nEHpb3LL

11 / 78
2table of Contents
3Chapter 1 Overview.............................................. .................................................. ...............................3
41. The main findings............................................. .................................................. ...........................3
52. Name the origin .............................................. .................................................. ...........................4
6Chapter 2 Purpose of Attack and Victim Analysis.......................................... .................................................. .......5
71. Purpose of the attack.............................................. .................................................. ...........................5
82. Industry distribution.............................................. .................................................. ...........................6
93. Geographical distribution.............................................. .................................................. ...........................6
10Chapter 3 Activities that last 11 years.......................................... .................................................. .............8
111. Initial attack.............................................. .................................................. ...........................8
121) Spear phishing email attack.......................................... .................................................. ...8
132) RLO camouflage document extension........................................... .................................................. 16
143) Camouflage icon hide extension........................................... .................................................. 16
152. Vulnerability Analysis.............................................. .................................................. .........................17
161) CVE-2012-0158 Vulnerabilities.......................................... .................................................. ...17
172) CVE-2014-6352 Vulnerability (0day).......................................... ........................................19
183) CVE-2017-8759 Vulnerabilities.......................................... .................................................. ...twenty four
193. Continuous penetration.............................................. .................................................. .........................25
201) RAT evolution.............................................. .................................................. ..................25
212) RAT 13 version analysis.......................................... .................................................. ....27
223) Attack load analysis of script loading.......................................... ...........................................36
234) Latest Control Trojan Analysis............................................ .................................................. ...44
244. C&C Analysis.............................................. .................................................. .........................51
251) Dynamic domain name.............................................. .................................................. .................51
262) Domain Name Meaning.............................................. .................................................. .................52
273) Cloud disk................................................ .................................................. .........................53
284) Third Party Blogs.......................................... .................................................. ..............55
295) C&C's IP (ASN).......................................... .................................................. ...56
306) Others............................................... .................................................. ........................56
315. Correlation analysis................................................ .................................................. .........................57
321) Overall relevance.............................................. .................................................. .................57
332) RAT iterative upgrade (against method)........................................... .........................................58
34Encryption method................................................ .................................................. .......................................59
35Chapter 4 Behind the Scenes............................................. .................................................. ..............65
361. Resource approach.............................................. .................................................. .........................65
372. Related related information................................................ .................................................. ..................65
381) Domain name whois information................................................ .................................................. ...65
392) Keywords of concern............................................ .................................................. ...........66
403) Traditional fonts in the PE sample, BIG5 character set....................................... ................................66
414) Traditional fonts in the vulnerability documentation.......................................... .................................................. 67
425) The confusing document released........................................... .................................................. .......68
43Chapter 5. Organizational Capabilities or Characteristics Analysis.......................................... .................................................. .....69
44Appendix 1: File MD5 List
456a37ce66d3003ebf04d249ab049acb22 svchoct.exe Backdoor.Win32.Ht
46tpBot
47Figure 11 Screenshot of carrying a PE binary executable program case mail
4814 / 78
49Figure 12 Screenshot of the mail attachment attachment compression package carrying the PE binary executable program
50Figure 13 Carrying the PE binary executable program in the case of the Trojan release confusing document opened after the screenshot
51Attacking organizations send phishing emails usually log in to webmail and attack the mail through related tools (PHPMailer2)
52The sending of the piece.
53
542 PHPMailer, http://code.google.com/a/apache-extras.org/p/phpmailer/
5515 / 78
56C. Carrying a self-extracting file
57 The attacking organization sends a compressed form of the RAR self-extracting format program to the target mailbox.
58 Inside the attachment is a Trojan file:
59 The file is actually a RAR self-extracting format program, the parameters are as follows, click on this exe, it will run directly inside
60Bat file:
61The default batch command moves the Trojan body to the temp directory, then executes it, and deletes the batch.
62Pieces:
6316 / 78
642) RLO3 camouflage document extension
65MD5 file name virus name
66Mail
67annex
68954f50f7ed8b4c11b59560769de0ec36 East China Sea Aviation Communications Station Regulations
69Supplementary materials
70Hangbaoexe.doc (real
71Extension cod.exe)
72Dropper.Win32.Fak
73eDoc
74Figure 14 Capture Camouflage Document Extension (RLO) sample screenshot
753) Camouflage icon hide extension
76MD5 file name virus name
77Mail
78annex
79Cbeebf063f914eb3b5eba8b37302189f "Intensive development of military and civilian integration
80Slightly research "consultation project officially
81Start .exe
82Dropper.Win32.Fak
83eFolder
84Figure 15 camouflage icon hide extension case 1 screenshot
85MD5 file name virus name
86
873 RLO, http://en.wikipedia.org/wiki/Unicode_character_property
8817 / 78
89Mail
90annex
91Ae004a5d4f1829594d830956c55d6ae4 2014-03-18 Chinese system imitation
92Really learn the funding of scientific research projects
93Self-check xls
94___________________
95__________.exe
96Dropper.Win32.Fak
97eXls
98Figure 16 Camouflage icon hide extension case 2 screenshot
99Figure 17 Camouflage icon hide extension case 2 Trojan release puzzle file screenshot
1002. Vulnerability analysis
1011) CVE-2012-0158 Vulnerability
102Vulnerability number CVE-2012-0158
103A remote code execution vulnerability exists in Windows common controls. An attacker can build a specially crafted network
104Page to exploit this vulnerability. The vulnerability could allow remote code execution when a user views a web page. success
105An attacker who exploited this vulnerability could gain the same user rights as the logged in user.
106Published on April 10, 2012
107Reference link https://technet.microsoft.com/en-us/library/security/ms12-027.aspx
108Http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158
10918 / 78
110A. Vulnerability document execution process
111Figure 18 Vulnerability Document (CVE-2012-0158) Execution Process
112B. MHT format
113Figure 19 Vulnerability document two forms (upper MHT, lower RTF) comparison chart
114The CVE-2012-0158 vulnerability is mainly based on the rtf and doc formats, but this attack saves the doc file as mht.
115The format causes the killing soft to be missed during the vulnerability check due to the mismatch of the pre-logic. Related vulnerability documentation files were compared at the time
116Low detection rate.
11719 / 78
118C. shellcode comparison
119Related comparisons
120The shellcode first layer shellcode is XOR 0xA3 for decryption, the relevant samples are 3 layers of shellcode,
121And the data structure is consistent
122The value of Magic is: 0x22776655, 0xCACACACA, 0xA02005CA, all consistent
123Release the file path consistent:
124 Normal document file: “%USERPROFILE%”, the file name of the relevant document will change, such as:
125“About the construction of the first phase of the large-scale offshore repair and support base project of Qinzhou Shipbuilding in Qinzhou
126Comments on the Responsibility Form (No. 37).doc", "Important Release Reports.doc", "123.doc"
127Wait
128 PE Trojan file: "C:\Documents and Settings\All Users\" Start Menu\
129Program\Startup\update.exe"
130Clear traces Decode related registry entries and delete them. The purpose is to clear records such as office open failures.
131Historical information.
132Related registry entries:
133"Software\Microsoft\Office\12.0\Word\Resiliency\DisabledItems"
134"Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems"
135"Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery"
136"Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems"
137"Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems"
138Through our comparison of the shellcode of the vulnerability document, we can find that the relevant structure and function are basically the same, further I
139We can also infer that the relevant vulnerability documentation is developed by the same organization.
1402) CVE-2014-6352 Vulnerability (0day)
141A. Background introduction
142CVE-2014-4114 Vulnerability is a report released by iSIGHT Company 4 on October 14, 2014, the report mentions
143A 0day vulnerability (CVE-2014-4114) for Russia related mainly to NATO, EU, telecommunications and energy related
144Domain cyber espionage. Microsoft also released the relevant security bulletin on October 14.
145And CVE-2014-6352 is a vulnerability that can be considered to bypass the CVE-2014-4114 patch.
146First add the MakeFileUnsafe call after generating the Inf and exe files to set the file Zone information, so that it is leaking
147There is a security prompt when the hole performs an inf installation. The CVE-2014-6352 vulnerability sample was abandoned using inf to install
148Exe, and directly execute exe. Because the right-click menu of the system executable file above xp is the administrator's permission.
149This causes the user to turn off uac without any security reminders. So the patch for Microsoft 6352 is in tune.
150Add a security alert popup window using the context menu.
151Vulnerability number CVE-2014-4114
152
1534"iSIGHT discovers zero-day vulnerability CVE-2014-4114 used in Russian cyber-espionage campaign",
154Http://www.isightpartners.com/2014/10/cve-2014-4114/
15520 / 78
156A vulnerability exists in Windows OLE if a user opens a file containing a specially crafted OLE object.
157The vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could get and log in
158User with the same user rights. If the current user is logged in with administrative user rights, the attacker can follow
159Post-installer; view, change, or delete data; or create a new account with full user rights.
160Users whose accounts are configured to have fewer user rights are subject to users with administrative user rights.
161The impact is small.
162Published on October 14, 2014
163Reference link https://technet.microsoft.com/en-us/library/security/ms14-060.aspx
164Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4114
165Vulnerability number CVE-2014-6352
166Description After the user downloads or receives, and then opens a specially designed Microsoft that contains OLE objects
167When the Office file is used, it causes a remote code execution vulnerability in the current user context. Microsoft most
168I first learned about this vulnerability by coordinating the vulnerability disclosure channel. This vulnerability was originally created in Microsoft
169The safety bulletin 3010060 is described. Microsoft is aware of the limited attack on trying to exploit this vulnerability
170hit. This update verifies memory usage by modifying the operating system that is affected when accessing OLE objects
171Ways to solve these vulnerabilities.
172Published on October 21, 2014
173Reference link https://technet.microsoft.com/en-us/library/security/3010060.aspx
174Https://technet.microsoft.com/en-us/library/security/ms14-064.aspx
175Http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6352
176B. Related introductions in this action
177MD5 file name virus name
178Da807804fa5f53f7cbcaac82b901689c Command and Control Committee
179Ren Shu.ppsx
180Virus.exp.20146352
18119f967e27e21802fe92bc9705ae0a770 South China Sea Title Project Suggestions
182Book.ppsx
183Virus.exp.20146352
18421 / 78
185Figure 20 Vulnerability Document (CVE-2014-6352) attribute related information
186Figure 21 CVE-2014-6352 Related Critical Time Nodes
187The sample in this action did not use inf5 as a springboard, but directly used exe, CVE-2014-4114 vulnerability trigger
188After that, the second item of the right-click menu is called by default. Under Windows7, it is normally opened with administrator rights, if the second item
189Other options will pass the virus path as a parameter, which will also cause partial compatibility issues. The execution effect is as follows
190The figure below shows:
191
1925
193Inf is a file used to describe device information. You can complete some operations on files and the registry through inf files.
19422 / 78
195Figure 22 Schematic diagram of the vulnerability implementation
196Vulnerability document version upgrade
197Figure 23 Screenshot of the Sandworm Vulnerability Document Sample (Version A)
19823 / 78
199Figure 24 Screenshot of the Sandworm Vulnerability Document Sample (Version B)
200Figure 25 Screenshot of the poison cloud vine vulnerability document sample (version C)
201Version time vendor description
202Revision A October 14, 2014
203(Report release time)
204iSIGHT UNC Download PE Trojan, use inf to install boot PE
205Trojan horse
206Version B October 16, 2014
207(capture sample time)
208Xecure lab6 uses inf to execute PEs embedded in ".ppsx" documents
209Trojan horse
210
2116http://blog.xecure-lab.com/2014/10/cve-2014-4114-pptx-apt-xecure-lab.html
21224 / 78
213Version C September 12, 2014
214(capture sample time)
215360 does not use inf, directly embed embedded ".ppsx" text
216PE Trojan in the file
2173) CVE-2017-8759 Vulnerability
218A. Background introduction
219 CVE-2017-8759 Vulnerability is a 0Day vulnerability disclosed by FireEye on September 12, 2017
220(CVE-2017-8759). Microsoft also released a related security bulletin on September 12.
221Vulnerability number CVE-2017-8759
222Description CVE-2017-8759 is a SOAP WSDL parser code injection vulnerability that parses SOAP WSDL definitions
223In its content it allows an attacker to inject arbitrary code that affects all .NET environments.
224Published on September 12, 2017
225Reference link https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8759
226B. Related introductions in this action
227MD5 file name virus name
2285d0b4cadfb149695d9fbc71dd1b36bef 2017 New developments in cross-strait relations
229Problem (internal).rtf
230Virus.exp.20178759
231The link to the objautlink and objupdate control fields is automatically updated in the Rtf document, and the vulnerability triggers mshta.exe
232Execute the remotely specified HTA file.
233The HTA file is an html page with a malicious VBS embedded. The VBS calls POWERSHELL to download the subsequent exe loader.
23425 / 78
2353. Continuous penetration
2361) RAT evolution
237RAT (Remote Access Trojan): Remote access Trojan, commonly known as remote control.
238Figure 26 Related RAT evolution timeline
239RAT first, latest
240ZxShell 2007/12/26 2014/10/14
241Poison Ivy 2011/12/27 2014/9/10
242Kbox 2015/2/11 2015/5/4
243Puppet 2008/12/22 2009/2/12
244Httpbot 2013/7/23 2013/10/2
245Gh0st 2009/1/13 2013/4/21
246AresRemote 2009/5/5 2009/5/5
247Shellcode 2011/7/13 2015/5/5
24826 / 78
249XRAT 2013/11/6 2013/11/6
250FakeRising 2009/5/15 2009/5/15
251FakeWinupdate 2009/10/21 2009/10/21
252SBlog2014
253SBlog2015
254The relevant backdoors involve a total of 11 versions. The relevant proportions are as follows:
255Figure 27 11 versions RAT distribution ratio
256RAT quantity
257ZxShell 23
258Poison Ivy 17
259Kbox 15
260Puppet 4
261Httpbot 4
262Gh0st 4
263FakeRising 2
264AresRemote 1
265Shellcode 1
266XRAT 1
267FakeWinupdate 1
26832%
269twenty three%
270twenty one%
2716%
2726%
2735%
2743%
2751% 1% 1% 1%
276ZxShell
277Poison Ivy
278Kbox
279Puppet
280Httpbot
281Gh0st
282FakeRising
283AresRemote
284Shellcode
285XRAT
286FakeWinupdate
28727 / 78
2882) RAT 13 version analysis
289Figure 28 RAT related version classification
290A. Poison Ivy
291The Poison Ivy Trojan is essentially a remote control Trojan (RAT). FireEye specializes in Poison Ivy
292A research analysis was conducted7.
293The Poison Ivy Trojans in this report correspond to a generator version of 2.3.2, Poison Ivy Trojan Generator
294A total of 10 versions starting with version 1.0.0, the latest version is 2.3.2. Poison Ivy Trojan Generator can generate EXE and
295In both versions of shellcode, the Trojans generated in this action are shellcode. Further related mutexes
296Some are defaults: ")! VoqA.I4".
297
2987 “POISON IVY: Assessing Damage and Extracting Intelligence”,
299Https://www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf
30028 / 78
301Figure 29 Posion Ivy generator related configuration interface screenshot
302Poison Ivy
303(shellcode)
304XOR
305Key1 and key2
306Figure 30 Outer and inner PI relationships
307In addition, the Poison Ivy Trojans are derived from the outer parent by X or key1 and key2 to get the shellcode.
308Figure 31 Poison Ivy Trojan (three) related XOR decryption comparison chart
30929 / 78
310The following table is a list of related Poison Ivy Trojan configuration information (ID and corresponding password).
311MD5 ID password
312D61c583eba31f2670ae688af070c87fc 14 926
31326d7f7aa3135e99581119f40986a8ac3 14 8613
3145ee2958b130f9cda8f5f3fc1dc5249cf 4 #My43@92
3157639ed0f0c0f5ac48ec9a548a82e2f50 1013 @1234@
316250c9ec3e77d1c6d999ce782c69fc21b avex admin
317F3ed0632cadd2d6beffb9d33db4188ed w6U900 admin
3189b925250786571058dae5a7cbea71d28 zhan ftp1234
319Ae004a5d4f1829594d830956c55d6ae4 zhan2 ftp1234
320Fccb13c00df25d074a78f1eeeb04a0e7 zhan2 ftp1234
321A73d3f749e42e2b614f89c4b3ce97fe1 009-4 ftp443
322785b24a55dd41c94060efe8b39dc6d4c 120707 hook32wins
32336c23c569205d6586984a2f6f8c3a39e 90518 kkbox55
32481e1332d15b29e8a19d0e97459d0a1de 90518 kkbox55
3257c498b7ad4c12c38b1f4eb12044a9def motices ps135790
326Ca663597299b1cecaf57c14c6579b23b 010-4 ps1478
32776782ecf9684595dbf86e5e37ba95cc8 13099 updatewin
328C31549489bf0478ab4c367c563916ada 0314--Good updatewin
329B. ZxShell
330ZxShell has been used continuously by the poisonous Yunteng organization from December 2007 until October 2014. Due to phase
331The version differs greatly, and is divided into the internal public version and the open source version. The first version refers to the period from 2007 to 2012.
332The ZxShell Trojan used by the organization before, the second edition refers to the one that appeared from 2012 to 2014.
333The relevant ZxShell Trojan used by the organization, the related Trojan is developed based on the open source version, which we call the second open
334Released.
335Both the internal public version and the open source version are version 3.0. The former is not widely available, and the functions are rich.
336The source code is widely distributed, and the function is removed from the previous version.
337For a discussion of ZxShell, see Cisco's Threat Spotlight: Group 72, Opening the ZxShell Report 8.
338 Internal public version Open source version Secondary development version
339CleanEvent √ √ √
340End √ √ √
341Execute √ √ √
342Help / ? √ √ √
343LoadDll √ √ √
344Ps √ √ √
345SC √ √ √
346
3478 Threat Spotlight: Group 72, Opening the ZxShell, http://blogs.cisco.com/security/talos/opening-zxshell
34830 / 78
349ShareShell √ √ √
350SysInfo √ √ √
351TermSvc √ √ √
352TransFile √ √ √
353ZXNC √ √ √
354Zxplug √ √ √
355CA √ √ ×
356CloseFW √ √ ×
357FileTime √ √ ×
358PortScan √ √ ×
359RunAs √ √ ×
360Shutdown √ √ ×
361Uninstall √ √ ×
362User √ √ ×
363ZXHttpProxy √ √ ×
364ZXHttpServer √ √ ×
365ZXSockProxy √ √ ×
366Capsrv √ × ×
367Exit / Quit √ × ×
368FileMG √ × ×
369FindDialPass √ × ×
370FindPass √ × ×
371GetCMD √ × ×
372KeyLog √ × ×
373rPortMap √ × ×
374SYNFlood √ × ×
375Winvnc √ × ×
376ZXARPS √ × ×
377Total instructions 35 24 13
378It can be seen from the above table that the number of instructions corresponding to the version is decreasing, that is, the poisonous vine
379The organization eliminated more existing functions, and only retained 13 instructions in the secondary development version, further incrementing other instructions.
380and function. The related new features in the secondary development version are shown in the following table:
381The second development version is compared with the open source version.
382Culling function retention function new
383Clone system account
384Temporarily closed windows comes with fire protection
385wall
386Time information for cloning a file
387Port scan
388Transported as another process or user
389Clear system diary
390End the program
391Run a program
392Display this information
393Load a DLL or insert into the specification
394Process
395IEPass gets the IE password
396Search for sensitive information encrypted to write to a file:
397Within the specified time range; specify file expansion
398Exhibition name; within the specified keyword range
399Collect information back to the server
400Related version changes during the period: modify monitoring
40131 / 78
402Line program
403Logout || Restart || Shut down the system
404Unloading
405System account management
406Proxy server
407HTTP server
408Socks 4 & 5 Agent
409Process management
410Service management
411Share a shell for others.
412View system details
413Configuring Terminal Services
414Download files or upload from the specified URL
415File to the specified FTP server
416NC
417Plugin function, you can add custom life
418make
419Log file encryption is written to the log
420Adovbs.mof; add configuration characters
421Monitoring; added Profiles.log
422Record system information and file information
423The samples we captured are based on ZxShell source code modifications, retaining the original structure, and ZxShell itself has more instructions.
424There are more than twenty kinds. In addition to retaining some instructions, the samples we capture exclude a large number of instructions, such as: installation start, clone
425System account, turn off firewall, port scan, proxy server and other functions. Also add the "IEPass" command.
426Figure 32 contains a screenshot of the IEPass directive related code
427Related subversion iteration update (secondary development version)
4281. Compared with the previous version, the change is mainly the part of collecting information. The creation time of collecting documents has changed from half a year ago to 4
429Years ago, the file collection of the ".wps" extension was added, and the original ".doc" was changed to ".doc*";
4302. The creation time of the stolen document is changed to half a year, and the file packaging part is modified to remove the file version information;
4313, relatively large changes, modify the monitoring log file encryption to write to the log adovbs.mof, add configuration characters to monitor, increase
432Plus, added Profiles.log to record system information and file information;
4334, the code function is less updated than the previous version, the position of the relevant function has changed, it is related to the anti-virus software.
434Adjustment.
43532 / 78
436Figure 33 contains a screenshot of the relevant keyword code
437ZxShell related configuration list
438Online password tag keyword
439Admin fish1111 "201", "report", "item"
440Ps1357 ps1234 "Military", "on Taiwan", "work"
441Ftp533 ftp1234 "Army", "item"
4428613 spring "Army", "aviation", "report"
443661566 Large 661566 Large "Polar", "Army", "Snow"
444987 zxcvasdf "On the stage", "international", "military"
44595279527 asusgo "air", "no one", "military"
446Qwer1234 kano918 "Airline", "Army", "Department"
447C. Cool disk version
448Related sample camouflage folder icon, release the "svch0st.exe" Trojan file after execution and use as a confusing user
449Frequent folders and ".doc" document files.
450"svch0st.exe" is a Trojan that is transmitted using the ssl encryption protocol. It will be executed every hour.
451Go through all the Trojan processes, the Trojan process includes all the information on the computer (related information includes: file directory,
452System version, network card information, process list information, package specified files, network information, and disk information), and if
453The current file has related keywords (such as: "Taiwan", "Army", "War") files, packaged, uploaded to the ssl protocol
454The cool disk that the attacker registered in advance.
455The C&C address is the cool disk address 9, which is uploaded via the API provided by the cool disk.
456API upload interface:
457Https://api-upload.kanbox.com/0/upload/%s/%s?bearer_token=%s
458Https://auth.kanbox.com/0/token
459
4609https://kanbox.com/
46133 / 78
462Figure 34 Screenshot of the code containing the cool disk API address
463Figure 35 Cool disk official website home page screenshot
464Cool disk version A related function description
465(Do not release the Shellcode backdoor)
466Cool disk version B related function description
467(release the shellcode back door)
4681, release the secret Trojan horse
4692, get system information
4701, release the secret Trojan horse
4712, get system information
47234 / 78
4733, search for sensitive files
4744, package encryption upload sensitive files
4753, search for sensitive files
4764, package encryption upload sensitive files
4775, release the shellcode backdoor sub-body (increase)
4786, connect remote CC server (add)
4797, execute remote commands (add)
480Cool disk version related configuration information list
481Sample compilation timestamp monitor character signature string
4822/11/2015 20:48:26 "2014", "Army", "Bing" A-plus
4832/11/2015 20:48:26 "Taiwan", "Army", "Battle" Aboutdoublewu
4842/11/2015 20:48:26 "201", "报", "研研" book
4852/11/2015 20:48:26 "International", "cooperation", "military" wind
4862/11/2015 20:48:26 "Units", "Airports", "Units" rankco
4873/1/2015 22:08:18 "2014", "Army", "Bing" A-plus
4883/2/2015 8:21:01 "Army", "machine", "station" ineedyou
4893/2/2015 23:17:57 "Ten", "Country", "Medium" ineedyou
4903/2/2015 23:17:57 "Army", "machine", "station" ineedyou
4913/2/2015 23:17:57 "Thirteen", "transportation", "railway" AJ
4925/4/2015 16:48:12 "Unit", "Taiwan", "base" rancor
4935/4/2015 16:48:12 "Army", "Technology", "Country" furyman
4945/4/2015 16:48:12 "201", "tight", "internal" king
4955/4/2015 16:48:12 “2015”, “Work”, “Report” comein
4965/4/2015 16:48:12 "201", "报", "研研" book
497D. Unknown RAT
498The unknown RAT is divided into two versions from the outer dropper to the folder and bundle, where the RAT is divided into 4 versions, which
499The four RATs are all unknown remote controls.
500a) Folder version
501Figure 36 Related changes after the implementation of the unknown RAT file version
502b) Bundled version
50367d5f04fb0e00addc4085457f40900a2
504└─Atnewyrr.exe~tmp.zip
50535 / 78
506│ newyrr.exe
507│
508└─doll.exe
509 Aaa.vbs
510 B.bat
511 Server.exe
512Figure 37 Digital signature used in unknown RAT
513E. Other
514The backdoor program used by the poison cloud vine organization in related actions further includes gh0st, XRAT, and HttpBot.
515RAT.
51636 / 78
5173) Attack load analysis of script loading
518 At the beginning of 2018, the 360 ​​Threat Intelligence Center discovered a control virus distribution organization used to control and distribute attack payloads.
519Control the domain name http://updateinfo.servegame.org and disclose relevant attack techniques and correlation analysis (see
520Https://ti.360.net/blog/articles/analysis-of-apt-c-01/).
521 During the attack, the organization combined the CVE-2017-8759 vulnerability document to download a malicious HTA file and execute the phase.
522Close the script command to download and execute the subsequent attack payload module.
523A. Dropper analysis
524 The Dropper program triggers the download execution by the vulnerability document that comes with the Harpoon Mail.
52537 / 78
526 And further download the malicious HTA file, which executes the PowerShell command to download the Loader program and save it as
527Officeupdate.exe and execute.
528B. Loader analysis
529 According to the string information contained in the Loader program, the creator named it SCLoaderByWeb, version information.
530Version 1.0, literally means the Shellcode Loader program obtained from the Web. It is used to download and execute shellcode generation
531code.
532 The Loader program will first try to connect to a common URL to determine network connectivity. If there is no networking, it will be every 5
533Try to connect once in seconds until you can connect to the Internet.
534 Then download the payload from hxxp://updateinfo.servegame.org/tiny1detvghrt.tmp, as shown:
53538 / 78
536 Then judge whether the file is successfully downloaded. If there is no download, it will sleep for 1 second, then try to download again.
537Payload:
538 After the download is successful, the contents of the downloaded file are XORed with 0xac, 0x5c, 0xdd, respectively (in essence
539Is directly each byte XOR 0x2d), as shown:
54039 / 78
541 The decrypted shellcode is then executed in the newly created thread, as shown in the figure:
54240 / 78
543C. Shellcode analysis
544 The .tmp files hosted by the distribution domain name address are byte-by-byte XOR shellcodes, as shown in the following figure.
545The tinyq1detvghrt.tmp file, which is XORed with 0x2d encrypted data.
546 After decryption, it is found to be the shellcode generated by Poison Ivy. The flags are as follows:
547 Analyze the shellcode format generated by the Poison Ivy Trojan and the shellcode grid used in the attack payload
548Compare and get the location and meaning of each configuration field in the shellcode.
54941 / 78
550The format of its shellcode configuration field is as follows:
55142 / 78
552 When I analyzed the code logic of the kernel32 base address in Poison Ivy, I found that it is not compatible with the Windows 7 version.
553System, because the second module of InitializationOrderModule under Windows 7 is KernelBase.dll, so it gets
554The actual address is the base address of KernelBase.
555 Since Poison Ivy has stopped updating, the attack gang is in order to enable shellcode to be executed in subsequent versions.
556Windows system, which uses code patches to improve the code to get the kernel32 base address.
557 The improvement method is as follows:
5581. Add a jump instruction to the end of the shellcode before the original kernel32 base code is obtained. The patch code is increased.
559Add to the tail;
5602. The patch code first gets the base address of the second module of the InitializationOrderModule (under WinXP)
561Kernel32.dll, WIN7 is kernelbase.dll);
5623. Then get the address of LoadLibraryExA of the second module of InitializationOrderModule (under WinXP)
563Kernel32.dll and kernelbase.dll under WIN7 have this export function)
5644. Finally, get the base address of kernel32 by calling the LoadLibraryExA function.
56543 / 78
566 The attacker's patch for shellcode makes it available for different versions of Windows systems.
567 The function of the shellcode is mainly the remote control Trojan's control module, which communicates with C2 and implements remote control. Here we
568Simulate the on-line process of the Trojan under the Win7 system.
56944 / 78
570 The other shellcode files hosted on the control domain name are decrypted, and the online information of the obtained samples is as follows:
571Action ID On-line domain name Port On-line password Mutex
5722017 office.go.dyndns.org 5566 !@#3432!@#@! )!VoqA.I4
573Bing zxcv201789.dynssl.com 8088 zxc5566 )!VoqA.I4
574Ding1 microsoftword.serveuser.com 53 1wd3wa$RFGHY^%$ )!VoqA.I4
575Ding2 uswebmail163.sendsmtp.com 53 1wd3wa$RFGHY^%$ )!VoqA.I4
576Geiwoaaa geiwoaaa.qpoe.com 443 wyaaa8 )!VoqA.I4
577Jin_1 hy-zhqopin.mynumber.org 80 HK#mq6!Z+. )!VoqA.I4
578Jin_2 bearingonly.rebatesrule.net 53 ~@FA<9p2c* )!VoqA.I4
579Justdied www.service.justdied.com 80 ppt.168@ )!VoqA.I4
580Pouhui pouhui.diskstation.org 53 index#help )!VoqA.I4
581Tina_1 fevupdate.ocry.com 80 168168 )!VoqA.I4
582Tina_2 wmiaprp.ezua.com 53 116688 )!VoqA.I4
583Tony_1 winsysupdate.dynamic-dns.net 80 0A@2q60#21 )!VoqA.I4
584Tony_2 officepatch.dnset.com 53 aZ!@2q6U0# )!VoqA.I4
5854) Latest control Trojan analysis
586In May 2018, we discovered in the organization’s attack on relevant maritime agencies and units in the country.
587The new Trojan program used, which mainly uses the harpoon mail delivery RAR self-extracting program attachment, when the victim target double
588Execute after the hit.
589 At the entrance of the remote control module, malicious code is executed in the catch by triggering the exception code, as shown in the figure:
59045 / 78
591 Then use the same method to trigger the exception code and enter the second layer of code:
59246 / 78
593 Enter the location where the socket is initialized and connected to C2:
59447 / 78
595 Connect to port 8080 of zxcv201789.dynssl.com to create a C&C channel:
59648 / 78
597 The place where the online package is sent to the control server has an online password: asd88, as shown in the figure:
59849 / 78
599 Finally enter the functional loop part of the remote control:
60050 / 78
601The picture is as follows:
602Features include:
603Token function
6040x04 close the connection
6050x41 remote shell
6060x42 process enumeration
6070x43 End the specified process
6080x51 enumeration drive
6090x52 column specified directory
6100x53 Upload file to victim
61151 / 78
6120x54 Download victim's file
6130x55 delete file
6140x56 remote execution
615 The string in the Trojan uses inverted strings, which are reversed by the strrev of C language.
616This approach has also been used in the organization's 2015 Trojan. Figure:
6174. C&C analysis
6181) Dynamic domain name
619Figure 38 Dynamic Domain Name Service Provider (ChangeIP)
62052 / 78
621Figure 39 Dynamic domain name service provider related scale diagram
622Dynamic Domain Name Providers
623ChangeIP 30
624No-IP 9
625DynDNS 2
626Afraid (FreeDNS) 1
627dnsExit 1
628Non-dynamic domain name 6
6292) Domain name meaning
630The following is the research and analysis of the relevant mapping meanings by taking the dynamic domain name subdomain (the name of the attack organization registration).
631C&C Name Website Name Website Address
632Chinamil.lflink.com chinamil China Military Network www.chinamil.com.cn10
633Red Strategy Network www.chinamil.com
634China Defense Domain Name
635Registration network
636Www.chinamil.cn
637Soagov.sytes.net
638Soagov.zapto.org
639Soasoa.sytes.net
640Soagov, soasoa National Oceanic Administration www.soa.gov.cn
641Xinhua.redirectme.net xinhua Xinhuanet www.xinhuanet.com
642classification name
643Mailbox class 126mailserver, mail.sends, mail163, mailsends
644Kill soft class kav2011, safe360, cluster.safe360,rising
645Network class javainfo, webupdate, updates, netlink
646
64710 The website will now be redirected to www.81.cn China Military Network's new domain name.
64861% 19%
6494%
6502%2%
65112%
652ChangeIP No-IP
653DynDNS Afraid (FreeDNS)
654dnsExit non-dynamic domain name
65553 / 78
656Name class Sandy, jerry, jason
6573) Cloud disk
658Cool disk related samples currently have two Tokens:
659Client_id client_secret refresh_token
660Token1 3edfe684ded31a7cca637
6618c0226f5629
662Bfa89eebf29032076e9cffb
66375549fee5
66475cdc35b1cdaee24047f3af
665B23a5ccce
666Token2 7a5691b81bf4322fd88f5f
667A99407fbbc
668D44cfa7dd3c852b69c59efa
669Cf766cc23
67014b6685330bf32a2268891
6710e765b5dce
672Through the analysis of the cool disk API, we get the information of the cloud disk account used by the attacking organization, mainly including one.
673China Mobile's mobile number, which is used to register the cloud account.
674{"status":"ok","email":"","phone":"15811848796","spaceQuota":1700807049216,"spaceUsed":5
67508800279, "emailIsActive": 0, "phoneIsActive": 1}
676Here are some of the results of our association analysis with this mobile number:
677Figure 40 Google search related results
678Figure 41 Weifengtang Locomotive Network User Information 1
67954 / 78
680Figure 42 Weifengtang Locomotive Network User Information 2
681Figure 43 Mobile phone number related to Alipay and WeChat information
68255 / 78
6834) Third party blog
684Figure 44 Screenshot of a third-party blog section
685The picture above shows the poisonous cloud vine organization relying on a third-party blog for malicious code transmission. The domain name of the blog is usually in the firewall and each
686In the whitelist of security software, using this method to keep malicious code in the blog, you can avoid killing and intercepting.
68756 / 78
6885) C&C's IP (ASN)
689Figure 45 C&C IP Association Analysis
6906) Other
691In the non-dynamic domain name gaewaaa.upgrinfo.com This domain name has relevant whois information, as shown below.
69257 / 78
693Figure 46 Domain Name Registration Information
694Another non-dynamic domain name moneyaaa.beijingdasihei.com
6955. Association analysis
6961) Overall relevance
697From raw attack mail, vulnerability files, 3 different RATs (ZxShell, Poison Ivy and Cool Edition), and related
698The domain name, online password, file extension, compressed package password, and keyword are associated with different resources.
69958 / 78
700Figure 47 Overall correlation between different resources
7012) RAT iterative upgrade (against method)
702 A B C D E F G
703 Development environment encryption party
704law
705Custom stealing letter
706number
707Shellco
708De
709Free kill against static
710
711Free killing
712
713Camouflage document
714Wait 
71559 / 78
716Httpbot C++ × √ × √ √ √
717Kbox C++ √ √ √ √ √ √
718Poison Ivy C++ √ × √ √ √ ×
719Puppet Borland
720C++
721√ × × √ × √
722XRAT Delphi √ × √ √ √ ×
723Gh0st Borland
724C++
725√ × × √ × √
726FakeRising Borland
727C++
728× × × × × ×
729AresRemote C++ √ × × √ × √
730Shellcode C++ √ × √ √ √
731FakeWinupda
732Te
733C++ √ × × √ × ×
734SBolg2014 C++ √ √ √ √ × √
735SBolg2015 C++ √ × √ √ × ×
736Zxshell C++ √ √ √ √ √
737Typical methods of homologous samples:
738A. Development environment
739In addition to the XRAT backdoor, other versions have used the C++ development language from 2007 to 2015.
740B. Encryption method
7412011, memcache version, Voice64 version, HTTPBOTS version, kanbox version, PI, XRAT are all used continuously 2
742The second way to decrypt, and then execute the malicious code. In addition, the cloud disk version of the Trojan will also encrypt the file in the uploaded file.
743method.
744Figure 48 Unknown RAT2011 version (left), cool disk version (right)
74560 / 78
746C. stealing function
747The custom stealing function used by the ZXShell version of the backdoor is very similar to the stealing function used by the 2015 Netplate version of the child. with
748The samples are excluded from the search of the A disk (usually the floppy disk drive letter); the disk is also traversed in advance, and the drive letter list is saved.
749In memory, the list of drive letters in memory is read by adding 5 pointers.
750Figure 49 ZxShell (left), cool disk version (right)
751D. Shellcode back door
752Comparing the 2011 version (Poison Ivy) injected into the system's Shellcode and 2015 cloud disk version of the child, you can see the use
753A highly similar Shellcode backdoor, the tail of the online address is also padded with 0x30.
754Figure 50 Unknown RAT2011 version (left), cool disk version (right)
755Related shellcode Trojan file checkout results (0 checkout):
756Https://www.virustotal.com/en/file/8cee670d7419d1fd0f8f0ac6a2bd981593c2c96ca0f6b801931
7577cf556337cfa8/analysis/
75861 / 78
759E. Child file name (outer layer)
760By comparing the 2009 version code with the 2011 version of the code, it can be seen that the child file names released by the virus are ~work.tmp,
761The format string is "%s\%s.bak" and the code is very similar.
762Use ~tmp.tmp, ~tmp.zip, ~mstmp.cpt as the Trojan temporary file name (07~09).
763Figure 51 Unknown RAT2009 version (left), unknown RAT2011 version (right)
764F. Free kill confrontation – API string reverse order against static scan:
765HttpBot, cool disk, XRAT, unknown RAT (07~11 version) Trojan, the reverse order API word is used in the code writing process.
766String. When the Trojan executes, the reverse string is converted to a normal API string by the _strrev function, and finally the call is made.
767The GetProcAddress function dynamically gets the API address. Reverse order API strings increase the difficulty of string detection, making the API
768Strings are not easily detected; in addition, API addresses are obtained in Trojan dynamic execution, which is difficult in PE static information.
769It has been detected, increasing the difficulty of API detection.
770The poisonous vine tissue is known to have been used since 2009 and will continue to be used until 2018.
77162 / 78
772Figure 52 Unknown RAT2009 (on), cool disk (below)
773G. Free kill confrontation – pass error API parameters against dynamic scanning:
774Cool Disk, Poison Ivy, XRAT, ZxShell, Unknown RAT (07~11) Trojan, using GetClientRect
775A number of dynamic scanning technologies against anti-virus software.
776The prototype of GetClientRect is: BOOL GetClientRect(HWND hWnd, LPRECT lpRect);. Function is to obtain the window
777Port coordinate area. The first parameter is the target window handle and the second parameter is the returned coordinate structure. Trojan call
778GetClientRect, deliberately passing the argument to 0 in the first argument, thus making the GetClientRect function in normal Windows
779The execution in the operating system always fails, and the return value is 0;
780At present, many anti-virus software uses dynamic scanning technology (used for heuristic detection), and performs ExClientRect in simulation.
781The function does not take into account the case of the error parameter, so that the GetClientRect function is always executed successfully by the simulation, and the return value
782Not 0. In this way, the anti-virus software virtual environment and the user's real system can be distinguished by Trojans, thus avoiding anti-virus software.
783Detection. The measured Kaspersky Virtual Machine heuristic scanning environment can be detected by Trojans.
784The poisonous vine tissue is known to have been used since 2011 and will continue to be used until 2018.
78563 / 78
786Figure 53 Unknown RAT2011 (top left), zxshell (top right), cool disk (bottom)
787The GetClientRect function is called in the way that the cool disk uses the dynamic get API.
788H. Legal digital signature
789Earlier versions before 2011
79064 / 78
7912015BLOG version
792Signing in May 2015 (suspected of being stolen)
793Signature: We Build Toolbars LLC
79465 / 78
795Chapter 4 Behind the scenes
796Resource method
7971, the vulnerability document:
798(1) Mainly released normal DOC: Traditional, or related font characters in a specific area. DOC code page
799(2) Some paths, such as DANK for PPSX?
8002, PE: string traditional, or a specific area related font characters (BIG5, etc.) and so on. PE file version information. on
801String such as line ID\password\mutex
8023, CC:
803(1) Non-Dynamic Domain Name: Webster Pinyin, Registration Information
804(2) Dynamic domain name:
805(3) Cloud disk
8064, IP: or a specific region, the United States, mainly distinguish between CC and mail
8075, related schedules: PE timestamps, document time, etc., conclusions such as focusing on Monday morning attacks, etc.
8082. Related related information
8091) Domain name whois information
810The domain name is javainfo.upgrinfo.com, the address in the registration information is a specific area, and the relevant person name may be used.
811It is Wei's Pinyin and so on.
81266 / 78
8132) Keywords of interest
814Figure 54 contains a screenshot of the relevant keyword code
815Keywords:
816"Taiwan", "Taiwan", "Taiwan"
817Corruption file or Trojan horse original file name (bait file name) related list:
8182012 Taiwan-related law research project materials.doc
8192012 Annual Research Project on Taiwan's Peripheral Issues.doc
8202013 Annual Research Project on Taiwan's Peripheral Issues.doc
821Circular on the 2012 Annual Meeting of the Law Society of the Cross-Strait Relations and the General Assembly.doc
822Background material on the academic symposium on cross-strait relations research.doc
823Cross-Strait Relations Research Association 2013 Annual Research on Taiwan's Peripheral Issues. zip
824The Straits Forum promotes cross-strait relations in depth
825Invitation letter for the academic seminar on military mutual trust research between the two sides of the strait.doc
826Taiwan Alliance Central Political Participation Work Newsletter 2013 No. 2 .doc
8273) Traditional fonts in the PE sample, BIG5 character set
828The help information in the Zxshell version is garbled, and it is actually Traditional Chinese.
829Figure 55 ZxShell related code screenshot
83067 / 78
831Figure 56 Unknown RAT2009
8324) Traditional fonts in the vulnerability document
833Figure 57 Vulnerability Document (CVE-2014-4114) Property Details Screenshot
834Figure 58 Contents of the slide file in the vulnerability document (CVE-2014-4114)
83568 / 78
8365) Released confused document
837Default font for a specific region: fine body
838Figure 59 The confused document released by the back door
839Figure 60 Xinhuanet related news screenshots
840Http://news.xinhuanet.com/world/2014-05/18/c_1110741502.htm
84169 / 78
842Chapter 5 Analysis of organizational capabilities or characteristics
843Main item child poison cloud vine sea lotus
844Targets, government personnel, industry experts, government personnel, industry experts
845Industry, field Chinese government, research institutes, maritime institutions
846Military, cross-strait relations
847Chinese government, research institutes, maritime agencies, etc.
848Country China China, other
849Geographical focus: Beijing, Fujian, Guangdong, Zhejiang,
850Shanghai
851Focus: Beijing, Tianjin
852Profile Attacker Personal Information
853scale
854Native language Simplified Chinese, Traditional Chinese Simplified Chinese, Vietnamese
855Threat level high (5) high (4)
856Comprehensive strength High (5) High (3)
857Involved action
858(unique to the organization)
859Involved organization
860(action specific)
861Attack method Common language or language Simplified Chinese Simplified Chinese
862Attack lead mail +PE
863Mail + vulnerability document
864Mail + PE
865Website +PE(MAC)
866Send mail habits with WEB mailbox
867Phpmail tool
8680day use case 1 none
869Type of exploit CVE-2014-4114, CVE-2012-0158 None
870Attack platform windows Windows\Mac
871Lateral movement
872Commonly used RAT type PI\ZXSHELL, etc. Unknown
873Family type 6 or more 4
874......
875Purpose of the attack, destruction, no
876Stealing CC instructions and traversing specified files CC instructions
877Action duration
878between
879First attack time 2007 2012
880Recent attack time 2018 2018
881Active, very active, very active
882Other C&C domain name attributes A large number of dynamic domain names, based on NO-IP
883Wait
884Dynamic domain name is not used, but domain name information is guaranteed
885Protection
886IP attribute ADSL, most of which belong to a specific place
887District, there are also the United States, Hong Kong, China
88870 / 78
889Appendix 1: File MD5 List
890 
89103d762794a6fe96458d8228bb7561629
8920595f5005f237967dcfda517b26497d6
89307561810d818905851ce6ab2c1152871
8940e80fca91103fe46766dcb0763c6f6af
8951374e999e1cda9e406c19dfe99830ffc
8961396cafb08ca09fac5d4bd2f12c65059
8971ab54f5f0b847a1aaaf00237d3a9f0ba
8981aca8cd40d9b84cab225d333b09f9ba5
8991dc61f30feeb60995174692e8d864312
900250c9ec3e77d1c6d999ce782c69fc21b
9012579b715ea1b76a1979c415b139fdee7
90226d7f7aa3135e99581119f40986a8ac3
90327f683baed7b02927a591cdc0c850743
90428e4545e9944eb53897ee9acf67b1969
9052a96042e605146ead06b2ee4835baec3
9062c405d608b600655196a4aa13bdb3790
90730866adc2976704bca0f051b5474a1ee
90831c81459c10d3f001d2ccef830239c16
9093484302809ac3df6ceec857cb4f75fb1
91036c23c569205d6586984a2f6f8c3a39e
911382132e601d7a4ae39a4e7d89457597f
9123e12538b6eaf19ca163a47ea599cfa9b
91341c7e09170037fafe95bb691df021a20
91445e983ae2fca8dacfdebe1b1277102c9
9154e57987d0897878eb2241f9d52303713
9165696bbee662d75f9be0e8a9ed8672755
9175e4c2fbcd0308a0b9af92bf87383604f
9185ee2958b130f9cda8f5f3fc1dc5249cf
9195f1a1ff9f272539904e25d300f2bfbcc
920611cefaee48c5f096fb644073247621c
92167d5f04fb0e00addc4085457f40900a2
9226a37ce66d3003ebf04d249ab049acb22
9236ca3a598492152eb08e36819ee56ab83
9247639ed0f0c0f5ac48ec9a548a82e2f50
92576782ecf9684595dbf86e5e37ba95cc8
926785b24a55dd41c94060efe8b39dc6d4c
9277c498b7ad4c12c38b1f4eb12044a9def
92881232f4c5c7810939b3486fa78d666c2
92981e1332d15b29e8a19d0e97459d0a1de
9308abb22771fd3ca34d6def30ba5c5081c
93195f0b0e942081b4952e6daef2e373967
93271 / 78
9339b925250786571058dae5a7cbea71d28
9349bcb41da619c289fcfdf3131bbf2be21
9359f9a24b063018613f7f290cc057b8c40
936a73d3f749e42e2b614f89c4b3ce97fe1
937a807486cfe05b30a43c109fdb6a95993
938a8417d19c5e5183d45a38a2abf48e43e
939acc598bf20fada204b5cfd4c3344f98a
940accb53eb0faebfca9f190815d143e04b
941adc3a4dfbdfe7640153ed0ea1c3cf125
942ae004a5d4f1829594d830956c55d6ae4
943b0be3c5fe298fb2b894394e808d5ffaf
944b244cced7c7f728bcc4d363f8260090d
945b301cd0e42803b0373438e9d4ca01421
946bd2272535c655aff1f1566b24a70ee97
947bd4b579f889bbe681b9d3ab11768ca07
948bfb9d13daf5a4232e5e45875e7e905d7
949c31549489bf0478ab4c367c563916ada
950c8755d732be4dc13eecd8e4c49cfab94
951c8fd2748a82e336f934963a79313aaa1
952ca663597299b1cecaf57c14c6579b23b
953d12099237026ae7475c24b3dfb5d18bc
954d61c583eba31f2670ae688af070c87fc
955dde2c03d6168089affdca3b5ec41f661
956e2e2cd911e099b005e0b2a80a34cfaac
957e9a9c0485ee3e32e7db79247fee8bba6
958ec7e11cfca01af40f4d96cbbacb41fed
959eff88ecf0c3e719f584371e9150061d2
960f0c29f89ffdb0f3f03e663ef415b9e4e
961f1b6ed2624583c913392dcd7e3ea6ae1
962f27a9cd7df897cf8d2e540b6530dceb3
963f29abd84d6cdec8bb5ce8d51e85ddafc
964f3ed0632cadd2d6beffb9d33db4188ed
965fbd0f2c62b14b576f087e92f60e7d132
966fccb13c00df25d074a78f1eeeb04a0e7
9670fb92524625fffda3425d08c94c014a1
968168365197031ffcdbe65ab13d71b64ec
9692b5ddabf1c6fd8670137cade8b60a034
970517c81b6d05bf285d095e0fd91cb6f03
9717deeb1b3cce6528add4f9489ce1ec5d6
972aa57085e5544d923f576e9f86adf9dc0
973cda1961d63aaee991ff97845705e08b8
974e07ca9f773bd772a41a6698c6fd6e551
975fb427874a13f6ea5e0fd1a0aec6a095c
97672 / 78
977附录 2：C&C 列表
978126mailserver.serveftp.com
979access.webplurk.com
980aliago.dyndns.dk
981as1688.webhop.org
982babana.wikaba.com
983backaaa.beijingdasihei.com
984bt0116.servebbs.net
985ceepitbj.servepics.com
986check.blogdns.com
987china.serveblog.net
988chinamil.lflink.com
989cluster.safe360.dns05.com
990cnwww.m-music.net
991fff.dynamic-dns.net
992gaewaa.upgrinfo.com
993givemea.ygto.com
994givemeaaa.upgrinfo.com
995goldlion.mefound.com
996gugupd.008.net
997guliu2008.9966.org
998hyssjc.securitytactics.com
999jason.zyns.com
1000javainfo.upgrinfo.com
1001jerry.jkub.com
1002kav2011.mooo.com
1003kouwel.zapto.org
1004laizaow.mefound.com
1005localhosts.ddns.us
1006mail.sends.sendsmtp.com
1007mail163.mypop3.net
1008mailsends.sendsmtp.com
1009mediatvset.no-ip.org
1010moneyaaa.beijingdasihei.com
1011motices.ourhobby.com
1012mp3.dnset.com
1013netlink.vizvaz.com
1014operater.solaris.nu
1015pps.longmusic.com
1016ps1688.webhop.org
1017rising.linkpc.net
1018safe360.dns05.com
101973 / 78
1020sandy.ourhobby.com
1021soagov.sytes.net
1022soagov.zapto.org
1023soasoa.sytes.net
1024ssy.ikwb.com
1025ssy.mynumber.org
1026svcsrset.ezua.com
1027teacat.https443.org
1028tong.wikaba.com
1029updates.lflink.com
1030usa08.serveftp.net
1031waterfall.mynumber.org
1032webupdate.dnsrd.com
1033www.safe360.dns05.com
1034www.ssy.ikwb.com
1035www.tong.wikaba.com
1036wwwdo.tyur.acmetoy.com
1037xinhua.redirectme.net
1038131.213.66.10
1039146.0.32.168
1040165.227.220.223
1041188.166.67.36
1042199.101.133.169
104345.32.8.137
104445.76.125.176
104545.76.228.61
104645.76.9.206
104745.77.171.209
1048bearingonly.rebatesrule.net
1049canberk.gecekodu.com
1050emailser163.serveusers.com
1051fevupdate.ocry.com
1052geiwoaaa.qpoe.com
1053hy-zhqopin.mynumber.org
1054l63service.serveuser.com
1055microsoftword.serveuser.com
1056office.go.dyndns.org
1057updateinfo.servegame.org
1058uswebmail163.sendsmtp.com
1059winsysupdate.dynamic-dns.net
1060wmiaprp.ezua.com
1061www.service.justdied.com
1062zxcv201789.dynssl.com
1063officepatch.dnset.com
106474 / 78
1065pouhui.diskstation.org
1066comehigh.mefound.com
1067annie165.zyns.com
1068http://annie165.zyns.com/zxcvb.hta