Genel Bakis

Bu ornek, 无常订制QQ语音神器.exe ("Wu Chang Ozel QQ Ses Araci") adini tasiyan 1.2MB'lik AutoIt derlenmiş trojan. Tencent QQ kullanicilarina yonelik bu sosyal muhendislik kurgusunun arkasindan process injection, HTTP indirme ve FTP yukleme kapasitesi barindiran ciddi bir yuk gizlenmektedir.

Teknik Analiz

AutoIt Tespiti

  • AutoIt hata mesajlari: CONTINUELOOP, CONTINUECASE, Unable to load the internet libraries
  • DllStruct, While/Do/For donguleri — AutoIt script kaliplaradan derlenmis
  • FPU anti-disassembly: evet

Process Injection

  • VirtualAllocEx — uzak islemde bellek tahsisi
  • WriteProcessMemory — uzak isleme yazi

Ag Yetenekleri

  • InternetOpenW, HttpOpenRequestW, HttpSendRequestW, InternetConnectW — HTTP indirme
  • InternetOpenUrlW — URL agma
  • FtpOpenFileW, FtpGetFileSize — FTP erisim (veri sizintisi?)

Ayricalik Yukseltme

  • AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken
  • DuplicateTokenEx, CheckTokenMembership, GetTokenInformation

Teknik Ozellikler

OzellikDeger
Dosya Adi无常订制QQ语音神器.exe (QQ Ses Araci)
FormatPE32 GUI Intel 80386
Boyut1.244.160 bayt
Entropi7.10 (muhtemelen paketlenmis)
DerlemeAutoIt compiled
Anti-DebugFPU anti-disassembly
InjectionVirtualAllocEx + WriteProcessMemory
AgHTTP + FTP

IOC Ozeti

  • Dosya: 无常订制QQ语音神器.exe
  • SHA256: 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b

IOC Listesi (1 gösterge)

IOC — AutoIt Trojan
# SHA256 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b
TürDeğerNot
sha256 22c5a786602a46b23ff82c4165daf2eb777357c49434f9997c74eae4bed52c5b
Etiketler
autoittrojanchineseqqsocial-engineeringinjectionhttpftpexfilfpu-anti-disassemblyprivilege-escalationvirtualalloc