{"id":56317,"date":"2018-07-19T13:56:21","date_gmt":"2018-07-19T05:56:21","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=56317"},"modified":"2018-07-28T14:00:20","modified_gmt":"2018-07-28T06:00:20","slug":"blackgear%e7%b6%b2%e8%b7%af%e9%96%93%e8%ab%9c%e6%b4%bb%e5%8b%95%e5%86%8d%e5%ba%a6%e5%87%ba%e7%8f%be%ef%bc%8c%e5%88%a9%e7%94%a8%e7%a4%be%e7%be%a4%e5%aa%92%e9%ab%94%e9%80%b2%e8%a1%8ccc%e9%80%a3","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=56317","title":{"rendered":"Blackgear\u7db2\u8def\u9593\u8adc\u6d3b\u52d5\u518d\u5ea6\u51fa\u73fe\uff0c\u5229\u7528\u793e\u7fa4\u5a92\u9ad4\u9032\u884cC&C\u9023\u7dda"},"content":{"rendered":"

Blackgear\uff08\u4e5f\u7a31\u70baTopgear\u548cComnie\uff09\u7db2\u8def\u9593\u8adc\u6d3b\u52d5\u65e9\u57282008\u5e74<\/a>\u5c31\u5df2\u7d93\u51fa\u73fe\uff08\u6839\u64da\u99ed\u5ba2\u6240\u4f7f\u7528\u7684Protux\u5f8c\u9580\u7a0b\u5f0f\uff09\u3002\u5b83\u7684\u76ee\u6a19\u662f\u65e5\u672c\u3001\u97d3\u570b\u548c\u53f0\u7063\u7684\u7d44\u7e54\uff0c\u5c0d\u516c\u5bb6\u6a5f\u95dc\u3001\u96fb\u4fe1\u696d\u53ca\u5176\u4ed6\u9ad8\u79d1\u6280\u7522\u696d\u9032\u884c\u653b\u64ca\u3002\u50cf\u57282016\u5e74<\/a>\uff0c\u6211\u5011\u5c31\u767c\u73fe\u5b83\u4f7f\u7528\u5404\u7a2e\u60e1\u610f\u5de5\u5177\uff08\u6700\u8457\u540d\u7684\u662fElirks\u5f8c\u9580\u7a0b\u5f0f\uff09\u653b\u64ca\u65e5\u672c\u7684\u7d44\u7e54\u3002Blackgear\u6709\u8457\u9ad8\u5ea6\u7684\u7d44\u7e54\u6027\uff0c\u800c\u4e14\u81ea\u884c\u958b\u767c\u6240\u7528\u7684\u5de5\u5177\uff0c\u6211\u5011\u5f9e\u5176\u6700\u65b0\u653b\u64ca\u53ef\u4ee5\u767c\u73fe\u9019\u4e9b\u5de5\u5177\u90fd\u5df2\u7d93\u88ab\u6539\u9032\u904e\u3002<\/p>\n

Blackgear\u7684\u7279\u8272\u662f\u5b83\u8eb2\u907f\u5075\u6e2c\u7684\u80fd\u529b\uff0c\u6703\u5229\u7528\u90e8\u843d\u683c\u3001\u5fae\u7db2\u8a8c\u548c\u793e\u7fa4\u5a92\u9ad4\u4f86\u96b1\u85cf\u5176\u547d\u4ee4\u8207\u63a7\u5236\uff08C&C\uff09\u8a2d\u5b9a\u3002\u4e0d\u540c\u65bc\u5c07C&C\u8cc7\u8a0a\u5d4c\u5165\u60e1\u610f\u8edf\u9ad4\u800c\u5bb9\u6613\u88ab\u5c01\u9396\u7684\u4f5c\u6cd5\uff0c\u5b83\u7684\u4f5c\u6cd5\u8b93Blackgear\u53ef\u4ee5\u6839\u64da\u9700\u8981\u4f86\u5feb\u901f\u8b8a\u66f4C&C\u4f3a\u670d\u5668\u3002\u8b93\u5b83\u80fd\u5920\u5ef6\u9577\u99d0\u7559\u5728\u7cfb\u7d71\u5167\u7684\u6642\u9593\u597d\u9032\u884c\u9032\u4e00\u6b65\u7684\u6a6b\u5411\u79fb\u52d5\u3002<\/p>\n

 <\/p>\n

\u5206\u6790\u4e86Blackgear\u6700\u65b0\u653b\u64ca\u6d3b\u52d5\u6240\u4f7f\u7528\u7684Marade\u4e0b\u8f09\u5668\uff08\u8da8\u52e2\u79d1\u6280\u5075\u6e2c\u70baTSPY_MARADE.ZTBC\uff09\u548cProtux\uff08BKDR_PROTUX.ZTBC\uff09\uff0c\u6211\u5011\u5728\u90e8\u843d\u683c\u548c\u793e\u7fa4\u5a92\u9ad4\u627e\u5230\u52a0\u5bc6\u904e\u7684\u8a2d\u5b9a\uff08\u53c3\u898b\u57161\uff09\u3002\u9019\u53ef\u80fd\u8868\u793a\u9019\u4e9b\u60e1\u610f\u8edf\u9ad4\u662f\u7531\u540c\u4e00\u500b\u5718\u9ad4\u958b\u767c\u3002<\/p>\n

<\/p>\n

\u5716<\/em>1<\/em>\u3001<\/em>Marade<\/em>\u767c<\/em>\u5728<\/em>Facebook<\/em>\u4e0a\u7684\u52a0\u5bc6\u904e\u8a2d\u5b9a<\/em><\/p>\n

<\/p>\n

\u5716<\/em>2<\/em>\u3001<\/em>Blackgear<\/em>\u653b\u64ca\u7684\u611f\u67d3\u93c8<\/em><\/p>\n

 <\/p>\n

\u653b\u64ca\u93c8<\/em><\/strong><\/p>\n

 <\/p>\n

\u70ba\u4e86\u66f4\u52a0\u4e86\u89e3Blackgear\u653b\u64ca\u7684\u5168\u8c8c\uff0c\u6211\u5011\u5c07\u5176\u6240\u7528\u7684\u5de5\u5177\u548c\u76ee\u6a19\u653b\u64ca\u7b56\u7565\u9032\u884c\u95dc\u806f\u3002\u4ee5\u4e0b\u662fBlackgear\u6700\u65b0\u653b\u64ca\u6d3b\u52d5\u7684\u6982\u8981\uff1a<\/p>\n

 <\/p>\n

    \n
  1. \u7528\u5783\u573e\u90f5\u4ef6\u4f86\u5bc4\u9001\u8a98\u990c\u6587\u4ef6\u6216\u5047\u5b89\u88dd\u6a94\u4f86\u8a98\u9a19\u76ee\u6a19\u53d7\u5bb3\u8005\u9ede\u64ca\u3002<\/li>\n
  2. \u8a98\u990c\u6587\u4ef6\u6703\u89e3\u51faMarade\u4e0b\u8f09\u5668\u518d\u8907\u88fd\u5230\u7cfb\u7d71\u7684\u66ab\u5b58\u8cc7\u6599\u593e\uff0c\u4e26\u4e14\u6703\u5c07\u6a94\u6848\u5927\u5c0f\u589e\u52a0\u523050MB\u4ee5\u4e0a\u4f86\u7e5e\u904e\u50b3\u7d71\u7684\u6c99\u7bb1\u89e3\u6c7a\u65b9\u6848\u3002<\/li>\n
  3. Marade\u6703\u6aa2\u67e5\u4e2d\u6bd2\u96fb\u8166\u662f\u5426\u53ef\u4ee5\u9023\u4e0a\u7db2\u8def\u53ca\u662f\u5426\u6709\u5b89\u88dd\u9632\u6bd2\u8edf\u9ad4\u3002<\/li>\n
  4. \u5982\u679c\u4e2d\u6bd2\u96fb\u8166\u53ef\u4ee5\u9023\u7db2\u4e14\u6c92\u6709\u5b89\u88dd\u9632\u6bd2\u8edf\u9ad4\uff0cMarade\u6703\u9023\u5230Blackgear\u6240\u63a7\u5236\u7684\u516c\u958b\u90e8\u843d\u683c\u6216\u793e\u7fa4\u5a92\u9ad4\u7684\u8cbc\u6587\u4f86\u53d6\u5f97\u52a0\u5bc6\u904e\u7684C&C\u8a2d\u5b9a\u3002\u5426\u5247Marade\u6703\u4f7f\u7528\u7a0b\u5f0f\u5167\u5d4c\u7684C&C\u8cc7\u8a0a\u3002<\/li>\n
  5. \u52a0\u5bc6\u904e\u5b57\u4e32\u6703\u7d44\u6210magnet link\u4f86\u9632\u6b62\u60e1\u610f\u6d41\u91cf\u88ab\u9632\u6bd2\u8edf\u9ad4\u5075\u6e2c\u3002\u63a5\u8457Marade\u6703\u89e3\u5bc6\u52a0\u5bc6\u904e\u5b57\u4e32\u4e26\u53d6\u5f97C&C\u4f3a\u670d\u5668\u8cc7\u8a0a\u3002<\/li>\n
  6. C&C\u4f3a\u670d\u5668\u6703\u6d3e\u9001Protux\u5230\u53d7\u5bb3\u8005\u96fb\u8166\u4e26\u52a0\u4ee5\u57f7\u884c\u3002Protux\u662f\u77e5\u540d\u7684\u5f8c\u9580\u7a0b\u5f0f\uff0c\u6703\u5229\u7528rundll32<\/em>\u57f7\u884c\u3002\u5b83\u6703\u6aa2\u6e2c\u7cfb\u7d71\u7db2\u8def\uff0c\u5f9e\u53e6\u4e00\u500b\u90e8\u843d\u683c\u53d6\u5f97C&C\u4f3a\u670d\u5668\uff0c\u4e26\u4e14\u7528RSA\u6f14\u7b97\u6cd5\u4f86\u7522\u751f\u6703\u8a71\u91d1\u9470\uff08session key\uff09\u518d\u5c07\u8cc7\u8a0a\u9001\u5230C&C\u4f3a\u670d\u5668\u3002<\/li>\n<\/ol>\n

     <\/p>\n

    Blackgear\u7684\u60e1\u610f\u8edf\u9ad4\u662f\u4ee5RAR\u81ea\u89e3\u57f7\u884c\u6a94\uff08SFX\uff09\u6216\u7528Office VBScript\u5efa\u7acb\u7684\u8a98\u990c\u6587\u4ef6\u5f62\u5f0f\u4f86\u50b3\u9001\u7d66\u76ee\u6a19\u53d7\u5bb3\u8005\u3002\u4ee5\u4e0b\u662f\u6700\u65b0\u653b\u64ca\u6d3b\u52d5\u6240\u7528SFX\u6a94\u548c\u6587\u4ef6\u6a94\u7684\u622a\u5716\uff1a<\/p>\n

    <\/p>\n

    \u5716<\/em>3<\/em>\u3001<\/em>Blackgear<\/em>\u6240<\/em>\u4f7f\u7528\u60e1\u610f<\/em>SFX<\/em>\u6a94\u6848<\/em>\u5167\u5bb9\uff0c\u507d\u88dd\u6210<\/em>Flash Player<\/em>\u5b89\u88dd\u7a0b\u5f0f<\/em><\/p>\n

     <\/p>\n

    <\/p>\n

    \u5716<\/em>4<\/em>\u3001<\/em>Blackgear<\/em>\u6240<\/em>\u4f7f\u7528\u7684\u60e1\u610f\u6587\u4ef6\uff08\u4e0a\uff09\u53ca\u5982\u4f55\u4f7f\u7528<\/em>VBScript<\/em>\u57f7\u884c<\/em>Marade<\/em>\uff08\u4e0b\uff09<\/em><\/p>\n

    <\/p>\n

    \u5716<\/em>5<\/em>\u3001<\/em>\u540c\u4e00\u90e8\u843d\u683c\u6587\u7ae0\u5167<\/em>Protux<\/em>\uff08\u4e0a\uff09\u548c<\/em>Marade<\/em>\uff08\u4e0b\uff09\u7684\u52a0\u5bc6\u904e\u8a2d\u5b9a<\/em><\/p>\n

     <\/p>\n

    \u5c0d<\/em><\/strong>Marade<\/em><\/strong>\u548c<\/em><\/strong>Protux<\/em><\/strong>\u9032\u884c\u95dc\u806f<\/em><\/strong><\/p>\n

     <\/p>\n

    Marade\u548cProtux\u7684\u52a0\u5bc6\u904e\u8a2d\u5b9a\u90fd\u53ef\u4ee5\u5728\u540c\u4e00\u7bc7\u90e8\u843d\u683c\u6587\u7ae0\u4e2d\u627e\u5230\u3002\u5982\u57165\u6240\u793a\uff0c\u7528\u7d05\u8272\u5f37\u8abf\u7684\u5b57\u4e32\u88ab\u7528\u4f5c\u641c\u5c0b\u6a19\u7c64\u4f86\u627e\u51fa\u8a2d\u5b9a\u8cc7\u8a0a\u7684\u4f4d\u7f6e\uff1b\u7528\u6a59\u8272\u5f37\u8abf\u7684\u5167\u5bb9\u8207Protux\u8981\u53d6\u5f97\u7684\u52a0\u5bc6\u904e\u8a2d\u5b9a\u6709\u95dc\u3002<\/p>\n

     <\/p>\n

    \u5728Blackgear\u4e4b\u524d\u7684\u653b\u64ca\u6d3b\u52d5\u4e2d\uff0cProtux\u7684\u8a2d\u5b9a\u683c\u5f0f\u88ab\u6539\u6210\u5176\u4ed6\u7248\u672c\u3002\u4f8b\u5982\uff0c\u820a\u7248Protux\u6703\u5c0b\u627e\u201c++ a ++\u201d\u6a19\u7c64\uff08\u5982\u57165\u6240\u793a\uff09\u3002Protux\u7684\u6700\u65b0\u7248\u672c\u5247\u4f7f\u7528\u8207Marade\u985e\u4f3c\u7684\u683c\u5f0f\uff08\u5982\u57166\u6240\u793a\uff09\u3002<\/p>\n

    <\/p>\n

    \u5716<\/em>6<\/em>\u3001<\/em>Protux<\/em>\u8cbc<\/em>\u5728\u516c\u958b\u90e8\u843d\u683c\u7684\u52a0\u5bc6\u904e\u8a2d\u5b9a\uff08\u6ce8\u610f\u9019\u516d\u500b<\/em>magnet <\/em>URL<\/em>\uff1b<\/em>\u7b2c\u4e09\u500b\u662f<\/em>Protux<\/em>\u7684\u6700\u65b0\u8a2d\u5b9a\u683c\u5f0f\uff09<\/em><\/p>\n

     <\/p>\n

    \u5c0dProtux\u7684\u6700\u65b0\u7248\u672c\u9032\u884c\u9006\u5411\u5de5\u7a0b\u5f8c\u8b93\u6211\u5011\u78ba\u8a8d\u4e86\u5982\u4f55\u89e3\u5bc6C&C\u8cc7\u8a0a\uff0c\u53ef\u4ee5\u4f7f\u7528\u4e0b\u9762\u7684Python\u7a0b\u5f0f\u9032\u884c\u3002\u7814\u7a76\u4eba\u54e1\u3001\u7cfb\u7d71\u7ba1\u7406\u54e1\u548c\u8cc7\u5b89\u5c08\u5bb6\u4e5f\u53ef\u4ee5\u7528\u5b83\u4f86\u89e3\u5bc6Protux\u7684\u6700\u65b0\u7248\u672c\u3002<\/p>\n

     <\/p>\n

    #!\/usr\/bin\/env python2<\/p>\n

    #-*-coding:utf-8 -*-<\/p>\n

     <\/p>\n

    import os, sys, datetime, operator, base64<\/p>\n

     <\/p>\n

    def decrypt():<\/p>\n

    if len(sys.argv) != 2:<\/p>\n

    print \u201cUsegae : .\/decrypt_protux_magnet.py <Full magnet strings>\u201d<\/p>\n

    sys.exit(0)<\/p>\n

     <\/p>\n

    str = sys.argv[1]<\/p>\n

    head = str.find(\u201cmagnet:?xt=urn:bhih:\u201d)<\/p>\n

    tail = str.find(\u201c&xl=\u201d)<\/p>\n

    if -1 == tail:<\/p>\n

    tail = str.find(\u201c&amp;xl=\u201d)<\/p>\n

     <\/p>\n

    if -1 == head or -1 == tail:<\/p>\n

    print(\u201ccan\u2019t find delimiter\u201d)<\/p>\n

    sys.exit()<\/p>\n

     <\/p>\n

    b64_data = str[len(\u201cmagnet:?xt=urn:bhih:\u201d): tail]<\/p>\n

     <\/p>\n

    b64_decode = base64.b64decode(b64_data)<\/p>\n

    key = ord(b64_decode[2])<\/p>\n

    data = b64_decode[4:]<\/p>\n

     <\/p>\n

    output_file = open(\u201cC2_info\u201d, \u201cwb\u201d)<\/p>\n

    for single_byte in data:<\/p>\n

    output_file.write(chr(ord(single_byte) ^ key))<\/p>\n

    output_file.close()<\/p>\n

    if __name__ == \u2018__main__\u2019:<\/p>\n

    decrypt ()<\/p>\n

     <\/p>\n

    \u4e00\u7a2e\u65b0\u7684\u9060\u7aef\u63a7\u5236\u5de5\u5177<\/em><\/strong><\/p>\n

     <\/p>\n

    \u6211\u5011\u9084\u53ef\u4ee5\u53d6\u5f97Protux\u9060\u7aef\u63a7\u5236\u5de5\u5177\u7684\u6a23\u672c\u3002\u5b83\u63d0\u4f9b\u4e86\u4f7f\u7528\u8005\u4ecb\u9762\uff0c\u53ef\u4ee5\u8b93\u653b\u64ca\u8005\u50b3\u9001\u6307\u4ee4\u7d66\u4efb\u4e00\u500b\u4e2d\u6bd2\u7cfb\u7d71\u4e26\u5c0d\u5176\u9032\u884c\u76e3\u63a7\u3002\u6b64\u5de5\u5177\u4e5f\u53ef\u4ee5\u9060\u7aef\u63a7\u5236\u4e2d\u6bd2\u7cfb\u7d71\u5167\u7684Marade\u3002<\/p>\n

    <\/p>\n

     <\/p>\n

    \u5716<\/em>7<\/em>\u3001\u63a7\u5236\u5668\u53d6\u5f97<\/em>Marade<\/em>\u76f8\u95dc\u8cc7\u8a0a\uff08\u4e0a\uff09\u548c\u6536\u96c6<\/em>Protux<\/em>\u76f8\u95dc\u8cc7\u8a0a\uff08\u4e0b\uff09<\/em><\/p>\n

     <\/p>\n

    \u6839\u64da\u9019\u500b\u63a7\u5236\u5de5\u5177\u7684\u884c\u70ba\uff0c\u6211\u5011\u53ef\u4ee5\u63a8\u5b9aMarade\u548cProtux\u90fd\u662f\u7531\u540c\u4e00\u500b\u99ed\u5ba2\u88fd\u4f5c\uff0c\u5728\u7cfb\u7d71\u5167\u9032\u884c\u7279\u5b9a\u7684\u5de5\u4f5c\u3002Marade\u9032\u884c\u653b\u64ca\u7684\u7b2c\u4e00\u968e\u6bb5\uff0c\u5c07\u4e2d\u6bd2\u7cfb\u7d71\u7684\u8cc7\u8a0a\u9001\u5230C&C\u4f3a\u670d\u5668\uff0c\u63a5\u8457\u7b49\u5f85\u4f86\u81ea\u63a7\u5236\u5de5\u5177\u7684\u547d\u4ee4\u3002\u9019\u8b93\u653b\u64ca\u8005\u53ef\u4ee5\u76e3\u8996\u4e26\u6aa2\u67e5\u4e2d\u6bd2\u96fb\u8166\u662f\u5426\u8b93\u4ed6\u5011\u611f\u8208\u8da3\u3002\u5982\u679c\u662f\uff0c\u63a5\u8457\u5c31\u6703\u90e8\u7f72Protux\u4f86\u9032\u5165\u7b2c\u4e8c\u968e\u6bb5\u3002\u9019\u500b\u5de5\u5177\u9084\u53ef\u4ee5\u5373\u6642\u63a7\u5236\u5f8c\u9580\u7a0b\u5f0f\u548c\u653b\u64ca\u8005\u9593\u7684\u9023\u7dda\u3002\u4ee5\u4e0b\u662fProtux\u503c\u5f97\u6ce8\u610f\u7684\u7d44\u4ef6\u53ca\u5176\u529f\u80fd\u7684\u5217\u8868\uff1a<\/p>\n

     <\/p>\n