Emotet PowerShell Payload反混淆技术详解<\/h1>

一、Emotet概述<\/h2>

Emotet是2014年发现的银行木马，主要通过以下感染链传播：<\/p>

用户收到钓鱼邮件并点击其中的链接<\/li>
下载武器化的Word文档<\/li>
文档诱使用户启用内容和宏<\/li>
执行混淆的VBA代码<\/li>

VBA代码最终加载混淆的PowerShell命令<\/li> <\/ol>

二、混淆技术原理<\/h2>

混淆技术主要有两个目的：<\/p>

规避反病毒软件的签名检测<\/li>

增加人工分析的时间和难度<\/li> <\/ol>

三、Emotet使用的三种混淆方法<\/h2>

方法1：字符串替换<\/h3>

特征<\/strong>：<\/p>

使用多个PowerShell的replace功能交换无用字符串和关键字<\/li>
最终生成有效的PowerShell代码<\/li> <\/ul>
示例代码<\/strong>：<\/p>
('S'<\/span>+'y'<\/span>+'s'<\/span>+'t'<\/span>+'e'<\/span>+'m'<\/span>).replace('S'<\/span>,'I'<\/span>).replace('y'<\/span>,'n'<\/span>).replace('s'<\/span>,'v'<\/span>).replace('t'<\/span>,'o'<\/span>).replace('e'<\/span>,'k'<\/span>).replace('m'<\/span>,'e'<\/span>) <\/span><\/span><\/code><\/pre>反混淆方法<\/strong>：<\/p> 在文本编辑器中进行字符串替换<\/li> 使用正则表达式加速处理<\/li> 编写Python脚本自动化处理<\/li> <\/ol> Python反混淆注意事项<\/strong>：<\/p> 处理字符串连接符+<\/code><\/li> 处理字符类型映射（如int转char）<\/li> 使用循环处理嵌套替换<\/li> <\/ul> 方法2：字符串压缩<\/h3> 特征<\/strong>：<\/p> 使用PowerShell内置的DeflateStream<\/code>类解压缩和执行压缩流<\/li> <\/ul> 示例代码<\/strong>：<\/p> [IO.Compression.CompressionMode]<\/span>::Decompress);$s.Read($b,0,$b.Length)|Out-Null;$d=(New-Object Text.UTF8Encoding).GetString($b);Invoke-Expression $d <\/span><\/span><\/code><\/pre>反混淆方法<\/strong>：<\/p> 使用PowerShell解压缩字符串<\/li> 手动移除前两个括号中的命令（通常是混淆的Invoke-Expression）<\/li> 使用zlib库处理（需注意DeflateStream不需要zlib文件头）<\/li> <\/ol> Python实现<\/strong>：<\/p> import<\/span> zlib <\/span><\/span># 使用zlib.MAX_WBITS负值跳过header位<\/span> <\/span><\/span>decompressed =<\/span> zlib.<\/span>decompress(compressed_data, -<\/span>zlib.<\/span>MAX_WBITS) <\/span><\/span><\/code><\/pre>方法3：ASCII码数组<\/h3> 特征<\/strong>：<\/p> 使用数字数组表示ASCII字符<\/li> 通过切割函数分割字符串进行混淆<\/li> <\/ul> 示例代码<\/strong>：<\/p> $s=('73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110'<\/span>).split(','<\/span>) <\/span><\/span>$d=''<\/span>;foreach<\/span>($c in<\/span> $s){$d+=[char][int]<\/span>$c};Invoke-Expression $d <\/span><\/span><\/code><\/pre>反混淆方法<\/strong>：<\/p> 使用split方法分割字符串<\/li> 使用chr()函数将数字映射为字符<\/li> <\/ol> Python实现<\/strong>：<\/p> ascii_array =<\/span> '73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110'<\/span> <\/span><\/span>decoded =<\/span> ''<\/span>.<\/span>join([chr(int(c)) for<\/span> c in<\/span> ascii_array.<\/span>split(','<\/span>)]) <\/span><\/span># 结果为"Invoke-Expression"<\/span> <\/span><\/span><\/code><\/pre>四、Invoke-Expression的混淆技巧<\/h2> PowerShell中常见的Invoke-Expression混淆方法：<\/p> 使用缩写<\/strong>：<\/p> 完整命令：Invoke-Expression<\/code><\/li> 标准缩写：iex<\/code><\/li> <\/ul> <\/li> 字符串拼接<\/strong>：<\/p> $vERBOsepreFErEncE.tOStRIng()[1,3]+'X'<\/span>-JoIn''<\/span> <\/span><\/span><\/code><\/pre> $verbosepreference<\/code>默认值为"SilentlyContinue"<\/li> 取第2和第4个字符（i和e）加上X组成"iex"<\/li> <\/ul> <\/li> 变量存储<\/strong>：<\/p> $a='Inv'<\/span>;$b='oke'<\/span>;$c='-Exp'<\/span>;$d='ression'<\/span>;$cmd=$a+$b+$c+$d <\/span><\/span><\/code><\/pre><\/li> <\/ol> 五、真实Payload分析<\/h2> 解混淆后的典型Emotet PowerShell payload功能：<\/p> 使用WebClient<\/code>类连接硬编码域名<\/li> 在%TEMP%<\/code>目录下载二进制文件<\/li> 加载下载的文件<\/li> 使用break<\/code>和try-catch<\/code>确保下载完成前能连接到域名<\/li> <\/ol> 六、分析建议<\/h2> 安全环境<\/strong>：始终在隔离的虚拟环境中分析恶意代码<\/li> 分步处理<\/strong>：先识别混淆类型，再针对性解混淆<\/li> 工具辅助<\/strong>：结合文本编辑器、正则表达式和脚本语言提高效率<\/li> 关注IoC<\/strong>：解混淆后重点关注硬编码域名、URL和文件路径等指标<\/li> <\/ol> 七、自动化反混淆脚本示例<\/h2> import<\/span> re <\/span><\/span>import<\/span> zlib <\/span><\/span> <\/span><\/span>def<\/span> deobfuscate_replace<\/span>(code): <\/span><\/span> # 处理字符串替换型混淆<\/span> <\/span><\/span> while<\/span> True<\/span>: <\/span><\/span> new_code =<\/span> re.<\/span>sub(r<\/span>"\.replace$'(.)','(.)'$"<\/span>, lambda<\/span> m: <\/span><\/span> code.<\/span>replace(m.<\/span>group(1<\/span>), m.<\/span>group(2<\/span>)), code) <\/span><\/span> if<\/span> new_code ==<\/span> code: <\/span><\/span> break<\/span> <\/span><\/span> code =<\/span> new_code <\/span><\/span> return<\/span> code <\/span><\/span> <\/span><\/span>def<\/span> deobfuscate_ascii<\/span>(code): <\/span><\/span> # 处理ASCII数组型混淆<\/span> <\/span><\/span> matches =<\/span> re.<\/span>findall(r<\/span>"$(.*?)$\.split$'(.*?)'$"<\/span>, code) <\/span><\/span> for<\/span> match in<\/span> matches: <\/span><\/span> nums, sep =<\/span> match <\/span><\/span> decoded =<\/span> ''<\/span>.<\/span>join([chr(int(c)) for<\/span> c in<\/span> nums.<\/span>split(sep)]) <\/span><\/span> code =<\/span> code.<\/span>replace(f<\/span>"(<\/span>{<\/span>nums}<\/span>).split('<\/span>{<\/span>sep}<\/span>')"<\/span>, f<\/span>"'<\/span>{<\/span>decoded}<\/span>'"<\/span>) <\/span><\/span> return<\/span> code <\/span><\/span> <\/span><\/span>def<\/span> deobfuscate_deflate<\/span>(code): <\/span><\/span> # 处理Deflate压缩型混淆<\/span> <\/span><\/span> matches =<\/span> re.<\/span>findall(r<\/span>"FromBase64String$'(.*?)'$"<\/span>, code) <\/span><\/span> for<\/span> match in<\/span> matches: <\/span><\/span> compressed =<\/span> base64.<\/span>b64decode(match) <\/span><\/span> decompressed =<\/span> zlib.<\/span>decompress(compressed, -<\/span>zlib.<\/span>MAX_WBITS) <\/span><\/span> code =<\/span> code.<\/span>replace(f<\/span>"FromBase64String('<\/span>{<\/span>match}<\/span>')"<\/span>, f<\/span>"'<\/span>{<\/span>decompressed.<\/span>decode()}<\/span>'"<\/span>) <\/span><\/span> return<\/span> code <\/span><\/span><\/code><\/pre>通过系统性地应用这些技术，可以有效分析Emotet等恶意软件使用的混淆PowerShell payload。<\/p>