1
2
3
4
5
6
7
8
9
10
11
12
13
14
<span style="font-family: 'courier new', courier, monospace;" ><code data-lang="console"><span
class="tok-go">\carbon_working_folder\% // base folder</span>
<span class="tok-go">├── 0409 // contains tasks (commands to be executed or PE file) and their
configuration files</span>
<span class="tok-go">│ ├── cifrado.xml // tasks to be executed by the injected library</span>
<span class="tok-go">│ ├── encodebase.inf // tasks to be executed by the orchestrator</span>
<span class="tok-go">├── 1033 // tasks results and logs files</span>
<span class="tok-go">│ ├── dsntype.gif // contains list of files to send to the C&C server, this
file is neither compressed nor encrypted</span>
<span class="tok-go">├── en-US // plugins folder</span>
<span class="tok-go">│ ├── asmlang.jpg // not used</span>
<span class="tok-go">├── fsbootfail.dat // error log</span>
<span class="tok-go">├── mkfieldsec.dll // injected library (x32)</span>
<span class="tok-go">├── preinsta.jpg // log</span>
<span class="tok-go">├── wkstrend.xml // configuration file</span>
<span class="tok-go">├── xmlrts.png</span>
<span class="tok-go">└── zcerterror.png</span></code></span>
File access
In the case of the majority of the files from the Carbon working folder, when one is accessed
by the malware, the following steps are taken:
a specific mutex is used to ensure its exclusive access.
the file is decrypted (CAST-128)
when the operations on the file are done, the file is reencrypted (CAST-128)
the mutex is released
Mutexes
The following mutexes are created by the orchestrator in Carbon 3.7x:
“Global\\MSCTF.Shared.MUTEX.ZRX” (used to ensure exclusive access to
“vndkrmn.dic”)
“Global\\DBWindowsBase” (used to ensure exclusive access to “C_56743.NLS”)
“Global\\IEFrame.LockDefaultBrowser” (used to ensure exclusive access to
“b9s3coss.ax”)
“Global\\WinSta0_DesktopSessionMut” (used to ensure exclusive access to
“a67ncodc.ax”)
“Global\{5FA3BC02-920F-D42A-68BC-04F2A75BE158}” (used to ensure exclusive
access to new files created in “Nls” folder)
5/25
剩余24页未读，继续阅读
netkid0011
- 粉丝: 0
- 资源: 30
我的内容管理
展开
最新资源
- Vue实现iOS原生Picker组件：详细解析与实现思路
- Arduino蓝牙小车：参数调试与功能控制
- 百度Java面试精华：200页精选资源涵盖核心知识点
- Swift使用CoreData填坑指南：CoreData在Swift 3.0的变化
- 微距离无线充电器创新设计及其实验探索
- MTK Android平台开发全攻略：44步详解流程
- RecyclerView全面解析：替代ListView的新选择
- Android开发：自动适配中英文键盘解决方案
- Android调用WebService接口教程
- Android开发：BitmapUtil图片处理全解析与实例
- Android多线程断点续传实现详解
- PCA算法在人脸识别会议签到系统中的应用
- EventBus 3.0：Android事件总线详解与实战应用
- Android FileUtil：全面解析文件操作实用技巧与实例
- RecyclerView添加头部和尾部实战教程
- Android实现微博滑动固定顶部栏实战与优化
资源上传下载、课程学习等过程中有任何疑问或建议，欢迎提出宝贵意见哦~我们会及时处理！
点击此处反馈
