Remcos分析报告

rule Remcos
{
 strings:
  $my_hex_string  = {46 8B 44 B4 10 03 F8 81 E7 FF 00 00 80 79 08 4F 81 CF 00 FF FF FF 47}
  $my_hex_string1  = {25 30 32 69 3A 25 30 32 69 3A 25 30 32 69 3A 25 30 33 69}
  $my_string1 = "SETTINGS"
 condition:
  $my_hex_string and $my_hex_string1 and $my_string1
}

配置提取工具:
// ConfigExtract.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>
#include <Windows.h>
#include <vector>
using namespace std;
void rc4_init(unsigned int* s, unsigned char* key, unsigned long Len) //初始化函数
{
 int i = 0, j = 0;
 char k[256] = { 0 };
 unsigned char tmp = 0;
 for (i = 0;i < 256;i++)
 {
  s[i] = i;
  k[i] = key[i % Len];
 }
 for (i = 0; i < 256; i++)
 {
  j = (j + s[i] + k[i]) % 256;
  tmp = s[i];
  s[i] = s[j]; //交换s[i]和s[j]
  s[j] = tmp;
 }
}

std::vector<string> split(const string& str, char pattern)
{
 char* strc = new char[strlen(str.c_str()) + 1];
 strcpy(strc, str.c_str());
 std::vector<string> resultVec;
 char* tmpStr = strtok(strc, &pattern);
 while (tmpStr != NULL)
 {
  resultVec.push_back(string(tmpStr));
  tmpStr = strtok(NULL, &pattern);
 }
 delete[] strc;

 return resultVec;
}
void print(const char* key, const char* value)
{
 if (value[0] == 0x1e)
 {
  return;
 }
 printf("%s: ", key);
 for (int i = 0; i < strlen(value); i++)
 {
  if (value[i] == 0x1e)
  {
   continue;
  }
  printf("%c", value[i]);
 }
 printf("\r\n\r\n");

}
void DataDispose(char* Data, unsigned long Len)
{
 int temp = 0;
 int temp1 = 0;
 for (int i = 0;i < Len - 1;i++)
 {
  if (Data[i] == '\0')
  {
   Data[i] = 0x1e;
  }
  if (Data[i] == 0x7c)
  {
   temp++;
  }
  else if (Data[i] == 0x40)
  {
   temp1++;
  }
 }
 char c;
 temp > temp1 ? c = '|' : c = '@';
 vector<string> config;
 config = split(Data,c);

 //判断是哪种分割符号分割的
 if (temp> temp1)
 {
  print("C2", config[0].c_str());
  print("Botnet", config[2].c_str());
  print("copy_file", config[0x13].c_str());
  print("copy_file", config[0x14].c_str());
  print("startup_value", config[0x15].c_str());
  print("startup_value", config[0x16].c_str());
  print("mutex", config[0x1b].c_str());
  print("mutex", config[0x1c].c_str());
  print("keylog_file", config[0x21].c_str());
  print("keylog_file", config[0x22].c_str());
  print("take_screenshot_title", config[0x2d].c_str());
  print("take_screenshot_title", config[0x2e].c_str());
  print("screenshot_folder", config[0x33].c_str());
  print("screenshot_folder", config[0x34].c_str());
  print("audio_folder", config[0x4b].c_str());
  print("audio_folder", config[0x4c].c_str());
  print("copy_folder", config[0x5f].c_str());
  print("copy_folder", config[0x60].c_str());
  print("keylog_folder", config[0x61].c_str());
  print("keylog_folder", config[0x62].c_str());
 }
 else if (temp < temp1)
 {
  print("C2", config[0].c_str());
  print("Botnet", config[1].c_str());
  print("copy_file", config[0xa].c_str());
  print("startup_value", config[0xb].c_str());
  print("mutex", config[0xe].c_str());
  print("keylog_file", config[0x11].c_str());
  print("take_screenshot_title", config[0x19].c_str());
  print("screenshot_folder", config[0x25].c_str());
  print("copy_folder", config[0x2e].c_str());
  print("keylog_folder", config[0x2f].c_str());
 }



}
void rc4_crypt(unsigned int* s, unsigned char* Data, unsigned long Len) //加解密
{
 int i = 0, j = 0, t = 0;
 unsigned long k = 0;
 unsigned char tmp;
 for (k = 0;k < Len;k++)
 {
  i = (i + 1) % 256;
  j = (j + s[i]) % 256;
  tmp = s[i];
  s[i] = s[j]; //交换s[x]和s[y]
  s[j] = tmp;
  t = (s[i] + s[j]) % 256;
  Data[k] ^= s[t];
 }

 DataDispose((char*)Data, Len);
 
}
void decode(char* ResourceData,int resourceSize)
{
 unsigned int s[256] = { 0 };
 char* key = new char[(BYTE)ResourceData[0]];
 memcpy(key, ResourceData + 1, (BYTE)ResourceData[0]);

 char* c = ResourceData + 0x4e;
 rc4_init(s, (unsigned char*)key, (BYTE)ResourceData[0]);   //已经完成了初始化
 rc4_crypt(s, (unsigned char*)(ResourceData+1+ (BYTE)ResourceData[0]), (resourceSize- (1 + (BYTE)ResourceData[0])));//解密
}
int main()
{
 char filePath[256] = { 0 };
 printf("文件路径:");
 scanf_s("%s", filePath, 256);
 int size = strlen(filePath);
 filePath[size] = '.';
 filePath[size + 1 ] = '\0';
 HMODULE hMod = LoadLibraryA(filePath);
 if (hMod == NULL)
 {
  return 0;
 }
 HRSRC hRes = FindResourceA(hMod, "SETTINGS", (LPCSTR)RT_RCDATA);
 if (hRes == NULL)
 {
  return 0;
 }
 HGLOBAL ResData = LoadResource(hMod, hRes);
 int resSize = SizeofResource(hMod, hRes);

 char* pResData = new char[resSize+1];
 memcpy(pResData, ResData, resSize);
 FreeLibrary(hMod);
 decode(pResData, resSize);
 delete[] pResData;
 system("pause");

 return 0;
}