{"id":31133,"date":"2016-10-27T09:00:35","date_gmt":"2016-10-27T01:00:35","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=31133"},"modified":"2016-10-22T18:53:33","modified_gmt":"2016-10-22T10:53:33","slug":"%e8%b6%a8%e5%8b%a2%e7%a7%91%e6%8a%80%e8%b3%87%e6%b7%b1%e5%a8%81%e8%84%85%e7%a0%94%e7%a9%b6%e5%93%a1%e9%80%8f%e9%81%8e%e5%88%86%e6%9e%90stampado-%e5%8b%92%e7%b4%a2%e7%97%85%e6%af%92%e6%94%b9%e8%89%af","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=31133","title":{"rendered":"\u8da8\u52e2\u79d1\u6280\u8cc7\u6df1\u5a01\u8105\u7814\u7a76\u54e1,\u900f\u904e\u5206\u6790Stampado \u52d2\u7d22\u75c5\u6bd2,\u6539\u826f\u60e1\u610f\u8edf\u9ad4\u8fa8\u8b58\u5de5\u5177Yara"},"content":{"rendered":"

Yara \u662f\u4e00\u500b\u8cc7\u5b89\u7814\u7a76\u4eba\u54e1\u6240\u4f7f\u7528\u7684\u958b\u653e\u539f\u59cb\u78bc\u5de5\u5177\uff0c\u53ef\u6839\u64da\u9810\u5148\u5b9a\u7fa9\u597d\u7684\u898f\u5247\u4f86\u5075\u6e2c\u53ca\u5206\u985e\u60e1\u610f\u7a0b\u5f0f\u6a23\u672c\u3002\u524d\u4e0d\u4e45\uff0c\u4e00\u4f4d\u540c\u4e8b\u8acb\u6211\u64b0\u5beb Yara \u898f\u5247\u4f86\u5075\u6e2c Stampado \u52d2\u7d22\u75c5\u6bd2 Ransomware<\/a> (\u52d2\u7d22\u8edf\u9ad4\/\u7d81\u67b6\u75c5\u6bd2)\u5bb6\u65cf\u7684\u6a23\u672c\u3002Stampado \u7b97\u662f\u4e00\u500b\u76f8\u5c0d\u8f03\u65b0\u7684\u52d2\u7d22\u75c5\u6bd2\u670d\u52d9 (Ransomware-as-a-Service\uff0c\u7c21\u7a31 RaaS) <\/a>\u5a01\u8105\uff0c\u4e0d\u4e45\u524d\u525b\u9032\u5165\u8da8\u52e2\u79d1\u6280<\/a>\u7684\u76e3\u63a7\u540d\u55ae\u3002\u7576\u6642\u6211\u624b\u4e0a\u53ea\u6709\u5e7e\u500b\u6a23\u672c\uff0c\u539f\u672c\u6211\u6253\u7b97\u5728\u9019\u4e9b\u6a23\u672c\u4e4b\u9593\u627e\u627e\u770b\u6709\u6c92\u6709\u5171\u540c\u7684\u5b57\u4e32\uff0c\u4f46\u6c92\u6709\u6210\u529f\u3002\u5f8c\u4f86\u6211\u6bd4\u5c0d\u4e86\u5404\u6a94\u6848\u4e4b\u9593\u7684\u7d50\u69cb\u767c\u73fe\uff0c\u6bcf\u4e00\u500b\u6a94\u6848\u672b\u7aef\u90fd\u6709\u4e00\u6bb5\u6709\u8da3\u7684\u5167\u5bb9\uff0c\u5f9e\u4f4d\u79fb 0xde000 \u8655\u958b\u59cb\uff1a<\/p>\n

<\/p>\n

\u5716 1\uff1aStampado \u52d2\u7d22\u75c5\u6bd2\u6a23\u672c\u5167\u5bb9\u4ee5\u5341\u516d\u9032\u4f4d\u78bc\u986f\u793a\u3002<\/em><\/p>\n

\u6a94\u6848\u672b\u7aef\u660e\u986f\u5217\u4e86\u4e00\u500b\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u3002\u6211\u5411\u540c\u4e8b\u8a62\u554f\u662f\u5426\u77e5\u9053\u6b64\u4e8b\uff0c\u4ed6\u7acb\u5373\u544a\u8a34\u6211 \u00a0Stampado \u6703\u63d0\u4f9b\u4e00\u4e9b\u4f7f\u7528\u8aaa\u660e\u7d66\u8cfc\u8cb7\u8a72\u5957\u4ef6\u7684\u99ed\u5ba2\uff0c\u8aaa\u660e\u4e2d\u6709\u63d0\u5230\u9019\u4ef6\u4e8b\uff1a<\/p>\n

<\/p>\n

\u5716 2\uff1a\u7d66 \u00a0Stampado \u8cb7\u5bb6\u7684\u4f7f\u7528\u8aaa\u660e\u3002<\/em><\/p>\n

\u6211\u5224\u65b7 Stampado \u7684\u958b\u767c\u8005\u61c9\u8a72\u662f\u5728\u6bcf\u500b\u6a94\u6848\u672b\u7aef\u591a\u52a0\u4e86\u4e00\u500b\u4f4d\u5143\u7d44\uff0c\u6578\u503c\u70ba 0x0d (\u9019\u5728 ASCII \u5b57\u78bc\u8868\u4e0a\u662f\u8fd4\u56de\u958b\u982d\u7684 CR \u7b26\u865f)\uff0c\u7136\u5f8c\u53eb\u4f7f\u7528\u8005\u5229\u7528\u4e00\u822c\u7684\u6587\u5b57\u7de8\u8f2f\u5de5\u5177\u5728\u6700\u5f8c\u4e00\u884c\u7a7a\u767d\u4e0b\u65b9 (\u4e5f\u5c31\u662f\u5728 CR \u7b26\u865f\u4e4b\u5f8c) \u52a0\u5165\u81ea\u5df1\u7684\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u3002\u6b63\u78ba\u4f86\u8aaa CR \u7b26\u865f\u4e26\u4e0d\u662f\u9019\u6a23\u7528\uff0c\u56e0\u70ba\u5728 DOS\/Windows \u7cfb\u7d71\u4e0b\uff0c\u5982\u679c\u8981\u63db\u884c\u7684\u8a71\uff0c\u6b63\u78ba\u7684\u65b9\u5f0f\u662f 0x0d 0x0a (\u4e5f\u5c31\u662f CR + LF\uff1a\u8fd4\u56de\u958b\u982d\u4e26\u524d\u9032\u4e00\u884c)\uff0c\u81f3\u65bc\u5f9e Unix \u884d\u751f\u7684\u4f5c\u696d\u7cfb\u7d71\u5247\u662f\u53ea\u9700\u8981 \u00a0LF \u7b26\u865f\u3002\u4e0d\u7ba1\u600e\u6a23\uff0c Stampado \u7684\u6a23\u672c\u6a94\u6848\u672b\u7aef\u90fd\u6703\u5e36\u8457\u4e00\u500b CR \u7b26\u865f\uff0c\u9019\u4e5f\u7b97\u662f\u500b\u6709\u8da3\u7684\u7279\u5fb5\uff0c\u9019\u6a23\u5c31\u80fd\u5efa\u7acb Yara \u898f\u5247\u4f86\u5075\u6e2c\u9019\u500b\u60e1\u610f\u7a0b\u5f0f\u3002<\/p>\n

\u6211\u5e0c\u671b\u80fd\u5efa\u7acb\u4e00\u500b\u4e0d\u7ba1\u6a23\u672c\u6a94\u6848\u672b\u7aef\u662f\u5426\u5e36\u6709\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u90fd\u80fd\u9069\u7528\u7684\u898f\u5247\u3002\u6240\u4ee5\uff0c\u6211\u7684\u898f\u5247\u4e0d\u80fd\u53ea\u662f\u5224\u65b7\u300c\u6a94\u6848\u6700\u5f8c\u4e00\u500b\u4f4d\u5143\u7d44\u662f\u5426\u70ba 0x0d\u300d\uff0c\u56e0\u70ba\u5982\u679c\u6a94\u6848\u5f8c\u9762\u53c8\u52a0\u4e0a\u4e86\u96fb\u5b50\u90f5\u4ef6\uff0c0x0d \u7684\u4f4d\u7f6e\u5c31\u6703\u4e0d\u662f\u5728\u6700\u5f8c\u4e00\u500b\u4f4d\u5143\u7d44\uff0c\u800c\u662f\u8981\u770b\u96fb\u5b50\u90f5\u4ef6\u5730\u5740\u7684\u9577\u5ea6\u800c\u5b9a\u3002<\/p>\n

\u7576\u4e00\u500b PE\u57f7\u884c\u6a94\u672b\u7aef\u8981\u589e\u52a0\u4e00\u4e9b\u4f4d\u5143\u7d44\u6642\uff0c\u5fc5\u9808\u5efa\u7acb\u4e00\u500b\u6240\u8b02\u7684\u300c\u91cd\u758a\u5340\u6bb5\u300d(overlay section)\u3002\u9019\u500b\u5340\u6bb5\u4e26\u7d0d\u5165\u6a19\u982d\u4e2d\u8a18\u8f09\u7684 PE \u5340\u6bb5\u6e05\u55ae\uff0c\u56e0\u6b64\u8981\u67e5\u770b\u4e00\u500b PE \u6a94\u6848\u662f\u5426\u6709\u91cd\u758a\u5340\u6bb5\uff0c\u4e00\u500b\u7c21\u55ae\u7684\u4f5c\u6cd5\u5c31\u662f\u67e5\u770b\u6700\u5f8c\u4e00\u500b PE \u5340\u6bb5\u7684\u672b\u7aef\u4e4b\u5f8c\u662f\u5426\u9084\u6709\u8cc7\u6599\u3002\u5982\u679c\u6709\uff0c\u90a3\u5c31\u4ee3\u8868\u9019\u500b PE \u6a94\u6848\u672b\u7aef\u52a0\u4e86\u5225\u7684\u6771\u897f\uff0c\u4e5f\u5c31\u662f\u5305\u542b\u91cd\u758a\u5340\u6bb5\u3002<\/p>\n

\u4ee5\u4e0b\u662f\u6211\u6839\u64da\u7576\u524d Yara \u7248\u672c\u6240\u5efa\u7acb\u7684\u5224\u65b7\u898f\u5247\uff1a<\/p>\n

private rule has_overlay {\u00a0\u00a0\u00a0\u00a0 condition:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 filesize > pe.sections[pe.number_of_sections – 1].raw_data_offset + pe.sections[pe.number_of_sections – 1].raw_data_size}<\/p>\n

\u4e0d\u904e\uff0c\u9019\u689d\u898f\u5247\u6709\u500b\u554f\u984c\uff1a\u5982\u679c\u6a19\u982d\u4e2d\u6240\u5217\u7684\u6700\u5f8c\u4e00\u500b\u5340\u6bb5\u4e26\u975e\u6a94\u6848\u5167\u5be6\u969b\u4e0a\u6700\u5f8c\u4e00\u500b\u5340\u6bb5\uff0c\u90a3\u898f\u5247\u5c31\u884c\u4e0d\u901a\u3002\u6211\u5728 Yara \u7684 Github \u4e0a\u8a0e\u8ad6\u9019\u500b\u554f\u984c<\/a>\uff0c\u7db2\u53cb\u4e5f\u597d\u5fc3\u5730\u63d0\u4f9b\u4e86\u4e00\u4e9b\u5efa\u8b70\uff0c\u8b93\u6211\u60f3\u5230\u53ef\u4ee5\u91dd\u5c0d Yara \u7684 PE \u6a21\u7d44\u5efa\u7acb\u4e00\u500b Pull Request \u4f86\u589e\u52a0\u8655\u7406\u91cd\u758a\u5340\u6bb5\u7684\u529f\u80fd\u3002\u6c92\u591a\u4e45\uff0c\u4ee5\u4e0b\u7684 Yara \u898f\u5247\u5c31\u53ef\u4ee5\u9806\u5229\u904b\u4f5c\uff1a<\/p>\n

import “pe”\u00a0private rule has_overlay {\u00a0\u00a0\u00a0\u00a0 condition:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pe.overlay.offset}\u00a0rule big_overlay {\u00a0\u00a0\u00a0\u00a0 condition:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 pe.overlay.size > 1024}\u00a0rule overlay_bytes {\u00a0\u00a0\u00a0\u00a0 strings:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $bytes = { 90 41 42 50 56 }\u00a0\u00a0\u00a0\u00a0 condition:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 bytes at pe.overlay.offset}<\/p>\n

\u4e00\u65e6 Yara 3.6.0 \u7248\u63a8\u51fa\u4e4b\u5f8c\uff0c\u6211\u5c31\u80fd\u5c07\u6700\u5f8c\u4e00\u9053\u689d\u4ef6\u5f0f (condition) \u6539\u6210\u300cuint8(pe.overlay.offset) == 0x0d\u300d\uff0c\u4e26\u4e14\u4e0d\u6703\u51fa\u73fe\u610f\u5916\u72c0\u6cc1\u3002\u5f88\u6176\u5e78 Yara \u662f\u4e00\u500b\u958b\u653e\u539f\u59cb\u78bc\u5c08\u6848\uff0c\u8b93\u6211\u6709\u6a5f\u6703\u505a\u51fa\u4ee5\u4e0b\u7684\u5c0f\u5c0f\u8ca2\u737b\u3002\u8a72\u5de5\u5177\u4e5f\u56e0\u6b64\u80fd\u96a8\u8457\u6642\u9593\u800c\u4e0d\u65b7\u6539\u826f\uff0c\u56e0\u61c9\u65b0\u7684\u6311\u6230\u3002<\/p>\n

rule stampado_overlay{meta:description = “Catches Stampado samples looking for \\\\r at the beginning of PE overlay section”reference = “”author = “Fernando Merces, FTR, Trend Micro”date = “2016-07″md5 = “a393b9536a1caa34914636d3da7378b5″md5 = “dbf3707a9cd090853a11dda9cfa78ff0″md5 = “dd5686ca7ec28815c3cf3ed3dbebdff2″md5 = “6337f0938e4a9c0ef44ab99deb0ef466”\u00a0condition:pe.characteristics == 0x122 andpe.number_of_sections == 5 andpe.imports(“VERSION.dll”, “VerQueryValueW”) and uint8(pe.sections[4].raw_data_offset + pe.sections[4].raw_data_size) == 0x0d\u00a0}<\/p>\n

\u63a1\u7528\u6211\u5011\u81ea\u5bb6\u6280\u8853\u7684\u8da8\u52e2\u79d1\u6280\u7522\u54c1\uff0c\u5df2\u7d93\u80fd\u5920\u5075\u6e2c Stampado \u7684\u6a23\u672c\uff0c\u6211\u5011\u5c07\u5b83\u547d\u540d\u70ba\uff1aRANSOM_STAMP.SM\u3002\u6b64\u5916\uff0c\u6211\u5011\u7684\u8da8\u52e2\u79d1\u6280\u6a94\u6848\u89e3\u5bc6\u5de5\u5177<\/a>\u4e5f\u5c0d\u9019\u500b\u52d2\u7d22\u75c5\u6bd2\u6709\u7528\uff0c\u53ef\u89e3\u958b\u5b83\u6240\u52a0\u5bc6\u7684\u6a94\u6848\u3002<\/p>\n

\u958b\u653e\u539f\u59cb\u78bc\u5de5\u5177\u5728\u5168\u7403\u8cc7\u5b89\u7814\u7a76\u4eba\u54e1\u4e4b\u9593\u53ef\u8aaa\u76f8\u7576\u6d41\u884c\u3002\u6211\u5011\u5f88\u9ad8\u8208\u80fd\u6709\u6a5f\u6703\u5c0d\u6574\u9ad4\u793e\u7fa4\u505a\u51fa\u8ca2\u737b\uff0c\u5e0c\u671b\u672a\u4f86\u53ef\u4ee5\u66f4\u983b\u7e41\u5730\u56de\u994b\u793e\u7fa4\u3002<\/p>\n

\u539f\u6587\u51fa\u8655\uff1aHow Stampado Ransomware Analysis Led To Yara Improvements<\/a>\u4f5c\u8005\uff1aFernando Merc\u00eas (\u8cc7\u6df1\u5a01\u8105\u7814\u7a76\u54e1)<\/a><\/p>\n

\u8da8\u52e2\u79d1\u6280\u7684\u52d2\u7d22\u75c5\u6bd2\u89e3\u6c7a\u65b9\u6848<\/em><\/strong><\/h1>\n

\u5f9e\u4e2d\u5c0f\u4f01\u696d\u5230\u5927\u578b\u4f01\u696d\u7684\u7db2\u8def\u8a2d\u5099\u90fd\u662fCrysis\u9019\u985e\u52d2\u7d22\u75c5\u6bd2\u7684\u653b\u64ca\u76ee\u6a19\uff0c\u696d\u52d9\u6301\u7e8c\u6027\u3001\u8ca1\u52d9\u640d\u5931\u548c\u516c\u53f8\u8072\u8b7d\u90fd\u53d7\u5230\u4e86\u5a01\u8105\u3002\u7576\u7db2\u8def\u72af\u7f6a\u5206\u5b50\u6c72\u6c72\u71df\u71df\u5730\u60f3\u8981\u5c07\u95dc\u9375\u8cc7\u6599\u505a\u70ba\u4eba\u8cea\uff0c\u91cd\u8981\u7684\u662f\u80fd\u5920\u5177\u5099\u4e3b\u52d5\u5f0f\u3001\u591a\u5c64\u6b21\u7684\u5b89\u5168\u9632\u8b77\uff1a\u5f9e\u9598\u9053<\/a>\u3001\u7aef\u9ede<\/a>\u3001\u7db2\u8def<\/a>\u5230\u4f3a\u670d\u5668<\/a>\u3002<\/p>\n

 <\/p>\n

 <\/p>\n\n\n\n\n
\u96fb\u5b50\u90f5\u4ef6\u548c\u9598\u9053\u9632\u8b77<\/strong><\/p>\n

\u8da8\u52e2\u79d1\u6280Cloud App Security<\/a>\u3001\u8da8\u52e2\u79d1\u6280Deep Discovery\u2122 Email Inspector<\/a>\u548cInterScan\u2122 Web Security<\/a> \u53ef\u4ee5\u9632\u79a6\u5e38\u88ab\u7528\u4f86\u6563\u64ad\u52d2\u7d22\u75c5\u6bd2\u7684\u7ba1\u9053\uff0c\u5982\u96fb\u5b50\u90f5\u4ef6\u548c\u7db2\u9801\u3002<\/p>\n

\u7aef\u9ede\u9632\u8b77<\/strong><\/p>\n

\u8da8\u52e2\u79d1\u6280 Smart Protection Suites<\/a> \u5728\u7aef\u9ede\u5c64\u7d1a\u5075\u6e2c\u548c\u963b\u6b62\u8207\u52d2\u7d22\u75c5\u6bd2\u76f8\u95dc\u7684\u53ef\u7591\u884c\u70ba\u548c\u6f0f\u6d1e\u653b\u64ca\u3002<\/p>\n

\u7db2\u8def\u4fdd\u8b77<\/strong><\/p>\n

\u8da8\u52e2\u79d1\u6280Deep Discovery Inspector<\/a>\u5075\u6e2c\u8207\u52d2\u7d22\u75c5\u6bd2\u9032\u5165\u7db2\u8def\u76f8\u95dc\u7684\u60e1\u610f\u6d41\u91cf\u3001\u9023\u7dda\u548c\u5176\u4ed6\u6d3b\u52d5\u3002<\/p>\n

\u4f3a\u670d\u5668\u9632\u8b77<\/strong><\/p>\n

\u8da8\u52e2\u79d1\u6280Deep Security<\/a>\u53ef\u4ee5\u5075\u6e2c\u548c\u963b\u6b62\u53ef\u7591\u7db2\u8def\u6d3b\u52d5\u548c\u4fdd\u8b77\u4f3a\u670d\u5668\u548c\u61c9\u7528\u7a0b\u5f0f\u514d\u65bc\u6f0f\u6d1e\u653b\u64ca\u3002<\/p>\n