Voici ci-dessous le phénotype du malware Renos.aco qui est un storm worm utilisant plusieurs techniques.

Il se telecharge automatiquement via des sites webs publiques contamines par des ajouts de IFRAME, pour enfin pointer sur des serveurs hebergeurs du code malicieux Renos.

Description du PhénoType :

Ty-5;Trojan

Ty-7;Trojan Downloader

Ty-10;Storm Worm

Ty-36;Disable System Restore

Ty-3;Worm

Commande Non Documentee dans Base de connaissances Cariotypes de Blanchard (marc.blanchard@viruslab.ath.cx)

Ty-4;Virus

OS-130;Windows ALL

Pg-61;HTTP

Pg-78;Automatic download

Pg-84;AUTORUN

Pg-90;Download via other malware

%System%\lphc3pgj0e3ct.exe

%System%\blphc3pgj0e3ct.scr

%System%\lphc3pgj0e3ct.exe

%System%\blphc3pgj0e3ct.scr

%System%\lphc3pgj0e3ct.exe

%System%\blphc3pgj0e3ct.scr

%System%\phc3pgj0e3ct.bmp

Ex-182;HTTP

Ex-199;Automatic download

Ex-205;AUTORUN

Rm-216;Requette HTTP normalisee

%System%\lphc3pgj0e3ct.exe

%System%\blphc3pgj0e3ct.scr

%System%\phc3pgj0e3ct.bmp

Te-246;File creation

Te-249;Autorun

Te-251;desktop wallpaper change

Te-252;PE

Te-258;scr

Te-261;Residant en memoire

Te-262;Residant en memoire en mode sans echec

HKLM\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun = "0"HKLM\SYSTEM\CurrentControlSet\Services\sr\Start = "0"

HKLM\SYSTEM\CurrentControlSet\Services\sr\ImagePath = "\System32\DRIVERS\sr.sys"

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR = "0"

HKLM\SOFTWARE\Microsoft\Software Notifier

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc3pgj0e3ct

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage = "1"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage = "1"

HKCU\Software\Sysinternals\Bluescreen Screen Saver

HKCU\Control Panel\Colors\Background = "0 0 255"

HKCU\Control Panel\Desktop\ConvertedWallpaper = "%System%\phc3pgj0e3ct.bmp"

HKCU\Control Panel\Desktop\ScreenSaveActive = "1"

HKCU\Control Panel\Desktop\SCRNSAVE.EXE = "%System%\blphc3pgj0e3ct.scr"

HKCU\Control Panel\Desktop\TileWallpaper = "0"

HKCU\Control Panel\Desktop\Wallpaper = "%System%\phc3pgj0e3ct.bmp"

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\GeneralFlags = "0"