#!/usr/bin/python

# -*- coding: utf-8 -*-

# -*- coding: euc-kr -*- //우분투에서 필수 영문ver

print u'\uc548\ub155\ud558\uc138\uc694gkgksd'

#print unicode('한글asdfasdfasdfasdf','EUC-KR') //우분투 

#print unicode('한글asdfasdfasdfasdf','MBCS')

#print unicode('한글asdfasdfasdfasdf','EUC-KR').ENCODE('UTF-8')

print unicode('한글asdfasdfasdfasdf')

print unicode('윈도우즈 파이썬은 기본적으로 EUC-KR 인코딩')

print unicode('우분투 파이썬은 EUC-KR 인코딩해야함') //영문ver

오픈소스로 된 고스트 원격제어툴, 현재까지도 중국에서 엄청나게 악성코드로 뿌려지고 있다.
Darkshell, Redosdru 등 탐지 이름도 많다.

http://blogs.norman.com/2012/security-research/the-many-faces-of-gh0st-rat

------------------------

The many faces of Gh0st Rat

Gh0st Rat is an open source backdoor trojan (or “Remote Administration Tool” ) that has been used in a large number of incidents, of which many have been targeted attacks. It is famed for being used in the espionage operation called “GhostNet”.

It is originally Chinese which naturally means that it is popular to use by Chinese hackers.

In a study conducted here at Norman, we have attempted to unmask the links that exist between different known Gh0st Rat attack campaigns. We primarily used the network communication as recognizable characteristic, since Gh0st communication is quite distinctive – it uses a “magic tag” (usually 5 alphanumeric letters) to identify itself to the command & control server.

We clustered samples that used the same tags together, to make plots like this:

brown nodes = samples, purple nodes = IP addresses, yellow nodes = domains, blue nodes = identifier tag

Fig1 : Same Gh0st variant (called “cb1st” because of its communication tag) is seen using two main C&C hubs and many smaller. The hub www.wk1888.com is also used by a large cluster of trojans using the default “Gh0st” tag, branching out at the right.

In the above plot we see that samples of one type (“cb1st”) connect to the same Command&Control server as samples of another type – “Gh0st”, thus these samples can be said to be logically linked.

Other connections were discovered, surprisingly, by miscommunication between the malware and its C&C server. In quite a large number of cases, the server responded to the initial connection by using a different magic tag. In a way, the malware said “Are you there”, and the server said “Que?”.

Fig2 Gh0st Rat of the KOBBX variant attempts to talk to the server, but receives LUCKK back.

Obviously the KOBBX and LUCKK campaigns are connected.

Not only Gh0st Rats exhibited this odd behavior. We also saw other malware miscommunicating in this way, for example DarkShell DDOS bots.

Fig3 DarkShell initial connection receiving “whmhl”, a tag belonging to a particular Gh0st variation.

In our paper, we have examined and clustered 49 variations of Gh0st, divided over some 1200 samples from 2011-2012. We found that a great many Gh0st Rat clusters likely are produced and operated by the same persons or groups.

Fig4 Eight different Gh0st variations that are linked in a “supercluster”.

We have attempted to trace some of the attacks back to apparent perpetrators.

The full paper is 70 pages long, and is available by filling out a request here:
The many faces of Gh0st Rat
It’s free. We won’t try to sell you anything.

http://www.securelist.com/en/blog/208214062/Kimsuky_APT_Operations_possible_North_Korean_links_uncovered

북한에서 제작한 걸로 추정하는 분석내용이네요.

카스퍼스키는 예전에도 이슈가 될 만한 악성코드를 참 잘 찾아내더 군요.

• The public e-mail server in question was Bulgarian - mail.bg.
• The compilation path string contained Korean hieroglyphs. 

이런 내용을 보면 자동화된 분석으로 찾아낸 거 같기도하고.. 어쨌건 부럽네요.

그리고 요즘은 외국 블로그 같은 곳에서 한국에서 일어나는 사이버 보안관련 이슈를

상당히 관심있게 보고 있다는 느낌이 듭니다. 그간의 일들(?)이 그 이유겠지요. ㅎ

좋은 감시 프로그램 잘 만들어야겠다는 생각이 들어서... 주저리주저리 ㅋ

MFC 리버싱하기

http://quequero.org/2008/08/guidelines-to-mfc-reversing/

Guidelines to MFC Reversing

• Debuggers:
  • OllyDbg, free, a fine debugger, for which you can find numerous user-made plugins and scripts to make it all the more useful.
  • WinDbg, free, a quite capable debugger by Microsoft. WinDbg is especially useful for looking at the Windows internals, since it knows more about the data structures than other debuggers.
  • SoftICE, SICE to friends. Commercial and development stopped in 2006. SoftICE is kind of a hardcore tool that runs beneath the operating system (and halts the whole system when invoked). SoftICE is still used by many professionals, although might be hard to obtain and might not work on some hardware (or software - namely, it will not work on Vista or NVIDIA gfx cards).
• Disassemblers:
  • IDA Pro, commercial, top of the line disassembler/debugger. Used by most professionals, like malware analysts etc. Costs quite a few bucks though.
  • W32Dasm, free, a bit dated but gets the job done. I believe W32Dasm is abandonware these days, and there are numerous user-created hacks to add some very useful functionality. You'll have to look around to find the best version.
• Decompilers:
  • Visual Basic: VB Decompiler, commercial, produces somewhat identifiable bytecode.
  • Delphi: DeDe, free, produces good quality source code.
  • C: HexRays, commercial, a plugin for IDA Pro by the same company. Produces great results but costs a big buck, and won't be sold to just anyone (or so I hear).
  • .NET(C#): dotPeek, free, decompiles .NET 1.0-4.5 assemblies to C#. Support for .dll, .exe, .zip, .vsix, .nupkg, and .winmd files.

Some related tools that might come handy in whatever it is you're doing are resource editors such asResourceHacker (free) and a good hex editor such as Hex Workshop (commercial).

최근 악성코드가 사용한 캡쳐 코드

{

  i = 0;

  do

  {

    v5 = 1;

    v6 = 0;

    v7 = 0;

    v8 = 0;

    GdiplusStartup(&v4, &v5, &v13);

    v1 = CreateDCA("DISPLAY", 0, 0, 0);

    H_value = GetDeviceCaps(v1, 8);             // H(가로)

    V_value = GetDeviceCaps(v1, 10);            // V(세로)

    v10 = 0;

    v9 = 0;

    Sleep(0xBB8u);

    GetTempPathW(0xC8u, &Buffer);

    wsprintfW(&Buffer, L"%s%d.jpg", &Buffer, i);

    v2 = CREATE_BITMAP(&v9);

    Save_img(v2, &Buffer);

    DeleteDC(v1);

    GdiplusShutdown(v4);

    ++i;

  }

  while ( i < 5 );

  Sleep(0x2710u);

  return sub_10001C90(&unk_10004140);

}

CREATE_BITMAP(&v9){

  v1 = a1;

  if ( IsRectEmpty(a1) )

  {

    result = 0;

  }

  else

  {

    v8 = CreateDCA("DISPLAY", 0, 0, 0);

    hDCA = v8;

    v9 = CreateCompatibleDC(v8);

    v10 = v1->top;

    v5 = v1->right;

    v6 = v9;

    v11 = v1->left;

    v4 = v1->bottom;

    v19 = v11;

    v18 = v10;

    H_value = GetDeviceCaps(hDCA, 8);

    V_value = GetDeviceCaps(hDCA, 10);

    if ( v19 < 0 )

      v19 = 0;

    if ( v18 < 0 )

      v18 = 0;

    if ( v5 > H_value )

      v5 = H_value;

    if ( v4 > V_value )

      v4 = V_value;

    v12 = v4 - v18;

    v13 = v5 - v19;

    v14 = CreateCompatibleBitmap(hDCA, v13, v12);

    v15 = SelectObject(v6, v14);

    BitBlt(v6, 0, 0, v13, v12, hDCA, v19, v18, 0xCC0020u);

    v16 = SelectObject(v6, v15);

    (DeleteDC)(v17, hDCA);

    DeleteDC(v6);

    result = v16;

  }

  return result;

}

Save_img(v2, &Buffer){

  v4 = 0;

  GdipCreateBitmapFromHBITMAP(this, 0, &v4);

  v3 = v4;

  jpeg_encode(&v6);

  v8 = dword_1000317C;

  v9 = dword_10003180;

  v7 = 1;

  v10 = dword_10003184;

  v12 = 1;

  v11 = dword_10003188;

  v14 = &v5;

  v13 = 4;

  v5 = 30;

  GdipSaveImageToFile(v3, a2, &v6, &v7);

  return GdipDisposeImage(v3);

}

http://c-nergy.be/blog/?p=2965

이게 딱 잘 나와있음..

Ubuntu 12.04 – How to Install KVM Virtualization solution on Ubuntu 12.04

http://precisionsec.com/virtualbox-host-only-network-cuckoo-sandbox-0-4-2/

virtualbox 설치 후 (cuckoo)agent.py와 xmlrpc로 연결되려면 host-only interface를 연결해야함

host-only 연결이지만 방화벽 설정 해주면 nat같이 사용가능. 아래 참조.

The purpose of this post is to guide you through setting up host-only networking using VirtualBox for Cuckoo Sandbox. Using this method you can have multiple analysis machines running on the same server concurrently while giving all of them access to the Internet. This method is preferred over bridged networking because you only need one external IP. This post assumes that you have Virtualbox and your guest VMs installed and Cuckoo extracted somewhere.

First create a host-only interface on host:

vboxmanage hostonlyif create
vboxmanage hostonlyif ipconfig vboxnet0 --ip 192.168.56.1

Now you should see vboxnet0 configured with that IP when running ifconfig:

vboxnet0  Link encap:Ethernet  HWaddr 0A:00:27:00:00:00  
          inet addr:192.168.56.1  Bcast:192.168.56.255  Mask:255.255.255.0
          inet6 addr: fe80::800:27ff:fe00:0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:273 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 b)  TX bytes:31818 (31.0 KiB)

Next you need to set the NIC on the guest Virtual Machine as a host only interface. This can be done with the following commands:

vboxmanage modifyvm CuckooBox --hostonlyadapter1 vboxnet0
vboxmanage modifyvm CuckooBox --nic1 hostonly

Now you will have to set up networking on the guest to use the host as a gateway. I use the following settings:

Static IP - 192.168.56.101
DNS - any DNS server (8.8.8.8)
Default Gateway - 192.168.56.1

In order to have your Virtual Machines be able to access the internet you will have to add the followingiptables rules. This will forward packets through the host and on to the Internet:

iptables -A FORWARD -o eth0 -i vboxnet0 -s 192.168.56.0/24 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

You will also need to enable IP forwarding on the host by issuing the following command (as root):

echo 1 > /proc/sys/net/ipv4/ip_forward

If everything worked properly you should now have Internet connectivity from the guest to the Internet and you should be able to ping back and forth between the guest and the host.

Now you need to install the agent on the guest and edit the conf/virtualbox.conf file with the correct parameters as outlined in the Cuckoo documentation, set up your snapshot and you are in business.

ubuntu 10.04

python version 2.6.5 -> 2.7.2

(python 2.7.2는 설치하지 않은 상태)

http://gauryan.blogspot.kr/2011/07/ubuntu-1004-lts-nginx-django-13-fastcgi.html

# aptitude install zlibc zlib1g-dev

# echo 'export PYTHONBREW_ROOT=/opt/pythonbrew' >> /etc/profile; source /etc/profile

# curl -kLO http://xrl.us/pythonbrewinstall; chmod +x pythonbrewinstall; ./pythonbrewinstall

# echo 'source /opt/pythonbrew/etc/bashrc' >> /etc/profile; source /etc/profile

# pythonbrew install --force 2.7.2 (원본으로 안되서 이렇게 하니 되네요.)

# pythonbrew switch 2.7.2

그외 삽질하게 했던 자료들 링크

http://stackoverflow.com/questions/5233536/python-2-7-on-ubuntu

https://github.com/utahta/pythonbrew

--------------------------------///

그외 방법들로 2.7.2로 바꾸는 방법(2.7.2로 설치 후 defult version을 교체)

우분투 파이썬 defult version 바꾸기

http://intellectseed.wordpress.com/2012/10/26/how-to-change-default-python-version-in-ubuntu/

yara python 설치

http://santi-bassett.blogspot.kr/2013/01/installing-cuckoo-sandbox-on-virtualbox.html

!!!yara python 설치하려면 개발 모듈이 설치 되야함 

apt-get install python2.7-dev

python2.7 설치(아래링크는 2.6으로 낮추는 방법)

http://intellectseed.wordpress.com/2012/10/26/how-to-change-default-python-version-in-ubuntu/

2.7 설치 후 링크만 설정해주면 됨

2.7은 소스 받아서 설치함

★625악성코드의 특징

# DNS 증폭 DDOS(DNS Amplification DDoS, aka SMURF attack)

- 이거 다시 확인

mbr악성코드 특징(0708a979a5c7c3a0450b7ddc37faead7)

네트워크 관련

VICTIM 정보를 XOR 해서 유출(상태 파악)

프로세스 관련

User 계정에 따라 파라미터 -n -b -r -i -p -m -z -d -f -w -t -a 등을 붙혀 실행

defualt

Wow64DisableWow64FsRedirection - 64bit 확인(wow64 리다이렉션 기능을 멈추지만 그 용도로 쓰지는 않는 듯)

WTSEnumerateSessionsW - 계정 정보 검색, 아래 API로 토큰 정보를 수정하여 실행

WTSQueryUserToken

DuplicateTokenEx

SetTokenInformation

-b 옵션

mbr 변조

서비스 관련

Sens, Alerter - 중지

계정 관련

net user [계정] "highanon2013"

del "[계정]\Temp\3F03.tmp.bat"

파일 시스템 관련(PE 파일, 영상 파일, 이미지 파일, 웹 파일, 기타를 확장자로 구분하여 삭제)

GetDriveTypeW

_wmakepath "\\?\E:\*.*"

PathMatchSpecW 확장자 비교 함수 사용

[_remove:00401d40]영상, 이미지 확장자 확인 후 파일 변조, 그 후 다음 루틴

*.nms 파일외 *.exe, *.dll, *.sys, *.ocx은 삭제 또는 SetFileAttributesW 보안 해제 후 삭제

그외 확장자는 처음과 끝을 "20"으로 바꾼뒤 MoveFileW로 랜덤한 파일명으로 변환 & 삭제

# 320때 mbr삭제 악성코드와 연관성은 잘 모르겠다. mbr 악성코드만 보면 비슷하진 않음.

완전히 새로 코드를 짠 느낌.

# 윈도우7 관리자 권한으로 실행시 mbr 변조, 일반권한이면 유저권한의 파일만 삭제

- 윈도우7 기준으로 권한이 있어야 하는데, 그 역할은 아마도 웹하드 업데이터가 해줄 듯