N'oge na-adịbeghị anya, Xygeni hụrụ usoro dị egwu n'ọdịdị nke mwakpo ọkọnọ ngwanrọ na 2025., na-apụta n'etiti ndị njikwa ngwugwu abụọ a ma ama: P&IP na npmDịka akụkụ nke mgbalị anyị na-eme iji chọpụta ihe iyi egwu,Ịdọ Aka Ná Ntị Mmalite nke Xygeni nke Malware (MEW) ngwaọrụ ahụ chọpụtara ihe atụ dị iche mana yiri nke usoro nke ngwugwu ọjọọ ebugoro na ndekọ ọzọ na mbụ. Ikpe a na-egosi etu ndị na-eyi egwu si agbanwe ma na-eji usoro mwakpo eme ihe n'ofe gburugburu ebe obibi, ọkachasị site na ngwugwu Python ọjọọ na ngwugwu npm ọjọọ, nke na-eme ka ohere nke ngwugwu ọjọọ banye n'usoro ọkọnọ mepere emepe dịkwuo elu.
MEW nke Xygeni: Ịchọpụta ihe ndị yiri ya
E wuru ngwa MEW nke Xygeni iji chọpụta ma gosipụta ngwugwu ọjọọ, ọkachasị ndị jikọtara ya na Mwakpo Ngwanrọ na 2025, ozugbo e bipụtara ha na ndekọ ndị mepere emepe. Ọ na-arụ ọrụ site n'inyocha ngwugwu ọhụrụ maka omume a na-enyo enyo.
N'ọnọdụ a, o chọpụtara ụzọ abụọ ngwugwu Python ọjọọ (graphalgo na PyPI) na ngwugwu npm ọjọọ (express-cookie-parser na npm).
Ngwugwu Python na npm Ọjọọ na Mwakpo Ngwanrọ (2025)
Ka anyị nyochaa njirimara ndị anyị na-ekerịta nke kpalitere ịdọ aka ná ntị anyị:
Nhazi
Ha abụọ gbalịrị ime ka hà bụ ngwugwu ndị ama ama dị ugbu a.
- Graphalgo (PyPI): "Ngwugwu Python maka imepụta na ijikwa eserese na netwọk."Onye ọrụ aha ya bulitere ya "Larrytech" Na June 13, 2025, ngwugwu a gosipụtara onwe ya dị ka ihe ọzọ PyPi maka ọrụ grafalgo mbụ na-abụghị nke ọjọọ, nke e mechara gbanwee aha ya na graphdict.
- Nkọwapụta-kuki-nkọwa (npm)Ngwugwu a ṅomiri ngwugwu kuki a ma ama, ọbụna na-egosipụta ya README.md. Ịdị ka onye a na-eme ihe n'ụzọ dị otu a bụ usoro ochie iji jiri ntụkwasị obi dị ugbu a mee ihe.
Mkpuchi dị ka Ahịrị Nchebe Mbụ
Ngwugwu abụọ ahụ kpuchiri koodu ọjọọ ha n'ime faịlụ mbụ. graphalgo, a chọtara koodu ahụ gbara ọchịchịrị n'ime /utils/load_libraries.py. N'okwu nke Nkọwapụta-kuki-express, cookie-loader.min.js nwere ibu ọrụ a na-anaghị ahụ anya.
A na-ejikarị oyi akwa mbụ a nke obfuscation egbochi nyocha nkịtị na nyocha kwụ ọtọ. Obfuscation ahụ dị nnọọ mfe: mkpakọ ZLib ugboro ugboro tinyere koodu Base64. Ụdị obfuscation a na-egosi nke ọma na ngwanrọ ahụ na-agbalị izochi omume ya. Tinyere ihe akaebe ndị ọzọ, nke a nyere Xygeni MEW ohere ịkọwa ngwugwu ndị ahụ dị ka malware nwere ike ime. N'oge ọkwa nkwenye, ndị nyocha anyị kwadebere ngwa ngwa edemede deobfuscation nke kpughere ọkwa obfuscation dị njọ.
Nnyefe ibu dị iche iche na ebe mmalite ekekọrịtara
Ngwugwu abụọ ahụ rụrụ ọrụ dị ka "mmalite"ndị na-atụ mmiri"," na-ahazi ebe maka ibu ọrụ n'ezie. Ha kekọrịtara otu ihe jikọrọ ha na mpụga "mkpụrụ"URL faịlụ:https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
Faịlụ mkpụrụ mpụta a yiri nke ahụ bụ ihe na-egosi na onye na-eme ihe egwu a na-ekerịta. Ihe na-adọrọ mmasị bụ na ọdịnaya nke faịlụ mkpụrụ a yiri ka ọ bụ ihe dị mfe na-agbanwe gburugburu ebe obibi (dịka ọmụmaatụ, JWT_SECRET, PORT), nke nwere ike iduhie ọrụ ya n'ezie.
Mkpebi C2 dị ike yana DGA
Usoro dị mgbagwoju anya a hụrụ na ngwugwu ọjọọ ndị a bụ iji Domain Generation Algorithm (DGA) dozie sava Command and Control (C2) n'ụzọ dị iche iche. Usoro a, nke a na-ahụkarị na mwakpo usoro ngwanrọ dị elu na 2025, dabere na hash SHA256 sitere na ọdịnaya faịlụ mkpụrụ, yana ụkpụrụ ndị ọzọ e tinyere koodu siri ike. Site n'ime nke a, akụrụngwa C2 na-agbanwe ugboro ugboro, na-eme ka nchịkọta ojii ọdịnala ghara ịdị irè. N'okwu a, ụdị npm jiri uru edobere nke 496AAC7E dịka akụkụ nke usoro DGA ya.
Ịmepụta nnọgidesi ike
Ndị mwakpo abụọ a chọrọ ka ha nọrọ n'ebe sistemụ ndị metụtara. startup.py (maka PyPi) ma ọ bụ startup.js (maka npm), n'ime ndekọ data ndị ọrụ Google Chrome a na-ahụkarị n'ofe sistemụ arụmọrụ dị iche iche (Windows, Linux, macOS).
Nhicha Mgbe Mmechara Emechara
Iji belata akara ngosi, edemede ọjọọ abụọ ahụ mere ọrụ nhicha. Nke a gụnyere ihichapụ faịlụ mbu ha (load_libraries.py, cookie-loader.min.js) na ịgbanwe faịlụ ngwugwu ziri ezi (__init__.py, index.js) iwepụ ntụaka na ihe ndị ehichapụrụ ugbu a.
Ihe Ndị Na-egosi Nkwekọrịta Na Ngwugwu Python Ọjọọ na N'otu N'otu
- Ngwugwu PyPI: graphalgo (nke larrytech bipụtara, Juun 13, 2025)
- Ngwugwu npm: express-cookie-parser (kpọmkwem ụdị 1.4.12)
- Nweta URL Mkpụrụ Ekekọrịtara:
https://raw.githubusercontent.com/johns92/blog_app/refs/heads/main/server/.env.example
- Aha faịlụ ndị na-adịgide adịgide:
startup.py(Python)startup.js(JavaScript) - Ụzọ Ndị A Na-ahụkarị Na-adịgide Adịgide (dabere na OS): N'ime ndekọ data ndị ọrụ Google Chrome (dịka ọmụmaatụ,
AppData\Local\Google\Chrome\UserData\Scripts\na Windows,~/.config/google-chrome/Scripts/na Linux, wdg.).
Otu esi agbachitere megide ngwugwu ọjọọ na mwakpo ngwanro 2025
Ụzọ A Na-atụ aro Maka Ndị Mmepe
Ihe a merenụ bụ ihe atụ bara uru n'ihe gbasara mwakpo ngwanro na-agbanwe agbanwe na 2025. Ọ na-akọwapụta otu ngwugwu Python ọjọọ na ngwugwu npm ọjọọ nwere ike isi banye n'ime gburugburu ebe obibi a pụrụ ịtụkwasị obi, na-ezere nchọpụta ruo mgbe oge gafere. Ọ bụ ya mere nchọpụta mbụ, ngwaọrụ smart, na ịdị ọcha sistemụ na-arụ ọrụ ugbu a bụ akụkụ dị mkpa nke usoro ọrụ DevOps ọ bụla dị nchebe. A na-agba ndị mmepe ume ka ha tụlee ihe ndị a:
Nyocha nke Ndabere
Ọ bụrụ na ọrụ gị gụnyere graphalgo or Nkọwapụta-kuki-express, ọ ga-abụ ihe amamihe dị na ya ịga n'ihu na mwepụ ha.
- Maka PyPI:
pip uninstall graphalgo - Maka npm:
npm uninstall express-cookie-parser
Ịdị ọcha nke Sistemụ
Tụlee ime nyocha sistemụ zuru oke. Ọ dịkwa mma ka ị jiri aka gị lelee ụzọ ndekọ data onye ọrụ Chrome a na-ahụkarị maka ihe ọ bụla a na-atụghị anya ya. startup.py or startup.js faịlụ.
Usoro nchekwa na-arụ ọrụ
- Nyochaa Ndabere Ọhụrụ: Hazie usoro iji nyochaa ngwugwu ọhụrụ nke ọma tupu njikọta, lekwasị anya na nke sitere na ndị mbipụta na-amaghị.
- Jikọta Ngwaọrụ NchebeNgwaọrụ dịka MEW nke Xygeni, yana nyocha nhazi ngwanrọ ndị ọzọ (SCA) ngwọta, nwere ike inye oke nchekwa dị mkpa site n'ịchọpụta omume na adịghị ike ndị a na-enyo enyo.
- Ihe ùgwù kacha nta: Gburugburu mmepe ọrụ nke nwere ụkpụrụ nke ihe kacha nta nwere ike inye aka belata mmetụta nke nkwekọrịta.
- Mmata netwọkụ: Nleba anya na okporo ụzọ netwọk na-apụ apụ maka njikọ pụrụ iche nwere ike ikpughe mgbe ụfọdụ nkwukọrịta C2 nke DGA mepụtara.
Isi akụrụngwa nke load_libraries.py (site na graphalgo)
download_remote_content(): Na-ejikwa iweta faịlụ site na URL akọwapụtara.run_process(): Na-eme edemede Python mpụga n'ụzọ dị iche, na-egbochi mmepụta ka ọ nọgide na-enweghị ihe ọ bụla.get_output_file_path(): Na-ekpebi ebe sistemụ kwesịrị ekwesị maka faịlụ mmalite.py na-adịgide adịgide.remove_self(): Na-ahazi nhicha faịlụ ọjọọ mbụ na mgbanwe ngwugwu mgbe emechara mmezu ya.simple_shift_encrypt()/simple_shift_decrypt()Ọrụ nzuzo ahaziri maka ikpuchi ọwa nkwukọrịta, dị oke mkpa maka mmejuputa DGA.load_libraries(): Ọrụ bụ isi nke na-ahazi usoro niile dị n'ọtụtụ ọkwa, site na nbudata mbụ ruo na mmezu ikpeazụ nke ibu ọrụ na nhicha.
Nzuzu
Dịka ọ dị na ngwugwu ndị ọzọ nwere ike imerụ ahụ nke MEW chọpụtara, firewall dependance chebere ndị ọrụ ozugbo bụ ndị ga-etinye ngwugwu ọjọọ ndị a na ndabere ha. Mgbe anyị kwenyechara, anyị gbasoro usoro ngosi maka ndekọ abụọ ahụ, nke wepụrụ ngwugwu abụọ ahụ mgbe emechara nyocha.
