锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟絇OS锟斤拷木锟斤拷LogPOS

锟斤拷源锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷|锟斤拷时锟戒：2015-03-12 15:41:35 |锟斤拷锟侥讹拷锟斤拷153锟斤拷|锟斤拷锟斤拷签锟斤拷漏锟斤拷木锟斤拷锟斤拷锟界安全锟斤拷 |锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷

实锟街比斤拷锟街凤拷锟斤拷锟斤拷锟杰的达拷锟斤拷锟斤拷锟斤拷锟斤拷示锟斤拷

深入分析新型POS机木马LogPOS

一锟斤拷锟斤拷锟斤拷某锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟节帮拷锟斤拷锟斤拷锟叫ｏ拷锟酵伙拷锟斤拷锟矫猴拷锟斤拷WriteProcessMemory锟斤拷锟斤拷锟斤拷注锟诫到锟矫斤拷锟教碉拷锟节达拷占洹hellcode锟斤拷锟斤拷锟侥碉拷一锟斤拷锟铰撅拷锟斤拷寻锟斤拷kernel32锟侥伙拷锟斤拷址锟斤拷锟斤拷锟斤拷锟戒开始锟斤拷锟斤拷锟斤拷锟斤拷模锟介。寻锟斤拷kernel32锟侥凤拷锟斤拷锟节很多博锟斤拷锟叫讹拷锟窖撅拷锟杰斤拷暮锟斤拷锟较革拷恕锟�

深入分析新型POS机木马LogPOS

一锟斤拷锟斤拷锟斤拷锟剿伙拷锟斤拷址锟斤拷shellcode锟斤拷锟斤拷始通锟斤拷锟皆硷拷锟侥癸拷希锟斤拷锟斤拷锟截斤拷锟斤拷凇锟揭恍╋拷锟较ｏ拷投锟接χ碉拷锟斤拷斜锟斤拷锟斤拷锟斤拷锟绞撅拷锟�

深入分析新型POS机木马LogPOS

锟斤拷锟斤拷锟斤拷锟街拷螅锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷募锟斤拷锟�.mailslotLogCC为锟斤拷锟斤拷锟斤拷锟矫猴拷锟斤拷CreateFileA锟斤拷锟斤拷取一锟斤拷锟斤拷锟斤拷写锟斤拷锟斤拷锟斤拷锟侥硷拷锟斤拷锟斤拷锟�

深入分析新型POS机木马LogPOS

锟斤拷扫锟斤拷锟节达拷时锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷使锟斤拷一锟斤拷锟皆讹拷锟斤拷锟斤拷锟斤拷锟姐法锟斤拷锟斤拷锟揭革拷锟斤拷锟斤拷息锟侥筹拷锟斤拷锟侥憋拷志锟斤拷

深入分析新型POS机木马LogPOS

然锟襟，斤拷锟揭碉拷锟斤拷锟斤拷息锟斤拷锟捷革拷实锟街碉拷Luhn锟姐法锟斤拷锟斤拷锟斤拷锟斤拷证锟斤拷一锟斤拷锟斤拷锟斤拷息锟斤拷效锟斤拷锟斤拷锟斤拷锟角斤拷锟结被锟斤拷锟酵碉拷锟绞硷拷锟斤拷锟叫ｏ拷锟皆癸拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷亩锟饺★拷锟斤拷锟斤拷锟剿筹拷锟斤拷锟斤拷锟揭伙拷锟斤拷锟斤拷趾螅锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟揭伙拷锟斤拷锟绞斤拷锟斤拷址锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟较拷锟斤拷偷锟皆讹拷锟秸撅拷锟斤拷稀锟�

深入分析新型POS机木马LogPOS

然锟斤拷锟斤拷锟捷憋拷锟斤拷锟酵碉拷远锟斤拷站锟斤拷锟较ｏ拷通锟斤拷HTTP锟斤拷GET锟斤拷锟斤拷锟斤拷锟斤拷

深入分析新型POS机木马LogPOS

站锟斤拷锟斤拷盏锟斤拷锟斤拷锟斤拷莼岜伙拷锟斤拷锟斤拷一锟斤拷锟斤拷锟斤拷锟叫ｏ拷锟斤拷写锟斤拷锟斤拷时锟斤拷锟斤拷锟斤拷锟斤拷锟捷诧拷未锟斤拷锟杰ｏ拷锟斤拷锟斤拷锟斤拷锟叫大部分的猴拷锟诫都锟斤拷rdpclip锟斤拷notepad锟侥斤拷锟教空硷拷锟叫ｏ拷锟斤拷锟斤拷锟斤拷锟角诧拷锟斤拷锟斤拷芨枚锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷诓锟斤拷锟斤拷锟斤拷堑拇锟斤拷搿ｏ拷锟接︼拷锟斤拷莺锟斤拷锟斤拷IP锟斤拷息锟侥斤拷图锟斤拷锟斤拷图锟斤拷示锟斤拷

深入分析新型POS机木马LogPOS

锟斤拷夥斤拷锟�

锟斤拷为LogPOS锟斤拷锟斤拷锟斤拷通锟斤拷扫锟斤拷锟侥硷拷锟斤拷锟斤拷取未锟斤拷锟杰碉拷锟斤拷锟矫匡拷锟斤拷息锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟绞硷拷锟桔的凤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟杰癸拷锟杰匡拷锟斤拷统锟侥硷拷锟斤拷锟狡★拷然锟斤拷锟斤拷锟斤拷锟绞癸拷锟斤拷锟斤拷锟統ara锟斤拷锟斤拷锟侥癸拷锟竭的伙拷锟斤拷锟斤拷锟杰癸拷锟斤拷锟斤拷锟阶地硷拷獾斤拷枚锟斤拷锟斤拷锟斤拷锟斤拷母锟斤拷直锟斤拷濉ｏ拷锟斤拷锟侥癸拷锟斤拷锟杰癸拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟斤拷锟揭碉拷锟斤拷锟斤拷锟斤拷夤わ拷摺锟�

rule LogPOS { meta: author = "Morphick Security" description = "Detects Versions of LogPOS" md5 = "af13e7583ed1b27c4ae219e344a37e2b" strings: $mailslot = "\.mailslotLogCC" $get = "GET /%s?encoding=%c&t=%c&cc=%I64d&process=" //64A130000000 mov eax, dword ptr fs:[0x30] //8B400C mov eax, dword ptr [eax + 0xc] //8B401C mov eax, dword ptr [eax + 0x1c] //8B4008 mov eax, dword ptr [eax + 8] $sc = {64 A1 30 00 00 00 8B 40 0C 8B 40 1C 8B 40 08 } condition: $sc and 1 of ($mailslot,$get) }

小锟斤拷锟狡硷拷锟侥讹拷