分析平台再次升级

2017-3-31 Nie.Meining Life

其实中途已经更新过好几个版本了,只是人老了比较懒,一直没更新日志,猛然一看上一篇日志居然是两年前写的……

这期间其实发生了不少事,比如N个项目开发,比如发表论文和撰写专利,以及历尽千辛万苦累感不爱终于毕业了……

废话不多说,新版分析系统更新内容包括检测项目增加、检测能力加强、匹配规则优化等多个方面。

访问地址依旧http://tcasoft.com/,欢迎大家测试并提出宝贵意见!

--------------------------------------------------------------------------------------------------

另外分享一些比较有意思的恶意代码分析报告,有新有旧:

[java样本] 最近捕获到的java样本越来越多,这是一种新的趋势吗?

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=d97eded86dcd31b357e511b3df61029e

比较有意思的是,自己本来就是个java,还要再释放一个vbs,虽然vbs查询WMI的确挺方便:

1111.png


[js样本] 当然更大的趋势是各种脚本Downloader,也就是勒索软件……

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=6a71148619077ce9416659ee42b4db15

不过这类样本的存活周期往往比较短暂,为了触发js可能的后续行为我们实现了网络模拟:

2222.png

有兴趣的伙伴也可以下载pcap包进一步分析。


[BSOD样本] 对于某些加钩子的分析引擎可能会被一起弄崩溃吧。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=39a76b8b933a0c0a87430625b08c0d1a

不过我们的分析方法在硬件层实现,对我们来讲蓝屏也是GuestOS的一种正常状态。

5555.png


[DLL样本] 这类样本比较少见,主要是因为不太容易触发行为。好在我们开发了专门的加载器。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=576f6fb5d8ac9c44ac3abe6f8d696036

4444.png


[文档类样本] 这些东西是APT攻击的最爱。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=1a007aa5721ab1743e266a503434bbb3

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=e74596cb5ba2b33a9d8193b9cc0d7354

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=0bbe58ed30fcd35be418739b1eca995f

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=9c5b73c10138f6967b5e6c608b9a8c4b
http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=a728cf4da7bbdaee732fa9651c1dd0ad


有漏洞攻击的、有内嵌宏病毒的,还有需要用户交互才能触发的狡猾行为。比如第四个样本的触发秘密就隐藏在截图中 :

3333.png


[linux样本] linux系统越来越普及,样本也越来越多了。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=ee5ff02b2417d9fb00eeea16180051f6

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=de841064a9215d27ffaf9b03b65ec4b7

比较有意思的是,第一个样本居然指定了DNS服务器来查询恶意域名,也算是对抗模拟网络的一种手段吧:

6666.png

第二个样本伪装成日志文件java.log(在类型伪装方面显然linux比windows更加方便),然后调用一些列系统命令完成恶意行为,最后覆盖netstat等常用命令实现传播和复制。

7777.png

windows样本喜欢使用API序列,但调用系统命令可能是linux样本实现目的的常见方式,显然我们的引擎还没做好准备,输出的参数还不够完整,近期需要加强了。

----------------------------------------------------------------------------

另外由于这次版本更新比较大,以前的一些历史报告可能就看不到了,请谅解……



评论:

Deborahrah
2019-10-15 08:56
http://www.gamerword.net/forums/topic/3723/
http://ohotavotkinsk.ru/forums/users/nylvasartfo/edit/?updated=true
https://www.50seconds.com/forums/user/globalitmu/edit/?updated=true
http://myhelpdesk.club/forums/users/checafifpva/edit/?updated=true
https://www.youthwinconnect.com/forums/topic/484/
https://busfe.com/forums/topic/3909/
https://www.youthwinconnect.com/forums/topic/8555/
http://futurefrontier.co.za/forums/topic/9526/
http://4ucrafts.co.za/forums/user/neoterzoomest/edit/?updated=true
http://totalsurvivalmc.com/forums/user/phyperlysua/edit/?updated=true
http://pndworks.com/forums/topic/2327/
http://guidemia.cn/forums/topic/6872/
https://rawpolitics.co.ke/forums/user/tauradsdrosot/edit/?updated=true
http://localplus.co.uk/forums/topic/7192/
https://www.second-glance.fr/forums/topic/9239/
http://www.hunttherockies.com/forums/users/anagenat/edit/?updated=true
https://qaxooti.com/forums/topic/2573/
http://sgmath.ninja/forums/users/anmismoness/edit/?updated=true
http://totalsurvivalmc.com/forums/topic/6862/
http://taochicentering.com/forums/topic/4787/
Aarontic
2019-10-14 04:33
http://tadalafild7k.com - website
http://cialis00.com - corporate website
http://lasixf5h.com - company news
http://tetracycline1s1.com - company contacts
http://levitra1s1.com - company news
Aarontic
2019-10-13 17:07
http://lexapro1s1.com - company news
http://ventolin0i0.com - business
http://propeciad7k.com - company contacts
http://allopurinol0i0.com - business headquarters
http://viagra00.com - viagra00.com
FazidPaiVe
2019-10-11 14:28
vendita viagra
http://viagrawithoutdoctorbest.com - generic name viagra
  cheapest viagra online
<a href="http://viagrawithoutdoctorbest.com">viagra canada for sale
</a> - viagra information dosage miscellaneous
viagra song mp3
Aarontic
2019-10-11 07:47
http://tadalafil204.com - company contacts
http://kamagra0i0.com - corporate website
http://viagra000.com - business
http://tadalafilb4.com - website
http://cialis00.com - company news
WoodrowSnoli
2019-10-11 05:58
http://casathome.ihep.ac.cn/team_display.php?teamid=144495
https://torgi.gov.ru/forum/user/profile/726817.page
https://menwiki.men/wiki/Cats_breath_smells_bad_Kitten_Air_Curescure_intended_for_foul_breath
http://askme.honeybeesoft.net/index.php?qa=user&qa_1=tempermodem3
https://disqus.com/home/discussion/channel-new/an_organic_and_natural_way_of_the_best_skincare/
https://www.file-upload.com/2q1rqofs8pff
http://motofon.net/story/376009/
https://nerdgaming.science/wiki/A_life_threatening_Healthy_skin_care_Plan_Such_as_this_Will_continue_to_work_Amazing_things_onto_the_skin
https://valetinowiki.racing/wiki/Simple_Ideas_to_Get_Ideal_Epidermis_Immediately
https://bookmark4you.win/story.php?title=3-or-more-essential-functions-what-you-eat-needs-to-have-for-weight-loss-accomplishment#discuss
http://ge.tt/1JtHmix2/v/0
https://mozillabd.science/wiki/Love_Mediterranean_and_beyond_Weight_loss_plan_To_shed_pounds_and_also_Dwell_For_a_longer_time
http://temperairbus6.iktogo.com/post/supplements--space--choosing-the-right-one-for-you
http://www.electronoobs.com/QA/index.php?qa=user&qa_1=kettlechord6
http://redbuzz.kingthemes.net/index.php?qa=user&qa_1=bitmodem4
WoodrowSnoli
2019-10-10 18:44
http://whattheyshouldsay.org/qa/index.php?qa=6746&qa_1=first-timers-help-and-information-for-good-natural-feeding
http://wiki.worldbeyblade.org/index.php?title=User:SkyeBorchgrevink
https://ukdcircle.com/blog/8/rem-uninterrupted-sleep-and-even-musing/
https://senwiki.co.uk/index.php?title=User:NatashaGardin
https://80.211.17.224/mediawiki/index.php/Utente:RedaTpa41454
https://web.archive.org/web/2/https://mifarmacia24.com/topamax/
http://sportdvp.com/groups/prostate-targeted-antigen/
http://rarefiedtennis.com/rt/wiki/index.php/Alzheimer_s_Disease_Could_Be_The_At_A_Minimum_Connected_With_Their_Challenges_In_The_Taking_With_Debbie_Logan
http://richardbarber.works/index.php?title=Prostate_Cancer_Procedure_Watchful_Waiting_Around
http://hotlinks.biz/What-You-Don't-Know-About-Health_208859.html
https://www.colourlovers.com/lover/shellapembe
http://sharewiki.org/en/User:YvonneAiston285
http://aihelpwebsite.com/Activity-Feed/My-Profile/UserId/174767
http://www.telluslies.com/UserProfile/tabid/191/userId/17061/Default.aspx
https://128.227.67.21/Prostate_Health_Unique_Antigen
Stephenzet
2019-10-10 13:21
cialis per lastschrift https://cialisfavdrug.com/online-application.aspx generic cialis india pharmacy
KennethRar
2019-10-10 09:45
cialis dosage vs viagra https://cialisfavdrug.com how often should you take cialis
KennethRar
2019-10-10 07:13
cialis from india safe https://cialisfavdrug.com/allied-health-careers.aspx generic cialis walmart price
knoca
2019-10-09 14:16
921d40 beis

  
    

is kp
knoca
2019-10-09 14:14
921d40 islieferanten kanada

  
    

is usa discount be
knoca
2019-10-09 14:07
921d40 good choice female is

  
    

is usa discount be
knoca
2019-10-09 12:57
921d40 effetti is erezione

  
    

is original bon marche
knoca
2019-10-09 12:56
921d40 safe be is over internet

  
    

brand is e check

发表评论:

Powered by emlog