Shit

Merde

Per generare indirizzi utilizza le seguenti stringhe: • B4bb1cool; SpawN; jojo; mansonisme; Yoseph2000; 12050075; CoolMan; BabbyBear; Jagung-Bakar; MooNLight; Juwita; Davis; Titta; Anata; Emily; HellSpawn; Lia; Fria; admin; SaZZA; BInaSarana; Shit; JuwitaNingrum; HackersMinds; telkom; astaga; boleh; PLASA; indo; warung; gaul; id
http://www.avira.com/it/thr [...] _vb.bs.2.html

Pour produire des adresses il utilise les chaînes de caractères suivantes: • B4bb1cool; SpawN; jojo; mansonisme; Yoseph2000; 12050075; CoolMan; BabbyBear; Jagung-Bakar; MooNLight; Juwita; Davis; Titta; Anata; Emily; HellSpawn; Lia; Fria; admin; SaZZA; BInaSarana; Shit; JuwitaNingrum; HackersMinds; telkom; astaga; boleh; PLASA; indo; warung; gaul; id
http://www.avira.com/fr/thr [...] _vb.bs.2.html

Password: shit - Questo malware ha la capacità di recuperare ed inviare informazioni quali: • Velocità della CPU • Utente corrente • Dettagli sui driver • Spazio libero su disco • Memoria libera • Informazioni sulla rete • Dimensione della memoria • Nome Utente • Informazioni sul sistema operativo Windows - In più ha la capacità di effettuare azioni quali: • Download di file • Eseguire file • Inviare email • Aggiornarsi
http://www.avira.com/it/thr [...] mytob.fe.html

Mot de passe: shit - Ce Malware a la capacité de ramasser et d'envoyer des informations tel que: • Vitesse du CPU • Utilisateur courant • Détails sur les pilots • Espace libre sur le disque dur • Mémoire libre • Information sur le réseau • Taille de mémoire • Nom d'utilisateur • Information sur le système d'exploitation Windows - Ensuite il a la capacité d'opérer des actions tel que: • Télécharger un fichier • Exécuter un fichier • Envoyer des e-mails • Se mettre à jour tout seul
http://www.avira.com/fr/thr [...] mytob.fe.html

- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run • "Win32 Driver"="activesx.exe" - HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce • "Win32 Driver"="activesx.exe" - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce • "Win32 Driver"="activesx.exe" - HKCU\Software\Microsoft\Windows\CurrentVersion\Run • "Win32 Driver"="activesx.exe" - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices • "Win32 Driver"="activesx.exe" Le seguenti chiavi di registro vengono aggiunte per caricare il servizio dopo il riavvio: - HKLM\SYSTEM\CurrentControlSet\Services\shit • "Type"=dword:00000020 • "Start"=dword:00000004 • "ErrorControl"=dword:00000001 • "ImagePath"="
http://www.avira.com/it/thr [...] t.121772.html

- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run • "Win32 Driver"="activesx.exe" - HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce • "Win32 Driver"="activesx.exe" - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce • "Win32 Driver"="activesx.exe" - HKCU\Software\Microsoft\Windows\CurrentVersion\Run • "Win32 Driver"="activesx.exe" - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices • "Win32 Driver"="activesx.exe" Les clés de registre suivantes sont ajoutées afin de charger le service après le redémarrage: - HKLM\SYSTEM\CurrentControlSet\Services\shit • "Type"=dword:00000020 • "Start"=dword:00000004 • "ErrorControl"=dword:00000001 • "ImagePath"="
http://www.avira.com/fr/thr [...] t.121772.html

Le seguenti chiavi di registro vengono aggiunte per eseguire i processi dopo il riavvio: - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] • "Win32 Driver"="svchosts.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] • "Win32 Driver"="svchosts.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "Win32 Driver"="svchosts.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] • "Win32 Driver"="svchosts.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] • "Win32 Driver"="svchosts.exe" Le seguenti chiavi di registro vengono aggiunte per caricare il servizio dopo il riavvio: - [HKLM\SYSTEM\CurrentControlSet\Services\shit] • "Type"=dword:00000020 • "Start"=dword:00000004 • "ErrorControl"=dword:00000001 • "ImagePath"="
http://www.avira.com/it/thr [...] ot.97918.html

Les clés de registre suivantes sont ajoutées afin d'exécuter des processus après le redémarrage: - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] • "Win32 Driver"="svchosts.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] • "Win32 Driver"="svchosts.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "Win32 Driver"="svchosts.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] • "Win32 Driver"="svchosts.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] • "Win32 Driver"="svchosts.exe" Les clés de registre suivantes sont ajoutées afin de charger le service après le redémarrage: - [HKLM\SYSTEM\CurrentControlSet\Services\shit] • "Type"=dword:00000020 • "Start"=dword:00000004 • "ErrorControl"=dword:00000001 • "ImagePath"="
http://www.avira.com/fr/thr [...] ot.97918.html

Le seguenti chiavi di registro vengono aggiunte per eseguire i processi dopo il riavvio: - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] • "Windows Application 32"="WinApp32.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] • "Windows Application 32"="WinApp32.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "Windows Application 32"="WinApp32.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] • "Windows Application 32"="WinApp32.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] • "Windows Application 32"="WinApp32.exe" Vengono aggiunte nel registro le seguenti chiavi con lo scopo di caricare i servizi dopo il riavvio: - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Security] • "Security"=hex:
http://www.avira.com/it/thr [...] t.117152.html

Les clés de registre suivantes sont ajoutées afin d'exécuter des processus après le redémarrage: - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] • "Windows Application 32"="WinApp32.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] • "Windows Application 32"="WinApp32.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "Windows Application 32"="WinApp32.exe" - [HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce] • "Windows Application 32"="WinApp32.exe" - [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] • "Windows Application 32"="WinApp32.exe" Les clés de registre suivantes sont ajoutées afin de charger les services après le redémarrage: - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Security] • "Security"=hex:
http://www.avira.com/fr/thr [...] t.117152.html

\svchosts.exe" -netsvcs • "DisplayName"="Win32 Driver" • "ObjectName"="LocalSystem" • "FailureActions"=hex:ff,ff,ff,ff,00,00,00,00,00,00,00,00,01,00,00,00,69,00,76,\ • 00,01,00,00,00,01,00,00,00 • "DeleteFlag"=dword:00000001 Vengono aggiunte le seguenti chiavi di registro: - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Security] • "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\ 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\ 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\ 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Enum] • "0"="Root\\LEGACY_SHIT\\0000" • "Count"=dword:00000001 • "NextInstance"=dword:00000001 - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT] • "NextInstance"=dword:00000001 - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT\0000] • "Service"="shit" • "Legacy"=dword:00000001 • "ConfigFlags"=dword:00000000 • "Class"="LegacyDriver" • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" • "DeviceDesc"="Win32 Driver" - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT\0000\Control] • "*NewlyCreated*"=dword:00000000 • "ActiveService"="shit"
http://www.avira.com/it/thr [...] ot.97918.html

\svchosts.exe" -netsvcs • "DisplayName"="Win32 Driver" • "ObjectName"="LocalSystem" • "FailureActions"=hex:ff,ff,ff,ff,00,00,00,00,00,00,00,00,01,00,00,00,69,00,76,\ • 00,01,00,00,00,01,00,00,00 • "DeleteFlag"=dword:00000001 Les clés de registre suivantes sont ajoutée: - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Security] • "Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\ 00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\ 00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\ 05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\ 20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\ 00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\ 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00 - [HKLM\SYSTEM\CurrentControlSet\Services\shit\Enum] • "0"="Root\\LEGACY_SHIT\\0000" • "Count"=dword:00000001 • "NextInstance"=dword:00000001 - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT] • "NextInstance"=dword:00000001 - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT\0000] • "Service"="shit" • "Legacy"=dword:00000001 • "ConfigFlags"=dword:00000000 • "Class"="LegacyDriver" • "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" • "DeviceDesc"="Win32 Driver" - [HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SHIT\0000\Control] • "*NewlyCreated*"=dword:00000000 • "ActiveService"="shit"
http://www.avira.com/fr/thr [...] ot.97918.html

Per assicurarsi la propria propagazione, il malware tenta di connettersi ad altre macchine come descritto qui sotto: Fa una copia di se stesso nella seguente condivisione di rete: • $IPC Utilizza le seguenti informazioni di login per aprirsi l'accesso alla macchina remota: - Una lista di Nomi utente e Password: • asdfgh; server; 000; 0000; 00000; 000000; 0000000; 00000000; 123; 1234; 12345; 123456; 1234567; 12345678; 123456789; secret; secure; security; setup; shadow; shit; sql; super; sys; system; abc; abc123; access; adm; alpha; anon; anonymous; backdoor; backup; beta; bin; coffee; computer; crew; database; debug; default; demo; free; guest; hello; install; internet; login; mail; manager; money; monitor; network; new; newpass; nick; nobody; nopass; one; oracle; pass; passwd; password; poiuytre; private; pub; public; qwerty; random; real; remote; ruler; telnet; temp; test; test1; test2; visitor; web; windows; www
http://www.avira.com/it/thr [...] 180736.7.html

Il s'autocopie dans le partage réseau suivant: • $IPC Il emploie les informations d'identification suivantes afin de gagner accès à la machine distante: - Une liste de noms d'utilisateurs et de mots de passe: • asdfgh; server; 000; 0000; 00000; 000000; 0000000; 00000000; 123; 1234; 12345; 123456; 1234567; 12345678; 123456789; secret; secure; security; setup; shadow; shit; sql; super; sys; system; abc; abc123; access; adm; alpha; anon; anonymous; backdoor; backup; beta; bin; coffee; computer; crew; database; debug; default; demo; free; guest; hello; install; internet; login; mail; manager; money; monitor; network; new; newpass; nick; nobody; nopass; one; oracle; pass; passwd; password; poiuytre; private; pub; public; qwerty; random; real; remote; ruler; telnet; temp; test; test1; test2; visitor; web; windows; www
http://www.avira.com/fr/thr [...] 180736.7.html

Per assicurarsi la propria propagazione, il malware tenta di connettersi ad altre macchine come descritto qui sotto: Utilizza le seguenti informazioni di login per aprirsi l'accesso alla macchina remota: - Una lista di Nomi utente e Password: • www; windows; web; visitor; test2; test1; test; temp; telnet; ruler; remote; real; random; qwerty; public; pub; private; poiuytre; password; passwd; pass; oracle; one; nopass; nobody; nick; newpass; new; network; monitor; money; manager; mail; login; internet; install; hello; guest; free; demo; default; debug; database; crew; computer; coffee; bin; beta; backup; backdoor; anonymous; anon; alpha; adm; access; abc123; abc; system; sys; super; sql; shit; shadow; setup; security; secure; secret; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 00000000; 0000000; 000000; 00000; 0000; 000; server; asdfgh; admin; root
http://www.avira.com/it/thr [...] m_botsie.html

Il emploie les informations d'identification suivantes afin de gagner accès à la machine distante: - Une liste de noms d'utilisateurs et de mots de passe: • www; windows; web; visitor; test2; test1; test; temp; telnet; ruler; remote; real; random; qwerty; public; pub; private; poiuytre; password; passwd; pass; oracle; one; nopass; nobody; nick; newpass; new; network; monitor; money; manager; mail; login; internet; install; hello; guest; free; demo; default; debug; database; crew; computer; coffee; bin; beta; backup; backdoor; anonymous; anon; alpha; adm; access; abc123; abc; system; sys; super; sql; shit; shadow; setup; security; secure; secret; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 00000000; 0000000; 000000; 00000; 0000; 000; server; asdfgh; admin; root
http://www.avira.com/fr/thr [...] m_botsie.html

Utilizza le seguenti informazioni di login per aprirsi l'accesso alla macchina remota: - Una lista di Nomi utente e Password: • www; windows; web; visitor; test2; test1; test; temp; telnet; ruler; remote; real; random; qwerty; public; pub; private; poiuytre; password; passwd; pass; oracle; one; nopass; nobody; nick; newpass; new; network; monitor; money; manager; mail; login; internet; install; hello; guest; free; demo; default; debug; database; crew; computer; coffee; bin; beta; backup; backdoor; anonymous; anon; alpha; adm; access; abc123; abc; system; sys; super; sql; shit; shadow; setup; security; secure; secret; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 00000000; 0000000; 000000; 00000; 0000; 000; server; asdfgh; admin; root
http://www.avira.com/it/thr [...] vanbot.n.html

Il emploie les informations d'identification suivantes afin de gagner accès à la machine distante: - Une liste de noms d'utilisateurs et de mots de passe: • www; windows; web; visitor; test2; test1; test; temp; telnet; ruler; remote; real; random; qwerty; public; pub; private; poiuytre; password; passwd; pass; oracle; one; nopass; nobody; nick; newpass; new; network; monitor; money; manager; mail; login; internet; install; hello; guest; free; demo; default; debug; database; crew; computer; coffee; bin; beta; backup; backdoor; anonymous; anon; alpha; adm; access; abc123; abc; system; sys; super; sql; shit; shadow; setup; security; secure; secret; 123456789; 12345678; 1234567; 123456; 12345; 1234; 123; 00000000; 0000000; 000000; 00000; 0000; 000; server; asdfgh; admin; root
http://www.avira.com/fr/thr [...] vanbot.n.html