Iphakheji yePython i-threadfluent, efunyenwe kwiPyPI, ichongiwe njenge ezimbi, equlethe i-malware eqhelekileyo ye-infostealer. Nangona kunjalo, uphawu lwayo olucacileyo kukusebenzisa iindlela eziphambili ze-code obfuscation ezifihla umthwalo wayo, nto leyo eyenza uhlalutyo lube nzima kakhulu. Le malware isebenzisa iileya ezintathu ze-obfuscation ngokuphindaphindiweyo kwikhonkco layo lokuhlasela, idala imiqobo ebalulekileyo yokuchithwa kwesakhiwo ngesandla.
Iphepha lokukhohlisa: I-Infostealer Malware kunye ne-Code Obfuscation
Yintoni i-Infostealer Malware?
I-malware ye-Infostealer isebenza njengesela elifihlakeleyo kwihlabathi lakho ledijithali. Ibamba ulwazi oluyimfihlo ngokufihlakeleyo, olufana namagama akho ayimfihlo, iinombolo zekhadi letyala, okanye iinkcukacha zobuqu, ngaphandle kokuba uqaphele. Ezi nkqubo zirekhoda oko ukuchwethezayo (keylogging), zibambe ibrowser yakho, okanye ziskene iifayile kwisixhobo sakho ukuze ziqokelele idatha exabisekileyo. Eyona nto yoyikekayo? Zibalasele ekuhlaleni zingaziwa.
1. Ukubethela kathathu
Inkqubo yokufiphaza iqala ngomthwalo ofihliweyo kakhulu ofakwe kwi fluent.py Inkqubo yokuqala yokubhala ikhowudi kunye nokususa ukubethela ingashwankathelwa ngolu hlobo lulandelayo:
encoded_data = base64_module.b64decode("... BASE-6 with encrypted payload, IV and RSA-encrypted keys…”); # … Sequential decryption: ChaCha20, Blowfish and AES … encrypted_payload = AES_Cipher.new(aes_key, AES_Cipher.MODE_CBC, iv=aes_iv).decrypt(encrypted_payload[16:]) final_payload = unpad_function(encrypted_payload, AES_Cipher.block_size) exec( zlib_module.decompress(bz2_module.decompress(final_payload)) ) Le nkqubo yokufiphaza ibandakanya:
- Ukunyanzeliswa: Ukusebenzisa i-gzip kunye ne-bzip.
- Ufihlo lwe-Symmetric: Ukubethela okunamatyathanga ngeChaCha20, iBlowfish, kunye neAES.
- I-asymmetric encryption: I-RSA isetyenziselwa ukubethela amaqhosha alinganayo.
Isiphumo sifakwe kwi-Base64 kwaye sifakwe njenge idatha_ekhowudiweyo. Uphindaphindo ngalunye lwakhela phezu kolwangaphambili, ludala isakhiwo sokubethela esidibeneyo esenza kube nzima kakhulu ukufumanisa umthwalo wokwenene ngaphandle kobunjineli obubuyela umva.
2. Ukunciphisa i-Gzip
Kwiminyathelo emininzi ephakathi, i-malware isebenzisa indlela ethe ngqo kodwa esebenzayo yokufiphaza: ukucinezelwa kwe-Gzip kudityaniswe ne-Base64 encoding.
import base64, zlib; eval(zlib.decompress(base64.b64decode(<STR>).decode('utf-8')) Le ndlela iqinisekisa ukuba umthwalo ofihliweyo uhlala ufihliwe kuzo zonke izigaba.
3. Ukudibanisa iKhowudi kunye nokuQokelelwa okuDynamic
Umaleko wokugqibela ubandakanya ukwahlulahlula umthwalo ofihliweyo kwiinguqu ezininzi, ezidityaniswe ngokuguquguqukayo kwaye zichazwe ngexesha lokwenziwa:
import base64, zlib FEQXCBDOZKHVIhT = '...' # ....(111 other variables with base-64 encoded values) ... zZytWuvuEdBXSrO = eval(<FEQXCBDOZKHVIhT' encoded with '\x>) + eval(<next variable, encoded>) + eval( ' zlib.decompress(base64.b64decode(<VAR>)).decode('utf-8') ') + ... eval(compile(base64.b64decode(eval(zZytWuvuEdBXSrO)).decode('utf-8'), ‘<app>', 'exec')) Eli nqanaba linzima kakhulu ukuphinda uguqule ubunjineli ngesandla, njengoko inguqu nganye kufuneka ichazwe kwaye idityaniswe kwakhona ukuze ibonise umthwalo olandelayo.
Ngokudibanisa ezi ndlela zokufiphaza, infostealer malware in i-threadfluent iyabaleka ukubhaqwa, ibonisa indima ebalulekileyo Ikhowudi Obfuscation kwiintlaselo ze-intanethi zanamhlanje.
Uluhlu lohlaselo lwe-ThreadFluent olunezigaba ezininzi
The i-threadfluent infostealer malware inezigaba ezine ezahlukeneyo, ngasinye sisazisa ezinye iileya ezongezelelweyo Ikhowudi ObfuscationEzi zigaba azipheleli nje ekuthwaleni umthwalo kodwa zikwakhusela ekubhaqweni nasekuhlalutyweni.
Isigaba 0: Ukuphunyezwa kweKhowudi yokuqala
Indawo yokungena yile __init__.py ifayile, eqala ukuphunyezwa komthwalo ofihliweyo kwi fluent.pyLe fayile isebenzisa i-multi-layered obfuscation (njengoko kuchaziwe kumanyathelo 1-3) ukuvelisa i-Stage 1 dropper:
import os,threading def main(): if os.name == 'nt': from . import fluent fluent.main() thread = threading.Thread(target=main , daemon=True) thread.start() Inqanaba 1: I-Initial Dropper
I-dropper yokuqala, xa sele ivuliwe, ikhuphela kwaye ifake ikhowudi eyongezelelweyo enobungozi, puts.py, ukusuka kwindawo yokugcina izinto yeGitHub Iishanks-ezibomvu-1337/repuests (isilumkiso: ikhowudi enokubakho yobubi apha).
I-dropper ifaka puts.py kufakelo lwendawo oludumileyo izicelo ithala leencwadi, liguqula __init__.py ifayile yokuqhuba i-deobfuscation kunye nokwenza inqanaba elilandelayo. Olu deobfuscation luquka ukubuyisa umva usetyenziso oluninzi lweeleya ze-obfuscation 1 … 3.
Inqanaba lesi-2: I-Dropper yesiBini
Idropper yesibini, xa sele ivuliwe emva kwenkqubo efanayo, ikhuphela enye ipayload, ssl.py kwi-GitHub repository, iyinika igama elitsha njenge udp.py, kwaye ivelise ifayile yokutshixa ukuqinisekisa ukuba i-malware ayiphindi ifakelwe kwakhona. Emva koko iyaqhutywa ukuze ingabonakali, nto leyo ekhokelela ekuphunyezweni komthwalo wokugqibela we-infostealer.
Inqanaba lesi-3: Umgcini-lwazi wokugqibela
Inqanaba lokugqibela lisebenzisa iindlela eziphambili zokubaleka ulwazi:
- Iimpawu zokuchasana nohlalutyo:
- Ifumanisa izixhobo ze-antimalware kwaye iyaphelisa ukuba kukho naziphi na iinkqubo ezifakwe kuluhlu olumnyama, ii-IP, amagama e-hostname, okanye iindawo ezibonakalayo ezifunyenweyo.
- Ukukhutshwa kwedatha:
- Ibamba ulwazi olupheleleyo. Ukusuka kwi-IP, idilesi ye-Mac, idatha ye-VPN, iikuki/imbali yesikhangeli, idatha yekhadi letyala kunye neziqinisekiso ze-crypto wallet phakathi kwezinye, kubandakanya umfanekiso weskrini.
- Ithumela idatha ebiweyo (efihliweyo) ngetshaneli yeTelegram, isebenzisa itemplate eboniswe apha:
Icebo lokususa i-deobfuscation
Ukuze bahlalutye iipakeji ezifanayo, abaphandi kufuneka batshintshe ngokucwangcisiweyo iileya zazo zokufiphala:
- Lingisa Amanyathelo Okungaqondakali: Bhala izikripthi ukuze ulinganise utshintsho (umz., ukususa ukubethela, ukususa ukucinezela) ngaphandle kokusebenzisa umthwalo ohlawulelwayo.
- Iileya zokubethela ezibuyela umva: Susa kwaye uguqule i-payload usebenzisa izitshixo ezifakwe ngaphakathi kunye ne-algorithms.
- Uhlalutyo oluphindaphindayo: Qhuba inqanaba ngalinye eliphakathi ngokuphindaphindayo ukuze wakhe kwakhona umthwalo wokugqibela.
Izixhobo ezizenzekelayo kunye neendawo ezinesanti zibalulekile ukuze olu hlalutyo lube lula.
Ngaba ufuna ukufunda okungakumbi malunga nokuhlala uphambi kwezoyikiso ngexesha langempela?
Khuphela iphepha lethu elimhlophe, elithi 'Isilumkiso Kwangethuba: Ukufunyanwa Kobungozi Ngexesha Langempela Nokubekwa Phambili,' uze ufumane indlela yokukhusela uthotho lwakho lobonelelo lwesoftware.
Umdlali weNgcali
Kubonakala ngathi le phakheji ipapashwe kwiiakhawunti ezimbini zePyPI, I-ABIRHOSSAIN10 kwaye anomilano785, isusiwe okwangoku.
Kukho iakhawunti yeGitHub (esebenzayo okwangoku) egama lingu I-ABIRHOSSAIN10, nto leyo enokunxulunyaniswa nephulo. Iingqukuva-ezibomvu-1337 Umsebenzisi weGitHub ongumnikazi wendawo yokugcina esetyenziselwa ukukhuphela imithwalo yenqanaba lesi-2 nelesi-3 naye uyahlalutywa.
Nangona ukwabiwa kweenkcukacha kusoloko kuyinkimbinkimbi kwaye ubulungu kwiqela elibomvu buyinto enokwenzeka, uhlobo kunye nobuninzi bolwazi oluphumayo lwalubonisa umenzi wesenzo esinobubi.
Isiphelo: Indima yeCode Obfuscation kwiMalware Evolution
The i-threadfluent Iphakheji ibonisa ukufiphazwa kwe-malware yanamhlanje kwindlela yayo yokuhambisa izinto ezininzi. Idibene neendlela zokuphephela ezisetyenziswayo, le phakheji ibonisa umzamo ocacileyo wokubaleka ukubhaqwa nokuxhathisa uhlalutyo.
Olu hlalutyo lugxininisa ukubaluleka kwemizamo yokusebenzisana kunye nezixhobo ezizenzekelayo ekulweni nezo zisongelo. Ngokuhlalutya nokuqonda ezi ndlela, iingcali zokhuseleko zinokuphuhlisa iindlela zokuzikhusela ezingcono kwi-malware efanayo kwixesha elizayo.
Indlela iNkqubo ye-MEW kaXygeni eyathintela ngayo iPakethe ye-threadfluent enobungozi ekufikeleleni kwimveliso
IXygeni's Isilumkiso saKwangoko seMalware (MEW) le nkqubo ibe negalelo elikhulu ekumiseni i-threadfluent Iphakheji yePython, ukuxhomekeka okunobungozi okuqulethe i-advanced ikhowudi obfuscation kunye nenqanaba elininzi infostealer malware, ngaphambi kokuba ichaphazele iimeko zemveliso. Nantsi indlela yokwenza oku:
- Ukuchonga ngoHlalutyo oluZinzileyo
I-MEW ibonwe i-threadfluentikhowudi efihliweyo, ifumana iimpawu ezirhanelekayo ezifana nokubethela okunezitebhisi kunye nomsebenzi ongaqhelekanga wokuxhomekeka. - Uvavanyo lokuFikeleleka ngexesha loMsebenzi
Le nkqubo ifumanise ukuba ikhowudi yephakheji iyasebenza ngexesha lokusetyenziswa, iphawula ukuba iyingozi enkulu ngaphandle kokuyisebenzisa. - CI/CD Pipeline ukhuselo
I-MEW ivaliwe i-threadfluent ngexesha langempela, yayimisa ukuba ingabandakanywa kwizakhiwo, yaza yayithintela ukuba ifikelele kwimveliso. Ithumele izilumkiso ezisebenzisekayo kubaphuhlisi, isindisa ixesha elibalulekileyo. - Ukwabelana ngobukrelekrele emngciphekweni
I-Xygeni yabika ngokukhawuleza le phakheji kwi-PyPI yaza yabelana ngeziphumo zayo nenethiwekhi yayo yokhuseleko lwehlabathi, yaza yayithintela ukuba isasazeke ngakumbi.
Zikhusele CI/CD Pipelines for Mahala
Thintela izoyikiso ezifana i-threadfluent ngenkqubo yeXygeni's Malware Early Warning. Qala eyakho Uzamo lasimahla namhlanje kwaye ukhusele uthotho lwakho lobonelelo lwesoftware.
Louis Rodriguez
ULuis Rodriguez yingcali yomzimbacist + ingcali yezibalo kunye CISSP. Okwangoku ungumseki kunye ne-CTO kwiXygeni Security. Unamava angaphezu kweminyaka engama-20 kukhuseleko lwesoftware kwaye uthathe inxaxheba kwiiprojekthi ezifana SAST kwaye SCAOkwangoku ugxile kwi software supply chain security.
UDaniel Martin
UDaniel Martín yingcali yokhuseleko lwe-intanethi kunye nelungu leqela lophando lokhuseleko lwe-Xygeni, eligxile kwi SDLC ukunciphisa ubuthathaka bokhuseleko kunye nesicelo.
