Phân tích tính chất vài trận DDoS HVA vừa qua.

Hì hì, lần này em gặp cục xương khó gặm nhất, bự bà cố luôn. Bao nhiêu tinh tuý của mấy anh stl dồn hết vào cái file rfc2616.txt này à ? Mình nó mang trong bụng gần 5-6 PE file vậy ? Hay lắm, size của rfc2616.txt sau khi decode ra chỉ vỏn vẹn 476KB.
Nói mấy anh stl không tin, sợ em nói dóc. Thôi em gởi mấy anh vài đoạn script sau đọc đỡ buồn:
Code:

//-------------------------------------------------------------
//--- 010 Editor v3.2 Script File
//
// File: DecodeRfcTxt.1sc
// Author: ThangCuAnh (TQN) 
// Revision: 1.0
// Purpose: Decode the Rfcxxx.txt files downloaded from:
//  1. http://news.pedto.com/rfc1945.txt
//  2. http://blogs.pinix.org/rfc1945.txt
//  3. http://analytics.dynn.info/rfc1945.txt
//  4. http://news.pedto.com/rfc2616.txt
//  5. http://blogs.pinix.org/rfc2616.txt
//  6. http://analytics.dynn.info/rfc2616.txt
//-------------------------------------------------------------
int i, j, size = FileSize();

if (size <= 0)
{
    MessageBox(idOk, "DecodeRfcTxt", "No file loaded or file empty.");
    return -1;
}

// Modify from 8th byte
for (i = 0, j = 0; i < size; i += 2, ++j)
{
    // Modify the current byte
    WriteUByte(j, ReadUByte(i) - 65 + 26 * (ReadUByte(i + 1) - 65));
}
DeleteBytes(j, size);

Thêm cái script này nữa:
Code:

//----------------------------------------------------------------
//--- 010 Editor v3.2 Script File
//
// File: DecodeRwoqv.1sc
// Author: ThangCuAnh (TQN) 
// Revision: 1.1
// Purpose: Decode and extract the embedded PE files in rwoqv.exe
//----------------------------------------------------------------
char Mask[] = "ï¾ÞNullsoftInst '";
char strBin[255];

int i, j, iFiles, curFile, newFile;
int64 liPos, fSize;

// Check that a file is open
if (FileCount() == 0)
{
    MessageBox(idOk, "DecodeBin", "DecodeBin can only be executed when a file is loaded.");
    return -1;
}

// Save the file index of current file
curFile = GetFileNum();

// Find the embedded PE files
liPos = FindFirst(Mask);
if (liPos < 0)
{
    MessageBox(idOk, "DecodeBin", "Could not find the mask of embedded PE files");
    return -1;
}

liPos += 20;
liPos += 0x100; // stl coder modified code here
iFiles = ReadInt(liPos);
liPos += sizeof(int);

Printf("Number of embedded PE files %d - Start at 0x%LX", iFiles, liPos);

for (i = 0; i < iFiles; ++i)
{
    fSize = ReadInt(liPos);
    liPos += sizeof(int);
    SetSelection(liPos, fSize);
    CopyToClipboard();

    newFile = FileNew();
    FileSelect(newFile);    // force select new file
    PasteFromClipboard();

    // Decode the new file
    for (j = 0; j < FileSize(); ++j)
    {
        // Modify the current byte
        WriteUByte(j, ReadUByte(j) ^ (( j & 7) + 0x3E));    // stl coder modified code here
    }
    SPrintf(strBin, "File%d.bin", i + 1);
    strBin = InputSaveFileName("Save decoded PE as", "All files (*.*)", strBin, ".bin");
    FileSave(strBin);

    // Switch to old file
    FileSelect(curFile);

    // Seek to next embedded PE file
    liPos += fSize;
}

Và cái tracker.cmd cùi bắp luôn:
Code:

@echo off

echo ==================================================================================================
echo Download cac file trojan, bot va DDOS config files cua stl malwares mao danh soft cua QuickTime
echo Cac ban gap 2 file nay: QTTask.exe va QTTask.dll thi kill va xoa ngay !!!!!!!!!!!!!!!!!!!!!!!!!!!!
echo ===================================================================================================
echo.

wget -t3 "http://news.pedto.com/rfc1945.txt" -O news.pedto.com_rfc1945.txt
wget -t3 "http://blogs.pinix.org/rfc1945.txt" -O blogs.pinix.org_rfc1945.txt
wget -t3 "http://analytics.dynn.info/rfc1945.txt" -O analytics.dynn.info_rfc1945.txt
wget -t3 "http://news.pedto.com/rfc2616.txt" -O news.pedto.com_rfc2616.txt
wget -t3 "http://blogs.pinix.org/rfc2616.txt" -O blogs.pinix.org_rfc2616.txt
wget -t3 "http://analytics.dynn.info/rfc2616.txt" -O analytics.dynn.info_rfc2616.txt

pause

Users currently in here

3 Anonymous