Ukuphuma kwehlulekile: masiveze i-AgentTesla emanzini ahlanzekile. Ingxenye 2

Siqhubeka nochungechunge lwethu lwama-athikili anikelwe ekuhlaziyeni uhlelo olungayilungele ikhompuyutha. IN owokuqala Ngokwengxenye, sitshele ukuthi u-Ilya Pomerantsev, uchwepheshe wokuhlaziya uhlelo olungayilungele ikhompuyutha e-CERT Group-IB, enze kanjani ukuhlaziya okuningiliziwe kwefayela elitholwe ngeposi kwenye yezinkampani zaseYurophu futhi wathola inhloli lapho. Umenzeli weTesla. Kulesi sihloko, u-Ilya unikeza imiphumela yokuhlaziywa kwesinyathelo ngesinyathelo semodyuli eyinhloko Umenzeli weTesla.

I-Agent Tesla iyisofthiwe yokuhlola eyimojuli esatshalaliswa kusetshenziswa imodeli ye-malware-as-a-service ngaphansi kwesicathulo somkhiqizo we-keylogger osemthethweni. Umenzeli u-Tesla uyakwazi ukukhipha nokudlulisa imininingwane yomsebenzisi kusuka kuziphequluli, amaklayenti e-imeyili namakhasimende e-FTP aziyise kuseva kubahlaseli, ukurekhoda idatha yebhodi lokunamathisela, nokuthwebula isikrini sedivayisi. Ngesikhathi sokuhlaziya, iwebhusayithi esemthethweni yonjiniyela ibingatholakali.

Ifayela lokucushwa

Ithebula elingezansi libonisa ukuthi yikuphi ukusebenza okusebenza kusampula oyisebenzisayo:

Ukunamathisela imojuli eyinhloko ohlelweni

Uma ifulegi elihambisanayo lisethiwe, imojuli eyinhloko ikopishelwa endleleni ecaciswe ku-config njengendlela ezonikezwa uhlelo.

Kuye ngenani elivela ku-config, ifayela linikezwa izimfanelo "ezifihliwe" kanye "nesistimu".
I-Autorun ihlinzekwa ngamagatsha amabili okubhalisa:

• I-HKCU SoftwareMicrosoftWindowsCurrentVersionRun%inregname%
• HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun %insregname%

Njengoba i-bootloader ingena kunqubo I-RegAsm, ukusetha ifulegi eliqhubekayo lemojuli eyinhloko kuholela emiphumeleni ethakazelisa kakhulu. Esikhundleni sokuzikopisha, uhlelo olungayilungele ikhompuyutha lunamathisele ifayela lokuqala ohlelweni RegAsm.exe, lapho umjovo wenziwa khona.

Ukusebenzisana ne-C&C

Kungakhathalekile ukuthi iyiphi indlela esetshenzisiwe, ukuxhumana kwenethiwekhi kuqala ngokuthola i-IP yangaphandle yesisulu kusetshenziswa insiza ukuhlola[.]amazonaws[.]com/.
Okulandelayo kuchaza izindlela zokusebenzisana zenethiwekhi ezethulwa kusofthiwe.

iphaneli yewebhu

Ukuxhumana kwenzeka ngephrothokholi ye-HTTP. Uhlelo olungayilungele ikhompuyutha lwenza isicelo se-POST ngezihloko ezilandelayo:

• Umenzeli Womsebenzisi: Mozilla/5.0 (Windows U Windows NT 6.1 ru rv:1.9.2.3) Gecko/20100401 Firefox/4.0 (.NET CLR 3.5.30729)
• Ukuxhuma: Gcina-Uphila
• Uhlobo Lokuqukethwe: isicelo/x-www-form-urlencoded

Ikheli leseva licaciswa inani %PostURL%. Umlayezo obethelwe uthunyelwa ngepharamitha «P». Indlela yokubhala ngemfihlo ichazwe esigabeni "I-Encryption Algorithms" (Indlela 2).

Umlayezo odlulisiwe ubukeka kanje:

type={0}nhwid={1}ntime={2}npcname={3}nlogdata={4}nscreen={5}nipadd={6}nwebcam_link={7}nclient={8}nlink={9}nusername={10}npassword={11}nscreen_link={12}

Ipharamitha uhlobo ikhombisa uhlobo lomlayezo:

hwid - i-MD5 hashi irekhodwa kumanani we-serial number ye-motherboard kanye ne-ID yeprosesa. Kungenzeka ukuthi isetshenziswe njenge-ID Yomsebenzisi.
isikhathi — Isebenzela ukudlulisa isikhathi samanje nosuku.
pcname - kuchazwa ngokuthi <Igama lomsebenzisi>/<Igama lekhompyutha>.
logdata - idatha yokungena.

Lapho uthumela amaphasiwedi, umlayezo ubukeka kanje:

type={0}nhwid={1}ntime={2}npcname={3}nlogdata={4}nscreen={5}nipadd={6}nwebcam_link={7}nscreen_link={8}n[passwords]

Okulandelayo izincazelo zedatha eyebiwe ngefomethi nclient[]={0}nlink[]={1}igama lomsebenzisi[]={2}npassword[]={3}.

smtp

Ukuxhumana kwenzeka ngephrothokholi ye-SMTP. Incwadi edlulisiwe ikufomethi ye-HTML. Ipharamitha UMZIMBA inefomu:

Unhlokweni wencwadi unefomu elijwayelekile: <IGAMA LOMSEBENZISI>/<IGAMA LEKHOMPYUTHA> <UHLOBO LOKUQUKETHWE>. Okuqukethwe yincwadi, kanye nezinanyathiselwa zayo, akubetheliwe.

Ukuxhumana kwenzeka ngephrothokholi ye-FTP. Ifayela elinegama lidluliselwa kuseva eshiwo <UHLOBO LOKUQUKETHWE>_<UMSEBENZISI IGAMA>-<I-COMPUTER NAME>_<IDETHI NESIKHATHI>.html. Okuqukethwe kwefayela akubetheliwe.

Ama-algorithms wokubethela

Leli cala lisebenzisa izindlela zokubethela ezilandelayo:

Indlela ye-1

Le ndlela isetshenziselwa ukubethela izintambo kumojuli eyinhloko. I-algorithm esetshenziselwa ukubethela ithi I-AES.

Okokufaka kuyinombolo yedesimali enezinhlamvu eziyisithupha. Ukuguqulwa okulandelayo kwenziwa kuyo:

f(x) = (((x >> 2 - 31059) ^ 6380) - 1363) >> 3

Inani eliwumphumela liyinkomba yohlu lwedatha eshumekiwe.

Isici ngasinye samalungu afanayo siwukulandelana I-DWORD. Uma uhlanganisa I-DWORD kutholwa amabhayithi amaningi: amabhayithi okuqala angu-32 angukhiye wokubethela, alandelwe amabhayithi angu-16 evektha yokuqalisa, futhi amabhayithi asele idatha ebethelwe.

Indlela ye-2

I-algorithm esetshenzisiwe 3DES kumodi I-ECB nge-padding ngamabhayithi aphelele (I-PKCS7).

Ukhiye ucaciswa ipharamitha %urlkey%, nokho, ukubethela kusebenzisa i-MD5 hash yayo.

Ukusebenza okunonya

Isampula elingaphansi kocwaningo lisebenzisa lezi zinhlelo ezilandelayo ukwenza umsebenzi walo onobungozi:

I-KeyLogger

Uma kukhona ifulegi elihambisanayo le-malware esebenzisa umsebenzi we-WinAPI Setha iWindowsHookEx inika isibambi sayo semicimbi yokucindezela ukhiye kukhibhodi. Umsebenzi wesibambi uqala ngokuthola isihloko sewindi elisebenzayo.

Uma ifulegi lokuhlunga uhlelo lokusebenza lisethiwe, ukuhlunga kwenziwa kuye ngohlobo olushiwo:

1. igama lohlelo libhekwa ezihlokweni zewindi
2. igama lohlelo libhekwa egameni lenqubo yewindi

Okulandelayo, irekhodi lengezwa kulogi ngolwazi mayelana newindi elisebenzayo ngefomethi:

Bese ulwazi mayelana nokhiye ocindezelwe luyarekhodwa:

Ngokuvama okucacisiwe, ilogi eqoqiwe ithunyelwa kuseva. Uma ukudlulisa kungaphumeleli, ilogu igcinwa efayeleni %TEMP%log.tmp ngefomethi:

Lapho isibali sikhathi sivutha, ifayela lizodluliselwa kuseva.

I-ScreenLogger

Ngokuvama okucacisiwe, uhlelo olungayilungele ikhompuyutha ludala isithombe-skrini ngefomethi I-Jpeg ngencazelo Quality elilingana no-50 futhi liyigcina efayelini %APPDATA %<Ukulandelana okungahleliwe kwezinhlamvu ezingu-10>.jpg. Ngemva kokudlulisa, ifayela liyasuswa.

I-ClipboardLogger

Uma ifulegi elifanele lisethiwe, ukushintshwa kwenziwa embhalweni obanjiwe ngokwethebula elingezansi.

Ngemva kwalokhu, umbhalo ushuthekwa kulogi:

I-PasswordStealer

Uhlelo olungayilungele ikhompuyutha lungadawuniloda amaphasiwedi ezinhlelweni ezilandelayo:

Ukuphikisana nokuhlaziya okuguquguqukayo

• Ukusebenzisa umsebenzi Sleep. Ikuvumela ukuthi udlule ama-sandbox athile ngesikhathi sokuvala
• Ukucekela phansi intambo Isihlonzi.Indawo. Ikuvumela ukuthi ufihle iqiniso lokulanda ifayela ku-inthanethi
• Kupharamitha %filtha_list% icacisa uhlu lwezinqubo uhlelo olungayilungele ikhompuyutha ezizozinqamula ngezikhathi zomzuzwana owodwa
• Ukuxhuma I-UAC
• Ikhubaza isiphathi somsebenzi
• Ukuxhuma I-CMD
• Ikhubaza iwindi "Gijima"
• Ikhubaza Iphaneli Yokulawula
• Ikhubaza ithuluzi RegEdit
• Ikhubaza amaphuzu okubuyisela esistimu
• Khubaza imenyu yokuqukethwe ku-Explorer
• Ukuxhuma MSCONFIG
• Ukudlula UAC:

Izici ezingasebenzi zemojuli eyinhloko

Phakathi nokuhlaziywa kwemojula eyinhloko, imisebenzi yahlonzwa eyayinesibopho sokusabalalisa inethiwekhi yonkana nokulandelela indawo yegundane.

Worm

Imicimbi yokuxhuma imidiya ekhiphekayo igadwa ngochungechunge oluhlukile. Uma ixhunyiwe, uhlelo olungayilungele ikhompuyutha olunegama lukopishelwa kumsuka wesistimu yefayela scr.exe, ngemva kwalokho isesha amafayela anesandiso lnk. Iqembu lawo wonke umuntu lnk izinguquko ku cmd.exe /c qala scr.exe&qala <umyalo wangempela> & uphume.

Uhla lwemibhalo ngalunye kumsuka wemidiya lunikezwa isibaluli "Kufihliwe" futhi ifayela liyadalwa ngesandiso lnk negama lemibhalo efihliwe kanye nomyalo cmd.exe /c qala scr.exe&explorer /root,"%CD%<DIRECTORY NAME>" & phuma.

I-MouseTracker

Indlela yokwenza i-interception ifana naleyo esetshenziselwa ikhibhodi. Lokhu kusebenza kusathuthukiswa.

Umsebenzi wefayela

Iphrofayela yomhlaseli

Ngenxa yedatha yokuqinisekisa enekhodi eqinile, sikwazile ukuthola ukufinyelela esikhungweni somyalo.

Lokhu kusivumele ukuthi sikhombe i-imeyili yokugcina yabahlaseli:

junaid[.]ku***@gmail[.]com.

Igama lesizinda sesikhungo somyalo sibhaliswe ku-imeyili sg***@gmail[.]com.

isiphetho

Phakathi nokuhlaziywa okuningiliziwe kohlelo olungayilungele ikhompuyutha olusetshenziswe ekuhlaselweni, sikwazile ukuthola ukusebenza kwayo futhi sathola uhlu oluphelele kakhulu lwezinkomba zokonakala ezihambisana naleli cala. Ukuqonda izindlela zokusebenzelana kwenethiwekhi phakathi kwe-malware kwenze kwaba nokwenzeka ukunikeza izincomo zokulungisa ukusebenza kwamathuluzi okuvikela ulwazi, kanye nokubhala imithetho ezinzile ye-IDS.

Ingozi enkulu Umenzeli weTesla njenge-DataStealer ngokuthi ayidingi ukuzibophezela ohlelweni noma ukulinda umyalo wokulawula ukwenza imisebenzi yayo. Uma isisemshinini, iqala ngokushesha ukuqoqa imininingwane eyimfihlo bese iludlulisela ku-CnC. Lokhu kuziphatha okunolaka kufana ngezindlela ezithile nokuziphatha kwe-ransomware, umehluko kuphela ukuthi lena ayidingi ngisho nokuxhumeka kwenethiwekhi. Uma uhlangana nalo mndeni, ngemuva kokuhlanza uhlelo olunegciwane kuhlelo olungayilungele ikhompuyutha uqobo, kufanele nakanjani uguqule wonke amagama ayimfihlo okungenzeka, okungenani ngokwethiyori, alondolozwe kwesinye sezinhlelo zokusebenza ezibalwe ngenhla.

Uma sibheka phambili, ake sithi abahlaseli bayathumela Umenzeli weTesla, isilayishi sokuqala sokuqalisa sishintshwa kaningi. Lokhu kukuvumela ukuthi uhlale ungabonwa izikena ezimile kanye nabahlaziyi be-heuristic ngesikhathi sokuhlasela. Futhi ukuthambekela kwalo mndeni ukuqala ngokushesha imisebenzi yawo kwenza abaqaphi besistimu bangabi namsebenzi. Indlela engcono kakhulu yokulwa ne-AgentTesla ukuhlaziya kokuqala kubhokisi lesihlabathi.

Esihlokweni sesithathu salolu chungechunge sizobheka amanye ama-bootloader asetshenzisiwe Umenzeli weTesla, futhi bafunde nenqubo yokukhipha impahla yabo e-semi-automatic. Ungaphuthelwa!

Hash

I-C & C.

I-RegKey

I-Mutex

Azikho izinkomba.

Amafayela

Ulwazi lwamasampula

Source: www.habr.com