CloverPlus 애드웨어와 함께 배포되는 Gh0st RAT

요약

최근 캠페인에서는 Gh0st 원격 접근 트로이 목마를 CloverPlus 광고 소프트웨어 구성 요소와 함께 배포합니다. 로더는 두 개의 암호화된 리소스를 숨기고 무작위로 선택된 위치에 기록하여 RAT를 통해 rundll32.exe을 실행합니다. 악성코드는 여러 지속성 방법과 토큰 조작, DNS 하이재킹, 키로깅을 결합하여 장기적인 접근을 유지하고 광고 클릭 남용을 통해 수익을 창출합니다. 정당한 Windows 바이너리 사용과 다계층 난독화 사용은 탐지를 더 어렵게 만듭니다.

조사

Splunk 위협 연구팀이 로더를 역공학하여 Gh0st RAT DLL과 CloverPlus 광고 모듈이 포함된 것을 확인했습니다. 행동 분석을 통해 토큰 권한 에스컬레이션, VMware 기반 환경에 대한 레지스트리 점검, 데드 드롭 탐색자 사용, 핑 기반 슬립 지연, DNS 스푸핑, Windows 레지스트리에 루트된 여러 지속성 기술이 드러났습니다. 조사관들은 또한 비정상적인 rundll32.exe 실행, 페이로드가 시작되는 %temp%에서의 실행, 감염 체인에 연결된 특정 레지스트리 수정 사항과 같은 지표도 문서화했습니다.

완화

방어자는 rundll32.exe 비정상적인 확장자로 로딩된 파일이나 표준 디렉토리가 아닌 위치에서 실행되는 컨텐츠를 모니터링해야 합니다. 보안 팀은 또한 RemoteAccess 라우터 관리자 레지스트리 항목 생성과 실행키에 대한 의심스러운 변경 사항을 차단하거나 경고해야 합니다. 네트워크 제어는 식별된 데드 드롭 탐색자 URL에 대한 접근을 제한하고 악성코드 회피와 관련된 핑 기반 슬립 행동을 플래그해야 합니다. 응용 프로그램 제어 정책은 추가로 승인되지 않은 DLL 로딩을 방지하여 위험을 줄일 수 있습니다.

대응

이 활동이 감지되면 영향을 받은 호스트를 격리하고, 휘발성 증거와 의심스러운 DLL을 수집하고 해시 기반 조회를 수행하여 위협을 확인하세요. 지속성을 위해 사용된 악성 레지스트리 항목과 서비스를 제거하세요. 노출된 자격 증명, 특히 RDP 사용과 관련된 것을 초기화하고 DNS 설정 및 호스트 파일에 대한 무단 변경을 검사하세요. 추가적인 백도어나 2차 페이로드가 남아 있지 않은지 확인하기 위해 전체 포렌식 검토를 수행해야 합니다.

"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccccff classDef technique fill:#eeeeee classDef operator fill:#ff9900 %% Nodes u2013 Step 1 Loader Execution tool_wiseman["Tool – Name: wiseman.exe Description: Loader that decrypts embedded payloads (Gh0st RAT DLL and CloverPlus adware)."] class tool_wiseman tool action_loader["Action – Loader Execution"] class action_loader action tech_reflective["Technique – T1620 Reflective Code Loading Loads code into memory without writing it to disk."] class tech_reflective technique tech_obfuscate["Technique – T1027.009 Obfuscated Files or Information: Embedded Payloads Payloads are encrypted/obfuscated inside the loader."] class tech_obfuscate technique %% Connections u2013 Step 1 tool_wiseman –>|executes| action_loader action_loader –>|uses| tech_reflective action_loader –>|uses| tech_obfuscate %% Nodes u2013 Step 2 Write DLL and launch via rundll32 process_write_dll["Process – Write DLL to random folder in C:WindowsSystem32"] class process_write_dll process malware_gh0st["Malware – Gh0st RAT DLL"] class malware_gh0st malware tool_rundll32["Tool – rundll32.exe Purpose: Executes DLLs as if they were executables"] class tool_rundll32 tool %% Connections u2013 Step 2 action_loader –>|writes| process_write_dll process_write_dll –>|contains| malware_gh0st malware_gh0st –>|launched by| tool_rundll32 %% Nodes u2013 Step 3 Token Manipulation tech_token["Technique – T1134.002 Access Token Manipulation: Create Process with Token Enables SeDebugPrivilege for later operations."] class tech_token technique %% Connection u2013 Step 3 action_loader –>|modifies token| tech_token %% Nodes u2013 Step 4 Process Discovery of DNS service tech_proc_discovery["Technique – T1057 Process Discovery Enumerates running processes, identifies DNS service (port 53)."] class tech_proc_discovery technique tech_win_window["Technique – T1010 Application Window Discovery Collects window titles to aid process identification."] class tech_win_window technique %% Connection u2013 Step 4 tech_token –>|performs| tech_proc_discovery tech_proc_discovery –>|supplements| tech_win_window %% Nodes u2013 Step 5 Terminate DNS and delete file tech_process_injection["Technique – T1055.003 Process Injection: Thread Execution Hijacking Hijacks DNS process thread to terminate it."] class tech_process_injection technique tech_masquerade["Technique – T1036.009 Masquerading: Break Process Trees Creates a fake process hierarchy to hide malicious activity."] class tech_masquerade technique tech_file_deletion["Technique – T1070.004 File Deletion Deletes the original DNS executable file after termination."] class tech_file_deletion technique %% Connections u2013 Step 5 tech_proc_discovery –>|targets| tech_process_injection tech_process_injection –>|accompanies| tech_masquerade tech_masquerade –>|leads to| tech_file_deletion %% Nodes u2013 Step 6 Virtual Machine Discovery tech_vm_discovery["Technique – T1673 Virtual Machine Discovery Queries VMware registry key to detect analysis environment."] class tech_vm_discovery technique %% Connection u2013 Step 6 tech_token –>|checks| tech_vm_discovery %% Nodes u2013 Step 7 Deadu2011Drop Resolver tool_ping["Tool – ping.exe Use: Introduces delay before further actions."] class tool_ping tool tech_dead_drop["Technique – T1102.001 Web Service: Dead Drop Resolver Downloads a web page from a malicious URL to obtain C2 address."] class tech_dead_drop technique %% Connection u2013 Step 7 tech_vm_discovery –>|if VM detected| tech_dead_drop tech_dead_drop –>|uses| tool_ping %% Nodes u2013 Step 8 Delay Execution tech_delay["Technique – T1678 Delay Execution Uses ping -n to wait before executing payload."] class tech_delay technique %% Connection u2013 Step 8 tool_ping –>|implements| tech_delay %% Nodes u2013 Step 9 Hosts file modification and DNS spoofing tech_hosts_mod["Technique – T1568.002 Email Spoofing (repurposed for DNS spoofing) Modifies hosts file and crafts spoofed DNS responses to block security domains."] class tech_hosts_mod technique %% Connection u2013 Step 9 tech_delay –>|modifies| tech_hosts_mod %% Nodes u2013 Step 10 Flush DNS cache action_flush_dns["Action – Flush DNS Cache Executes ipconfig /flushdns to ensure malicious entries take effect."] class action_flush_dns action %% Connection u2013 Step 10 tech_hosts_mod –>|followed by| action_flush_dns %% Nodes u2013 Step 11 Collect hardware identifiers tech_snmp_dump["Technique – T1602.001 Data from Configuration Repository: SNMP (MIB Dump) Collects hardware IDs such as MAC address."] class tech_snmp_dump technique tech_net_config["Technique – T1602.002 Data from Configuration Repository: Network Device Configuration Dump Collects hardu2011drive serial number."] class tech_net_config technique %% Connections u2013 Step 11 action_flush_dns –>|collects| tech_snmp_dump action_flush_dns –>|collects| tech_net_config %% Nodes u2013 Step 12 Persistence via service and Run key tech_service_creation["Technique – T1543.003 Create or Modify System Process: Windows Service Creates a new Windows service that points to the malicious DLL."] class tech_service_creation technique tech_run_key["Technique – T1547.001 Registry Run Keys/Startup Folder Writes a Run registry entry referencing the malicious DLL."] class tech_run_key technique %% Connections u2013 Step 12 tech_snmp_dump –>|enables| tech_service_creation tech_snmp_dump –>|enables| tech_run_key %% Nodes u2013 Step 13 Hijack Execution Flow via Service Registry tech_hijack_service["Technique – T1574.011 Hijack Execution Flow: Services Registry Permissions Weakness Registers DLL under RemoteAccessRouterManagersIp (DllPath) and restarts service for autou2011execution."] class tech_hijack_service technique %% Connection u2013 Step 13 tech_service_creation –>|uses| tech_hijack_service tech_run_key –>|also uses| tech_hijack_service %% Operators for logical grouping (optional) op_and1(("AND")) class op_and1 operator %% Example logical flow grouping action_loader –>|leads to| op_and1 op_and1 –>|continues with| tech_proc_discovery "