Phukusi la Python womasuka, yomwe yapezeka pa PyPI, yadziwika kuti ndi zoipa, yokhala ndi pulogalamu yaumbanda yodziwika bwino yobisa zidziwitso. Komabe, khalidwe lake lodziwika bwino ndi kugwiritsa ntchito njira zamakono zobisa ma code zomwe zimabisa katundu wake, zomwe zimapangitsa kusanthula kukhala kovuta kwambiri. Pulogalamu yaumbanda iyi imagwiritsa ntchito magawo atatu a kubisa mobwerezabwereza mu unyolo wake wowukira, zomwe zimapangitsa kuti pakhale zopinga zazikulu pakuchotsa ntchito pamanja.
Cheat Sheet: Infostealer Malware ndi Code Obfuscation
Kodi Infostealer Malware ndi chiyani?
Pulogalamu yaumbanda ya Infostealer imagwira ntchito ngati wakuba wobisika m'dziko lanu la digito. Imagwira zinthu zachinsinsi mwakachetechete, monga mawu achinsinsi anu, manambala a kirediti kadi, kapena zambiri zanu, popanda inu kuzindikira. Mapulogalamuwa amalemba zomwe mwalemba (keylogging), kusakatula msakatuli wanu, kapena kusanthula mafayilo pa chipangizo chanu kuti asonkhanitse deta yamtengo wapatali. Gawo loopsa kwambiri ndi liti? Amachita bwino kwambiri podziwa kuti palibe amene angadziwe zambiri.
1. Kubisa Katatu
Njira yobisika imayamba ndi katundu wobisika kwambiri woikidwa mu fluent.py Fayilo. Njira yoyamba yolembera ndi kuchotsa ma codec ikhoza kufotokozedwa motere:
Njira yobisika iyi imaphatikizapo:
- KupanikizaKugwiritsa ntchito gzip ndi bzip.
- Symmetric encryption: Kubisa kwa unyolo ndi ChaCha20, Blowfish, ndi AES.
- Asymmetric encryption: RSA imagwiritsidwa ntchito kubisa makiyi ofanana.
Zotsatira zake zalembedwa mu Base64 ndipo zayikidwa ngati deta_yolembedwaKubwereza kulikonse kumapangidwa kuchokera ku koyamba, ndikupanga mawonekedwe obisika omwe amapangitsa kuti zikhale zovuta kwambiri kupeza katundu weniweni popanda kusintha njira.
2. Kuchepetsa Gzip
Mu magawo ambiri apakati, pulogalamu yaumbanda imagwiritsa ntchito njira yosavuta koma yothandiza yobisa: Gzip compression pamodzi ndi Base64 encoding.
Njira imeneyi imatsimikizira kuti katundu wobisika amakhalabe wobisika m'magawo onse.
3. Kugwirizana kwa Ma Code ndi Kusonkhanitsa Kwamphamvu
Gawo lomaliza limaphatikizapo kugawa katundu wobisika m'mitundu yosiyanasiyana, yomwe imalumikizidwa mosiyanasiyana ndikusinthidwa panthawi yogwira ntchito:
Gawo ili ndi lovuta kwambiri kutembenuza mainjiniya pamanja, chifukwa chosinthika chilichonse chiyenera kusinthidwa ndikusakanikirananso kuti chiwonetse katundu wotsatira.
Pogwiritsa ntchito njira izi zobisika, pulogalamu yaumbanda ya infostealer in womasuka amapewa kuzindikirika, kusonyeza udindo wofunikira wa Kusokoneza Code mu ziwopsezo zamakono za pa intaneti.
Unyolo Wowukira wa ThreadFluent wa Masitepe Ambiri
The womasuka pulogalamu yaumbanda ya infostealer ili ndi magawo anayi osiyana, iliyonse ikubweretsa magawo ena a Kusokoneza CodeMagawo awa samangopereka katundu wofunikira komanso amateteza kuti asapezeke ndi kusanthula.
Gawo 0: Kukhazikitsa Koyamba kwa Code
Malo olowera ndi __init__.py fayilo, yomwe imayambitsa kukhazikitsidwa kwa katundu wobisika mu fluent.pyFayilo iyi imagwiritsa ntchito multi-layered obfuscation (monga tafotokozera mu magawo 1-3) kuti ipange dropper ya Gawo 1:
Gawo 1: Chotsitsa Choyamba
Chotsitsa choyamba, chikangotsegulidwa, chimatsitsa ndikuyika ma code ena oyipa, puts.py, kuchokera ku malo osungira zinthu a GitHub Mashank-ofiira-1337/ma repuests (chenjezo: khodi yoyipa yomwe ingakhalepo apa).
Chotsitsa chimalowa puts.py kuyika kwa malo otchuka m'deralo zopempha laibulale, kusintha __init__.py fayilo kuti muyambe deobfuscation ndikuchita gawo lotsatira. Deobfuscation iyi imaphatikizapo kusintha ntchito zambiri za zigawo za obfuscation 1 … 3.
Gawo 2: Dothi Lachiwiri
Chotsitsa chachiwiri, chikasinthidwa motsatira njira yomweyi, chimatsitsanso katundu wina, ssl.py kuchokera ku malo osungira a GitHub, amachitcha dzina latsopano ngati udp.py, ndipo imapanga fayilo yotsekera kuti pulogalamu yaumbanda isayikidwenso mobwerezabwereza. Kenako imayendetsedwa kuti ichotsedwe, zomwe zimapangitsa kuti payload yomaliza ya infostealer ichitike.
Gawo 3: Woba Nkhani Womaliza
Gawo lomaliza ndi kuba zinthu zomwe zimagwira ntchito bwino lomwe limagwiritsa ntchito njira zamakono zopewera:
- Zinthu zotsutsana ndi kusanthula:
- Imazindikira zida zotsutsana ndi pulogalamu yaumbanda ndipo imathetsa ngati njira zilizonse zoletsedwa, ma IP, mayina a hostname, kapena malo enieni apezeka.
- Kusefedwa kwa data:
- Imagwira zidziwitso zonse. Kuyambira, IP, adilesi ya Mac, deta ya VPN, ma cookies/mbiri ya msakatuli, deta ya kirediti kadi ndi ziphaso za crypto wallet pakati pa zina, kuphatikiza chithunzi.
- Imatumiza deta yobedwa (yobisika) kudzera mu njira ya Telegram, pogwiritsa ntchito template yomwe yawonetsedwa apa:
Njira Yochotsera Kusakhazikika kwa Magazi
Kuti afufuze ma phukusi ofanana, ofufuza ayenera kusintha mosamala magawo ake obisika:
- Tsanzirani Njira Zobisika: Lembani zolemba kuti muyerekezere kusintha (monga, kuchotsa mawu obisika, kuchotsa mawu obisika) popanda kuchita zinthu zomwe zalembedwa.
- Magawo Osinthira Kubisa: Chotsani ndi kuchotsa mawu ofunikira pogwiritsa ntchito makiyi ndi ma algorithms ophatikizidwa.
- Kusanthula Kobwerezabwereza: Chitani gawo lililonse lapakati mobwerezabwereza kuti mukonzenso katundu womaliza.
Zida zodzichitira zokha komanso malo okhala ndi mchenga ndizofunikira kuti kusanthula kumeneku kukhale kosavuta.
Mukufuna kudziwa zambiri zokhudza kukhala patsogolo pa ziwopsezo nthawi yeniyeni?
Tsitsani pepala lathu loyera, 'Chenjezo Loyambirira: Kuzindikira ndi Kuika Patsogolo Zoopsa Pa Nthawi Yeniyeni,' ndikupeza momwe mungatetezere unyolo wanu wopereka mapulogalamu.
Wochita Zoopsa
Zikuoneka kuti phukusili linasindikizidwa kuchokera ku maakaunti awiri a PyPI, ABIRHOSSAIN10 ndi anomilano785, yachotsedwa pakadali pano.
Pali akaunti ya GitHub (yomwe ikugwira ntchito pano) yotchedwa ABIRHOSSAIN10, zomwe zingakhale zokhudzana ndi kampeni. Mashada-ofiira-1337 Wogwiritsa ntchito GitHub yemwe ali ndi malo osungiramo zinthu omwe amagwiritsidwa ntchito potsitsa magawo 2 ndi 3 a payloads nawonso akufufuzidwa.
Ngakhale kuti nthawi zonse kugawa zinthu kumakhala kovuta ndipo kukhala membala wa gulu lofiira ndi kotheka, mtundu ndi kuchuluka kwa chidziwitso chomwe chimapezeka chimasonyeza munthu wochita zoipa.
Kutsiliza: Udindo wa Kubisa Ma Code mu Kusintha kwa Malware
The womasuka phukusili likuwonetsa kubisika kwa mapulogalamu a pulogalamu yaumbanda m'magawo ambiri. Kuphatikiza pa njira zopewera zomwe zimagwiritsidwa ntchito, phukusili likuwonetsa kuyesetsa komveka bwino kopewa kuzindikirika ndikupewa kusanthula.
Kusanthula kumeneku kukuwonetsa kufunika kwa kuyesetsa mogwirizana ndi zida zodzipangira zokha polimbana ndi ziwopsezo zotere. Mwa kusanthula ndi kumvetsetsa njira izi, akatswiri achitetezo amatha kupanga njira zabwino zodzitetezera ku pulogalamu yaumbanda yofanana mtsogolo.
Momwe Xygeni's MEW System idaletsera kuti phukusi loipa la threadfluent lisafikire pakupanga
Xygeni's Chenjezo Loyambirira la Malware (MEW) dongosololi linathandiza kwambiri poletsa womasuka Phukusi la Python, kudalira koipa komwe kuli ndi advanced kubisika kwa ma code ndi magawo ambiri pulogalamu yaumbanda ya infostealer, isanasokoneze malo opangira zinthu. Umu ndi momwe mungachitire:
- Kuzindikira Kudzera mu Kusanthula Kosasinthasintha
MEW yapezeka womasuka's code yobisika, kupeza zizindikiro zokayikitsa monga kubisa zinthu motsatizana ndi zochitika zachilendo zodalira. - Kuwunika Kutha Kufikira Nthawi Yogwira Ntchito
Dongosololi linapeza kuti khodi ya phukusili imatha kugwira ntchito panthawi yogwiritsidwa ntchito, zomwe zinasonyeza kuti ndi chiwopsezo chachikulu popanda kuigwiritsa ntchito. - CI/CD Pipeline Protection
MEW yatsekedwa womasuka nthawi yeniyeni, idaletsa kuti isaphatikizidwe mu zomangamanga, ndipo idaletsa kuti isafike pakupanga. Inatumiza machenjezo kwa opanga mapulogalamu, zomwe zimapulumutsa nthawi yamtengo wapatali. - Kugawana Luntha Loopsa
Xygeni inauza PyPI mwachangu za phukusili ndipo inagawana zomwe yapeza ndi gulu lake lachitetezo padziko lonse lapansi, zomwe zinailetsa kufalikira.
Tetezani Anu CI/CD Pipelines Kwaulere
Pewani ziwopsezo monga womasuka ndi dongosolo la Xygeni's Malware Early Warning. Yambitsani yanu yesero laulere lero ndikuteteza unyolo wanu wa mapulogalamu.
Louis Rodriguez
Luis Rodriguez ndi katswiri wa zamaganizocist + katswiri wa masamu ndi CISSP. Pakadali pano ndi m'modzi mwa oyambitsa komanso CTO ku Xygeni Security. Ali ndi zaka zoposa 20 akugwira ntchito yoteteza mapulogalamu ndipo adachita nawo mapulojekiti monga SAST ndi SCAPakadali pano akuyang'ana kwambiri pa software supply chain security.
Daniel Martín
Daniel Martín ndi katswiri wa chitetezo cha pa intaneti komanso membala wa gulu lofufuza za chitetezo cha ku Xygeni, yemwe ndi katswiri pa SDLC kuchepetsa kufooka kwa chitetezo ndi kugwiritsa ntchito.
