MytobÀÇ º¯Á¾ ±Þ¼Ó È®»ê
Mytob´Â Windows PE EXE ÆÄÀÏ·Î ¾à 43KBÀ̸ç FSGÇüÅ·Π¾ÐÃàµÇ¾î ÀÖ´Ù. ¾ÐÃàÇØÁ¦ ½Ã ¾à
143KBÀ̸ç Mytob´Â Windows LSASS ¼ºñ½ºÀÇ Ãë¾àÁ¡°ú °¨¿°µÈ ¸Þ½ÃÁöÀÇ Ã·ºÎ ÆÄÀÏ ÇüÅÂ
·Î ÀüÆĵȴÙ. MytobÀº ÇÇÇØ ÄÄÇ»ÅÍ¿¡¼ ¼öÁýÇÑ À̸ÞÀÏ ÁÖ¼Ò·Î ÀÚ½ÅÀ» ¹ß¼ÛÇϸç Mydoom
ÀÇ ¼Ò½ºÄڵ带 ±â¹ÝÀ¸·Î Á¦ÀÛ µÇ¾ú´Ù. ¶ÇÇÑ IRCä³ÎÀ» ÅëÇØ Á¦¾îµÇ´Â ¹éµµ¾î ±â´ÉÀ» Æ÷ÇÔ
ÇÏ°í ÀÖ´Ù.
°¨¿° °æ·Î
½ÇÇàÀÌ µÇ¸é Mytob´Â ÀÚ½ÅÀ» Windows ½Ã½ºÅÛ µð·ºÅ丮¿¡ sky.exe·Î º¹»çÇÑ´Ù.
%System%sky.exe
±×¸®°í ½Ã½ºÅÛ ·¹Áö½ºÆ®¸®¿¡ µî·ÏÇÑ´Ù.
[HKCUSoftwareMicrosoftWindowsCurrentVersionRun]
[HKLMSoftwareMicrosoftWindowsCurrentVersionRun]
[HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices]
[HKCUSYSTEMCurrentControlSetControlLsa]
[HKCUSoftwareMicrosoftOLE]
LSASS Ãë¾àÁ¡À» ÀÌ¿ëÇÑ ÀüÆÄ
Mytob´Â °ø°ÝÇÒ IP ÁÖ¼Ò¸¦ ¼±ÅÃÇÏ°í TCP 445¹ø Æ÷Æ®·Î ¿äûÀ» Àü¼ÛÇÑ´Ù. ¸¸ÀÏ ¿ø°Ý ÄÄÇ»ÅÍ
°¡ ÀÀ´äÀ» Çϸé Mytob´Â LSASS Ãë¾àÁ¡À» ¾Ç¿ëÇÏ¿© ÀÚ½ÅÀ» ÇÇÇØ ÄÄÇ»ÅÍ¿¡ ½ÇÇàÇÑ´Ù.
EmailÀ» ÅëÇÑ ÀüÆÄ
Mytob´Â ÇÇÇØ ÄÄÇ»ÅÍ ³»¿¡¼ À̸ÞÀÏ ÁÖ¼Ò¸¦ ¼öÁýÇÏ°í ´ÙÀ½ÀÇ È®ÀåÀÚ¸¦ °¡Áö´Â ÆÄÀÏÀ» °Ë
»öÇÑ´Ù.
adb asp dbx htm php pl sht tbb wab
Mytob´Â ´ÙÀ½ÀÇ È®ÀåÀÚ¸¦ °¡Áö´Â ½ºÆ®¸µÀº ¹«½ÃÇÑ´Ù.
.edu .gov .mil accoun acketst admin anyone arin. avp berkeley borlan bsd
bugs ca certific contact example feste fido foo. fsf. gnu gold-certs google gov. help hotmail
iana ibm.com icrosof icrosoft ietf info inpris isc.o isi.e kernel linux listserv math me
mit.e mozilla msn. mydomai no nobody nodomai noone not nothing ntivi page
panda pgp postmaster privacy rating rfc-ed ripe. root ruslis samples secur
sendmail service site soft somebody someone sopho submit support syma tanford.e
the.bat unix usenet utgers.ed webmaster you your
Mytob´Â °¨¿°µÈ ¸Þ½ÃÁö¸¦ Àü¼ÛÇϱâ À§ÇØ SMTP ¼¹ö¿Í Á÷Á¢ ¿¬°áÀ» »ý¼ºÇÑ´Ù.
¿ø°Ý Á¦¾î
MytobÀº IRC ä³ÎÀ» ÅëÇØ ¸í·ÉÀ» ¼ö½ÅÇϱâ À§ÇÏ¿© ÇÇÇØ ÄÄÇ»ÅÍÀÇ TCP 6667 Æ÷Æ®¸¦ °³¹æÇÑ
´Ù. ¿ø°Ý ¾Ç¼º »ç¿ëÀÚ´Â °¨¿°µÈ ÇÇÇØ ÄÄÇ»ÅÍ¿¡ ¸ðµç ±ÇÇÑÀ» ¾ò°Ô µÇ¾î ÀÚ·áÀÇ ´Ù¿î·Îµå, ½Ç
Çà, ÆÄÀÏÀÇ »èÁ¦µîÀÇ ÀÛ¾÷À» ¼öÇàÇÏ°Ô µÈ´Ù.
|