Trik Botnet Ginzo.exe: 7 Teknikli Çok Aşamalı Dropper, 185.185.25.175 C2, RTF Makro + PowerShell ENV + bitsadmin

Genel Bakış

Bu örnek, Ginzo.exe adıyla gelen 340KB büyüklüğünde son derece karmaşık bir Trik Botnet çok aşamalı dropper'dır. VBA makro, RTF gömülü nesne, HTA, JavaScript, PowerShell ve bitsadmin LOLBin gibi birbirinden farklı yedi yük dağıtım tekniğini tek bir dosyada barındırarak çoklu C2 altyapısına bağlanmaktadır. İçinde Trik botnet PDB yolu, Chrome şifre çalıcı modülü (PasswordRecoveryChrome.exe) ve Monero madencisi bileşeni bulunmaktadır.

Teknik Analiz

Trik Botnet PDB Kanıtı

\Users\x\Desktop\Home\Code\Trik v[0-9]+.[0-9]+\Release\Trik.pdb

Trik Botnet: 2018-2020 döneminde aktif olan spam/dropper botnet
Aynı PDB repository'sinden birden fazla versiyon gömülü
İspanyolca PDB yolları: e:\proyectos egociadores\sqlnet\obj\debug\sqlnet.pdb ("negociadores"=müzakereciler)
Geliştirici kullanıcı adı: renzon
4asterix\documentsisual studio 2008\projects8novdwnelease8novdwn.pdb - downloader modülü

7 Farklı Yük Dağıtım Tekniği

Teknik	Kanıt Stringi
VBA Makro	`.vbproject.vbcomponents.codemodule.insertlines`
RTF Gömülü Nesne	`{\object\` (49 kez), `\objw`, `\objh`
HTA Dropper	`http://bcaou.cn/a.hta`
JavaScript	`javascript:` (5 kez), `GetObject(`
PowerShell ENV	`invoke-expression $env:`, `iex $env:`
bitsadmin LOLBin	`bitsadmin` (10 kez)
Script	`script:http` (5 kez)

C2 Altyapısı (8 IP, 20+ URL)

Ana C2: http://185.185.25.175/ref45.php
Payload: http://138.204.171.108/BxjL5iKld8.zip
EXE: http://92.63.197.153/good.exe
DLL C2 (port 280): http://js.1226bye.xyz:280/v.sctscrobj.dll
HTA: http://bcaou.cn/a.hta
Doc: http://droobox.online/luncher.doc
Logging: http://royaldiscoveryholidays.com/log/
CSS Steganografi: http://plet.dk/css/css.css
Pastebin Dead Drop: http://pastebin.com/raw/
Dynamic DNS: http://kasimovschmuck.hopto.org/, http://office-archives.duckdns.org/

Dahili C2 IP Listesi (8 Adres)

138.204.171.108 - payload sunucusu
173.208.139.170
178.128.115.182
18.130.111.206 (AWS)
185.185.25.175 - ana C2
46.101.202.232 (DigitalOcean)
92.63.197.153
94.156.189.77

Çalma Yetenekleri

PasswordRecoveryChrome.exe - Chrome şifre çalıcı
http://ip-api.com/*wallet*.dat - IP tespiti + wallet.dat arama
XMR Madenci: stratum+tcp://xmr.pool.minergate.com
AdjustTokenPrivileges - yetki yükseltme

Email Adres İfşaatı

pdharmaparrack@protonmail.com - operatör iletişim email
ttpettigrew8922555@mail.com - alternatif iletişim

Teknik Propriedadeler

Propriedade	Valor
Nome do arquivo	Ginzo.exe
Format	PE32+ Native x86-64
Tamanho	339.968 bayt
Entropy	5.98 (normal)
Família	Trik Botnet Dropper
Ana C2	185.185.25.175/ref45.php
8 C2 IP	Listelendi
Yük Teknikleri	7 Farklı (VBA, RTF, HTA, JS, PS, bitsadmin, Script)

IOC Özeti

C2 #1: 185.185.25.175/ref45.php
C2 Payload: 138.204.171.108/BxjL5iKld8.zip
DLL C2: js.1226bye.xyz:280/v.sctscrobj.dll
Email: pdharmaparrack@protonmail.com
SHA256: c73a91a1fdfa8b8ad1c4092fd33e3e84c16b568ae622996891d573bb449eec04

Lista IOC (19 indicadores)

IOC — Trik Botnet

# SHA256
c73a91a1fdfa8b8ad1c4092fd33e3e84c16b568ae622996891d573bb449eec04

# IP
185.185.25.175

# IP
138.204.171.108

# IP
92.63.197.153

# IP
173.208.139.170

# IP
178.128.115.182

# IP
18.130.111.206

# IP
46.101.202.232

# IP
94.156.189.77

# DOMAIN
1226bye.xyz

# DOMAIN
droobox.online

# DOMAIN
kasimovschmuck.hopto.org

# DOMAIN
office-archives.duckdns.org

# DOMAIN
office-cleaner-commander.com

# EMAIL
pdharmaparrack@protonmail.com

# EMAIL
ttpettigrew8922555@mail.com

# URL
http://185.185.25.175/ref45.php

# URL
http://138.204.171.108/BxjL5iKld8.zip

# URL
http://92.63.197.153/good.exe

Tipo	Valor	Nota
sha256	c73a91a1fdfa8b8ad1c4092fd33e3e84c16b568ae622996891d573bb449eec04
ip	185.185.25.175
ip	138.204.171.108
ip	92.63.197.153
ip	173.208.139.170
ip	178.128.115.182
ip	18.130.111.206
ip	46.101.202.232
ip	94.156.189.77
domain	1226bye.xyz
domain	droobox.online
domain	kasimovschmuck.hopto.org
domain	office-archives.duckdns.org
domain	office-cleaner-commander.com
email	pdharmaparrack@protonmail.com
email	ttpettigrew8922555@mail.com
url	http://185.185.25.175/ref45.php
url	http://138.204.171.108/BxjL5iKld8.zip
url	http://92.63.197.153/good.exe