Trojan.MSIL.FRS.VSNW0BK24

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它添加下列文(wén)件夹：

• If -o | --output parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\headers
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\images
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\src
  
  Otherwise:
  • %Application Data%\EyeWitness_{Date}_{Time}
  • %Application Data%\EyeWitness_{Date}_{Time}\headers
  • %Application Data%\EyeWitness_{Date}_{Time}\images
  • %Application Data%\EyeWitness_{Date}_{Time}\src

(注意: %Application Data% 是当前用(yòng)户的 Application Data 文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)

它植入下列文(wén)件：

• If -o | --output parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\headers\{URL Accessed}.txt → contains the HTTP response headers from the captured webpage
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\images\{URL Accessed}.bmp → contains screenshot of the webpage as rendered by EyeWitness
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\src\{URL Accessed}.txt → contains the full HTML, JavaScript, and CSS source code of the webpage
  • {Path Set by the User}\EyeWitness_{Date}_{Time}\report_page1.html → contains the generated report, showing details of the web request, HTTP headers, source code, and a screenshot of the captured webpage
  
  Otherwise:
  • %Application Data%\EyeWitness_{Date}_{Time}\headers\{URL Accessed}.txt
  • %Application Data%\EyeWitness_{Date}_{Time}\images\{URL Accessed}.bmp
  • %Application Data%\EyeWitness_{Date}_{Time}\src\{URL Accessed}.txt
  • %Application Data%\EyeWitness_{Date}_{Time}\report_page1.html
    
    
• It compresses the above files into the following if -c | --compress parameter is used:
  • {Path Set by the User}\EyeWitness_{Date}_{Time}.zip or
  • %Application Data%\EyeWitness_{Date}_{Time}.zip

(注意: %Application Data% 是当前用(yòng)户的 Application Data 文(wén)件夹，通常位于 C:\Windows\Profiles\{user name}\Application Data (Windows 98 和 ME)、C:\WINNT\Profiles\{user name}\Application Data (Windows NT)、C:\Documents and Settings\{user name}\Local Settings\Application Data (Windows 2000(32-bit)、XP 和 Server 2003(32-bit)) 和 C:\Users\{user name}\AppData\Roaming (Windows Vista、7、8、8.1、2008(64-bit)、2012(64-bit) 和 10(64-bit))。)

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It captures screenshots of web pages, analyzing HTTP responses, and generating reports for reconnaissance and security assessments.
• It uses the following version of EyeWitness:
  • EyeWitness v1.1