情报速递20240705｜“银狐”变种木马正通过随机化特征进行攻击
1.背景
腾讯安全科恩实验室（以下简称“腾讯科恩”）持续基于多源数据的威胁情报分析，以及系统自动化方式，追踪捕获基于钓鱼样本的攻击事件。近日，腾讯科恩发现“银狐团伙”正通过随机化特征的方式对抗安全软件的检测，具体行为包括样本文件hash随机化和C2地址批量生产。在情报自动化分析系统中，我们在同一天会捕获到大量的相似样本，样本之间仅存在少量字节不同，疑似通过自动化工具批量生成。同时C2 IP地址也存在A段、B段相同的情况，疑似从网络服务商批量购买了IP地址用作远控木马的C2服务器。
同时间段出现的高度相似钓鱼样本列表：
md5
文件大小
发现时间
5c08352f8dcf3b2a41122f249d03b942
25297456
2024-06-20 09:42:28
30c9bffeef7c5598279030e7e5675547
25297456
2024-06-20 10:51:04
93a50397e4d616811e8f4e75d60446e0
25272320
2024-06-20 10:58:10
5578bca9c64b768a9ed0202546dbf139
25297456
2024-06-20 12:07:22
e1a6bad0a3a2e1040d730a2d6694fc1c
25284840
2024-06-20 14:14:25
152dba380ec0e9874d03c6c904c5b719
25284840
2024-06-20 15:18:35
e59b389e739af82429ff19e707b6eb61
25297456
2024-06-20 16:19:37
c42965e57680bb86a1ec73706df4f5cb
25284840
2024-06-20 16:47:14
4cdc98b6d6922ed9a53b69f0fab3ede6
25284840
2024-06-20 17:05:28
9f9c2e9c586f2b6d9c8d4e738863e1a9
25284840
2024-06-20 17:37:50
3bfb555bfdc4c460fa55389b086496d5
25284840
2024-06-20 17:45:09
29ca6a80ce27d671392f87ad1c91fbc5
21843968
2024-06-21 09:30:47
b5f583f9ad55b3b1df72b19778c133ce
25297456
2024-06-21 10:21:48
33642d364eb40bbcaa2a8db424fd7947
21843968
2024-06-21 10:30:49
679b102b2f7e22201467fa1679538b33
21869120
2024-06-21 11:27:19
a3e2e7ca1c713b9b456e8bf911e8b61b
21869120
2024-06-21 12:46:37
be600a6b5fea37ad1e63270d5e1f32d4
21843968
2024-06-21 12:48:26
46b0a09df4050f163695eeb1a3e19b2b
22319680
2024-06-21 14:03:10
4f6090a4699ddb1a7a1db48b3516c970
21869120
2024-06-21 14:24:57
48981e3503ded6fdc025322f0a78d585
22319680
2024-06-21 14:35:29
37a0f97f8d0a115ac4da4fc755a5baa8
21869120
2024-06-21 14:47:56
cc988bd086032e009fee7cdd58dfd442
21869120
2024-06-21 16:13:38
钓鱼攻击使用的同网段C&C：
154.39.249.194[:]3760
154.82.92.17[:]3760
154.91.64.155[:]3760
156.225.58.58[:]3760
156.234.0.20[:]3760
156.234.0.32[:]3760
206.233.128.109[:]3760
206.238.115.146[:]3760
206.238.115.184[:]3760
206.238.197.185[:]3760
206.238.198.20[:]3760
206.238.198.233[:]3760
206.238.199.40[:]3760
206.238.221.220[:]3760
在钓鱼样本文件的命名特点上，以"合同"、"查询"、"表格"为关键词进行命名的有所增多，此外还出现了使用"ziliao"、"mingdan"、"cailiao"等拼音来代替原有的"资料"、"名单"、"材料"等关键词，企图以此来对抗情报自动化分析系统的感知策略。
钓鱼样本文件样例如下：
md5
文件名
6b76457c570f41f07d88c06dde996b05
ziliao-pdf-moban6.03.exe
33fc4d1e0ff95975dc801c593474dfa4
ming-dan.exe
30d3e1468412556b54b959dd9d2c65cf
mingdan.exe
4ddeecd15da7bf9da28de2b899010316
cailiaoPDF-mobanDOC.exe
93a50397e4d616811e8f4e75d60446e0
ziliao-PDF.exe
5d983954e643aa72412f8df0db713975
cailiao-mdPDF.exe
a38651421c3f327601e6d6c28e361a7b
mingdan-PDF.exe
d50b5470a52512ed405dc9d78dad9e98
ziliao-PDF.exe
ef1a6069c5d334a7dcb68b1ac392eb6a
mingdan.exe
9166ca99fd8d85eca258a3d671a36c87
mingdan.exe
根据腾讯科恩威胁情报中心统计数据显示，6月初至7月银狐钓鱼攻击呈现增长趋势，通过威胁情报云查拦截的攻击平均每天超过11万次，高峰时期一天超过27万次。并且攻击样本呈现出批量化、自动化生产的特点，部分具有明显共同家族特征的的样本，近一个月内检测出300多个变种。
在当前重保以及银狐黑产团伙活跃的背景下，腾讯科恩提醒广大用户在打开任何从外部获取的文件之前，务必验证其来源的可靠性，不要随意打开来自未知或不可信来源的文件，特别是后缀名为".exe"、".msi"的文件。在电子邮件或即时通讯消息中，不要随意点击链接，尤其是指向不明网站或要求立即下载文件的链接。
2.技术分析
同源样本之间在二进制数据层面仅存在微小差异：
部分样本通过将PE文件入口修改到非text段来逃避检测：
母体样本运行后会通过弹窗提示迷惑用户：
然后在用户文档目录下释放木马文件Tomcat.exe并启动，然后删除母体文件：
将木马exe创建快捷方式wps.lnk，并写入开机启动项：
Tomcat.exe在内存加载并执行shellcode：
连接C2地址156.225.58[.]58[:]3760：
木马上线后搜集用户名、系统版本、CPU等信息发送至远端：
发送命令获取当前系统安装软件列表，并持续通过其他指令对机器进行远程控制，部分指令为明文字符串，例如"GetSoft"为获取当前系统安装软件列表：
相关IOC
C&C:
118.107.42.171[:]3706
143.92.48.166[:]3706
154.39.249.194[:]3706
154.82.92.17[:]3706
154.91.64.155[:]3706
156.225.58.58[:]3706
156.234.0.20[:]3706
156.234.0.32[:]3706
156.240.242.2[:]3706
156.251.17.69[:]3706
206.233.128.109[:]3706
206.238.115.146[:]3706
206.238.115.184[:]3706
206.238.115.233[:]3706
206.238.196.149[:]3706
206.238.196.17[:]3706
206.238.197.185[:]3706
206.238.197.223[:]3706
206.238.198.20[:]3706
206.238.198.23[:]3706
206.238.198.233[:]3706
206.238.199.40[:]3706
206.238.221.220[:]3706
MD5:
93a50397e4d616811e8f4e75d60446e0
33642d364eb40bbcaa2a8db424fd7947
9f9c2e9c586f2b6d9c8d4e738863e1a9
4f6090a4699ddb1a7a1db48b3516c970
48981e3503ded6fdc025322f0a78d585
37a0f97f8d0a115ac4da4fc755a5baa8
b5f583f9ad55b3b1df72b19778c133ce
29ca6a80ce27d671392f87ad1c91fbc5
46b0a09df4050f163695eeb1a3e19b2b
5578bca9c64b768a9ed0202546dbf139
cc988bd086032e009fee7cdd58dfd442
d25e9126e74f1093f35f0dd25064ce46
4cdc98b6d6922ed9a53b69f0fab3ede6
30c9bffeef7c5598279030e7e5675547
3bfb555bfdc4c460fa55389b086496d5
81ff760fa2fd00a428fb6267b4fa397d
5c08352f8dcf3b2a41122f249d03b942
152dba380ec0e9874d03c6c904c5b719
465fbf7671d5a465cbd2f5beeecdbb86
a3e2e7ca1c713b9b456e8bf911e8b61b
e1a6bad0a3a2e1040d730a2d6694fc1c
1e8a2685e7a5f270ae24c1085a7cf5e3
6c96511bba4923cf2bfce64aa6892151
ba3cc50a8b7e6ffc7dfc29622e5cf5dc
679b102b2f7e22201467fa1679538b33
c42965e57680bb86a1ec73706df4f5cb
e59b389e739af82429ff19e707b6eb61
be600a6b5fea37ad1e63270d5e1f32d4
4ea960dd8a5f718f9b2b24b79b4892df
e639842e49a5f0ae3578e412f80ea46a
915475082c4ece8f159f3a794fe90bbb
213c108fe48d438061df6e197a03c366
37ecc6c2799fd75ab3ab21deffc00221
c2ca3b28cbe12eae825c1f0244e19183
29dd8cd8dbd9adbf22185189b8849595
24ce1fcccdfafec78996363c2cb039f6
adc365e56603387842aba7f786b03872
a44b6fe4ce2c657ae1f0ab5bffd62b48
71b28e612164f586d22e4d73b8eab477
3776f123f9b462909122438b4992fe31
618e4cbc6dde5c9a2bb60fc515d69c2c
1fdf0817c288c1e18af81f8ca08bf5f2
e6337af355c5daabb068fb740a996eab
3f71703f4d6db77023f777c773d17199
b2ebd322e5d28537dab96ddf4a8923e0
2b167c677a4b530ea698976ab95738ea
0e83e54d79252cc7e1af2e09cf3bbef1
efc3b07380d322d9713da132001235dd
5cd294b94371d13efabcd5da87debb1e
8d91d692064e16f228a76a9c3b7bba18
43a44ea09fafa570aead6275cb5a7732
775e1e9ee1aaaaf336a5aa70e971829a
e0056f09d421a4dcfbc069e74c96a89c
495809d6f7bc1080fe8d119d7a0dc72c
23d6b3b2891f74ae1bcac00c572077c9
ae9602f2aef92b96059d170dfbb6c82d
c2a6d29f4c94aeeef93161a12ab656c1
98b2de18f7878ee0db91718bc0777dc2
8c59ff8b2d4c5d685b82e5a868c25f2e
93b581ed8cef9df055d52650afca8014
daa8f08b53d07b29ae0428f67feb09fb
0bd82b66a22bf6e2ad996f5ddd748ef9
3becaca2dcdddc45fd722348300e0f1a
83c90e61a05818faa962ea43ca71d490
c239b795d1c76a873406b8cc592f2e0b
f41d951ca062b0ed7b280c8162af5e28
7a82efce200c49f85645b1c2048b495c
4ad09c5d1a431702b37931af6624a2d6
19936b848f813d4addb7efc3dbe970c6
71c7bfe08e4f10d1bdcf230837add319
1cd0d13eec14647afed2c853ebc2efea
e6414b1427d54f2d551c99b831244b3e
94fc00f3b2738678eaabf10e1371c968
8f368b5ba983b61bf6d43a96ec34c492
a5e8f005873aaa08e426e4baf0f9b5b5
aad4360f411a6d350f1b5b3c01526ae3
e711531569d2e446c3501c635b41e89c
52740e63c9a6b6e9aeea0f278de455b3
5aa7afc7d25ab48dbb218946ad6ee500
4c1cd201918591cbe98e6db0f21b2488
05d001649a3c44a1ba5bf974ee43d36f
05667500c91e8d0fcf6458a6b8c68e2c
8e7de5a170ea663b6823f5c67e36a46f
aaaac616aaae31df11c06b5f5f3666a1
c30a5e14826f692ccb575002c100f347
b0f837bd1799ccee00f37d2f0a8d210d
4b53eda46731a348cf96a1f9f5e55d79
1d8800e1624a1cb6d92dee6bf0b853a6
9b623075e89c0d0bace91c7edac91b4e
d6e6d04854f4453e988f8bc095e47ef4
9386d3ff6eb4f00f70b503c5152fd6db
f5ea12474b1461fec0a6a88a3831062f
40b01c9a816fdd1bed905be01065f71c
26099604c50660ac7a2091ce0fb4bfc7
73f85063864d930740cb2ba6af60567e
7aa437395bd17c4118f1ec65be5639cd
bf744baa82e827d0cff43df998d5efe3
3ac79c6e0bf89908d3299c0626ce27a9
f9d772a1dba21d2b96fd42fead7e82d5
043ce29831861a0ed54e4e83ed463975
bccd141d7b45eeb996a02b1b054ac35f
62c1ce5d8ab09a3cbc5727ee1fbb757b
a0326096e584c1194159f024e1fcd775
9b2dc63c0e916513630fe4660b45cb2d
b528d0802179997ffbd993bd93c4628d
e2e42d8337b5cd9ba970b5cbb2d94e63
41899f4832976a54f3763d6789299dca
2111aeb82504e96133f3fbb01645df56
49116c4dba1f8959bbbda70a29660821
0754b50fb12b5e7d5d441ca2130784d3
d41be81c052d01d8c1631f9e9661cf07
3f1ead10e9fec39370ba0a2c07c34d2a
83ac773d2f5214b2857d8665169e93b2
a1967396e294689ef71433fe1f3b10c6
878d775f3ed264f8354502e1226fc012
44cee02b8c97c1f06fbdd9e02b3e865a
d39b87d6d056ecedb33f573f8deacded
4122f234a63d6e7fabf4c6f85d3176b0
bf34768f65eac1332faa190d0970cc1d
6dfe366e08951950ad22a0c2fce9d4c3
1d98e2cfd25a41547a90802556919cc9
721be4b4e73421dc34ef5d5c19bb211e
49ed775e66e2cd74be732cc95bab5ef0
9166ca99fd8d85eca258a3d671a36c87
241013fa7d60361d06e5b741bafea26d
3aae84c3e1eafdad49eb2632c85ba74d
d9c28cbb35cdb73cf320d100082ee943
74874c09492735908887e233687d0cab
a8aa01f4a43fea827102d1bce46213c6
6257c39e7a1172cc915d9ff377a13203
d2be59033da6fe93168d2840c8554039
f97ac05643c9123104268af0b6d4423a
b92f1fcc85ce32e421c1f19fb1aa6e03
6f463e2c7df43f974a76161da2583b23
f2585a7f7894747d17eac78ee15ff05c
ddd1f1f54e7106437136f0185de60af8
ef1a6069c5d334a7dcb68b1ac392eb6a
e594dd8eb79861283c19aa7318b89c42
91c1233768f6271258333507cd373530
5d36af000f21e3d74e88c420370f197f
33437540fd3127caaac11cff4463d76a
0d3656e6be2535d30f50dd337a7d699d
96923d284853213e7aace419750ee040
3d834811b31f5ab9e3c24abff4aa8faa
89e72fdac1a9026c7497f87085c57cb3
2b2623e8238e191e75d1cf95cadbacd7
d50b5470a52512ed405dc9d78dad9e98
a38651421c3f327601e6d6c28e361a7b
46a2885a769e205acbbe0dee272aacab
1a931ae24935a6fe5dce82d3148caf2e
35d2c163a83bc6268452ca090ac84a65
fa2c637ca4e1cb0ca5e2547542a5a10a
5d8f00b5297f7a7cbf19ee1f8948d94e
188b5ed90295582678320c1a6acced38
8aaf1bf2e74e420a3bdf0fb49d8ee326
1b371ddabe058687147de7f3c50fe85e
6a2b7ff58724ee54dc269f03c22bbc82
330dcfe2ca29a557aaf366ec51b04e85
8eb0d603bab47cb997d31bf8752097ea
acdef0db16fabc13735e34d817f37059
43f818bab0e589c4f1fbf12d7057628a
bbb7342ea6de274965dc25231b2885e9
afecc5153abef4191481f7f19cad65fd
83d91cdb1ebfb015f8ab417426d2ebec
31e5bfa1d6acfc69648eecd70e905ced
1aa9af059403e322c754ffbd8bdce04d
73c96ad0a1c5d3f0857439eaa7a475a4
80065575480b7ef12c48a32987608e90
66749718ff7cb1bd19d07c98d2982a6a
775c29c41d442cbd62bfd4248c7e9637
8587ef26e77d69a0beccc75044ede529
175b55c22f109c44566896347181daec
5d983954e643aa72412f8df0db713975
2f3cd2d1d52ee8f27d745cf573a6e702
7239bd003c04acad686e2a05e2a6f831
7cefd5c28dce8776d10f4278ae698498
2ab727082a3544482d3a2ec3695272ee
9dc7412c7d5e95f958880f7f71a6c115
5645d43d27697d40925bc82820a9d9ed
6c49dd2bcd979c42ab91b5c5260f0e7b
fe696a3faf727be637c67d65c182571d
ebc01f4dd0f592783299f5a013ab8b0a
30d3e1468412556b54b959dd9d2c65cf
a0d353d9f63e272952ee568d18331c55
c063b4f319d232add8be3d45a213b4ef
ccb5172876effc2cd6cc25896391e3a8
be911fe3973e63a8532351e4988be16b
8e1a23264ebcf3b6fffb41ae88c27ac7
7e59c45c1d129d77f15d03b87005f9ac
deacdcb415f2096dd45eb4912798ff31
e2d98bf5a5e988e3ab2bf7491edba620
fca16da1b848e82a83e89d8ecbb63ee9
d776c27d16c83279d78ddc9b67a561f9
f52320d9ff7f4cb8b9986703427d1ef6
741a6c3c68832ed7a822324464c3eff2
d3a2d394d602ed0fc01fe5e44506c333
d2542bd1192aad475bc9d5d58707da21
c2b9294bbc8be37f3ed7836af1c33493
39cfbf361ee0885d6c267c18a5a6bf37
00a9cf23426afed330fe186bf2fab166
1e6931316c72586349fab023d6c48588
0185d2869f57f204f9a6900fd64d03ae
915a23beb4886796c9629f3622cf0a8d
ebc30b9cad91be74268130443151f34e
0776775e35d5c1b5a95e011096b73b98
b0572b1f4f3fc1c8d1bec8179053debe
43eab78f19505795a54b87406ee8afe6
905706524807e4dc00d435c14f7a65b0
1157b10101d4d568e711c545a28644c1
cc6e18e79d231e313a348bcd08f26f02
06c5fd15041c469f7a4f5fdc6ff9524e
cf6d909a57368dc64fd30ee8f3e6e9f9
3089b6b3986fd315807a7e3fcdea5255
44e63f0cc4ec4fa2ce6d61597a97ecd5
19c3ba2e9154706a48f689fdacb17579
a6520fb81c1af13b699fab929b02cd42
6c5ed72d2e305a871b953eedf1245287
7796cd00f37302ad85b0b9fde1c24a5e
33fc4d1e0ff95975dc801c593474dfa4
5b45d02d76b4dc5cdfe79aa95d98a357
758620433c51d56fd7e3353519a9dd9a
84a241afa01c1e480c0278403db07d25
a7e8512f3b9a08aa8ef70e6112cff464
cc8d2862d13c86e2b246817ecfdb6825
4ddeecd15da7bf9da28de2b899010316
cbcf0954033bb825bf5ed579f7c70762
419d3b0d26bcc2e8854d53baa37a9bc7
dacddef361efc350cceec4cd3ad1e9b1
0d332e188cce9d1cb2f279e4a2d4fd8e
1d6d15297fa5f4d84256535f8c54e7f3
04682c46af5e600b8b327001d0d8def8
510283695a0cbf3a2cfe4732affd60a3
6fe6ac2510c084264e735a0362eb041c
846831c799b1e57c14ecc6268c4954aa
370b9354b175b2f638a07743b6e5bce0
688ad6cc5d8cbcc979df5ecc436b0db2
c7aafd2edeb7f854567fd8655a662b3d
4450058efd92854936ddb1c7a7619c4a
a10b79d01959130566e0030478f4f112
d35580d2f551e9639337df35d79f8db2
0389c154e6dcf81f4a643991eedd6d8b
a0e36bf7ec2355d9304df551bec2d7be
e45d9aa16f07fbf6264a84f02ebb2009
bf46b5872582b912e6bfb75a235c957b
cf479fa6639785ff8f27bfa55613f7e2
699f692c8a12e74ba726ac2339ce89ab
0f0578d5751a82fb4020443ff379958a
423b3013bddf9f736b0f9dec42f9e734
e184580805c3944c06d1f27ac7b7e825
6b76457c570f41f07d88c06dde996b05
755d4e935bce40277ee8c3ceb1eef463
52fa6d8f45f160b057efeca4c505849a
4d9f9ecbfdc63fd7afd62eac8cea1496
547aec3c6fe67362189e007400e90575
cfb35e7ed9135540eec21bcece9684f8
0b1e09264d0973e20ecc888d3071d354
bc467552d6cd82ed8c8452d6bc7f1b05
c14f82f1a9f8de0a23a5f3c709b8741c
ac3ce2b00b8f9fec31faa522c96a153f
bc1a06fbaec8e9c6180800281d64c161
c5c524c0d86f0f2d61088e8a2aff4ac3
28f784e18cbd562cbe24a4585d26a233
产品体验
