ばぁど・うぉっちんぐ

セキュリティを頑張りたいプログラマ。自由と春を求めて羽ばたく渡り鳥。

ばぁどのハニーポット・うぉっちんぐ - マルウェア解析スクリプト(仮)完成しました -

どーも。ばぁどです。

念願だったマルウェア解析スクリプトがついに完成しました。 (ソースコード公開していますが、ファイルパスとか独自のものなので、そのままは使えないと思います!)

github.com

初めてのPython。 ほぼ、初めてのshellscript。

なんかプログラマとしてそれ以前に考慮しなきゃいけないところとかあるのですが・・・

ファイル名微妙だし、ソースコードの中身はすごい汚いし、コメントも入ってないので、これから随時リファクタリングなどを行なっていきます。

一旦、スクリプトが完成したのでその共有でした。

次回の観察日誌からマルウェアの解析結果を載せることができそうです。

開発TIPS

Virus total

今回はVirus totalのAPIを使用しました。

developers.virustotal.com

file-report以外にもエンドポイントがあるみたいなので、そちらの方が良ければ、そっち使います。

Virus totalのAPIは1分間におけるAPIの使用回数があるので、4回実行したら一度60秒以上待つ必要があります。(ソースコード中は65秒で設定)

実行結果の例(2018年11月23日19:00 現在)

# python check.py 
START SCRIPT
[LOG] Check: tmpfQnHEL
[LOG] Check: tmpe4ebw9
[LOG] Check: tmpKZEhAq
[LOG] Check: b33b30c3cc7e027320e4d203303cc36a4e84b44451278bbb524ec54d5f61a4d6
[LOG] Sleep 65 seconds.
[LOG] Check: tmpiBhhlP
[LOG] Check: tmpyl2ld4
[LOG] Check: tmpeXn97K
[LOG] Check: tmpKWk7Vv
[LOG] Sleep 65 seconds.
[LOG] Check: 872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f
===================[LOG] FAILED API======================
{u'response_code': 0, u'resource': u'872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f', u'verbose_msg': u'The requested resource is not among the finished, queued or pending scans'}
[LOG] Check: 2b5ce510a3d9a2ac1b3638bd32944cdc125d9c53f87c4d10ac4852f12683be05
[LOG] Check: tmpFAKOif
[LOG] Check: tmprusSbe
[LOG] Sleep 65 seconds.
[LOG] Check: tmpbTUvYJ
[LOG] Check: tmpNy7R6x
[LOG] Check: tmp84HPF3
[LOG] Check: tmpAQ0Gnf
[LOG] Sleep 65 seconds.
[LOG] Check: tmpaKo7_E
[LOG] Check: tmpfXFEXD
[LOG] Check: 79197e90329ff0c84b88e3eaa4f0ce1393bae0df74752272dea84db849798231
[LOG] Check: 9c2848962733846bf50b490fd8f6c7ce9ecade2d3f2f530f5ecbba283af87d3a
[LOG] Sleep 65 seconds.
[LOG] Check: 5685b086ce12ffede8814e303223a67eca476735dfe4e9e84b751354a5ea0232
[LOG] Check: 86fbdd7df9486a17e9c408c7e50635e26402fdf297c9e97f1a5256100401dcc5
[LOG] Check: 5c8c41253aa68adeb955e7d1c7b8e084e06537f75eff12c3f3a0f3cb30cb2152
[LOG] Check: 0ffa9e646e881568c1f65055917547b04d89a8a2150af45faa66beb2733e7427
[LOG] Sleep 65 seconds.
[LOG] Check: tmp1Q7jBF
[LOG] Check: tmp9df5pF
[LOG] Check: tmpApB9Dx
[LOG] Check: tmpC1igwO
[LOG] Sleep 65 seconds.
[LOG] Check: tmp_HKrPu
[LOG] Check: tmp0f4rsH
[LOG] Check: tmpLSkNE7
[LOG] Check: tmpE8bXAp
[LOG] Sleep 65 seconds.
[LOG] Check: f72d5721e2246d68faa22ed9fc7a2b903ff95eb2f7047fe79599cf42e772f138
[LOG] Check: tmpA3Cj85
[LOG] Check: tmp8khfH6
[LOG] Check: tmpZVtSCx
[LOG] Sleep 65 seconds.
[LOG] Check: tmpM771xe
[LOG] Check: tmpdvxYCI
[LOG] Check: tmpLZDt81
[LOG] Check: tmpJDc7Zr
[LOG] Sleep 65 seconds.
END SCRIPT

なにやら一つだけVirus totalでは解析できないものがあるなぁ。 調べるか。

解析結果

取り急ぎ、前回分までのマルウェアの解析結果。

取得日時: 11月4日 〜 11月16日分 マルウェア総数:40個

ファイル名 取得日時 検出率 URL
tmpfQnHEL 2018/11/04 13:57:51 38/57 https://www.virustotal.com/file/90ad1f172af7d0915e548bd84443ab3cc3b3df97b3fbf8c06ecc8b42604fbb5f/analysis/1542329214/
tmpe4ebw9 2018/11/04 20:10:08 38/57 https://www.virustotal.com/file/90ad1f172af7d0915e548bd84443ab3cc3b3df97b3fbf8c06ecc8b42604fbb5f/analysis/1542329214/
tmpKZEhAq 2018/11/05 03:29:56 39/57 https://www.virustotal.com/file/46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0/analysis/1541824163/
b33b30c3cc7e027320e4d203303cc36a4e84b44451278bbb524ec54d5f61a4d6 2018/11/05 13:13:15 30/56 https://www.virustotal.com/file/b33b30c3cc7e027320e4d203303cc36a4e84b44451278bbb524ec54d5f61a4d6/analysis/1542867902/
tmpiBhhlP 2018/11/05 19:36:18 39/57 https://www.virustotal.com/file/46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0/analysis/1541824163/
tmpyl2ld4 2018/11/06 00:37:44 39/57 https://www.virustotal.com/file/46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0/analysis/1541824163/
tmpeXn97K 2018/11/06 19:45:54 38/57 https://www.virustotal.com/file/b5af6310e833e227562ece7d24dbb628a7717b91a0cb67ec2036dd1776fb1b45/analysis/1542949659/
tmpKWk7Vv 2018/11/07 03:29:59 39/55 https://www.virustotal.com/file/7358b6fc402681a3585d7cd69763d4b8f0c3093d746b85a35205b77e5b26e13d/analysis/1542924543/
872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f 2018/11/07 17:57:11
2b5ce510a3d9a2ac1b3638bd32944cdc125d9c53f87c4d10ac4852f12683be05 2018/11/07 17:57:11 37/56 https://www.virustotal.com/file/2b5ce510a3d9a2ac1b3638bd32944cdc125d9c53f87c4d10ac4852f12683be05/analysis/1542616847/
tmpFAKOif 2018/11/07 19:55:20 39/55 https://www.virustotal.com/file/7358b6fc402681a3585d7cd69763d4b8f0c3093d746b85a35205b77e5b26e13d/analysis/1542924543/
tmprusSbe 2018/11/08 03:32:20 37/57 https://www.virustotal.com/file/8e0feb43f2137013fbbe42258dcc118104f9237cf41bfa52d342211ac823fad2/analysis/1542534170/
tmpbTUvYJ 2018/11/08 19:43:41 37/57 https://www.virustotal.com/file/8e0feb43f2137013fbbe42258dcc118104f9237cf41bfa52d342211ac823fad2/analysis/1542534170/
tmpNy7R6x 2018/11/08 21:16:31 1/58 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966208/
tmp84HPF3 2018/11/08 21:28:30 1/58 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966208/
tmpAQ0Gnf 2018/11/09 03:30:56 39/57 https://www.virustotal.com/file/46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0/analysis/1541824163/
tmpaKo7_E 2018/11/09 19:51:12 39/57 https://www.virustotal.com/file/46b79608c9a603c1f0046b0952f080b6cce855320a80bb6db4155a26ab0fd5f0/analysis/1541824163/
tmpfXFEXD 2018/11/10 03:32:27 39/57 https://www.virustotal.com/file/c98669337e18ede65029f72655341a23d999a72966ce6c89ac813b2ffcf02ad3/analysis/1542943589/
79197e90329ff0c84b88e3eaa4f0ce1393bae0df74752272dea84db849798231 2018/11/10 04:19:29 34/57 https://www.virustotal.com/file/79197e90329ff0c84b88e3eaa4f0ce1393bae0df74752272dea84db849798231/analysis/1541909102/
9c2848962733846bf50b490fd8f6c7ce9ecade2d3f2f530f5ecbba283af87d3a 2018/11/10 12:10:38 37/56 https://www.virustotal.com/file/9c2848962733846bf50b490fd8f6c7ce9ecade2d3f2f530f5ecbba283af87d3a/analysis/1541641980/
5685b086ce12ffede8814e303223a67eca476735dfe4e9e84b751354a5ea0232 2018/11/10 12:11:12 33/56 https://www.virustotal.com/file/5685b086ce12ffede8814e303223a67eca476735dfe4e9e84b751354a5ea0232/analysis/1541589706/
86fbdd7df9486a17e9c408c7e50635e26402fdf297c9e97f1a5256100401dcc5 2018/11/10 12:11:46 33/55 https://www.virustotal.com/file/86fbdd7df9486a17e9c408c7e50635e26402fdf297c9e97f1a5256100401dcc5/analysis/1541589658/
5c8c41253aa68adeb955e7d1c7b8e084e06537f75eff12c3f3a0f3cb30cb2152 2018/11/10 12:12:19 36/57 https://www.virustotal.com/file/5c8c41253aa68adeb955e7d1c7b8e084e06537f75eff12c3f3a0f3cb30cb2152/analysis/1539819736/
0ffa9e646e881568c1f65055917547b04d89a8a2150af45faa66beb2733e7427 2018/11/10 12:12:53 37/55 https://www.virustotal.com/file/0ffa9e646e881568c1f65055917547b04d89a8a2150af45faa66beb2733e7427/analysis/1542705783/
tmp1Q7jBF 2018/11/11 03:32:17 40/56 https://www.virustotal.com/file/02ab39d5ef83ffd09e3774a67b783bfa345505d3cb86694c5b0f0c94980e5ae8/analysis/1542948374/
tmp9df5pF 2018/11/11 20:10:52 40/56 https://www.virustotal.com/file/02ab39d5ef83ffd09e3774a67b783bfa345505d3cb86694c5b0f0c94980e5ae8/analysis/1542948374/
tmpApB9Dx 2018/11/12 03:31:44 38/57 https://www.virustotal.com/file/90ad1f172af7d0915e548bd84443ab3cc3b3df97b3fbf8c06ecc8b42604fbb5f/analysis/1542329214/
tmpC1igwO 2018/11/12 19:38:55 38/57 https://www.virustotal.com/file/90ad1f172af7d0915e548bd84443ab3cc3b3df97b3fbf8c06ecc8b42604fbb5f/analysis/1542329214/
tmp_HKrPu 2018/11/13 03:32:46 37/56 https://www.virustotal.com/file/94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f/analysis/1542400627/
tmp0f4rsH 2018/11/13 20:13:54 37/56 https://www.virustotal.com/file/94b59b4761147519fecf662cecba7219ac2f70682ae02685081a181758cb705f/analysis/1542400627/
tmpLSkNE7 2018/11/14 03:32:46 38/57 https://www.virustotal.com/file/b5af6310e833e227562ece7d24dbb628a7717b91a0cb67ec2036dd1776fb1b45/analysis/1542949659/
tmpE8bXAp 2018/11/14 20:47:21 38/57 https://www.virustotal.com/file/b5af6310e833e227562ece7d24dbb628a7717b91a0cb67ec2036dd1776fb1b45/analysis/1542949659/
f72d5721e2246d68faa22ed9fc7a2b903ff95eb2f7047fe79599cf42e772f138 2018/11/14 21:05:15 30/57 https://www.virustotal.com/file/f72d5721e2246d68faa22ed9fc7a2b903ff95eb2f7047fe79599cf42e772f138/analysis/1542136745/
tmpA3Cj85 2018/11/15 03:32:14 37/57 https://www.virustotal.com/file/8e0feb43f2137013fbbe42258dcc118104f9237cf41bfa52d342211ac823fad2/analysis/1542534170/
tmp8khfH6 2018/11/15 13:49:16 37/57 https://www.virustotal.com/file/8e0feb43f2137013fbbe42258dcc118104f9237cf41bfa52d342211ac823fad2/analysis/1542534170/
tmpZVtSCx 2018/11/16 03:11:11 1/60 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966208/
tmpM771xe 2018/11/16 03:31:50 1/58 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966413/
tmpdvxYCI 2018/11/16 03:50:50 39/57 https://www.virustotal.com/file/2815c35a00c6abadc22aa61b888cb144bc51458d08196794f15d06851d185b1d/analysis/1542534189/
tmpLZDt81 2018/11/16 06:13:45 1/58 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966413/
tmpJDc7Zr 2018/11/16 21:19:39 1/58 https://www.virustotal.com/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/analysis/1542966413/

file コマンド

ついでにfileコマンドの結果。本当は上記の表に加えたい。

./0ffa9e646e881568c1f65055917547b04d89a8a2150af45faa66beb2733e7427: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
./2b5ce510a3d9a2ac1b3638bd32944cdc125d9c53f87c4d10ac4852f12683be05: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.2.5, not stripped
./5685b086ce12ffede8814e303223a67eca476735dfe4e9e84b751354a5ea0232: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
./5c8c41253aa68adeb955e7d1c7b8e084e06537f75eff12c3f3a0f3cb30cb2152: ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
./79197e90329ff0c84b88e3eaa4f0ce1393bae0df74752272dea84db849798231: a /usr/bin/perl script executable (binary data)
./86fbdd7df9486a17e9c408c7e50635e26402fdf297c9e97f1a5256100401dcc5: ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
./872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f: ASCII text
./9c2848962733846bf50b490fd8f6c7ce9ecade2d3f2f530f5ecbba283af87d3a: ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
./b33b30c3cc7e027320e4d203303cc36a4e84b44451278bbb524ec54d5f61a4d6: Bourne-Again shell script executable (binary data)
./f72d5721e2246d68faa22ed9fc7a2b903ff95eb2f7047fe79599cf42e772f138: a /usr/bin/perl script executable (binary data)
./tmp0f4rsH:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmp1Q7jBF:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmp84HPF3:                                                        empty
./tmp8khfH6:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmp9df5pF:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpA3Cj85:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpAQ0Gnf:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpApB9Dx:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpC1igwO:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpE8bXAp:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpFAKOif:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpJDc7Zr:                                                        empty
./tmpKWk7Vv:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpKZEhAq:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpLSkNE7:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpLZDt81:                                                        empty
./tmpM771xe:                                                        empty
./tmpNy7R6x:                                                        empty
./tmpZVtSCx:                                                        empty
./tmp_HKrPu:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpaKo7_E:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpbTUvYJ:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpdvxYCI:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpe4ebw9:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpeXn97K:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpfQnHEL:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpfXFEXD:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpiBhhlP:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmprusSbe:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped
./tmpyl2ld4:                                                        ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.9, not stripped

Virus Totalでは解析できなかったやつ

ファイル名:872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f

fileコマンドの結果

./872950739d98fdb6385e024e2bb3b8879e4e9387a4afc4a8a69b7f309b13279f: ASCII text

中身

※ウイルスというか単なるコマンドだったので大丈夫だよね?(問題あれば消します)

cd /tmp/
./udp25000&
/etc/init.d/iptables stop

/tmpフォルダ下に移動して、udpをどうにかしようとしているのか?(わからない)

iptablesをストップさせようとしているのはわかった。

悪い子ですね。

そりゃスクリプト記述されているだけなんだから、VirusTotalで解析できるわけがないや。

まとめ

今回はスクリプト完成のご報告。

次回からマルウェアの解析結果も掲載できます。

今は最低限の情報しか掲載していないので、今後スクリプトで情報を追加していきます。