本帖最后由 欧阳宣 于 2015-10-14 13:45 编辑
Meet the Worm
初遇蠕虫
Writing code for criminal gain is done with a specific purpose in mind, usually focusing on stealing information such as banking credentials, data, or intellectual property. Unlike the ends we’ve seen in other malware families, the ultimate goal of the cybercriminal behind this particular worm is to maintain persistence on the victim’s machine.
为犯罪目的编写代码往往具有特定的目的，一般来说是窃取诸如银行登录信息，数据，或者是知识财产等。和我们以前在其他病毒家族中见到的情况不同，这个蠕虫所存在的终极目的是保持自己能在被感染者的机器上活下来。
Known as W32/Worm-AAEH (as well as W32/Autorun.worm.aaeh, VObfus, VBObfus, Beebone, Changeup, and other names), the aim of this family is to support the download of other malware—including banking password stealers, rootkits, fake antivirus, and ransomware. The malware includes wormlike functionality to spread quickly to new machines by propagating across networks, removable drives (USB/CD/DVD), and through ZIP and RAR archive files.
The worm was written in Visual Basic 6. Using the inherent complex and undocumented nature of Visual Basic 6 and employing polymorphism and obfuscation, W32/Worm-AAEH has successfully maintained its relevance since it was discovered in June 2009.
这个家族的命名为W32/Worm-AAEH (包含 W32/Autorun.worm.aaeh, VObfus, VBObfus, Beebone, Changeup, 以及其他名称)，主要目的是为其他类型的恶意软件下载到电脑提供基础支持——恶意软件包含银行密码窃取器，rootkit，fakeav，以及勒索软件等。这些软件也具有蠕虫一样在全新机器间迅速传播的特征，可以通过网络，可移动存储设备以及压缩包来传播。
Polymorphic malware, which can change its form with every infection, is a very difficult threat to combat. W32/Worm-AAEH is a polymorphic downloader worm with more than five million unique samples known to McAfee Labs. This worm has had a devastating impact on customer systems (more than 100,000 infected since March 2014). Once aboard, it morphs every few hours and rapidly spreads across the network, downloading a multitude of malware including password stealers, ransomware, rootkits, spambots, and additional downloaders. Our tracking of this worm since March 2014 shows that the control server replaces samples with new variants one to six times per day and that the server-side polymorphic engine serves client-specific samples and guarantees a unique sample with each download request. Proactive, automated monitoring has helped McAfee Labs stay ahead of these adversaries in detection and removal, thereby preventing an onslaught of malware in customer environments.
可变形的恶意软件会随着每次感染而变化为新的形式，是一种非常难对付的威胁。W32/Worm-AAEH是一种可变形的下载者蠕虫，迈克菲实验室已经探明的独立样本数就超过了五百万种。这种蠕虫会给被感染者的系统造成毁灭性的影响（从2014年三月起已经有超过100000台机器受到感染）。一旦到达机器，它会每几个小时变形一次，在网络中间疯狂地传播，同时下载一大堆恶意软件，包括密码窃取器，勒索软件，rootkit，spambot，以及其他下载器。我们从2014年三月份开始跟踪这个蠕虫，当时探明主控服务器会以每天6次的速度用新的变种替代机器上的样本，而服务器端存在控制变形的算法，确保每台被感染机器上的样本都是不同的，每次下载请求所下载到的样本也是不同的。前瞻性的自动化检测确保迈克菲实验室能在这个检测与反检测的循环中抢先一步，避免了该病毒在消费者环境中的大规模传播。
In this report we describe an automation system created in March 2014 by McAfee Labs to mimic the worm’s communication behavior and tap into its control servers to harvest malware. This system has allowed our researchers zero-day access to the malware and has helped McAfee Labs monitor the botnet’s activity prior to infecting customers. The automation has significantly reduced the number of customer system infections and escalations.
本次报告中我们将会描述一种实验室在14年三月自主开发的自动化系统，它的用途是模仿蠕虫的通讯行为，同时潜入主控服务器来直接收集样本。这个系统允许我们零延迟获取病毒，同时在僵尸网络感染消费者之前提前监控它的行为。自动化系统大大降低了被感染和占据的消费者机器的数量。
Evolution: as the W32/Worm-AAEH turns
进化：W32/Worm-AAEH的变身
The first known W32/Worm-AAEH sample (6ca70205cdd67682d6e86c8394ea459e) was found on June 22, 2009 (compiled on June 20). It is detected as Generic Packed.c. Despite being the first version released in the wild, the worm’s authors intended to make it hard to analyze by storing every string as individual characters and concatenating them at runtime. Aside from this step, however, no other functionality prevented the analysis of the malware. The sample had
modest capabilities:
第一个W32/Worm-AAEH 的样本 (6ca70205cdd67682d6e86c8394ea459e)是在09年六月22日被发现，编译于六月20日。当时的报法为Generic Packed.c。尽管是第一个被检测的样本，蠕虫的作者尽最大努力让分析这个样本变得非常困难：样本的每个字符串都被拆开成单个字符，只在运行时才被合并在一起。但除了这个步骤之外，样本并没有采取其他措施。这个样本的权限并非很具有侵略性：
■■
Executing at system startup and hiding in the User Profile directory.
在系统启动时执行，隐藏在用户目录下。
■■
Copying itself in all removable drives and using a hidden autorun.inf file to launch automatically. Using the string “Open folder to view files” as the action text in the local language, supporting 16 European languages.
将自己复制到所有可移动存储设备中，并使用一个隐藏属性的autorun.inf来保证自动启动；使用字符串“打开文件夹以查看文件”来触发，并支持16种欧洲各国语言。
■■
Disabling Windows Task Manager’s ability to terminate applications to prevent itself from being manually terminated by the user.
使windows任务管理器的结束任务功能失效，防止用户手动结束进程。
■■
Contacting a hardcoded domain (ns1.theimageparlour.net) to download and execute additional malware.
与一个代码被固化的域名(ns1.theimageparlour.net)进行通信，然后下载并运行其他恶意软件。
Over time, the authors introduced new features. Currently, the worm can:
随着时间推移，作者对蠕虫加入了新功能，如今这个蠕虫已经可以：
■■
Detect virtual machines and antivirus software.
侦测虚拟机和反病毒软件
■■
Terminate Internet connections to IP addresses at security companies.
中止与反病毒厂商相关ip地址的通信
■■
Use a domain generation algorithm (DGA) to find its control servers.
采用域名生成算法(DGA)来寻找主控服务器
■■
Inject malware into existing processes.
将恶意软件植入已有进程。
■■
Use encryption.
采用加密。
■■
Disable tools from terminating it.
防止工具结束自身
■■
Spread itself via removable CD/DVD drives.
通过CD/DVD驱动器传播
■■
Exploit a LNK file vulnerability (CVE-2010-2568).
采用lnk文件漏洞进行攻击(CVE-2010-2568)
■■
Insert itself in ZIP or RAR archives to aid its persistence and propagation.
将自己插入压缩包以保障自己的存活和传播。 |
[复制链接]
发表于 2015-10-14 13:37:49
楼主
查杀的了QQ粘虫妈？