{"id":51589,"date":"2017-08-11T09:00:48","date_gmt":"2017-08-11T01:00:48","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=51589"},"modified":"2017-08-09T17:38:37","modified_gmt":"2017-08-09T09:38:37","slug":"%e7%b4%94%e7%84%a1%e6%aa%94%e6%a1%88%e5%bc%8f%e6%83%a1%e6%84%8f%e7%a8%8b%e5%bc%8f-js_powmet-90-%e7%9a%84%e6%84%9f%e6%9f%93%e6%a1%88%e4%be%8b%e5%9c%a8%e4%ba%9e%e5%a4%aa%e5%8d%80","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=51589","title":{"rendered":"\u7d14\u7121\u6a94\u6848\u5f0f\u60e1\u610f\u7a0b\u5f0f JS_POWMET, 90% \u7684\u611f\u67d3\u6848\u4f8b\u5728\u4e9e\u592a\u5340"},"content":{"rendered":"

<\/h1>\n

\u6700\u8fd1\uff0c\u7db2\u8def\u99ed\u5ba2\u958b\u59cb\u5c08\u5fc3\u7814\u7a76\u5982\u4f55\u5728\u653b\u64ca\u904e\u7a0b\u7576\u4e2d\u4e0d\u7559\u4e0b\u75d5\u8de1\uff0c\u56e0\u6b64\u7121\u6a94\u6848\u5f0f\u60e1\u610f\u7a0b\u5f0f<\/a> (\u5982\u6700\u8fd1\u7684 SOREBRECT \u52d2\u7d22\u75c5\u6bd2<\/a>) \u672a\u4f86\u5c07\u66f4\u52a0\u666e\u904d\u3002\u4e0d\u904e\uff0c\u9019\u985e\u60e1\u610f\u7a0b\u5f0f\u6709\u5f88\u591a\u53ea\u5728\u6f5b\u5165\u4f7f\u7528\u8005\u7cfb\u7d71\u6642\u624d\u4e0d\u5beb\u5165\u6a94\u6848\uff0c\u4f46\u6700\u5f8c\u5728\u57f7\u884c\u771f\u6b63\u7684\u60e1\u610f\u7a0b\u5f0f\u6642\u9084\u662f\u6703\u5728\u78c1\u789f\u4e0a\u7522\u751f\u6a94\u6848\uff0c\u6240\u4ee5\u7d14\u7121\u6a94\u6848\u5f0f\u7684\u653b\u64ca\u7562\u7adf\u9084\u662f\u5c11\u6578\u3002\u56e0\u6b64\uff0c\u6211\u5011\u89ba\u5f97\u6709\u5fc5\u8981\u8ddf\u5927\u5bb6\u4ecb\u7d39\u4e00\u500b\u65b0\u7684\u6728\u99ac\u7a0b\u5f0f\uff0c\u53eb\u505a\u300cJS_POWMET\u300d(\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba JS_POWMET.DE<\/a>)\uff0c\u8a72\u7a0b\u5f0f\u6703\u5229\u7528 Windows \u7cfb\u7d71\u767b\u9304\u4e2d\u7684\u958b\u6a5f\u81ea\u52d5\u57f7\u884c\u6a5f\u78bc\u4f86\u9032\u5165\u96fb\u8166\u3002\u5176\u611f\u67d3\u904e\u7a0b\u5b8c\u5168\u4e0d\u6703\u5728\u78c1\u789f\u4e0a\u7522\u751f\u6a94\u6848\uff0c\u6240\u4ee5\u5f88\u96e3\u7528\u6c99\u76d2\u6a21\u64ec\u5206\u6790\u6280\u8853\u4f86\u52a0\u4ee5\u5075\u6e2c\uff0c\u540c\u6642\u4e5f\u52a0\u6df1\u4e86\u8cc7\u5b89\u4eba\u54e1\u7684\u7814\u7a76\u96e3\u5ea6\u3002<\/p>\n

\u6839\u64da\u8da8\u52e2\u79d1\u6280<\/a> Smart Protection Network (SPN) \u5168\u7403\u5a01\u8105\u60c5\u5831\u7db2\u6240\u6536\u5230\u7684\u521d\u6b65\u8cc7\u6599\u986f\u793a\uff0c\u611f\u67d3 JS_POWMET \u6700\u56b4\u91cd\u7684\u662f\u4e9e\u592a\u5730\u5340\uff0c\u5c07\u8fd1 90% \u7684\u611f\u67d3\u6848\u4f8b\u90fd\u4f86\u81ea\u8a72\u5340\u57df\u3002<\/p>\n

\u6280\u8853\u7d30\u7bc0<\/strong><\/em><\/p>\n

\"Figure<\/p>\n

\u00a0\u5716 1\uff1aJS_POWMET \u611f\u67d3\u904e\u7a0b\u793a\u610f\u5716\u3002<\/em><\/p>\n

\u5118\u7ba1\u6b64\u6728\u99ac\u7a0b\u5f0f\u9032\u5165\u7cfb\u7d71\u7684\u78ba\u5207\u7ba1\u9053\u9084\u7121\u6cd5\u78ba\u5b9a\uff0c\u4f46\u5f88\u53ef\u80fd\u662f\u56e0\u70ba\u4f7f\u7528\u8005\u700f\u89bd\u4e86\u60e1\u610f\u7db2\u7ad9\u624d\u4e0b\u8f09\u5230\u8a72\u6728\u99ac\u7a0b\u5f0f\uff0c\u6216\u8005\u662f\u7531\u5176\u4ed6\u60e1\u610f\u7a0b\u5f0f\u690d\u5165\u7cfb\u7d71\u7576\u4e2d\u3002\u4f46\u5f88\u80af\u5b9a\u7684\u662f\uff0c\u7576\u8a72\u60e1\u610f\u7a0b\u5f0f\u4e0b\u8f09\u5230\u7cfb\u7d71\u4e0a\u6642\uff0c\u7cfb\u7d71\u767b\u9304\u7576\u4e2d\u5c31\u6703\u51fa\u73fe\u4ee5\u4e0b\u6a5f\u78bc\uff1a<\/p>\n

HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run<\/em><\/p>\n

COM+ = <\/em>\u201c<\/em>regsvr32 \/s \/n \/u \/i:{<\/em>\u6b64\u8655\u70ba<\/em> JS_POWMET \u7684\u4e0b\u8f09\u7db2\u5740} scrobj.dll<\/em>\u201d<\/em><\/p>\n

\u9019\u500b\u5728\u958b\u6a5f\u6642\u6703\u81ea\u52d5\u555f\u52d5\u7a0b\u5f0f\u7684\u7cfb\u7d71\u767b\u9304\u6a5f\u78bc\u5c07\u4f7f\u5f97\u300cregsvr32\u300d\u9019\u500b\u7cfb\u7d71\u7a0b\u5f0f\u5230\u7db2\u8def\u4e0a\u4e0b\u8f09 JS_POWMET \u60e1\u610f\u7a0b\u5f0f\u3002<\/p>\n

\u4ee5\u4e0b\u662f\u300cregsvr32\u300d\u7a0b\u5f0f\u7684\u5404\u500b\u53c3\u6578\u8aaa\u660e\uff1a<\/p>\n

    \n
  1. \/s = \u5b89\u975c\u6a21\u5f0f\uff0c\u544a\u8a34 regsvr32 \u4e0d\u8981\u986f\u793a\u8a0a\u606f<\/li>\n
  2. \/n = \u544a\u8a34 regsvr32 \u4e0d\u8981\u4f7f\u7528 DllRegisterServer<\/li>\n
  3. \/u = \u89e3\u9664\u4f3a\u670d\u5668\/\u7269\u4ef6\u7684\u8a3b\u518a<\/li>\n
  4. \/i \u00a0= \u7528\u4f86\u50b3\u905e\u9078\u64c7\u6027\u53c3\u6578 (\u5982URL \u7db2\u5740) \u7d66 DLLinstall<\/li>\n
  5. dll = Microsoft \u7684\u8173\u672c\u57f7\u884c\u5143\u4ef6<\/li>\n<\/ol>\n

    \u5728\u9019\u9805\u6280\u5de7\u4e2d\uff0c\u6b79\u5f92\u5c07\u60e1\u610f\u7a0b\u5f0f\u7684\u7db2\u5740\u7576\u6210\u53c3\u6578\u50b3\u7d66 regsvr32\uff0c\u8b93 regsvr32 \u5f9e\u8a72\u7db2\u5740\u4e0b\u8f09 JS_POWMET (\u9019\u662f\u4e00\u500b\u5167\u542b\u60e1\u610f JavaScript \u7684 XML \u6a94\u6848)\u3002\u6b79\u5f92\u5c31\u662f\u5229\u7528\u9019\u6a23\u7684\u65b9\u5f0f\u8b93 regsvr32 \u57f7\u884c\u4efb\u4f55\u60e1\u610f\u8173\u672c\u800c\u4e0d\u9700\u5c07\u60e1\u610f\u6a94\u6848\u5132\u5b58\u5230\u96fb\u8166\u7cfb\u7d71\u4e0a\u3002\u4e0d\u50c5\u5982\u6b64\uff0c\u6bcf\u7576\u53d7\u611f\u67d3\u7684\u96fb\u8166\u958b\u6a5f\u555f\u52d5\u6642\uff0c\u90fd\u6703\u81ea\u52d5\u5f9e\u6b79\u5f92\u67b6\u8a2d\u5728\u7db2\u8def\u4e0a\u7684\u5e55\u5f8c\u64cd\u7e31 (C&C) \u4f3a\u670d\u5668\u4e0b\u8f09\u60e1\u610f\u6a94\u6848\u3002<\/p>\n

    JS_POWMET \u57f7\u884c\u8d77\u4f86\u4e4b\u5f8c\uff0c\u6703\u518d\u53bb\u4e0b\u8f09\u53e6\u4e00\u500b TROJ_PSINJECT \u6a94\u6848 (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba\u00a0TROJ_PSINJECT.A<\/a>)\u3002\u9019\u662f\u4e00\u500b PowerShell \u8173\u672c\uff0c\u9700\u900f\u904e PowerShell \u5de5\u5177\u4f86\u57f7\u884c\u3002\u63a5\u8457 TROJ_PSINJECT \u6703\u9023\u4e0a\u4e0b\u5217\u7db2\u5740\uff1a<\/p>\n

    https:\/\/bogerando.ru\/favicon<\/em><\/p>\n

    \u4f86\u4e0b\u8f09\u4e00\u500b\u540d\u53eb\u300cfavicon\u300d\u7684\u6a94\u6848\uff0c\u63a5\u8457\uff0c\u518d\u5229\u7528 ReflectivePELoader \u5c07\u300cfavicon\u300d\u6a94\u6848\u89e3\u78bc\u5f8c\u7684\u5167\u5bb9\u6ce8\u5165\u81ea\u5df1\u7684\u57f7\u884c\u7a0b\u5e8f\u7576\u4e2d (\u9019\u662f\u4e00\u500b\u5c08\u9580\u7528\u4f86\u5c07 EXE\/DLL \u6ce8\u5165\u57f7\u884c\u7a0b\u5e8f\u7684\u5de5\u5177)\u3002<\/p>\n

    \u5176\u89e3\u958b\u60e1\u610f\u7a0b\u5f0f\u78bc\u7684\u65b9\u5f0f\u5982\u4e0b\uff1a\u60e1\u610f\u7a0b\u5f0f\u78bc\u662f\u63a1\u7528 Base64 \u7de8\u78bc\uff0c\u9700\u4f7f\u7528 RC4 \u91d1\u9470\u4f86\u89e3\u78bc (\u91d1\u9470\u5beb\u6b7b\u5728\u60e1\u610f\u7a0b\u5f0f\u78bc\u7576\u4e2d)\u3002\u89e3\u958b\u5f8c\u7684\u5b57\u4e32\u5176\u5be6\u662f\u4e00\u6bb5\u7d93\u7531 GZIP \u58d3\u7e2e\u7684\u5167\u5bb9\uff0c\u56e0\u6b64\u9084\u8981\u518d\u7d93\u904e GZIP \u89e3\u58d3\u7e2e\u7a0b\u5e8f\u3002\u89e3\u58d3\u7e2e\u4e4b\u5f8c\u624d\u662f\u63d0\u4f9b\u7d66 ReflectivePELoader \u8f09\u5165\u7684\u7a0b\u5f0f\u78bc\u3002<\/p>\n

    \u6b64\u5916\uff0cFavicon \u6703\u518d\u7d93\u7531\u524d\u8ff0\u7684 RC4 \u91d1\u9470\u89e3\u51fa\u4e00\u500b\u540d\u70ba BKDR_ANDROM (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba BKDR_ANDROM.ETIN<\/a>) \u7684\u60e1\u610f DLL\u3002\u5c31\u9023\u9019\u88e1\u4e5f\u90fd\u9084\u662f\u7dad\u6301\u7121\u6a94\u6848\u7684\u5f62\u614b\uff0c\u56e0\u70ba\u6b64 DLL \u4e26\u4e0d\u6703\u5132\u5b58\u5230\u96fb\u8166\u4e0a\uff0c\u800c\u662f\u76f4\u63a5\u88ab\u6ce8\u5165 powershell.exe \u57f7\u884c\u7a0b\u5e8f\u7576\u4e2d\u3002\u60e1\u610f\u7a0b\u5f0f\u7684\u6240\u6709\u524d\u8ff0\u52d5\u4f5c\u90fd\u662f\u7d93\u7531 PowerShell \u6307\u4ee4\u4f86\u5b8c\u6210\u3002<\/p>\n

    \"Figure<\/p>\n

    \u5716 2\uff1a\u5f9e TROJ_PSINJECT \u7a0b\u5f0f\u78bc\u53ef\u770b\u51fa\u89e3\u78bc\u7684\u904e\u7a0b\u3002<\/em><\/p>\n

    BKDR_ANDROM \u5982\u679c\u767c\u73fe powershell.exe \u6b63\u5728\u7cfb\u7d71\u5167\u57f7\u884c\uff0c\u5c31\u6703\u5c07\u5b83\u7d42\u6b62\u3002\u6b64\u5916\uff0c\u5b83\u9084\u6703\u8490\u96c6\u4ee5\u4e0b\u8cc7\u6599\uff1a<\/p>\n