Genel Bakis

Bu ornek, 无常订制QQ语音神器.exe ("Wu Chang Ozel QQ Ses Araci") adini tasiyan 1.2MB'lik AutoIt derlenmiş trojan. Tencent QQ kullanicilarina yonelik bu sosyal muhendislik kurgusunun arkasindan process injection, HTTP indirme ve FTP yukleme kapasitesi barindiran ciddi bir yuk gizlenmektedir.

Teknik Analiz

AutoIt Tespiti

  • AutoIt hata mesajlari: CONTINUELOOP, CONTINUECASE, Unable to load the internet libraries
  • DllStruct, While/Do/For donguleri — AutoIt script kaliplaradan derlenmis
  • FPU anti-disassembly: evet

Process Injection

  • VirtualAllocEx — uzak islemde bellek tahsisi
  • WriteProcessMemory — uzak isleme yazi

Ag Yetenekleri

  • InternetOpenW, HttpOpenRequestW, HttpSendRequestW, InternetConnectW — HTTP indirme
  • InternetOpenUrlW — URL agma
  • FtpOpenFileW, FtpGetFileSize — FTP erisim (veri sizintisi?)

Ayricalik Yukseltme

  • AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken
  • DuplicateTokenEx, CheckTokenMembership, GetTokenInformation

Teknik Ozellikler

Ozellik値
ファイル Adi无常订制QQ语音神器.exe (QQ Ses Araci)
FormatPE32 GUI Intel 80386
サイズ1.244.160 bayt
Entropi7.10 (muhtemelen paketlenmis)
DerlemeAutoIt compiled
Anti-DebugFPU anti-disassembly
InjectionVirtualAllocEx + WriteProcessMemory
AgHTTP + FTP

IOC Ozeti

  • ファイル: 无常订制QQ语音神器.exe
  • SHA256: 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b

IOCリスト (1 件の指標)

IOC — AutoIt Trojan
# SHA256 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b
タイプ値メモ
sha256 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b
タグ
autoittrojanchineseqqsocial-engineeringinjectionhttpftpexfilfpu-anti-disassemblyprivilege-escalationvirtualalloc