Kasadar Malware Mai Hakuri, Sashe na I

Da wannan labarin za mu fara jerin wallafe-wallafe game da malware masu wuya. Shirye-shiryen shiga ba tare da fayil ba, kuma aka sani da shirye-shiryen shiga ba tare da fayil ba, yawanci suna amfani da PowerShell akan tsarin Windows don gudanar da umarni cikin shiru don bincika da fitar da abun ciki mai mahimmanci. Gano ayyukan hacker ba tare da munanan fayiloli ba abu ne mai wahala, saboda... Antivirus da sauran tsarin ganowa da yawa suna aiki bisa nazarin sa hannu. Amma labari mai dadi shine cewa irin wannan manhaja ta wanzu. Misali, UBA tsarin, iya gano munanan ayyuka a cikin tsarin fayil.

A lokacin da na fara bincike kan batun masu satar kutse, rashin amfani da hanyoyin gargajiya na kamuwa da cuta, amma kawai kayan aiki da software da ake samu akan kwamfutar wanda aka azabtar, ban san cewa nan ba da jimawa wannan zai zama sanannen hanyar kai hari. Ma'aikatan Tsaro ka cecewa wannan ya zama wani Trend, kuma kanun labarai masu ban tsoro - tabbatar da hakan. Saboda haka, na yanke shawarar yin jerin littattafai akan wannan batu.

Babban kuma Mai ƙarfi PowerShell

Na rubuta game da wasu daga cikin waɗannan ra'ayoyin a baya PowerShell jerin rufewa, amma fiye da dogara akan ra'ayi na ka'idar. Daga baya na ci karo gidan yanar gizo don nazarin matasan, inda za ku iya samun samfurori na malware "wanda aka kama" a cikin daji. Na yanke shawarar gwada amfani da wannan rukunin yanar gizon don nemo samfuran malware marasa fayil. Kuma na yi nasara. Af, idan kana so ka ci gaba da balaguron farauta na malware, dole ne a tabbatar da ku ta wannan rukunin yanar gizon don su san kuna yin aikin a matsayin ƙwararren farar hula. A matsayin mai rubutun ra'ayin yanar gizo na tsaro, na wuce ba tare da tambaya ba. Na tabbata kai ma za ka iya.

Baya ga samfurori da kansu, a kan shafin za ku iya ganin abin da waɗannan shirye-shiryen suke yi. Haɗaɗɗen bincike yana gudanar da malware a cikin akwatin sand ɗinsa kuma yana sa ido kan kiran tsarin, tafiyar matakai da ayyukan cibiyar sadarwa, kuma yana fitar da igiyoyin rubutu masu tuhuma. Don binaries da sauran fayilolin aiwatarwa, i.e. inda ba za ku iya duba ainihin lambar matakin ba, nazarin matasan yana yanke shawarar ko software ɗin tana da ƙeta ko kuma kawai ta shakku dangane da ayyukan sa na lokacin aiki. Kuma bayan haka an riga an kimanta samfurin.

A cikin yanayin PowerShell da sauran rubutun samfurin (Visual Basic, JavaScript, da sauransu), Na sami damar ganin lambar kanta. Misali, na ci karo da wannan misalin PowerShell:

Hakanan zaka iya gudanar da PowerShell a cikin rufaffiyar tushe64 don guje wa ganowa. Yi la'akari da amfani da ma'auni marasa hulɗa da ɓoyayyun.

Idan kun karanta rubuce-rubuce na akan ɓarna, to kun san cewa zaɓin -e yana ƙayyadad da cewa abun ciki yana ɓoye tushe64. Af, hybrid bincike shima yana taimakawa tare da wannan ta hanyar yanke duk abin da baya. Idan kana so ka gwada ƙaddamar da base64 PowerShell (wanda ake kira PS) da kanka, kana buƙatar gudanar da wannan umarni:

 [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedText))

Ku zurfafa

Na canza rubutun mu na PS ta amfani da wannan hanyar, a ƙasa akwai rubutun shirin, kodayake ni na ɗan gyara:

Lura cewa an ɗaure rubutun zuwa ranar Satumba 4, 2017 kuma an watsa kukis ɗin zaman.

Na rubuta game da wannan salon harin a PS obfuscation jerin, wanda tushe64 da aka rufaffen rubutun da kansa yayi lodi bata malware daga wani rukunin yanar gizo, ta amfani da .Net Framework's WebClient abu don yin nauyi mai nauyi.

Menene wannan don?

Don software na tsaro na bincika rajistan ayyukan Windows ko Tacewar zaɓi, tushe64 yana hana kirtani "WebClient" ganuwa ta hanyar rubutu a sarari don kariya daga yin irin wannan buƙatar yanar gizo. Kuma tunda duk “mugunta” na malware ana zazzage su kuma an wuce su cikin PowerShell ɗinmu, wannan hanyar ta ba mu damar guje wa gano gaba ɗaya. Ko kuma, abin da na yi tunani ke nan da farko.

Ya bayyana cewa tare da kunna Windows PowerShell Advanced Logging (duba labarina), zaku iya ganin layin da aka ɗora a cikin log ɗin taron. Ni kamar da sauransu ) Ina tsammanin ya kamata Microsoft ya ba da damar wannan matakin shiga ta tsohuwa. Don haka, tare da ƙarin shigar da shiga, za mu ga a cikin taron taron Windows an kammala buƙatar zazzagewa daga rubutun PS bisa ga misalin da muka tattauna a sama. Don haka, yana da ma'ana don kunna shi, ba ku yarda ba?

Bari mu ƙara ƙarin yanayi

Hackers suna ɓoye hare-haren PowerShell a cikin wayo a cikin Microsoft Office macros da aka rubuta cikin Visual Basic da sauran yarukan rubutun rubutu. Manufar ita ce wanda aka azabtar ya karɓi saƙo, misali daga sabis na isarwa, tare da rahoton makala a cikin tsarin .doc. Kuna buɗe wannan daftarin aiki mai ɗauke da macro, kuma tana ƙarewa da ƙaddamar da mugun PowerShell kanta.

Sau da yawa rubutun Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kayayyakin Kaya) ta yadda zai guje wa riga-kafi da sauran na'urorin daukar hoto na malware. A cikin ruhun abubuwan da ke sama, na yanke shawarar yin code na sama PowerShell a JavaScript azaman motsa jiki. A ƙasa akwai sakamakon aikina:

Rushe JavaScript yana ɓoye PowerShell ɗin mu. Hackers na gaske suna yin haka sau ɗaya ko sau biyu.

Wannan wata dabara ce da na gani tana yawo a cikin gidan yanar gizo: ta amfani da Wscript.Shell don gudanar da lambar PowerShell. Af, JavaScript kanta ita ce yana nufin isar da malware. Yawancin nau'ikan Windows sun gina a ciki Mai watsa shiri Rubutun Windows, wanda shi kansa zai iya tafiyar da JS.
A cikin yanayinmu, an saka rubutun JS qeta azaman fayil tare da tsawo na .doc.js. Windows yawanci zai nuna suffix na farko kawai, don haka zai bayyana ga wanda aka azabtar a matsayin takaddar Kalma.

Alamar JS tana bayyana kawai a gunkin gungurawa. Ba abin mamaki ba ne cewa mutane da yawa za su buɗe wannan abin da aka makala suna tunanin takaddar Kalma ce.

A misali na, na gyara PowerShell a sama don zazzage rubutun daga gidan yanar gizona. Rubutun PS mai nisa yana buga "Evil Malware". Kamar yadda kake gani, ba shi da mugunta ko kaɗan. Tabbas, hackers na gaske suna sha'awar samun damar shiga kwamfutar tafi-da-gidanka ko uwar garken, a ce, ta hanyar harsashi. A cikin labarin na gaba, zan nuna muku yadda ake yin hakan ta amfani da daular PowerShell.

Ina fatan cewa don labarin gabatarwa na farko ba mu nutse da zurfi cikin batun ba. Yanzu zan bar ku ku huta, kuma lokaci na gaba za mu fara kallon ainihin misalan hare-hare ta amfani da malware marasa fayil ba tare da wasu kalmomin gabatarwa ko shiri ba.

source: www.habr.com