مرحباً بكم ، في هذا عدد الأول من برمجيات خبيثة سوف نتطرق إلى فيروس باك دور ,خبيث يقوم بفتح باب خلفي ان صح التعبير من اجل التنصت ومنح الهاكر.
اتصال امن باالجهاز وبذلك يحافظ الهاكر علي اتصاله باالضحية ويمكنه من تنزيل برمجيات اخري خبيثة علي الجهاز.وسوف نحاول تسليط الضوء على هذا الباكدور و كيفية ازالته من الجهاز.
لمحة عن Backdoor.Androm
هذا الباكدور يقوم بمنح المخربين اتصال خلفي مع جهاز الضحية ويمكنه من تحميل برمجيات اخري خبيثة الي الجهاز وايضا التلاعب به .بعض المعلومات التقنية عن هذا التروجان:
Backdoor.Androm يقوم باالتالي اثناء دخوله الي الجهاز
1_ انشاء مفاتيح الروجيستري التالية :
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x00000000
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x000001EF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x00000061
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x0000005B
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000355
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000544
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B9
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B3
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx: 09 00 00 00 01 00 00 00 03 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx: 01 00 00 00 0A 00 00 00 03 00 00 00 09 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx: 07 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx: 08 00 00 00 07 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x00000000
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x000001EF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x00000061
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x0000005B
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000355
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000544
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B9
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B3
2_يقوم ايضا باانشاء الملفات التالية :
Users\.....\AppData\Roaming\Windows\winmgr85.exe
Windows\Temp\TMP0000000497317E0621D23D9F
Windows\Temp\TMP0000000497317E0621D23D9F
Windows\Prefetch\SKT 1 [AUTO - INSTALLER].EXE-178C0216.pf
3_يقوم ايضا باانشاء البروسيس التالي RegAsm.exe ويتصل من خلالها باالانترنت
افضل وسيلة للقضاء على هذا الروتكيت :
نقوم بالتالي :
1- استخدام الاداة المشهورة لـ ايقاف البروسيسات الضارة RKill
2- استخدام اداة ComboFix
3-استخدام KaSpErSky ViRus ReMovAl TooL 2015
4- الفحص المباشر ببرنامج ESET Online Scanner
5- فحص الجهاز ببرنامج MalwareBytes Anti-Malware
6- Emsisoft Anti-Malware
7- واخيراً تنظيف الجهاز ببرنامج CCleaner
هذا الباكدور يقوم بمنح المخربين اتصال خلفي مع جهاز الضحية ويمكنه من تحميل برمجيات اخري خبيثة الي الجهاز وايضا التلاعب به .بعض المعلومات التقنية عن هذا التروجان:
Backdoor.Androm يقوم باالتالي اثناء دخوله الي الجهاز
1_ انشاء مفاتيح الروجيستري التالية :
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x00000000
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x000001EF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x00000061
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x0000005B
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000355
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000544
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B9
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B3
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx: 09 00 00 00 01 00 00 00 03 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx: 01 00 00 00 0A 00 00 00 03 00 00 00 09 00 00 00 08 00 00 00 06 00 00 00 07 00 00 00 05 00 00 00 04 00 00 00 02 00 00 00 00 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx: 07 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx: 08 00 00 00 07 00 00 00 06 00 00 00 01 00 00 00 05 00 00 00 04 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 FF FF FF FF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).x: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFF8300
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1366x768x96(1).y: 0xFFFFFFFF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x00000000
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).left: 0x000001EF
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x00000061
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).top: 0x0000005B
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000355
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).right: 0x00000544
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B9
HKU\S-1-5-21-2454437697-1701064923-3935294702-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1366x768x96(1).bottom: 0x000002B3
2_يقوم ايضا باانشاء الملفات التالية :
Users\.....\AppData\Roaming\Windows\winmgr85.exe
Windows\Temp\TMP0000000497317E0621D23D9F
Windows\Temp\TMP0000000497317E0621D23D9F
Windows\Prefetch\SKT 1 [AUTO - INSTALLER].EXE-178C0216.pf
3_يقوم ايضا باانشاء البروسيس التالي RegAsm.exe ويتصل من خلالها باالانترنت
افضل وسيلة للقضاء على هذا الروتكيت :
نقوم بالتالي :
1- استخدام الاداة المشهورة لـ ايقاف البروسيسات الضارة RKill
2- استخدام اداة ComboFix
3-استخدام KaSpErSky ViRus ReMovAl TooL 2015
4- الفحص المباشر ببرنامج ESET Online Scanner
5- فحص الجهاز ببرنامج MalwareBytes Anti-Malware
6- Emsisoft Anti-Malware
7- واخيراً تنظيف الجهاز ببرنامج CCleaner
اض٠تعليق:
0 تعليقات: