Iphakheji yePython i-threadfluent, etholakale ku-PyPI, ikhonjwe njenge enonya, equkethe i-malware evamile ye-infostealer. Kodwa-ke, isici sayo esichazayo ukusetshenziswa kwamasu athuthukisiwe okufihla ikhodi afihla umthwalo wayo, okwenza ukuhlaziya kube nzima kakhulu. Le malware isebenzisa izendlalelo ezintathu zokufihla ngokuphindaphindiwe kulo lonke uchungechunge lwayo lokuhlasela, okudala izithiyo ezibalulekile zokuqedwa kokwakhiwa ngesandla.
Ishidi Lokukhohlisa: I-Infostealer Malware kanye ne-Code Obfuscation
Kuyini i-Infostealer Malware?
I-malware ye-Infostealer isebenza njengesela elikhohlisayo ezweni lakho ledijithali. Ibamba ulwazi olubucayi buthule, njengamaphasiwedi akho, izinombolo zekhadi lesikweletu, noma imininingwane yomuntu siqu, ngaphandle kokuqaphela. Lezi zinhlelo ziqopha lokho okuthayiphayo (ukufaka ama-keylogging), zithathe isiphequluli sakho, noma ziskene amafayela kudivayisi yakho ukuze ziqoqe idatha ebalulekile. Ingxenye eyesabekayo kakhulu? Ziyakwazi ukuhlala zingaziwa.
1. Ukubethela Kathathu
Inqubo yokufiphaza iqala ngomthwalo obhalwe ngokubethela kakhulu ofakwe ku- fluent.py ifayela. Inqubo yokuqala yokufaka ikhodi kanye nokususa ukubethela ingafingqwa kanje:
encoded_data = base64_module.b64decode("... BASE-6 with encrypted payload, IV and RSA-encrypted keys…”); # … Sequential decryption: ChaCha20, Blowfish and AES … encrypted_payload = AES_Cipher.new(aes_key, AES_Cipher.MODE_CBC, iv=aes_iv).decrypt(encrypted_payload[16:]) final_payload = unpad_function(encrypted_payload, AES_Cipher.block_size) exec( zlib_module.decompress(bz2_module.decompress(final_payload)) ) Le nqubo yokufiphaza ihilela:
- Ukucindezela: Ukusebenzisa i-gzip ne-bzip.
- Ukubethela kwe-Symmetric: Ukubethela okuboshwe ngeketanga nge-ChaCha20, i-Blowfish, kanye ne-AES.
- Ukubethela kwe-asymmetric: I-RSA isetshenziselwa ukubethela okhiye abalinganayo.
Umphumela ufakwe ikhodi ku-Base64 futhi ufakwe njengo idatha_ekhodiwe. Ukuphindaphinda ngakunye kwakha phezu kwangaphambilini, kudala isakhiwo sokubethela esihlanganisiwe esenza kube nzima kakhulu ukuthola umthwalo wangempela ngaphandle kobunjiniyela obubuyela emuva.
2. Ukususwa kwe-Gzip
Ezinyathelweni eziningi eziphakathi nendawo, i-malware isebenzisa indlela eqondile kodwa ephumelelayo yokufiphaza: ukucindezelwa kwe-Gzip kuhlanganiswe nokubhala ikhodi kwe-Base64.
import base64, zlib; eval(zlib.decompress(base64.b64decode(<STR>).decode('utf-8')) Le ndlela iqinisekisa ukuthi umthwalo ofihliwe uhlala ufihliwe kuzo zonke izigaba.
3. Ukuhlanganiswa Kwekhodi Nokuhlanganiswa Okuguquguqukayo
Isendlalelo sokugcina sihilela ukuhlukanisa umthwalo ofihliwe kuzo zonke izinto eziningi eziguquguqukayo, ezihlanganiswa futhi zichazwe ngokuguquguqukayo ngesikhathi sokwenziwa:
import base64, zlib FEQXCBDOZKHVIhT = '...' # ....(111 other variables with base-64 encoded values) ... zZytWuvuEdBXSrO = eval(<FEQXCBDOZKHVIhT' encoded with '\x>) + eval(<next variable, encoded>) + eval( ' zlib.decompress(base64.b64decode(<VAR>)).decode('utf-8') ') + ... eval(compile(base64.b64decode(eval(zZytWuvuEdBXSrO)).decode('utf-8'), ‘<app>', 'exec')) Lesi sigaba sinzima kakhulu ukwenza ubunjiniyela obushintshayo ngesandla, njengoba i-variable ngayinye kumele ichazwe futhi ihlanganiswe kabusha ukuze iveze umthwalo olandelayo.
Ngokuhlanganisa lezi zindlela zokufiphaza, i-malware ye-infostealer in i-threadfluent igwema ukutholakala, ikhombisa indima ebalulekile Ikhodi Obfuscation ekuhlaselweni kwe-cyber kwanamuhla.
Uchungechunge Lokuhlasela Lwezigaba Eziningi lwe-ThreadFluent
The i-threadfluent i-malware ye-infostealer inezigaba ezine ezihlukene, ngasinye sethula izendlalelo ezengeziwe ze Ikhodi ObfuscationLezi zigaba azigcini nje ngokuletha umthwalo kodwa futhi ziwuvikela ekutholweni nasekuhlaziyweni.
Isigaba 0: Ukuqaliswa Kwekhodi Yokuqala
Indawo yokungena yi- __init__.py ifayela, eliqala ukwenziwa komthwalo ofihliwe ku fluent.pyLeli fayela lisebenzisa i-multi-layered obfuscation (njengoba kuchaziwe ezinyathelweni 1-3) ukukhiqiza i-Stage 1 dropper:
import os,threading def main(): if os.name == 'nt': from . import fluent fluent.main() thread = threading.Thread(target=main , daemon=True) thread.start() Isigaba 1: I-Initial Dropper
I-dropper yokuqala, uma isisusiwe, ilanda futhi ifake ikhodi enobungozi eyengeziwe, puts.py, kusukela endaweni yokugcina i-GitHub Ama-shanks anezinwele ezibomvu-1337/ama-repuest (isexwayiso: ikhodi enobungozi engaba khona lapha).
I-dropper iyashumeka puts.py ekufakweni kwendawo kwe-popular izicelo umtapo wolwazi, ukuguqula __init__.py ifayela lokusebenzisa i-deobfuscation bese liqhuba isigaba esilandelayo. Lokhu kuguqulwa kwe-deobfuscation kuqukethe ukubuyisela emuva izinhlelo zokusebenza eziningi zezingqimba ze-obfuscation 1 … 3.
Isigaba 2: I-Dropper Yesibili
I-dropper yesibili, uma isisusiwe ngemuva kwenqubo efanayo, ilanda enye i-payload, i-ssl.py kusuka endaweni yokugcina ye-GitHub, uyiqamba kabusha ngokuthi i-udp.py, futhi ikhiqiza ifayela lokukhiya ukuqinisekisa ukuthi i-malware ayiphindi ifake kabusha ngokuphindaphindiwe. Bese isetshenziswa ukuze ingabonakali, okuholela ekusetshenzisweni komthwalo wokugcina we-infostealer.
Isigaba 3: Ukweba Ulwazi Kokugcina
Isigaba sokugcina siwukubamba ulwazi okusebenzayo ngokugcwele okusebenzisa amasu athuthukile okugwema:
- Izici zokulwa nokuhlaziywa:
- Ithola amathuluzi e-antimalware futhi iyaqeda uma kutholwa noma yiziphi izinqubo ezifakwe ohlwini oluvinjelwe, ama-IP, amagama abamba, noma izindawo ezibonakalayo.
- Ukukhishwa kwedatha:
- Ithwebula ulwazi oluphelele. Kusukela ku-IP, ikheli le-Mac, idatha ye-VPN, amakhukhi/umlando wesiphequluli, idatha yekhadi lesikweletu kanye neziqinisekiso zesikhwama semali se-crypto phakathi kokunye, kufaka phakathi isithombe-skrini.
- Ithumela idatha eyebiwe (ebethelwe) ngesiteshi seTelegram, isebenzisa ithempulethi eboniswe lapha:
Isu Lokususa Ukungcola
Ukuze bahlaziye amaphakheji afanayo, abacwaningi kumele baguqule ngokuhlelekile izendlalelo zawo zokufiphaza:
- Lingisa Izinyathelo Zokufiphaza: Bhala izikripthi ukuze ulingise ukuguqulwa (isb., ukususa ukubethela, ukususa ukucindezela) ngaphandle kokusebenzisa umthwalo okhokhelwayo.
- Izendlalelo Zokubethela Ezibuyela Emuva: Khipha futhi ukhiphe umbhalo we-payload usebenzisa okhiye abafakiwe kanye nama-algorithms.
- Ukuhlaziywa Okuphindaphindayo: Cubungula isigaba ngasinye esiphakathi ngokuphindaphindiwe ukuze wakhe kabusha umthwalo wokugcina.
Amathuluzi azenzakalelayo kanye nezindawo ezifakwe i-sandbox kubalulekile ukuze kube lula lokhu kuhlaziya.
Ufuna ukufunda okwengeziwe mayelana nokuhlala uphambi kwezinsongo ngesikhathi sangempela?
Landa iphepha lethu elimhlophe, elithi 'Isexwayiso Sasekuqaleni: Ukutholwa Kwengozi Yesikhathi Sangempela Nokubekwa Eqhulwini,' bese uthola ukuthi ungayivikela kanjani i-software supply chain yakho.
Umlingisi Wezingozi
Kubonakala sengathi iphakheji yanyatheliswa kusuka kuma-akhawunti amabili e-PyPI, I-ABIRHOSSAIN10 futhi anomilano785, isusiwe okwamanje.
Kukhona i-akhawunti ye-GitHub (esebenzayo njengamanje) eqanjwe ngegama I-ABIRHOSSAIN10, okungase kuhlotshaniswe nomkhankaso. Ama-shanks anezinwele ezibomvu-1337 Umsebenzisi we-GitHub ongumnikazi wendawo yokugcina esetshenziselwa ukulanda imithwalo yokulayisha yesigaba sesi-2 nesesi-3 naye uyahlaziywa.
Nakuba ukuchazwa kuhlale kuyinkimbinkimbi futhi ubulungu beqembu elibomvu buyinto engenzeka, uhlobo kanye nobuningi bolwazi kwakubonisa umuntu onobungozi.
Isiphetho: Indima Yokufiphazwa Kwekhodi Ekuguqukeni Kwe-Malware
The i-threadfluent Iphakheji ibonisa ukufiphazwa kwe-malware yesimanje ekulethweni kwayo kwezigaba eziningi. Uma kuhambisana namasu okugwema asetshenziswayo, leli phakheji libonisa umzamo ocacile wokugwema ukutholwa nokumelana nokuhlaziywa.
Lokhu kuhlaziya kugcizelela ukubaluleka kwemizamo yokubambisana kanye namathuluzi azenzakalelayo ekulweni nezinsongo ezinjalo. Ngokuhlaziya nokuqonda lezi zindlela, ochwepheshe bezokuphepha bangakha ukuzivikela okungcono ngokumelene ne-malware efanayo esikhathini esizayo.
Indlela Uhlelo lwe-MEW lwe-Xygeni oluvimbele ngayo iphakheji ye-threadfluent enonya ukuthi ifinyelele ekukhiqizeni
I-Xygeni's Isexwayiso Sangaphambi Kwesikhathi Se-Malware (MEW) uhlelo lube nesandla ekumiseni i-threadfluent Iphakheji yePython, ukuthembela okunonya okuqukethe okuthuthukisiwe ukuguqulwa kwekhodi kanye nesigaba esinezigaba eziningi i-malware ye-infostealer, ngaphambi kokuba kubeke engcupheni izindawo zokukhiqiza. Nansi indlela:
- Ukutholwa Ngokuhlaziya Okungaguquki
I-MEW ibonwe i-threadfluentikhodi efihliwe, ukuthola izimpawu ezisolisayo njengokubethela okunezingqimba kanye nomsebenzi ongavamile wokuthembela. - Ukuhlolwa Kokufinyeleleka Kwesikhathi Sokusebenza
Uhlelo luthole ukuthi ikhodi yephakheji ingasebenza ngesikhathi sokusetshenziswa, iphawula ukuthi iyisongo esikhulu ngaphandle kokuyisebenzisa ngempela. - CI/CD Pipeline Protection
I-MEW ivinjiwe i-threadfluent ngesikhathi sangempela, yakuvimba ukuthi kufakwe ezakhiweni, futhi yakuvimbela ukuthi kufinyelele ekukhiqizweni. Yathumela onjiniyela izexwayiso ezisebenzayo, yasindisa isikhathi esibalulekile. - Ukwabelana Ngobuhlakani Bezinsongo
I-Xygeni ibike ngokushesha iphakethe ku-PyPI futhi yabelana ngemiphumela yayo nenethiwekhi yayo yokuphepha yomhlaba wonke, yalivimba ukuthi lingasabalali kakhulu.
Vikela CI/CD Pipelines Mahhala
Vimbela izinsongo ezifana i-threadfluent ngesistimu ye-Xygeni's Malware Early Warning. Qala eyakho isivivinyo samahhala namuhla futhi uvikele uchungechunge lwakho lokuhlinzekwa kwesofthiwe.
Louis Rodriguez
ULuis Rodriguez ungudokotela wezifo zomzimbacisisazi sezibalo kanye CISSP. Njengamanje ungumsunguli kanye ne-CTO e-Xygeni Security. Uneminyaka engaphezu kwengu-20 yesipiliyoni ekuphepheni kwesofthiwe futhi wabamba iqhaza kumaphrojekthi afana nalawa SAST futhi SCAOkwamanje ugxile ku software supply chain security.
UDaniel Martin
UDaniel Martín unguchwepheshe wezokuphepha kwe-inthanethi kanye nelungu leqembu locwaningo lwezokuphepha le-Xygeni, ogxile kakhulu SDLC ukuphepha kanye nokunciphisa ubungozi bokusetshenziswa.
