新型.NET远控木马分析教学文档<\/h1>

一、样本概述<\/h2>

1.1 基本信息<\/h3>

样本名称<\/strong>：RV-tools-4.7.0.1.exe<\/li>
文件大小<\/strong>：44817464字节<\/li>
文件版本<\/strong>：4.8.0.1<\/li>

哈希信息<\/strong>：

MD5：288A873227369A421DC7A4148C2D6613<\/li>
SHA1：7E4C67D4E10D20B4D1AD0F398D4CD6959F663219<\/li>
SHA256：e15decd55971d328e0a404ae14278cbd2aa3c43305e27165565712639a8e94f8<\/li> <\/ul> <\/li> <\/ul>
1.2 数字签名特征<\/h3>

签名主体<\/strong>：Taiyuan Tataomi Technology Co., Ltd.（太原踏涛米科技有限公司）<\/li>
状态<\/strong>：样本曝光后已被证书颁发机构撤销<\/li> <\/ul>
二、技术特点分析<\/h2>
2.1 跨语言内存加载机制<\/h3>
样本采用多语言混合执行技术，依次加载：<\/p>

Python模块<\/strong>：通过pythonw.exe执行恶意脚本<\/li>
PowerShell脚本<\/strong>：内存中动态加载执行<\/li>
C#程序集<\/strong>：通过反射机制内存加载<\/li> <\/ol>
2.2 文件释放行为<\/h3>
2.2.1 释放目录结构<\/h4>
C:\ProgramData\Microsoft\SystemWEB\ ├── WINWORD.EXE（正常文件） ├── appvisvsubsystems64.dll（恶意DLL） ├── rvtools.msi（正常安装包） └── Cert.txt C:\ProgramData\Microsoft\AppUpdate\ ├── WINWORD.EXE（正常文件） ├── appvisvsubsystems64.dll（恶意DLL） ├── app-systeminfo.py（恶意脚本） └── SystemInfo\/（Python环境文件） └── UsbServiceBroker.exe（pythonw.exe重命名） <\/code><\/pre> 2.2.2 关键文件哈希对照表<\/h4> 文件路径<\/th> MD5<\/th> 性质<\/th> <\/tr> <\/thead> C:\ProgramData\Microsoft\AppUpdate\appvisvsubsystems64.dll<\/td> 1A749E03A80BD8047AE6FAD441BE721D<\/td> 恶意<\/td> <\/tr> C:\ProgramData\Microsoft\AppUpdate\app-systeminfo.py<\/td> 16626F5D64940A11067C346AE1F621D7<\/td> 恶意<\/td> <\/tr> C:\ProgramData\Microsoft\SystemWEB\appvisvsubsystems64.dll<\/td> 7A160E20C51755B20FD3147C5BD1A7C7<\/td> 恶意<\/td> <\/tr> UsbService64.exe（内存释放）<\/td> 6A54536BBF5E9C6808065307B3BFBB08<\/td> 恶意<\/td> <\/tr> <\/tbody> <\/table> 2.3 白加黑技术实现<\/h3> 利用方式<\/strong>：正常WINWORD.EXE加载同目录恶意appvisvsubsystems64.dll<\/li> 技术原理<\/strong>：利用系统DLL搜索顺序劫持合法程序执行流程<\/li> <\/ul> 三、核心功能分析<\/h2> 3.1 UsbService64.exe远控模块<\/h3> 3.1.1 配置信息<\/h4> string<\/span> url = "https:\/\/divine-glitter-cfb4.elena-morales.workers.dev\/"<\/span>; <\/span><\/span>string<\/span> key = "kgZgwUMuMaoonJhCKrdLzujD"<\/span>; <\/span><\/span>int<\/span> sleepTime = 15000<\/span>; <\/span><\/span><\/code><\/pre>3.1.2 通信加密算法<\/h4> 加密方案<\/strong>：Base64 + RC4双重加密<\/li> 密钥管理<\/strong>：硬编码在程序入口参数中<\/li> 数据格式<\/strong>：JSON格式传输<\/li> <\/ul> { <\/span><\/span> "UUID"<\/span>: null<\/span>, <\/span><\/span> "ID"<\/span>: "随机16字节ID"<\/span>, <\/span><\/span> "Data"<\/span>: "RC4加密后的Base64数据"<\/span> <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.1.3 远控指令集<\/h4> 指令格式<\/th> 功能描述<\/th> <\/tr> <\/thead> exit<\/code><\/td> 退出程序<\/td> <\/tr> delay time<\/code><\/td> 设置休眠时间（毫秒）<\/td> <\/tr> byop PowerShell程序集字节数组 PowerShell脚本<\/code><\/td> 内存加载PowerShell脚本<\/td> <\/tr> module cache cachefilename base64data<\/code><\/td> 保存Base64数据到本地缓存<\/td> <\/tr> module cache cachefilename url<\/code><\/td> 从URL下载文件到本地缓存<\/td> <\/tr> module run cached cachefilename<\/code><\/td> 加载本地缓存的.NET模块<\/td> <\/tr> module run base64 base64data<\/code><\/td> 直接加载Base64编码的.NET模块<\/td> <\/tr> module run file filename<\/code><\/td> 加载指定路径的.NET模块<\/td> <\/tr> <\/tbody> <\/table> 3.2 内存加载技术细节<\/h3> 3.2.1 PowerShell加载流程<\/h4> # app-systeminfo.py中的加载逻辑<\/span> <\/span><\/span>powershell_script =<\/span> "解密的PowerShell代码"<\/span> <\/span><\/span>decrypted_csharp =<\/span> "从BJhrL2FUWDXg变量解密C#代码"<\/span> <\/span><\/span><\/code><\/pre>3.2.2 C#反射加载机制<\/h4> \/\/ 典型的Assembly.Load内存加载<\/span> <\/span><\/span>byte<\/span>[] assemblyBytes = DecryptBase64Data(base64Data); <\/span><\/span>Assembly assembly = Assembly.Load(assemblyBytes); <\/span><\/span>MethodInfo method = assembly.EntryPoint; <\/span><\/span>method.Invoke(null<\/span>, new<\/span> object<\/span>[] { args }); <\/span><\/span><\/code><\/pre>四、网络通信分析<\/h2> 4.1 C2基础设施<\/h3> 通信域名<\/strong>： divine-glitter-cfb4.elena-morales.workers.dev<\/li> log-ingest-f1d.nina-alvarez.workers.dev<\/li> <\/ul> <\/li> IP地址<\/strong>： 104.21.90.78（美国 Cloudflare, Inc.）<\/li> 172.67.153.253（美国 Cloudflare, Inc.）<\/li> <\/ul> <\/li> 技术平台<\/strong>：Cloudflare Workers无服务器平台<\/li> <\/ul> 4.2 通信协议分析<\/h3> 4.2.1 上线握手流程<\/h4> 生成16字节随机ID<\/li> 发送注册信息：register [ID] [COMPUTERNAME] [USERDOMAIN\USERNAME]<\/code><\/li> 示例：register hMSEICw8FcX9Y6Yz DESKTOP-JGLLJLD DESKTOP-JGLLJLD\admin<\/code><\/li> <\/ol> 4.2.2 心跳维持机制<\/h4> 间隔时间<\/strong>：可配置的休眠时间（默认15秒）<\/li> 心跳数据<\/strong>：空Data字段的JSON请求<\/li> 指令获取<\/strong>：通过UUID字段标识有效指令<\/li> <\/ul> 4.3 通信数据解密示例<\/h3> 4.3.1 UsbService64.exe通信解密<\/h4> # 原始加密数据<\/span> <\/span><\/span>encrypted_data =<\/span> "n+phoBrjN1AGaZzTZor54nDSCuSUSh67ILLJPfZinUCJrh0UIXRHuZSGLCDvv9X9EU3ysbcF9I\/tBgQUpLl4"<\/span> <\/span><\/span> <\/span><\/span># RC4解密流程<\/span> <\/span><\/span>key =<\/span> "kgZgwUMuMaoonJhCKrdLzujD"<\/span> <\/span><\/span>decrypted =<\/span> RC4_decrypt(Base64_decode(encrypted_data), key) <\/span><\/span># 结果：register hMSEICw8FcX9Y6Yz DESKTOP-JGLLJLD DESKTOP-JGLLJLD\admin<\/span> <\/span><\/span><\/code><\/pre>五、防御检测建议<\/h2> 5.1 行为检测指标<\/h3> 文件系统监控<\/strong><\/p> 异常目录创建：C:\ProgramData\Microsoft\SystemWEB\<\/code><\/li> 正常程序与异常DLL同目录存放<\/li> %TEMP%目录下UsbService64.exe释放执行<\/li> <\/ul> <\/li> 进程行为检测<\/strong><\/p> WINWORD.EXE异常加载appvisvsubsystems64.dll<\/li> pythonw.exe重命名为UsbServiceBroker.exe<\/li> 多级进程链：exe → dll → python → powershell → C#<\/li> <\/ul> <\/li> 网络通信特征<\/strong><\/p> workers.dev域名通信<\/li> 固定间隔的HTTPS POST请求<\/li> JSON数据格式+Base64编码载荷<\/li> <\/ul> <\/li> <\/ol> 5.2 静态检测特征<\/h3> 数字证书验证<\/strong><\/p> 检查Taiyuan Tataomi Technology Co., Ltd.签名状态<\/li> 验证证书吊销状态<\/li> <\/ul> <\/li> 字符串特征<\/strong><\/p> RC4密钥硬编码模式<\/li> Cloudflare Workers域名特征<\/li> 特定的远控指令关键字<\/li> <\/ul> <\/li> <\/ol> 5.3 缓解措施<\/h3> 应用程序控制<\/strong>：限制未知程序的DLL加载行为<\/li> 网络过滤<\/strong>：监控workers.dev域名的异常访问<\/li> 内存保护<\/strong>：检测反射加载和内存执行行为<\/li> 日志审计<\/strong>：加强进程创建和模块加载日志记录<\/li> <\/ol> 六、IOC信息汇总<\/h2> 6.1 文件哈希<\/h3> e15decd55971d328e0a404ae14278cbd2aa3c43305e27165565712639a8e94f8 c85a23cddbc9979c0c9c8040218c41b0a0008fee9e60cf8a885f94594eff04ea b56e1ebd367b0fd66122fd1ff7454f41e23987b143f00340ebc81a73357cf96f 472eb0572e4e63b74b92d40cdc506af1523849a9444973617d4eda402db84733 17aa198d89e3208926c97c05c8960b4085a84dadceffb0d092fee5e0cf29560b 2158b1a74763a2e112fa2531f92c0a8718ad998db55ca1db04f70e7d87a223f9 <\/code><\/pre> 6.2 网络指标<\/h3> divine-glitter-cfb4.elena-morales.workers.dev log-ingest-f1d.nina-alvarez.workers.dev 104.21.90.78 172.67.153.253 <\/code><\/pre> 6.3 行为特征<\/h3> 公司名称：Taiyuan Tataomi Technology Co., Ltd.<\/li> 特定目录：C:\ProgramData\Microsoft\SystemWEB\<\/li> 进程名称：UsbServiceBroker.exe（pythonw.exe）<\/li> 注册表键：特定安装信息记录<\/li> <\/ul> 本教学文档详细分析了新型.NET远控木马的技术实现，为安全研究人员提供完整的技术参考和检测方案。<\/em><\/p>