{"id":25235,"date":"2016-08-02T09:00:59","date_gmt":"2016-08-02T01:00:59","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=25235"},"modified":"2016-08-02T15:19:59","modified_gmt":"2016-08-02T07:19:59","slug":"%e5%8b%92%e7%b4%a2%e7%97%85%e6%af%92%e4%b9%9f%e7%88%86%e5%b1%b1%e5%af%a8%e7%89%88-%e6%b6%89%e5%ab%8c%e6%8a%84%e8%a5%b2-cryptxxx-%e7%9a%84crypmic","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=25235","title":{"rendered":"\u52d2\u7d22\u75c5\u6bd2\u4e5f\u7206\u5c71\u5be8\u7248? \u6d89\u5acc\u6284\u8972 CryptXXX \u7684CrypMIC"},"content":{"rendered":"

\u4fd7\u8a71\u8aaa\uff1a\u300c\u6a21\u4eff\u662f\u6700\u597d\u7684\u8b9a\u7f8e\u300d\u3002CrypMIC (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba RANSOM_CRYPMIC) \u9019\u500b\u65b0\u7684\u52d2\u7d22\u75c5\u6bd2 Ransomware (\u52d2\u7d22\u8edf\u9ad4\/\u7d81\u67b6\u75c5\u6bd2) \u5bb6\u65cf\uff0c\u4f3c\u4e4e\u5728\u5165\u4fb5\u7ba1\u9053\u3001\u52d2\u7d22\u8a0a\u606f\u4ee5\u53ca\u4ed8\u6b3e\u7db2\u7ad9\u4ecb\u9762\u4e0a\u90fd\u6a21\u4eff\u4e86 CryptXXX<\/a> \u52d2\u7d22\u75c5\u6bd2\u3002CrypMIC \u7684\u4f5c\u8005\u5f88\u53ef\u80fd\u662f\u770b\u4e0a CryptXXX \u5728\u6700\u8fd1\u6488\u4e86\u4e0d\u5c11<\/a>\u800c\u60f3\u4f86\u5206\u4e00\u676f\u7fb9\uff0c\u5e0c\u671b\u85c9\u6b64\u6d77\u6488\u4e00\u7968\u3002<\/p>\n

<\/p>\n

\"\u5716<\/a>
\u5716 1\uff1a\u8d85\u7d1a\u6bd4\u4e00\u6bd4\uff1aCrypMIC\u00a0 (\u5de6) \u548c CryptXXX (\u53f3) \u52d2\u7d22\u8a0a\u606f\u53ca\u4ed8\u6b3e\u7db2\u7ad9\u3002<\/figcaption><\/figure>\n

CrypMIC \u548c CryptXXX \u6709\u8a31\u591a\u5171\u901a\u4e4b\u8655\uff1a\u5169\u8005\u90fd\u662f\u7d93\u7531 Neutrino \u6f0f\u6d1e\u653b\u64ca\u5957\u4ef6<\/a>\u00a0\u4f86\u6563\u5e03\uff0c\u4e26\u4f7f\u7528\u76f8\u540c\u7684\u5c0f\u7248\u672c\u7de8\u865f\/\u6bad\u5c4d\u96fb\u8166ID\u683c\u5f0f (U[6\u78bc\u6578\u5b57] \/ \u00a0<\/em>UXXXXXX])\uff0c\u800c\u5176\u51fd\u5f0f\u7684\u547d\u540d\u4e5f\u76f8\u540c (MS1\u3001MS2)\u3002\u6b64\u5916\uff0c\u5169\u8005\u4e5f\u90fd\u63a1\u7528\u4e86\u5ba2\u88fd\u5316\u901a\u8a0a\u5354\u5b9a\uff0c\u7d93\u7531 TCP \u5354\u5b9a\u7684 443 \u9023\u63a5\u57e0\u4f86\u8207\u5e55\u5f8c\u64cd\u7e31 (C&C) \u4f3a\u670d\u5668\u901a\u8a0a\u3002<\/p>\n

\u7136\u800c\u9032\u4e00\u6b65\u5206\u6790\u4e4b\u5f8c\uff0c\u6211\u5011\u767c\u73fe CrypMIC \u548c CryptXXX \u7684\u539f\u59cb\u78bc\u548c\u80fd\u529b\u537b\u4e0d\u76f8\u540c\u3002\u4f8b\u5982\uff0cCrypMIC \u4e26\u4e0d\u6703\u5c07\u5176\u6240\u52a0\u5bc6\u7684\u6a94\u6848\u9644\u6a94\u540d\u6539\u6210\u67d0\u500b\u7279\u6b8a\u540d\u7a31\uff0c\u9019\u8b93\u4f7f\u7528\u8005\u66f4\u96e3\u5206\u8fa8\u54ea\u4e9b\u6a94\u6848\u5df2\u906d\u5230\u7d81\u67b6\u3002\u6b64\u5916\uff0c\u5169\u8005\u6240\u4f7f\u7528\u7de8\u8b6f\u5668\u548c\u6df7\u6dc6\u7de8\u78bc\u624b\u6cd5\u4e5f\u4e0d\u540c\u3002CrypMIC \u591a\u4e86\u4e00\u9053\u6aa2\u67e5\u81ea\u5df1\u662f\u5426\u5728\u865b\u64ec\u6a5f\u5668 (VM) \u4e0a\u57f7\u884c\u7684\u7a0b\u5e8f\uff0c\u4e26\u4e14\u6703\u5c07\u6b64\u8cc7\u8a0a\u56de\u5831\u7d66 C&C \u4f3a\u670d\u5668\u3002<\/p>\n

\u4e0b\u8868\u6bd4\u8f03\u5169\u8005\u7684\u7570\u540c\u4e4b\u8655\uff1a<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
<\/td>\nCrypMIC<\/strong><\/td>\nCryptXXX 4.001<\/strong><\/a> \/ 5.001<\/strong><\/td>\n<\/tr>\n
\u653b\u64ca\u9014\u5f91<\/td>\n\u60e1\u610f\u5ee3\u544a\u3001\u5df2\u906d\u5165\u4fb5\u7684\u7db2\u7ad9<\/td>\n\u60e1\u610f\u5ee3\u544a\u3001\u5df2\u906d\u5165\u4fb5\u7684\u7db2\u7ad9<\/td>\n<\/tr>\n
\u6f0f\u6d1e\u653b\u64ca\u5957\u4ef6<\/td>\nNeutrino<\/td>\nNeutrino<\/td>\n<\/tr>\n
\u6a94\u6848\u540d\u7a31\u548c\u985e\u578b<\/td>\n\u7576\u7d93\u7531 Neutrino \u690d\u5165\u96fb\u8166\u6642\u6703\u4f7f\u7528\u96a8\u6a5f\u547d\u540d\u7684 DLL \u6a94\u540d (rad{\u96a8\u6a5f\u7522\u751f\u7684\u5341\u516d\u9032\u4f4d\u78bc}.tmp.dll<\/em> )<\/td>\n\u7576\u7d93\u7531 Neutrino \u690d\u5165\u96fb\u8166\u6642\u6703\u4f7f\u7528\u96a8\u6a5f\u547d\u540d\u7684 DLL \u6a94\u540d (rad{\u96a8\u6a5f\u7522\u751f\u7684\u5341\u516d\u9032\u4f4d\u78bc}.tmp.dll<\/em> )<\/td>\n<\/tr>\n
\u52a0\u5bc6\u6f14\u7b97\u6cd5<\/td>\nAES-256 (\u5728\u52d2\u7d22\u8a0a\u606f\u7576\u4e2d\u5ba3\u7a31\u4f7f\u7528 RSA 4096)<\/td>\nRSA \u642d\u914d RC4<\/td>\n<\/tr>\n
\u6703\u52a0\u5bc6\u7684\u6a94\u6848\u985e\u578b\u6578\u91cf<\/td>\n901<\/td>\n933 (4.001 \u8207 5.001 \u7248)<\/td>\n<\/tr>\n
\u4fee\u6539\u9644\u6a94\u540d<\/td>\n\u7121<\/td>\n\u5c07\u539f\u672c\u7684\u9644\u6a94\u540d\u6539\u6210\u96a8\u6a5f\u7684\u5341\u516d\u9032\u4f4d\u78bc\uff1a{32 \u4f4d\u6578\u5341\u516d\u9032\u4f4d\u78bc}.{5 \u4f4d\u6578\u5341\u516d\u9032\u4f4d\u78bc}<\/em>\uff0c\u5982\uff1a 0412C29576C708CF0155E8DE242169B1.6B3FE<\/td>\n<\/tr>\n
\u52a0\u5bc6\u6642\u6703\u6383\u7784\u7684\u78c1\u789f\u6a5f<\/td>\nD \u81f3 Z\u3001%USERPROFILE%\uff0c\u4ee5\u53ca\u53ef\u5378\u9664\u5f0f\u78c1\u789f\u8207\u7db2\u8def\u78c1\u789f<\/td>\nB \u81f3 Z\uff0c\u4ee5\u53ca\u53ef\u5378\u9664\u5f0f\u78c1\u789f\u8207\u7db2\u8def\u78c1\u789f<\/td>\n<\/tr>\n
\u52d2\u7d22\u8a0a\u606f\u6a94\u6848\u540d\u7a31<\/td>\nREADME.TXT\u3001README.HTML\u3001README.BMP<\/td>\n!README.HTML\u3001!README.BMP<\/td>\n<\/tr>\n
\u958b\u6a5f\u81ea\u52d5\u555f\u52d5\u8207\u6f5b\u4f0f\u6a5f\u5236<\/td>\n\u7121<\/td>\n%User Startup%\\{\u975e\u91cd\u8907 ID}.lnk<\/em>\uff0c\u5176\u4e2d {\u975e\u91cd\u8907 ID} \u90e8\u5206\u70ba 12 \u4f4d\u6578\u5341\u516d\u9032\u4f4d\u78bc<\/td>\n<\/tr>\n
\u5c07\u87a2\u5e55\u756b\u9762\u9396\u4f4f<\/td>\n\u5426<\/td>\n\u662f<\/td>\n<\/tr>\n
\u865b\u64ec\u5316\u53cd\u5236\u8207\u865b\u64ec\u6a5f\u5668 (VM) \u6aa2\u67e5\u6a5f\u5236<\/td>\n\u6839\u64da CPUID\uff1b\u5373\u4f7f\u5728 VM \u4e2d\u57f7\u884c\u4ecd\u6703\u57f7\u884c\u52a0\u5bc6\uff0c\u4e26\u4e14\u6703\u5c07\u8cc7\u8a0a\u50b3\u56de C&C \u4f3a\u670d\u5668<\/td>\n\u7121 VM \u6aa2\u67e5\u6a5f\u5236<\/td>\n<\/tr>\n
\u52d2\u8d16\u91d1\u984d<\/td>\n1.2 \u81f3 2.4 \u6bd4\u7279\u5e63 (\u4f9d 2016 \u5e74 7 \u6708 15 \u65e5\u532f\u7387\u7d04\u5408 792 \u81f3 1,597 \u7f8e\u5143)<\/td>\n1.2 \u81f3 2.4 \u6bd4\u7279\u5e63 (\u4f9d 2016 \u5e74 7 \u6708 15 \u65e5\u532f\u7387\u7d04\u5408 792 \u81f3 1,597 \u7f8e\u5143)<\/td>\n<\/tr>\n
\u4ed8\u6b3e\u65b9\u5f0f<\/td>\n\u6bd4\u7279\u5e63\uff0cTor (\u6d0b\u8525\u8def\u7531\u5668) \u7db2\u8def<\/td>\n\u6bd4\u7279\u5e63\uff0cTor (\u6d0b\u8525\u8def\u7531\u5668) \u7db2\u8def<\/td>\n<\/tr>\n
C&C \u901a\u8a0a\u548c\u8cc7\u8a0a\u7aca\u53d6<\/td>\n\u5f9e C&C \u4f3a\u670d\u5668\u53d6\u5f97 AES \u52a0\u5bc6\u91d1\u9470\u53ca\u52d2\u7d22\u8a0a\u606f\u5167\u5bb9\uff1b\u5c07\u7cfb\u7d71\u8cc7\u8a0a\u53ca\u52a0\u5bc6\u7d50\u679c\u50b3\u9001\u56de C&C \u4f3a\u670d\u5668<\/td>\n\u5f9e C&C \u4f3a\u670d\u5668\u53d6\u5f97 RSA \u516c\u958b\u91d1\u9470\u3001\u4ed8\u6b3e\u7db2\u7ad9\u7db2\u57df\u8cc7\u8a0a\u4ee5\u53ca\u8cc7\u8a0a\u7aca\u53d6\u6a21\u7d44 (fx100.dll)\uff1b\u5c07\u7cfb\u7d71\u8cc7\u8a0a\u53ca\u52a0\u5bc6\u7d50\u679c\u50b3\u9001\u56de C&C \u4f3a\u670d\u5668<\/td>\n<\/tr>\n
\u7db2\u8def\u6d3b\u52d5<\/td>\n\u7d93\u7531 TCP \u5354\u5b9a\u7684 443 \u9023\u63a5\u57e0<\/td>\n\u7d93\u7531 TCP \u5354\u5b9a\u7684 443 \u9023\u63a5\u57e0<\/td>\n<\/tr>\n
\u522a\u9664\u9670\u5f71\u8907\u88fd\u5099\u4efd<\/td>\nvssadmin<\/td>\n\u5426<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\"\u5716
\u5716 2\uff1aNeutrino \u6f0f\u6d1e\u653b\u64ca\u5957\u4ef6\u5728 7 \u6708 14 \u65e5\u5c07\u4e00\u500b\u65b0\u7248\u7684 CryptXXX (5.001) \u6563\u64ad\u5230\u65e5\u672c\u3002<\/figcaption><\/figure>\n

 <\/p>\n

\u7531\u65bc Angler \u6f0f\u6d1e\u653b\u64ca\u5957\u4ef6\u5df2\u5f9e\u52a0\u5bc6\u52d2\u7d22\u75c5\u6bd2\u6d3b\u52d5\u7684\u5730\u5e73\u7dda\u6d88\u5931<\/a>\uff0c\u56e0\u800c\u4f7f\u5f97 CryptXXX \u958b\u59cb\u6539\u7528 Neutrino<\/a> \u6f0f\u6d1e\u653b\u64ca\u5957\u4ef6\u3002\u6839\u64da\u5831\u5c0e<\/a>\uff0c\u6b64\u5957\u4ef6\u6700\u8fd1\u4e5f\u7d93\u5e38\u6563\u5e03\u5176\u4ed6\u52d2\u7d22\u75c5\u6bd2\u5bb6\u65cf\uff0c\u5982\uff1aCryptoWall<\/a>\u3001TeslaCrypt<\/a>\u3001CryptoLocker<\/a>\u00a0\u53ca Cerber<\/a>\u3002<\/p>\n

\u6211\u5011\u89c0\u5bdf\u5230 Neutrino \u5728\u67d0\u500b\u661f\u671f\u7576\u4e2d\u66fe\u8f2a\u6d41\u6563\u5e03 CrypMIC \u548c CryptXXX\u3002\u5728 7 \u6708 6 \u65e5\u4e00\u958b\u59cb\uff0cNeutrino \u5148\u662f\u6563\u5e03 CrypMIC\uff0c\u7136\u5f8c\u5728 7 \u6708 8 \u65e5\u53c8\u6539\u70ba\u6563\u5e03 CryptXXX 4.001\u3002\u5230\u4e86 7 \u6708 12 \u65e5\u53c8\u958b\u59cb\u6563\u5e03 CrypMIC\uff0c\u7136\u5f8c\u9694\u5929\u53c8\u6539\u56de CryptXXX\u3002\u540c\u4e00\u661f\u671f\uff0cNeutrino \u4e5f\u66fe\u7d93\u7531\u60e1\u610f\u5ee3\u544a\u6563\u5e03 Cerber<\/a>\u4ee5\u53ca\u5176\u4ed6\u7db2\u8def\u72af\u7f6a\u96c6\u5718\u7684\u5176\u4ed6\u60e1\u610f\u7a0b\u5f0f\u3002\u5230\u4e86 7 \u6708 14 \u65e5\uff0cNeutrino \u53c8\u958b\u59cb\u6563\u5e03\u65b0\u7248\u7684 CryptXXX (5.001 \u7248)\u3002<\/p>\n

CryptXXX 5.001 \u4e0d\u7b97\u5927\u6539\u7248\uff0c\u50c5\u505a\u4e86\u5c11\u8a31\u8b8a\u66f4\uff0c\u4f8b\u5982\u4fee\u6539\u9644\u52a0\u5728\u88ab\u52a0\u5bc6\u6a94\u6848\u5167\u7684\u8cc7\u6599\u7d50\u69cb\u3002\u5176\u52a0\u5bc6\u65b9\u6cd5\u3001\u52a0\u5bc6\u6a94\u6848\u985e\u578b\u4ee5\u53ca\u5c01\u5305\u8cc7\u8a0a\u7b49\u7b49\uff0c\u90fd\u548c 4.001 \u7248\u76f8\u540c\u3002<\/p>\n

\"\u5716
\u5716 3\uff1a\u6211\u5011\u7d93\u7531 Cuckoo Sandbox \u60e1\u610f\u7a0b\u5f0f\u5206\u6790\u5de5\u5177\u767c\u73fe\uff0cCryptXXX 4.001 \u8207\u5176\u5148\u524d\u7684\u7248\u672c\u975e\u5e38\u96f7\u540c\uff0c\u6703\u7aca\u53d6\u5404\u7a2e\u61c9\u7528\u7a0b\u5f0f\u7576\u4e2d\u5132\u5b58\u7684\u5e33\u865f\u5bc6\u78bc\u3002<\/figcaption><\/figure>\n

CrypMIC \u548c CryptXXX \u5c0d\u4f01\u696d\u4f86\u8aaa\u5c24\u5176\u5371\u96aa\uff0c\u56e0\u70ba\u5b83\u5011\u9084\u6703\u5c07\u53ef\u5378\u9664\u5f0f\u78c1\u789f\u8207\u7db2\u8def\u78c1\u789f\u4e0a\u7684\u6a94\u6848\u52a0\u5bc6<\/strong>\u3002\u4e0d\u904e\uff0cCrypMIC \u53ea\u80fd\u5c07\u5df2\u5c0d\u61c9\u5230\u78c1\u789f\u6a5f\u4ee3\u865f\u7684\u7db2\u8def\u5171\u7528\u8cc7\u6599\u593e\u6a94\u6848\u52a0\u5bc6\u3002<\/p>\n

\u53cd\u89c0 CryptXXX \u5247\u80fd\u5920\u81ea\u52d5\u6383\u7784\u672c\u6a5f\u4e0a\u5df2\u9023\u7dda\u7684\u7db2\u8def\u5171\u7528\u8cc7\u6599\u593e\uff0c\u4e26\u5c07\u5176\u6a94\u6848\u52a0\u5bc6\u3002\u6b64\u5916\uff0cCryptXXX 4.001 \u9084\u6703\u4e0b\u8f09\u4e00\u500b\u540d\u70ba\u300cfx100.dll\u300d\u7684\u8cc7\u8a0a\u7aca\u53d6\u6a21\u7d44 (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba TSPY_STILLER.B) \u4e26\u5c07\u5b83\u8f09\u5165\u8a18\u61b6\u9ad4\u4e2d\u57f7\u884c\uff0c\u6b64\u6a21\u7d44\u53ef\u7aca\u53d6\u4e0b\u5217\u61c9\u7528\u7a0b\u5f0f\u7576\u4e2d\u6240\u5132\u5b58\u7684\u5e33\u865f\u5bc6\u78bc\u8cc7\u6599\uff1a<\/p>\n