [Packed with UPX]
*Compiler : Autoit v3.3.0.0
*Icon : 7zip SFX
*Level : -
*Checksum : File dg ** memiliki checksum yang sama
CRC32: C26D183F
MD5: CB465A4BC4F20B493E59D26F96BB9EB2
SHA-1: 7366C42FCB64E0FB1FDB3BA946B84028CF5A92D0
*Proses Aktif :
- ~F~l~y~f~f~666.exe
*Membuat / mengcopy file ke :
- C:\Windows\system32\~F~l~y~f~f~666.exe ** [Hidden, System]
- F:\~F~l~y~f~f~666.exe ** [Hidden, System]
- Virus membuat beberapa file di root drive dengan nama yang sama dengan folder yang ada, folder asli dihidden
*Analisa Registry :
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr,1,Dibuat
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools,1,Dibuat
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind,1,Dibuat
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden,0,Diubah
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title,HACKED BY FLYFF 666,Dibuat
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption,h4×0r3d By : Flyff 666,Dibuat
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText,Saya Adalah Program Jahat Yang Mengambil Alih Komputer kalian !! By : Flyff 666_VM,dibuat
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\System, C:\Windows\system32\~F~l~y~f~f~666.exe,dibuat
*Efek lain :
- Setiap startup, akan ada pesan dibawah ini :
h4×0r3d By : Flyff 666
Saya Adalah Program Jahat Yang Mengambil Alih Komputer kalian !! By : Flyff 666_VM
- Ketika akan menjalankan task manager dan regedit, komputer akan restart
*Analyzed by:
Muamar Kudo – [Kudosoft Founder] [MorphostLab Independent Team]
Blog: http://www.kudosoft.co.nr http://www.morphostlab.co.nr
Email, FB : muamar.kudo@gmail.com
18:23 Jumat, Februari 12, 2010

Label: Anti Virus

diposting oleh Muhammad Ardi @ 13.34