¿¡ºê¸®Á¸¼Ò°³ | Á¦Ç°¼Ò°³ | °í°´¼¾ÅÍ | »çÀÌÆ®¸Ê | Home
°³ÀÎ°í°´ ¿©¼º°í°´ eº¸¾È¸¶ÄÏ À̺¥Æ®
°³ÀÎ°í°´±â¾÷°í°´
º¸¾ÈÁ¢¼Ó IDÀúÀå
AD ¹«·á·Î Ã¥¹Þ¾Æ°¡¼¼¿ä!


 ¸ñ·Ï |  À­±Û |  ¾Æ·§±Û  
Backdoor-W32/SdBot.63488
 ¹ÙÀÌ·¯½º Á¾·ù
Backdoor
 ½ÇÇàȯ°æ
Windows
 ¹ß°ßÀÏ
2005³â07¿ù15ÀÏ
 Á¦ÀÛÁö
ºÒºÐ¸í
 À§Çèµî±Þ
º¸Åë
 È®»ê¹æ¹ý
³×Æ®¿öÅ©, º¸¾ÈÃë¾à¼º
 ¹ÙÀÌ·¯½º Å©±â
63,488 Bytes
 Ã·ºÎÆÄÀÏ
 ¸ÞÀÏÁ¦¸ñ
  
 Áõ»ó¿ä¾à
  Å¸ÄÏÀÌ µÇ´Â ½Ã½ºÅÛÀÇ Á¤º¸¿­¶÷, º¸¾È¼³Á¤ º¯°æ, ÇÁ·Î¼¼½º Á¾·á
 Ä¡·á¹æ¹ý

Åͺ¸¹é½Å Á¦Ç°±ºÀ¸·Î Áø´Ü/Ä¡·á °¡´ÉÇÕ´Ï´Ù.



  
 
»ó¼¼¼³¸í
³×Æ®¿öÅ© °øÀ¯ Æú´õ¿Í, À©µµ¿ì º¸¾ÈÆÐÄ¡ ÇêÁ¡µîÀ» ÀÌ¿ëÇؼ­ ÀüÆÄ¹× ¼³Ä¡µÈ´Ù.

Backdoor °¡ ½ÇÇà µÇ¸é, ÀϹÝÀûÀ¸·Î À©µµ¿ì Æú´õ
(win9x: C:\Windows, win XP: C:\Windows, win2000, NT : C:\WinNT)
¿¡ MCSECURE.EXE(63,488 Bytes) ÆÄÀÏÀÌ ¼³Ä¡µÈ´Ù.

±×¸®°í Hpdriver.sys(7,168 bytes)À» À©µµ¿ì ½Ã½ºÅÛ Æú´õ(win9x: C:\Windows\system, win XP: C:\Windows\system32, win2000, NT : C:\WinNT\system32)
¿¡ »ý¼ºÇÑ´Ù.

ÀÌ ÆÄÀÏÀº Åͺ¸¹é½Å Á¦Ç°±º¿¡¼­ Trojan-W32/AgentRootKit.7168·Î Áø´Ü ÇÑ´Ù.

À̶§ ÇØ´ç ÆÄÀÏÀÌ µ¿ÀÛÇÏ°Ô µÇ¸é ÀÚ½ÅÀ» ´ÙÀ½°ú °°ÀÌ ·¹Áö½ºÆ®¸®¿¡
µî·ÏµÇ¾î ´ÙÀ½ ºÎÆýà ½ÇÇàµÇµµ·Ï Á¶ÀÛ ÇÑ´Ù.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mcsecure
Ç׸ñ¿¡

(windows 9x, xp)
ImagePath = c:\windows\MCSECURE.EXE

(windows 2000, NT)
ImagePath = c:\winnt\MCSECURE.EXE

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mcsecure
Ç׸ñ¿¡

DisplayName = Mcsecure

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Hpdriver
Ç׸ñ¿¡

(windows 9x)
ImagePath = c:\windows\system\Hpdriver.sys

(windows xp)
ImagePath = c:\windows\system32\Hpdriver.sys

(windows 2000, NT)
ImagePath = c:\winnt\system\Hpdriver.sys

À» »ý¼ºÇÑ´Ù.

±×¸®°í ´ÙÀ½Ã³·³ À©µµ¿ì º¸¾È¼ÂÆÃÀ» Á¶ÀÛ ÇÑ´Ù.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Ç׸ñ¿¡

AntiVirusDisableNotify = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Ç׸ñ¿¡

FirewallDisableNotify = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Ç׸ñ¿¡

AntiVirusOverride = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Ç׸ñ¿¡

FirewallOverride = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
Ç׸ñ¿¡

UpdatesDisableNotify = "dword:00000001"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Ç׸ñ¿¡

DoNotAllowXPSP2 = "dword:00000001"

±âº»°ªÀº dword:00000000 ÀÌ´Ù.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
Ç׸ñ¿¡

EnableFirewall = "dword:00000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
Ç׸ñ¿¡

EnableFirewall = "dword:00000000"

ÀÇ À¯Àú ¼ÂÆÃÀ» º¯°æÇÑ´Ù.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
Ç׸ñ¿¡

Start = "dword:00000004"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Ç׸ñ¿¡

Start = "dword:00000004"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger
Ç׸ñ¿¡

Start = "dword:00000004"

±âº»°ªÀº dword:00000002 ÀÌ´Ù.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
Ç׸ñ¿¡

Start = "dword:00000004"

±âº»°ªÀº dword:00000003 ÀÌ´Ù.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
Ç׸ñ¿¡

WaitToKillServiceTimeout = "7000"

±âº»°ªÀº 20000 ÀÌ´Ù.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole
Ç׸ñ¿¡

EnableDCOM = "N"

±âº»°ªÀº Y ÀÌ´Ù.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
Ç׸ñ¿¡

restrictanonymous = "dword:00000001"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\
Ç׸ñ¿¡

AutoShareWks = "dword:00000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\
Ç׸ñ¿¡

AutoShareServer = "dword:00000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\
Ç׸ñ¿¡

AutoShareWks = "dword:00000000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters\
Ç׸ñ¿¡

AutoShareServer = "dword:00000000"

À¯Àú¼ÂÆà °ªÀ» º¯°æÇÑ´Ù.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update
Ç׸ñ¿¡

AUOption = "dword:00000001"

±âº»°ªÀº dword:00000000 ÀÌ´Ù.


¹éµµ¾î·Î¼­ µ¿ÀÛ ÇϰԵǸé, ´ÙÀ½°ú °°Àº ½Ã½ºÅÛ ¿Àµ¿ÀÛÀÌ ÀϾ ¼ö ÀÖ´Ù.

1. ÆÄÀÏ ½ÇÇà¹× »èÁ¦
2. Æ÷Æ®°¨½Ã
3. Å°º¸µå·Î ŸÀÌÇÎÇÑ ³»¿ëÀ» ÀúÀå
4. ÆÄÀÏ ´Ù¿î·Îµå
5. ÇÁ·Î¼¼½º Á¾·á
6. ftp¹× proxy ¼­¹ö·Î µ¿ÀÛ°¡´É
7. ½Ã½ºÅÛ Çϵå¿þ¾î Á¤º¸ ¼öÁý

±×¸®°í ÀÌ ¹éµµ¾î´Â ¸î¸î Worm ·ùÀÇ ½ÇÇàÀ» ¹æÇØ Çϸç ÇÁ·Î¼¼½ºÇà Á¾·á ½ÃÅ°´Â

±â´ÉÀ» °¡Áö°í ÀÖÀ¸³ª È®ÀεÇÁö ¾Ê¾Ò´Ù.

WebDav ¹öÆÛ ¿À¹ö Ç÷οì À§Çè, RPC/DCOM, RPCSS Servie,

LSASS ¿À·ù À§ÇèµîÀ» ÀÌ¿ëÇϹǷÎ, ´ÙÀ½ º¸¾ÈÆÐÄ¡¸¦ ±Ç°íÇÑ´Ù.

*MS03-007 À©µµ¿ì ±¸¼º¿ä¼Ò ¿À·ù
http://www.microsoft.com/korea/technet/security/bulletin/MS03-007.asp

*MS03-026 RPC ¹öÆÛ ¿À¹ö·± ¿À·ù
http://www.microsoft.com/korea/technet/security/bulletin/MS03-026.asp

*MS03-039 RPCSS ¼­ºñ½º ¹öÆÛ ¿À¹ö·± ¿À·ù
http://www.microsoft.com/korea/technet/security/bulletin/MS03-039.asp

*MS04-011 RPCSS ¿ø°ÝÄÚµå ½ÇÇà
http://www.microsoft.com/korea/technet/security/bulletin/MS03-039.asp
 
¿¹¹æ ¹× ¼öµ¿Á¶Ä¡¹æ¹ý
¹«´ÜÀüÀç¤ý¹èÆ÷±ÝÁö
¿¡ºê¸®Á¸¿¡¼­ Á¦°øÇÏ´Â ¸ðµç ÄÁÅÙÃ÷ Á¤º¸¿¡ ´ëÇÑ ÀúÀÛ±ÇÀº ¿¡ºê¸®Á¸ÀÇ ¼ÒÀ¯ÀÌ¸ç °ü·Ã¹ýÀÇ º¸È£¸¦ ¹Þ½À´Ï´Ù.
¿¡ºê¸®Á¸ÀÇ »çÀü Çã°¡ ¾øÀÌ ¿¡ºê¸®Á¸ ÄÁÅÙÃ÷¸¦ ¹«´ÜÀ¸·Î ÀüÀç, ¹èÆ÷¸¦ ±ÝÁöµÇ¾î ÀÖ½À´Ï´Ù.
À̸¦ À§¹ÝÇÏ´Â °æ¿ì ¼ÕÇعè»óÀÇ ´ë»ó ¶Ç´Â ¹Î.Çü»ç»óÀÇ ¹ýÀû ¼Ò¼Û ´ë»óÀÌ µÉ ¼ö ÀÖ½À´Ï´Ù.
                                                                 * ¿¡ºê¸®Á¸ Á¤º¸ ÀÌ¿ë ¹®ÀÇ : greenking@everyzone.com
 ¸ñ·Ï