分析平台再次升级

2017-3-31 Nie.Meining Life

其实中途已经更新过好几个版本了,只是人老了比较懒,一直没更新日志,猛然一看上一篇日志居然是两年前写的……

这期间其实发生了不少事,比如N个项目开发,比如发表论文和撰写专利,以及历尽千辛万苦累感不爱终于毕业了……

废话不多说,新版分析系统更新内容包括检测项目增加、检测能力加强、匹配规则优化等多个方面。

访问地址依旧http://tcasoft.com/,欢迎大家测试并提出宝贵意见!

--------------------------------------------------------------------------------------------------

另外分享一些比较有意思的恶意代码分析报告,有新有旧:

[java样本] 最近捕获到的java样本越来越多,这是一种新的趋势吗?

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=d97eded86dcd31b357e511b3df61029e

比较有意思的是,自己本来就是个java,还要再释放一个vbs,虽然vbs查询WMI的确挺方便:

1111.png


[js样本] 当然更大的趋势是各种脚本Downloader,也就是勒索软件……

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=6a71148619077ce9416659ee42b4db15

不过这类样本的存活周期往往比较短暂,为了触发js可能的后续行为我们实现了网络模拟:

2222.png

有兴趣的伙伴也可以下载pcap包进一步分析。


[BSOD样本] 对于某些加钩子的分析引擎可能会被一起弄崩溃吧。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=39a76b8b933a0c0a87430625b08c0d1a

不过我们的分析方法在硬件层实现,对我们来讲蓝屏也是GuestOS的一种正常状态。

5555.png


[DLL样本] 这类样本比较少见,主要是因为不太容易触发行为。好在我们开发了专门的加载器。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=576f6fb5d8ac9c44ac3abe6f8d696036

4444.png


[文档类样本] 这些东西是APT攻击的最爱。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=1a007aa5721ab1743e266a503434bbb3

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=e74596cb5ba2b33a9d8193b9cc0d7354

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=0bbe58ed30fcd35be418739b1eca995f

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=9c5b73c10138f6967b5e6c608b9a8c4b
http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=a728cf4da7bbdaee732fa9651c1dd0ad


有漏洞攻击的、有内嵌宏病毒的,还有需要用户交互才能触发的狡猾行为。比如第四个样本的触发秘密就隐藏在截图中 :

3333.png


[linux样本] linux系统越来越普及,样本也越来越多了。

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=ee5ff02b2417d9fb00eeea16180051f6

http://tcasoft.com/tcaCloudPlatform/report/toViewReport.action?rid=de841064a9215d27ffaf9b03b65ec4b7

比较有意思的是,第一个样本居然指定了DNS服务器来查询恶意域名,也算是对抗模拟网络的一种手段吧:

6666.png

第二个样本伪装成日志文件java.log(在类型伪装方面显然linux比windows更加方便),然后调用一些列系统命令完成恶意行为,最后覆盖netstat等常用命令实现传播和复制。

7777.png

windows样本喜欢使用API序列,但调用系统命令可能是linux样本实现目的的常见方式,显然我们的引擎还没做好准备,输出的参数还不够完整,近期需要加强了。

----------------------------------------------------------------------------

另外由于这次版本更新比较大,以前的一些历史报告可能就看不到了,请谅解……



评论:

Irinaknoca
2019-07-16 01:20
is 20mg teilen

     05d6 is pack trial
Irinaknoca
2019-07-15 23:57
is mail canada

     05d6 only today is tablets
Irinaknoca
2019-07-15 23:55
is at tadalafil best

     05d6 be is re
Irinaknoca
2019-07-15 22:45
a79940 prix is belgique pharmacie

  
    

cheap genric is online
Irinaknoca
2019-07-15 22:41
a79940 is effets a long terme

  
    

is im ausland kaufen
Irinaknoca
2019-07-15 22:32
is gnrique deutschland

     05d6 is de farmacia canadiense
trantyRurdyspusty
2019-07-15 20:39
tadalafil preis 20 mg http://viaqraonlinegen.com viagra online without script, can you take sildenafil with enalapril
Irinaknoca
2019-07-15 19:45
a79940 is generique uk suisse

  
    

is 4 sale
Irinaknoca
2019-07-15 19:45
a79940 levitra ads is

  
    

foro is ato
Irinaknoca
2019-07-15 19:38
a79940 is levitra preis

  
    

is 1 to 2 days shipping
Irinaknoca
2019-07-15 18:08
a79940 is effets a long terme

  
    

puedo tomar is
trantyRurdyspusty
2019-07-15 17:52
tadalafil c800 http://buyscialisrx.com/ buy cialis, natural food like viagra
ValerieRap
2019-07-15 13:55
http://www.skillpaw.com/groups/online-casino-games-84821
http://scientasia.com/groups/online-casino-real-money-82628
http://skilltraderz.com/groups/casino-slots-96860
http://www.artsyfact.com/forums/topic/online-casino-85709/
http://kriptobalkan.net/groups/casino-games-95028
http://deltaibiza.com/groups/casino-online-96239
http://www.spiritualtrade.com/groups/online-casinos-85775
http://www.fhle.org/groups/online-casino-real-money-92305
http://www.scooterstore.ph/forums/topic/casino-online-92745/
http://www.worklifestrife.com/groups/online-slots-81572
http://mygunbroker.net/groups/online-casino-90406
http://henkgeesink.com/groups/online-slots-99399
http://niggalations.com/groups/online-casino-91608
https://dating.nigeriansinsouthafrica.co.za/groups/online-casinos-84903
http://acencanal.org/forums/topic/online-casino-real-money-93116/
http://thehockeyepic.com/groups/online-casino-games-84136
http://www.alverdensmad.dk/forums/topic/casino-online-97025/
http://genesisos.co.uk/groups/online-casino-92299
http://schulzentrum-am-alex.org/forums/user/esreni1976
http://www.everydayinspiring.com/groups/online-casino-games-82746
ValerieRap
2019-07-14 15:25
http://expharm.co.za/forums/topic/online-casino-92474/
http://expharm.co.za/forums/topic/online-casino-games-95472/
http://www.lou-sifflaire.com/forums/user/piolyra1977
http://www.funmedia4u.com/groups/online-casino-96361
https://dating.nigeriansinsouthafrica.co.za/groups/casino-games-82906
http://coinfreshtalk.com/groups/online-casino-games-93647
https://atombrown.com/groups/casino-games-87401
http://animeinn.net/forums/topic/online-casino-real-money-85397/
http://www.silvanusinternational.org/groups/online-casino-real-money-81318
https://gamingproject.eu/groups/online-casino-86667
http://codigo.coffee/forums/topic/online-slots-84580/
http://userforum.azurewebsites.net/groups/online-slots-96935
http://www.habeshacentral.com/groups/online-casino-90200
http://www.biesadi.com/forums/user/wilbidffram1984
http://warriorsphere.com/groups/casino-online-98111
http://razamasjid.org/groups/online-casinos-90355
http://triliferacing.com/forums/topic/online-casinos-84104/
http://www.matjoin.com/forums/user/branpostten1973
https://www.bikramyoga.com/forums/topic/online-casino-real-money-96344/
https://malawiusfriends.com/groups/casino-games-97955
trantyRurdyspusty
2019-07-14 00:14
how old to buy sildenafil http://cialisle.com/ cialis, active ingredients for viagra

发表评论:

Powered by emlog