• ͺ
Ʈ
ȱǰ
 ̷
Ǽڵ
ϱ
 Ȱ溸
Level3 :
ֽ Ʈ Ȳ   document.write("2017.12.14.0");
̷ Űϱ
̷
   
 μ  
Trojan-W32/Magania.200704.C
̷ Trojan ȯ
߰ 01010101 ߱
Ȯ ̵ĵ̺
̷ ũ 200704 ÷
׶ ϸ, ϴ Ʈ
ġ

ͺ ǰ /ġ մϴ.

̵ ̺긦 Ͻ Ͻñ ٶϴ .

 


ͺ IS ü  ͺ IS
󼼼
׶ ϸ, ϴ Ʈ ̸,

USB  ̵ĵ̺ ޼ ߻.

 

 

ϻ:

%Temp%\105703_fer.temp

%System%\CRESS.com

%System%\NWCWorkstationfd.d11

 

 

Ʈ Ű :

[HKEY_LOCAL_MACHINE

 \SOFTWARE

  \Microsoft

   \Windows

    \CurrentVersion

     \policies

      \Explorer

       \Run]

 

[HKEY_LOCAL_MACHINE

 \SYSTEM

  \ControlSet001

   \Enum

    \Root

     \LEGACY_NWCWORKSTATION]

 

[HKEY_LOCAL_MACHINE

 \SYSTEM

  \ControlSet001

   \Services

    \NWCWorkstation]

 

[HKEY_LOCAL_MACHINE

 \SYSTEM

  \CurrentControlSet

   \Enum

    \Root

     \LEGACY_NWCWORKSTATION]

 

[HKEY_LOCAL_MACHINE

 \SYSTEM

  \CurrentControlSet

   \Services

    \NWCWorkstation\Enum]

 

 

Ʈ :

[HKEY_LOCAL_MACHINE

 \SOFTWARE

  \Microsoft

   \Windows

    \CurrentVersion

     \policies

      \system]

legalnoticecaption = ""

legalnoticetext = ""

 

 

  ġ

̵ ̺ ڵ Ͻ ð, Ž⸦ ̿Ͽ ̺ Ȯ Ǵ Ͻñ ٶϴ.


Ȯ


 


1.    []-[]-[cmd]



 





 


2.    %System% dir/ah



 



3.    ϵ CRESS.com NWCWorkstationfd.d11 (Ÿ NETSVCS_0x0fd.d11, NETSVCS_0x1fd.d11, NETSVCS_0x2fd.d11, NETSVCS_0x3fd.d11, NETSVCS_0x4fd.d11 ) Ȯ



 



4.    ۾ڿ CRESS.com Ȯ





ġ (ӽ )


 


1.    ۾ڿ CRESS.com



 



2.    NWCWorkstation




 



3.    Cmd %system% Ӽ


(Attrib –s –r –h  CRESS.com


Attrib –s –r –h  NWCWorkstationfd.d11


Attrib –s –r –h  NETSVCS_*.d11)



 



4.    Cmd %system% ش


(del CRESS.com


del  NETSVCS_*.d11)




 


5.    []-[]-[regedit]




 


6.    شŰ ( Run )


([HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run]


CRESS = "CRESS.COM") 



      



7.    Ʈ Ű (Start = 0x00000002 -> Start = 0x00000004 NWCWorkstation )


([HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NWCWorkstation]


Start = 0x00000004)         




 



8.    Ʈ Ű (NETSVCS_0x0 Ű )


 ([HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NETSVCS_0x0])




 



9.     Cmd %system% ش (del  NWCWorkstationfd.d11)




 




legalnoticecaption = ""


legalnoticetext = "")


1.    []-[]-[regedit]




 


2.    Ʈ ̵


([HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system])




 



3.    ش ڿ


("legalnoticecaption", "legalnoticetext")





        



Ϻ
- 긮 ϴ ۱ 긮 ̸ ù ȣ ޽ϴ.
- 긮 㰡 긮 , Ǿ ֽϴ.
- ̸ ϴ ع Ǵ . Ҽ ֽϴ.
* 긮 ̿ : greenking@everyzone.com