Pacifier APT：Bitdefender 2016年罗马尼亚网络间谍活动报告

需积分: 9 122 浏览量更新于2024-07-15 收藏 3.27MB PDF 举报

"Bitdefender_Pacifier-APT(7-1-2016) - APT报告" 这篇报告详细介绍了Bitdefender在2016年发现并阻止的一场针对罗马尼亚机构和其他外国目标的高级持续性威胁（APT）攻击活动。这场名为"Pacifier"的网络间谍活动始于2014年，并一直持续到2016年5月，显示出了高度的持久性和复杂性。报告概述： Bitdefender的研究人员在"Overview"部分指出，攻击者利用恶意的.doc文档和.zip文件通过定向钓鱼邮件进行传播。这些文件通常伪装成简历、社交活动邀请、会议通知、二手车广告，甚至有一次是来自高级官员的指示信，以此来诱骗受害者打开。一些文件还被标记为"紧急"、"重要"或"立即行动"，以增加其诱惑力。 2014-15可执行文件：这部分详细分析了从2014年至2015年间发现的恶意可执行文件。这些文件可能是攻击者用于在受害者的系统中部署恶意软件或进一步渗透网络的关键组件。 2014-15浏览器扩展：报告探讨了在这段时间内使用的恶意浏览器扩展，这些扩展可能被用来监视用户的在线活动，收集敏感信息，或者为攻击者提供后门通道。其他2015变种：此节列举了2015年出现的不同变种，说明攻击者不断调整和改进其工具，以逃避检测和增强其攻击效果。 2016攻击浪潮： 2016年，攻击者发起了新一轮攻势，这表明他们可能已经成功地更新了其战术，或者找到了新的漏洞来利用。 IOC（Indicator of Compromise）：报告提供了重要的IOC，包括SHA1哈希值，这些是识别和追踪攻击的关键指标。安全专家和组织可以使用这些哈希值来检查他们的系统是否受到Pacifier APT的影响。清理被投毒文档打开的文档：这部分可能涉及如何识别和清理由恶意dropper程序打开的干净文档，这有助于防止潜在的后续感染。作者：报告由Bitdefender的多位研究人员共同完成，包括Marius TIVADAR、Cristian ISTRATE、Iulian MUNTEAN和Andrei ARDELEAN。报告还提到了在伊朗、印度、菲律宾、俄罗斯、立陶宛、泰国、越南和匈牙利等国家也发现了相同恶意软件的样本，显示了Pacifier APT的跨国影响力。这个案例研究为理解和防范类似的APT攻击提供了宝贵的信息，强调了网络安全防御的重要性，以及对于未知威胁的持续监测和分析。

[6]

White Paper

The Dropper

The script previously loaded from the infected .doc le executes the dropper from:

%appdata%\Microsoft\Word\MSWord.exe

The dropper is a small executable that has the les to be deployed in the overlay encrypted with RC4. It just creates and runs the

following les in this order:

- %appdata%\TMP\European_global_navigation_system.doc

- %appdata%\Axpim\ubc.exe

- %appdata%\Axpim\ anfel.js

The le European_global_navigation_system.doc is a clean document used to distract the user (see Appendix B). The le ubc.exe

is another dropper containing the real payload. The anfel.js le is used for self deletion. The names: Axpim, ubc, anfel are random

generated.

The folder name will contain 4-6 characters and starts with capital letter. The le names contain 4-5 lowercase letters before the

extension. The random generator is based on GetTickCount API. The algorithm for creating the names is presented below in python

implementation. Practically, it concatenates random vowels and consonants, but with the condition that no more than two of the same

type to be consecutive, with the aim of generating names that are somewhat pronounceable and thus may pass as man-made.

This algorithm was also used in some versions of Zeus for le name generation.

# name length will be between minLen and maxLen

# ags - 4 name will contain spaces

# - 2 name will have rst letter uppercase

# - can be combined

def RandomName(minLen,maxLen,ag):

letters = [’aeiouy’, ’bcdfghklmnpqrstvwxz’]

name = ’ ’ seed()

index = randint(0,1)

nameLen = randint(minLen, maxLen)

for i in range(0, nameLen):

if i > 0 and i % 2 == 0:

index = randint(0,1)

if (ag & 4) == 4 and len(name)>0 and name[-1]!=’ ’ and randint(0,3)==0:

name = name + ’ ’

elif i % 2 == 0:

name = name + choice(letters[index])

else:

name = name + choice(letters[1 - index])

if (ag & 2) == 2:

name = name.title()

return name.rstrip()

# generate folder name

RandomName(4, 6, 2)

# generate le names

RandomName(4, 5, 0)

[7]

White Paper

The Second Dropper

The payload dropper, ubc.exe, contains its les in its .data section and is not encrypted or compressed. It creates the les:

- %temp%\ntlm.exe

- %temp%\msvci.dll

- %temp%\msvcp.dll

- %temp%\msvck.dll

- %temp%\msvct.dll

- %temp%\msvci.exe (64 bit)

- %temp%\msvck60.dll (64 bit)

- %temp%\msvct60.dll (64 bit)

These les make up the payload. The last three are for 64-bit Windows, the rest are for the 32-bit version. The starting point of the

payload is the ntlm.exe le which is discussed below. Next, using COM objects, the dropper modies the .lnk les from the desktop and

saves the original links in %temp%\Links folder. The links are modied to start the trojan:

Lnk Target

Original „C:\Program Files\Sysinternals\Filemon.exe”

Modied

„C:\Documents and Settings\user\Local Settings\Temp\ntlm.exe”

C:\Program Files\Sysinternals\Filemon.exe

The target le of the link is replaced with ntlm.exe and the original target is sent as a parameter to ntlm.exe, which upon execution

will execute it. Next, the dropper creates %temp%\startup.bat which adds to the registry:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchostUpdate -> %TEMP%\ntlm.exe

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Devices -> %TEMP%\ntlm.exe

The rst key is for starting the trojan, along the .lnk les. Some versions do not have the lnk feature, only the registry keys. The

second key is never used in our samples.

Last le created is %temp%\Axpim\selfdel.bat for self-deletion.

msvcp.dll

32 bit library used for returning the PID of one of the processes: iexplore.exe, outlook.exe, refox.exe, chrome.exe. It hase one export,

msvcp, which enumerates running processes and checks their names. It will return the PID of the rst one found. If the processes could

not be enumerated it returns 0. If no process was found it returns -1. Instead of storing the actual names of those processes in the dll,

it stores a byte array as a key and one byte array (result) for each of the 4 names. The checking is done: ProcessName xor key == result,

on coresponding bytes. The function may return different PIDs when processes are stopped or started.

剩余31页未读，继续阅读

netkid0011

粉丝: 0
资源: 30

Pacifier APT：Bitdefender 2016年罗马尼亚网络间谍活动报告

Bitdefender-Whitepaper-APT-Mac-A4-en-EN-web(02-23-2017)

bitdefender_2010注册机64位

信息安全_数据安全_alex- IoT Threats - The scary state of.pdf

BitDefender_Uninstall_Tool

bitdefender_antivirus_sp2

bitdefender_av_v10

Bitdefender-PR-Whitepaper-DarkNexus-creat4349-en-EN-interactive.pdf

BitDefender2010_WIN7_64位注册机

世界第一的杀毒软件，想用吗？BitDefender.-.注册机

BitDefender

最新资源