#OCJP-095： 「Cutwail/PushDo」マルウェアがSAKURA-IDCの49.212.180.205 / jaje-kansai.netに発見しました！

下記のIP/ドメイン↓

49.212.180.205 / jaje-kansai.net

ネットワーク情報↓

inetnum:        49.212.180.0 - 49.212.180.255
netname:        SAKURA-NET
descr:          SAKURA Internet Inc.
country:        JP
admin-c:        KT749JP
tech-c:         JP00072233

ドメイン情報↓

Domain Name: JAJE-KANSAI.NET
Registrar: GMO INTERNET, INC. DBA ONAMAE.COM
Name Server: NS1.DNS.NE.JP，NS2.DNS.NE.JP
Status: ok
Updated Date: 25-oct-2012
Creation Date: 25-oct-2012
Expiration Date: 25-oct-2013

下記のWordPressのURLで「Cutwail/PushDo」トロイを発見しました↓

jaje-kansai.net/wp-content/plugins/p0.exe

ダウンロード証拠↓

--2013-03-10 14:34:47--  hxxp://jaje-kansai.net/wp-content/plugins/p0.exe
Resolving jaje-kansai.net... seconds 0.00, 49.212.180.205
Caching jaje-kansai.net => 49.212.180.205
Connecting to jaje-kansai.net|49.212.180.205|:80... seconds 0.00, connected.
  :
GET /wp-content/plugins/p0.exe HTTP/1.0
Host: jaje-kansai.net
Connection: keep-alive
HTTP request sent, awaiting response...
  :
HTTP/1.1 200 OK
Date: Sun, 10 Mar 2013 05:34:42 GMT
Server: Apache/2.2.23
Last-Modified: Tue, 05 Mar 2013 23:36:36 GMT
ETag: "3beeb7-bc00-4d735f1c06900"
Accept-Ranges: bytes
Content-Length: 48128
Keep-Alive: timeout=5, max=20
Connection: Keep-Alive
Content-Type: application/x-msdownload
200 OK
Registered socket 1896 for persistent reuse.
Length: 48128 (47K) [application/x-msdownload]
Saving to: `p0.exe'
2013-03-10 14:34:48 (1.08 MB/s) - `p0.exe' saved [48128/48128]

画像↓


ファイル情報；

2013/03/06  08:36 48,128 p0.exe　215bed64c594feaf8c9b88c58bbc0dad

バイナリーsナップショット(1st block)↓

0000   4D 5A 80 00 01 00 00 00 04 00 10 00 FF FF 00 00    MZ..............
0010   40 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00    @.......@.......
0020   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
0030   00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00    ................
0040   0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68    ........!..L.!Th
0050   69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F    is program canno
0060   74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20    t be run in DOS
0070   6D 6F 64 65 2E 0D 0A 24 00 00 00 00 00 00 00 00    mode...$........

ウイルストータルスキャン結果は証拠となります→URL

SHA256: 19e01b1eea408712a9d69f4a776618331924b090c92af9d4c9a9a38b9e184f56
SHA1:  bfb5fc194dfca1860650f0ae2d4fe2b6ff84f48c
MD5:  215bed64c594feaf8c9b88c58bbc0dad
File size:  47.0 KB ( 48128 bytes )
File name:  mairno.exe
File type:  Win32 EXE
Detection ratio: 30 / 46
Analysis date:  2013-03-10 07:42:29 UTC ( 0 minutes ago ) 

MicroWorld-eScan         : Trojan.Crypt.JP
nProtect                 : Trojan/W32.Packer.48128.AV
McAfee                   : RDN/Generic BackDoor!ep
Malwarebytes             : Backdoor.Bot
Symantec                 : W32.Pilleuz
Norman                   : Pushdo.D
ESET-NOD32               : Win32/Wigon.DC
TrendMicro-HouseCall     : TROJ_CUTWAIL.PT
Avast                    : Win32:Malware-gen
Kaspersky                : Backdoor.Win32.Pushdo.pqp
BitDefender              : Trojan.Crypt.JP
Agnitum                  : Backdoor.Pushdo!A2ItnZdFNRk
Sophos                   : Mal/Generic-S
Comodo                   : UnclassifiedMalware
F-Secure                 : Trojan.Crypt.JP
DrWeb                    : BackDoor.Siggen.51575
VIPRE                    : Trojan.Win32.Generic!BT
AntiVir                  : TR/Crypt.XPACK.Gen
TrendMicro               : TROJ_CUTWAIL.PT
McAfee-GW-Edition        : RDN/Generic BackDoor!ep
Emsisoft                 : Backdoor.Win32.Pushdo.AMN (A)
Kingsoft                 : Win32.Hack.Pushdo.p.(kcloud)
Microsoft                : TrojanDownloader:Win32/Cutwail.BS
GData                    : Trojan.Crypt.JP
Commtouch                : W32/Backdoor.TIFP-8489
PCTools                  : Malware.Pilleuz!rem
Ikarus                   : Backdoor.Win32.Pushdo
Fortinet                 : W32/Pushdo.PQP!tr.bdr
AVG                      : SHeur4.BCWF
Panda                    : Trj/OCJ.D

↑他のマルウェアファイルがある可能性が高いですので、
サイトの全体的にスキャンが必要です。
それとも、本件は間違い無くサーバのログイン情報が漏れた事件の影響ですので、
サーバの管理ログイン情報を変更して下さい。