The Adventures of the Elusive Malware, Gawo I

Ndi nkhaniyi tiyamba zofalitsa zingapo za pulogalamu yaumbanda yomwe ilibe vuto. Mapulogalamu owononga mafayilo opanda mafayilo, omwe amadziwikanso kuti mapulogalamu opanda mafayilo, nthawi zambiri amagwiritsa ntchito PowerShell pa Windows machitidwe kuti aziyendetsa mwakachetechete malamulo kuti afufuze ndi kuchotsa zofunikira. Kuzindikira zochitika za hacker popanda mafayilo oyipa ndi ntchito yovuta, chifukwa ... ma antivayirasi ndi machitidwe ena ambiri ozindikira amagwira ntchito potengera kusanthula kwa siginecha. Koma uthenga wabwino ndi wakuti mapulogalamuwa alipo. Mwachitsanzo, UBA Systems, yokhoza kuzindikira zochitika zoipa m'mafayilo.

Nditayamba kufufuza mutu wa ma hackers oyipa, osagwiritsa ntchito njira zamatenda zamatenda, koma zida zokha ndi mapulogalamu omwe amapezeka pa kompyuta ya wozunzidwayo, sindinadziwe kuti posachedwapa iyi idzakhala njira yotchuka yowukira. Akatswiri a Chitetezo nenanikuti izi zikukhala chizolowezi, ndi mitu yankhani yowopsa - kutsimikizira izi. Choncho, ndinaganiza zopanga mabuku angapo okhudza nkhaniyi.

PowerShell Yaikulu ndi Yamphamvu

Ndalembapo za ena mwa malingaliro awa m'mbuyomu PowerShell obfuscation mndandanda, koma zambiri zochokera ku lingaliro lachidziwitso. Pambuyo pake ndinapeza tsamba la hybrid analysis, komwe mungapeze zitsanzo za pulogalamu yaumbanda "yogwidwa" kuthengo. Ndinaganiza zoyesa kugwiritsa ntchito tsamba ili kuti ndipeze zitsanzo za pulogalamu yaumbanda yopanda mafayilo. Ndipo ndinapambana. Mwa njira, ngati mukufuna kupita paulendo wanu wosaka pulogalamu yaumbanda, muyenera kutsimikiziridwa ndi tsamba ili kuti adziwe kuti mukugwira ntchitoyi ngati katswiri wa zipewa zoyera. Monga blogger yemwe amalemba za chitetezo, ndinadutsa popanda funso. Ine ndikutsimikiza inunso mungathe.

Kuphatikiza pa zitsanzo zokha, patsambali mutha kuwona zomwe mapulogalamuwa amachita. Kusanthula kwa Hybrid kumayendetsa pulogalamu yaumbanda mu sandbox yake ndikuwunika mafoni amachitidwe, kuyendetsa njira ndi zochitika pamanetiweki, ndikutulutsa zingwe zokayikitsa. Kwa ma binaries ndi mafayilo ena omwe angathe kuchitidwa, i.e. kumene simungathe ngakhale kuyang'ana pa code yeniyeni yapamwamba, kusanthula kosakanizidwa kumasankha ngati pulogalamuyo ndi yoyipa kapena yongokayikira kutengera ntchito yake yothamanga. Ndipo pambuyo pake chitsanzocho chawunikidwa kale.

Pankhani ya PowerShell ndi zolemba zina zachitsanzo (Visual Basic, JavaScript, etc.), ndinatha kuwona code yokha. Mwachitsanzo, ndinapeza chitsanzo cha PowerShell ichi:

Mutha kuyendetsanso PowerShell mu encoding ya base64 kuti musadziwike. Zindikirani kugwiritsa ntchito magawo Osagwirizana ndi Obisika.

Ngati mwawerenga zolemba zanga pa obfuscation, ndiye kuti mukudziwa kuti -e njira imatanthawuza kuti zomwe zili ndi base64 encoded. Mwa njira, kusanthula kwa hybrid kumathandizanso ndi izi polemba chilichonse kumbuyo. Ngati mukufuna kuyesa decoding base64 PowerShell (pano - PS) nokha, muyenera kuyendetsa lamulo ili:

 [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($EncodedText))

Kumba mozama

Ndidalemba zolemba zathu za PS pogwiritsa ntchito njirayi, pansipa pali zolemba za pulogalamuyi, ngakhale ndidasinthidwa pang'ono ndi ine:

Dziwani kuti zolembazo zidalumikizidwa ndi tsiku la Seputembara 4, 2017 ndikufalitsa ma cookie agawo.

Ndinalemba za mtundu uwu wa attack mu PS obfuscation mndandanda, momwe base64 encoded script imanyamula akusowa pulogalamu yaumbanda kuchokera patsamba lina, pogwiritsa ntchito chinthu cha WebClient cha laibulale ya .Net Framework kukweza zinthu zolemetsa.

Kodi ndi chiyani?

Pamapulogalamu achitetezo aja sikani mazenera a zochitika za Windows kapena ma firewall, ma encoding a base64 amalepheretsa chingwe "WebClient" kudziwika ndi mawonekedwe osavuta kuti muteteze ku pempho loterolo. Ndipo popeza "zoyipa" zonse za pulogalamu yaumbanda zimatsitsidwa ndikudutsa mu PowerShell yathu, njira iyi imatilola kuti tisadziwike. Kapena kani, ndi zomwe ndimaganiza poyamba.

Zikuoneka kuti ndi Windows PowerShell Advanced Logging (onani nkhani yanga), mudzatha kuwona mzere wodzaza mu chipika cha zochitika. Ndili ngati ndi zina ) Ndikuganiza kuti Microsoft iyenera kuloleza mulingo uwu wodula mwachisawawa. Chifukwa chake, ndikudula mitengo yotalikirapo, tiwona muzolemba za Windows pempho lomaliza lotsitsa kuchokera pa script ya PS malinga ndi chitsanzo chomwe takambirana pamwambapa. Chifukwa chake, ndizomveka kuyiyambitsa, sichoncho?

Tiyeni tiwonjezere zochitika zina

Obera amabisa mochenjera kuukira kwa PowerShell mu Microsoft Office macros olembedwa mu Visual Basic ndi zilankhulo zina zolembera. Lingaliro ndiloti wozunzidwa amalandira uthenga, mwachitsanzo kuchokera ku ntchito yobweretsera, ndi lipoti lophatikizidwa mu .doc format. Mumatsegula chikalatachi chomwe chili ndi macro, ndipo chimamaliza kuyambitsa PowerShell yoyipayo.

Nthawi zambiri Visual Basic script palokha imasokonezedwa kotero kuti imazemba momasuka antivayirasi ndi makina ena a pulogalamu yaumbanda. Mwa mzimu womwe uli pamwambapa, ndidaganiza zolembera PowerShell pamwambapa mu JavaScript ngati masewera olimbitsa thupi. M'munsimu muli zotsatira za ntchito yanga:

JavaScript yobisika yobisa PowerShell yathu. Obera enieni amachita izi kamodzi kapena kawiri.

Iyi ndi njira ina yomwe ndawona ikuyandama pa intaneti: kugwiritsa ntchito Wscript.Shell kuyendetsa PowerShell ya coded. Mwa njira, JavaScript yokha ndi zikutanthauza kutumiza kwa pulogalamu yaumbanda. Mabaibulo ambiri a Windows ali ndi zowonjezera Windows Script Host, yomwe yokha imatha kuyendetsa JS.
Kwa ife, script yoyipa ya JS imayikidwa ngati fayilo yokhala ndi .doc.js extension. Mawindo amangowonetsa chowonjezera choyamba, kotero chidzawonekera kwa wozunzidwa ngati chikalata cha Mawu.

Chizindikiro cha JS chimangowoneka pazithunzi za mpukutu. Ndizosadabwitsa kuti anthu ambiri atsegula cholumikizira ichi poganiza kuti ndi chikalata cha Mawu.

Mu chitsanzo changa, ndidasintha PowerShell pamwambapa kuti nditsitse zolemba patsamba langa. Zolemba zakutali za PS zimangosindikiza "Evil Malware". Monga mukuonera, iye si woipa konse. Zachidziwikire, obera enieni amafunitsitsa kupeza laputopu kapena seva, tinene, kudzera mu chipolopolo cholamula. M'nkhani yotsatira, ndikuwonetsani momwe mungachitire izi pogwiritsa ntchito PowerShell Empire.

Ndikukhulupirira kuti m'nkhani yoyamba yoyambilira sitinalowerere mozama pamutuwu. Tsopano ndikulolani kuti mupume, ndipo nthawi ina tidzayamba kuyang'ana zitsanzo zenizeni za kuukira pogwiritsa ntchito pulogalamu yaumbanda yopanda mafayilo popanda mawu oyambira osafunikira kapena kukonzekera.

Source: www.habr.com