本帖最后由 wowocock 于 2021-12-23 18:41 编辑
他里面还带了一个类似tcprelay.sys rootkit得隐藏端口的驱动，HOOK 了netio.sys驱动的NsiEnumerateObjectsAllParametersEx的导出函数。当系统上的用户运行“ netstat”命令时，最终会调用此功能，并且恶意软件可能会hook此功能，以隐藏受感染系统上的已连接网络端口。
NETIO!NsiEnumerateObjectsAllParametersEx:
fffff880`0158f810 ff2500000000 jmp qword ptr [NETIO!NsiEnumerateObjectsAllParametersEx+0x6 (fffff880`0158f816)]
fffff880`0158f816 c8d67903 enter 79D6h,3
fffff880`0158f81a 80f8ff cmp al,0FFh
fffff880`0158f81d ff4183 inc dword ptr [rcx-7Dh]
fffff880`0158f820 f9 stc
fffff880`0158f821 020f add cl,byte ptr [rdi]
fffff880`0158f823 84b78d010045 test byte ptr [rdi+4500018Dh],dh
fffff880`0158f829 85c9 test ecx,ecx
fffff880`0379d6c8 48894c2408 mov qword ptr [rsp+8],rcx
fffff880`0379d6cd 53 push rbx
fffff880`0379d6ce 55 push rbp
fffff880`0379d6cf 56 push rsi
fffff880`0379d6d0 57 push rdi
fffff880`0379d6d1 4154 push r12
fffff880`0379d6d3 4155 push r13
fffff880`0379d6d5 4156 push r14
1: kd> u
port+0x16d7:
fffff880`0379d6d7 4157 push r15
fffff880`0379d6d9 4883ec68 sub rsp,68h
fffff880`0379d6dd 488be9 mov rbp,rcx
fffff880`0379d6e0 488d0db9090000 lea rcx,[port+0x20a0 (fffff880`0379e0a0)]
fffff880`0379d6e7 90 nop
fffff880`0379d6e8 90 nop
fffff880`0379d6e9 90 nop
fffff880`0379d6ea 90 nop
1: kd> u
port+0x16eb:
fffff880`0379d6eb 90 nop
fffff880`0379d6ec 90 nop
fffff880`0379d6ed 488b4d18 mov rcx,qword ptr [rbp+18h]
fffff880`0379d6f1 488b5510 mov rdx,qword ptr [rbp+10h]
fffff880`0379d6f5 4883f903 cmp rcx,3
fffff880`0379d6f9 0f8542030000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d6ff 8a02 mov al,byte ptr [rdx]
fffff880`0379d701 3805f9280000 cmp byte ptr [port+0x4000 (fffff880`037a0000)],al
1: kd> u
port+0x1707:
fffff880`0379d707 0f8534030000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d70d 8a4204 mov al,byte ptr [rdx+4]
fffff880`0379d710 3805ee280000 cmp byte ptr [port+0x4004 (fffff880`037a0004)],al
fffff880`0379d716 0f8525030000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d71c 8a4205 mov al,byte ptr [rdx+5]
fffff880`0379d71f 3805e0280000 cmp byte ptr [port+0x4005 (fffff880`037a0005)],al
fffff880`0379d725 0f8516030000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d72b 8a4206 mov al,byte ptr [rdx+6]
1: kd> u
port+0x172e:
fffff880`0379d72e 3805d2280000 cmp byte ptr [port+0x4006 (fffff880`037a0006)],al
fffff880`0379d734 0f8507030000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d73a 8a4207 mov al,byte ptr [rdx+7]
fffff880`0379d73d 3805c4280000 cmp byte ptr [port+0x4007 (fffff880`037a0007)],al
fffff880`0379d743 0f85f8020000 jne port+0x1a41 (fffff880`0379da41)
fffff880`0379d749 8a4208 mov al,byte ptr [rdx+8]
fffff880`0379d74c 3805b6280000 cmp byte ptr [port+0x4008 (fffff880`037a0008)],al
fffff880`0379d752 0f85e9020000 jne port+0x1a41 (fffff880`0379da41)
。。。。。。
|
楼主: 病毒样本收集者
发表于 2021-12-18 15:05:31
