Kunshin Python zare mai laushi, wanda aka gano a kan PyPI, an gano shi a matsayin malicious, wanda ke ɗauke da malware na yau da kullun na satar bayanai. Duk da haka, siffa ta bayyana ita ce amfani da dabarun ɓoye lambobi na zamani waɗanda ke ɓoye nauyin da ke cikinsa, wanda hakan ke sa bincike ya zama ƙalubale. Wannan malware yana amfani da matakai uku na ɓoye bayanai akai-akai a cikin sarkar harinsa, yana haifar da manyan cikas don rushe ginin da hannu.
Takardar yaudara: Malware na Infostealer da ɓoye lambar
Menene Malware na Infostealer?
Malware na Infostealer yana aiki kamar ɓarawo mai ɓoye a duniyar dijital ɗinku. Yana ɗaukar bayanai masu mahimmanci a hankali, kamar kalmomin shiga, lambobin katin kiredit, ko bayanan sirri, ba tare da kun lura ba. Waɗannan shirye-shiryen suna rikodin abin da kuka rubuta (keylogging), sace burauzar ku, ko duba fayiloli akan na'urarku don tattara bayanai masu mahimmanci. Mafi ban tsoro? Sun yi fice wajen kasancewa a ƙarƙashin radar.
1. Ɓoye-ɓoye sau uku
Tsarin ɓoyewa yana farawa da nauyin da aka ɓoye sosai a cikin mai kyau.py fayil. Za a iya taƙaita tsarin farko na ɓoyewa da ɓoyewa kamar haka:
encoded_data = base64_module.b64decode("... BASE-6 with encrypted payload, IV and RSA-encrypted keys…”); # … Sequential decryption: ChaCha20, Blowfish and AES … encrypted_payload = AES_Cipher.new(aes_key, AES_Cipher.MODE_CBC, iv=aes_iv).decrypt(encrypted_payload[16:]) final_payload = unpad_function(encrypted_payload, AES_Cipher.block_size) exec( zlib_module.decompress(bz2_module.decompress(final_payload)) ) Wannan tsari na ɓoyewa ya ƙunshi:
- matsawa: Amfani da gzip da bzip.
- Rufin simmetric: Ɓoye-ɓoye da aka haɗa da ChaCha20, Blowfish, da AES.
- Asymmetric boye-boye: Ana amfani da RSA don ɓoye maɓallan daidaitawa.
An saka sakamakon a cikin Base64 kuma an saka shi azaman bayanan_mai ɓoyeKowane maimaitawa yana ginawa akan na baya, yana ƙirƙirar tsarin ɓoyewa mai tsari wanda ke sa ya zama da wahala a gano ainihin nauyin ba tare da injiniyan juyawa ba.
2. Rage Matsi na Gzip
A matakai da yawa na matsakaici, malware yana amfani da hanyar ɓoye bayanai kai tsaye amma mai tasiri: matsewar Gzip tare da lambar ɓoyewa ta Base64.
import base64, zlib; eval(zlib.decompress(base64.b64decode(<STR>).decode('utf-8')) Wannan dabarar tana tabbatar da cewa nauyin da aka ɓoye ya kasance a ɓoye a duk tsawon matakan.
3. Haɗa Lambobi da Tarin Sauyi
Mataki na ƙarshe ya ƙunshi raba nauyin da aka ɓoye a tsakanin masu canji da yawa, waɗanda aka haɗa su da kuma fassara su yayin aiwatarwa:
import base64, zlib FEQXCBDOZKHVIhT = '...' # ....(111 other variables with base-64 encoded values) ... zZytWuvuEdBXSrO = eval(<FEQXCBDOZKHVIhT' encoded with '\x>) + eval(<next variable, encoded>) + eval( ' zlib.decompress(base64.b64decode(<VAR>)).decode('utf-8') ') + ... eval(compile(base64.b64decode(eval(zZytWuvuEdBXSrO)).decode('utf-8'), ‘<app>', 'exec')) Wannan matakin yana da matuƙar wahala a juya injiniyoyin da hannu, domin dole ne a fassara kowane canji sannan a sake haɗa shi don a gano ƙarin nauyin da zai biyo baya.
Ta hanyar haɗa waɗannan dabarun ɓoye sirri, infostealer malware in zare mai laushi yana guje wa ganowa, yana nuna muhimmiyar rawar da Code obfused a cikin hare-haren yanar gizo na zamani.
Sarkar Hari Mai Mataki-mataki na ThreadFluent
The zare mai laushi infostealer malware ya ƙunshi matakai huɗu daban-daban, kowannensu yana gabatar da ƙarin matakai na Code obfusedWaɗannan matakai ba wai kawai suna taimakawa wajen isar da kayan aiki ba ne, har ma suna kare shi daga ganowa da bincike.
Mataki na 0: Aiwatar da Lambar Farko
Wurin shiga shine __init__.py fayil, wanda ke fara aiwatar da ayyukan da aka ɓoye a cikin mai kyau.pyWannan fayil ɗin yana amfani da ƙulle-ƙulle mai matakai da yawa (kamar yadda aka bayyana a matakai na 1-3) don samar da dropper na Mataki na 1:
import os,threading def main(): if os.name == 'nt': from . import fluent fluent.main() thread = threading.Thread(target=main , daemon=True) thread.start() Mataki na 1: Faifan Farko
Mai sauke fayil na farko, da zarar an cire shi, yana saukewa kuma yana saka ƙarin lambar ɓarna, sanya.py, daga ma'ajiyar bayanai ta GitHub Ja-shanks-masu gashi-1337/masu wakilci (gargaɗi: akwai yiwuwar lambar ɓarna a nan).
Mai ɗigon ruwa yana ƙunshe sanya.py cikin shigarwar gida na shahararrun mutane buƙatun canza ɗakin karatu, yana __init__.py fayil ɗin don gudanar da cirewa da aiwatar da mataki na gaba. Wannan cirewa ya ƙunshi juyawa aikace-aikace da yawa na yadudduka masu ɓoyewa 1 … 3.
Mataki na 2: Faifan Na Biyu
Na biyun, da zarar an cire shi daga tsarin, zai sake sauke wani ƙarin kayan aiki, ssl.py daga ma'ajiyar GitHub, an sake masa suna zuwa udp.py, kuma yana samar da fayil ɗin kullewa don tabbatar da cewa malware ɗin ba ya sake shigar da shi akai-akai. Sannan ana gudanar da shi don kawar da shi, wanda ke haifar da aiwatar da aikin ƙarshe na infostealer.
Mataki na 3: Mai satar bayanai na ƙarshe
Mataki na ƙarshe shine mai satar bayanai mai cikakken aiki wanda ke amfani da dabarun gujewa bayanai na zamani:
- Siffofin hana bincike:
- Yana gano kayan aikin antimalware kuma yana ƙarewa idan an gano wasu hanyoyin da aka saka a cikin jerin sunayen masu laifi, IPs, sunayen masu masauki, ko mahalli na kama-da-wane.
- Exfiltration na bayanai:
- Yana ɗaukar cikakkun bayanai. Daga ciki akwai, adireshin IP, adireshin Mac, bayanan VPN, kukis/tarihin mai bincike, bayanan katin kiredit da takardun shaidar walat ɗin crypto da sauransu, gami da hoton allo.
- Yana aika bayanan da aka sata (an ɓoye su) ta hanyar tashar Telegram, ta amfani da samfurin da aka nuna a nan:
Dabarun Bayyana Rufe Ido
Domin yin nazarin irin waɗannan fakitin, masu bincike dole ne su juya matakan ɓoyewarsu cikin tsari:
- Kwaikwayi Matakan Rufe Ido: Rubuta rubutun don kwaikwayon canje-canje (misali, ɓoyewa, cire matsi) ba tare da aiwatar da nauyin da aka ɗauka ba.
- Matakan ɓoyewa na baya: Cire da kuma cire kayan da ake buƙata ta amfani da maɓallan da aka saka da algorithms.
- Nazari Mai Sauyawa: A maimaita kowane mataki na matsakaici don sake gina nauyin ƙarshe.
Kayan aiki na atomatik da muhallin da aka yi wa yashi suna da mahimmanci don sauƙaƙe wannan bincike.
Kana son ƙarin koyo game da ci gaba da fuskantar barazana a ainihin lokaci?
Sauke faratinmu, 'Gargaɗi da Farko: Gano Barazana da Fifiko a Lokacin Ainihin Lokaci,' kuma gano yadda za ku kare tsarin samar da software ɗinku.
Jarumin Barazana
A bayyane yake cewa an buga kunshin ne daga asusun PyPI guda biyu, ABIRHOSSAIN10 da kuma anomilano785, an cire shi a halin yanzu.
Akwai asusun GitHub (wanda a halin yanzu yake aiki) mai suna ABIRHOSSAIN10, wanda zai iya kasancewa yana da alaƙa da kamfen ɗin. Ja-shanks-1337 Ana kuma yin nazari kan mai amfani da GitHub wanda ke da wurin adana bayanai da ake amfani da shi don saukar da kayan aiki na mataki na 2 da 3.
Duk da cewa dangantawa da wani abu yana da rikitarwa kuma kasancewa memba na ƙungiyar ja abu ne mai yiwuwa, nau'in da yawan bayanan da aka fitar sun nuna wa wani mai aikata laifi.
Kammalawa: Matsayin Rufe Lambobi a Juyin Halittar Malware
The zare mai laushi Kunshin ya nuna yadda ake ɓoye malware a zamani a cikin isar da shi ta matakai da yawa. Tare da dabarun gujewa amfani da shi, wannan kunshin yana nuna ƙoƙari bayyananne don gujewa ganowa da kuma tsayayya da bincike.
Wannan bincike ya nuna muhimmancin haɗin gwiwa da kayan aiki na atomatik wajen yaƙi da irin waɗannan barazanar. Ta hanyar bincika da fahimtar waɗannan hanyoyin, ƙwararrun tsaro za su iya haɓaka ingantattun kariya daga irin waɗannan malware a nan gaba.
Yadda Tsarin MEW na Xygeni Ya Hana Kunshin Zaren Mummunan Kaiwa Ga Samarwa
Xygeni's Gargaɗin Farko na Malware (MEW) tsarin ya taimaka wajen dakatar da zare mai laushi Python package, wani nau'in Python da ke ɗauke da wani nau'in cuta mai cutarwa rufaffen code da kuma wani mataki mai matakai da yawa infostealer malware, kafin ya iya kawo cikas ga yanayin samar da kayayyaki. Ga yadda ake yi:
- Ganowa Ta Hanyar Nazarin Tsaye
An gano MEW zare mai laushilambar sirri ta ɓoye, gano alamun da ake zargi kamar ɓoye bayanai masu layi da kuma ayyukan dogaro na musamman. - Kimantawar Isarwa Lokacin Aiki
Tsarin ya gano cewa lambar kunshin na iya aiki yayin amfani, wanda hakan ya sanya shi a matsayin babbar barazana ba tare da an kunna shi ba. - CI/CD Pipeline kariya
An toshe MEW zare mai laushi a ainihin lokaci, ya hana shi shiga cikin ginin, kuma ya hana shi isa ga samarwa. Ya aika wa masu haɓaka haɓakawa da faɗakarwa, yana adana lokaci mai mahimmanci. - Raba Bayanan Sirri na Barazana
Xygeni ya ba da rahoton kunshin ga PyPI cikin sauri kuma ya raba sakamakon bincikensa ga hanyar sadarwar tsaron duniya, wanda hakan ya hana shi yaɗuwa sosai.
Kare naka CI/CD Pipelines don Kyauta
Hana barazana kamar zare mai laushi tare da tsarin Gargaɗin Farko na Malware na Xygeni. Fara naka free fitina a yau kuma ka tabbatar da tsaron tsarin samar da manhajojinka.
Hoton Luis Rodriguez
Luis Rodriguez ƙwararren likita necist + masanin lissafi da CISSP. A halin yanzu shine wanda ya kafa kuma babban jami'in gudanarwa a Xygeni Security. Yana da sama da shekaru 20 na gogewa a fannin tsaron software kuma ya shiga cikin ayyuka kamar su SAST da kuma SCAA halin yanzu yana mai da hankali kan software supply chain security.
Daniel Martin
Daniel Martín ƙwararre ne a fannin tsaron yanar gizo kuma memba ne na ƙungiyar bincike ta Xygeni, ƙwararre a fannin tsaro SDLC rage raunin tsaro da aikace-aikace.
