黑基网 首页 资讯 安全圈 查看内容

上百款《荒野行动》游戏辅助被植入挖矿木马

2018-3-8 12:52| 投稿: xiaotiger |来自: 互联网

摘要: 《绝地求生》、《荒野行动》等枪战竞技游戏对玩家电脑的配置要求较高,这早已不是什么新鲜事,然而“高配置”却容易成为不法分子寻找“绝佳”挖矿机器的重要诱因。2017年12月,腾讯电脑管家发现一款名为tlMiner的挖 ...

0×1 概述

《绝地求生》、《荒野行动》等枪战竞技游戏对玩家电脑的配置要求较高,这早已不是什么新鲜事,然而“高配置”却容易成为不法分子寻找“绝佳”挖矿机器的重要诱因。2017年12月,腾讯电脑管家发现一款名为tlMiner的挖矿木马藏身《绝地求生》辅助程序中,影响机器量高达数十万台。此外,同期发现的另一款门罗币挖矿木马利用《荒野行动》辅助二次打包程序进行微量传播,并在2月中下旬呈现上涨趋势。

0×2 详细分析

带挖矿木马的辅助文件可大致分割为3个块区:

原始块:储存着原始的辅助PE文件

木马块:两个功能,充当木马的loader也是dropper,内部嵌入挖矿程序cass4.exe

配置块:存储木马辅助所需的参数,主要是名字,偏移,大小,在文件的末尾处,大小为0×70字节。辅助的各个块都使用RC4算法加密,每个块使用不同的密匙:

原始块密匙:{E5A42E7E-8130-4f46-BECC-7E43235496A6}

木马块密匙:{ADAB6D32-3994-40e2-8C18-2F226306408C}

配置块密匙:{F918FE01-164A-4e62-9954-EDC8C3964C1B}

解密完成后,会依据配置信息把原始辅助及木马释放到temp目录下,并启动程序

其中一辅助界面:

木马启动后设置自身开机启动,启动项名ADSC

木马文件内嵌挖矿程序cass4.exe:

释放并启动cass4.exe,cass4的真身是xmrig

Xmrig是一款基于CPU的门罗币开源挖矿程序,木马使用的是xmrig 2.1版本,cass4参数

木马所用矿池为皮皮虾矿池华东一区:

0×3 溯源

溯源发现这些挖矿木马大部分都由《荒野行动》辅助释放,种类多达上百款,部分辅助名单:

对各个辅助进行分析,发现它们如下特点:

不同点:

1、 作者QQ不相同

2、 推广Q群不同

相同点:

1、 辅助全部使用易语言开发

2、 辅助都带有透视功能

3、 文件区块分布相同:原始块+木马块+配置块

4、 解密算法及密匙相同

5、 矿池信息相同

目前这些被二次打包的辅助主要在社交群、网盘传播

0×4 安全建议

在辅助程序中植入挖矿木马,利用玩家的高配置电脑挖取加密货币,已然成为不法分子挖矿的新方式。针对日益猖獗的不法挖矿行为,腾讯电脑管家推出“反挖矿防护”功能,可对此类挖矿木马进行全面拦截。目前该防护功能已覆盖电脑管家全版本用户,为用户拦截并预警各类挖矿木马程序和含有挖矿js脚本网页的运行,确保用户电脑资源不被侵占,拥有轻快的上网体验。

*腾讯电脑管家

, groupId: 6530058177650622984, itemId: 6530058177650622984, type: 2, subInfo: { isOriginal: false, source: 信息安全搬运工, time: 2018-03-07 12:40:48 }, tagInfo: { tags: [{"name":"荒野行动"},{"name":"易语言"},{"name":"脚本语言"},{"name":"CPU"},{"name":"绝地求生"}], groupId: 6530058177650622984, itemId: 6530058177650622984, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6530058177650622984, itemId: 6530058177650622984, comments_count: 15, ban_comment: 0 }, mediaInfo: { uid: 16708401348, name: 信息安全搬运工, avatar: //p4.pstatp.com/large/509600019595fae42675, openUrl: /c/user/16708401348/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/16708401348/","avatar_url":"https://p4.pstatp.com/large/509600019595fae42675","media_id":1577869177541646,"name":"信息安全搬运工","user_verified":false},"articles":[{"item_id":"6530104533199094276","url":"/item/6530104533199094276","title":"dedecms v5.7 sp2代码执行漏洞复现"},{"item_id":"6530058177650622984","url":"/item/6530058177650622984","title":"上百款《荒野行动》游戏辅助被植入挖矿木马"},{"item_id":"6529667892382794247","url":"/item/6529667892382794247","title":"渗透测试:Webshell一句话免杀编写思路"},{"item_id":"6529284515632775687","url":"/item/6529284515632775687","title":"漏洞分析与实践之基于SAML实现的单点登录系统"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":162,"media_avatar_url":"//p3.pstatp.com/large/46da00004c8548762684","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:使用7.62子弹的大家族,威力极高","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6520117950068818440/","source":"天猫咪秀","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/61600001c09f56c78186","group_id":"6520117950068818440","is_related":true,"media_url":"/c/user/75745192950/"},{"comments_count":0,"media_avatar_url":"//p4.pstatp.com/large/615e000151b5c941f7fc","is_feed_ad":false,"is_diversion_page":false,"title":"《绝地求生》步枪评测指南","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530393956008591879/","source":"电竞张某某","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/6c35000352298bdb6e46","group_id":"6530393956008591879","is_related":true,"media_url":"/c/user/6388787199/"},{"comments_count":9,"media_avatar_url":"//p5a.pstatp.com/large/56890005cd1089311cd0","is_feed_ad":false,"is_diversion_page":false,"title":"刺激战场:快速排位上分?你需要掌握这些对敌策略","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529396746550772232/","source":"刺激战场情报局","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/pgc-image/1520243501328d285ea10c2","group_id":"6529396746550772232","is_related":true,"media_url":"/c/user/82532201442/"},{"comments_count":73,"media_avatar_url":"//p9.pstatp.com/large/47220000dc7d7fedf7ba","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:空投5大神器你都知道哪几种","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6500096263550140941/","source":"圣枪凉子","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":22,"image_url":"//p3.pstatp.com/list/190x124/4e6d0004549114afecc4","group_id":"6500096263550140941","is_related":true,"media_url":"/c/user/78147699961/"},{"comments_count":53,"media_avatar_url":"//p9.pstatp.com/large/53ef0005106a26decef9","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生刺激战场:吃鸡标配灵敏度设置,素质广场如何拿枪?","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529405281154105863/","source":"南极快递哥","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c2f0001ced792814b26","group_id":"6529405281154105863","is_related":true,"media_url":"/c/user/83842120975/"},{"comments_count":32,"media_avatar_url":"//p2.pstatp.com/large/2058/1993866579","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生刺激战场怎么移动射击 边移动边射击技巧分享","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529725952312738317/","source":"婚嫁百科","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":3,"image_url":"//p3.pstatp.com/list/190x124/65bf0010e00c365ad9a5","group_id":"6529725952312738317","is_related":true,"media_url":"/c/user/3892024568/"},{"comments_count":20,"media_avatar_url":"//p1.pstatp.com/large/5e7b00009572940fea0e","is_feed_ad":false,"is_diversion_page":false,"title":"刺激战场师徒系统开发,附近的人也能看了,这是要打社交牌?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530090818877784590/","source":"电竞全靠苟","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/6c310005ee67688e7f29","group_id":"6530090818877784590","is_related":true,"media_url":"/c/user/62870881205/"},{"comments_count":12,"media_avatar_url":"//p1.pstatp.com/large/66ad0003de9c033d557f","is_feed_ad":false,"is_diversion_page":false,"title":"涨姿势 ! 《绝地求生》的专业术语有哪些?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529637049668993550/","source":"一起天天来吃鸡","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/6c2d0003297c1ef139bd","group_id":"6529637049668993550","is_related":true,"media_url":"/c/user/6455977838/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/403e000018a0261d89b5","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:佛系外挂玩家亚服登顶 30场0杀吃鸡头像嘲讽","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530207615069192712/","source":"绝地求生大逃杀社区","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c370002143ca0e22fab","group_id":"6530207615069192712","is_related":true,"media_url":"/c/user/73198343353/"},{"comments_count":137,"media_avatar_url":"//p10.pstatp.com/large/3643001a8998385db055","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:捡到它们千万别扔!能够增加开镜速度的效果你知道吗?","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6499717095574471182/","source":"牧童说电竞","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":28,"image_url":"//p3.pstatp.com/list/190x124/4e6b0001b12d1f5070a6","group_id":"6499717095574471182","is_related":true,"media_url":"/c/user/58301455974/"},{"comments_count":51,"media_avatar_url":"//p1.pstatp.com/large/568f00059cff5f45a50e","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:刺激战场地图真没得挑!但我为什么选择全军出击?","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530122070792077827/","source":"全军出击小迷妹","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c36000177595c9bd4e0","group_id":"6530122070792077827","is_related":true,"media_url":"/c/user/2419673050/"},{"comments_count":19,"media_avatar_url":"//p1.pstatp.com/large/412000a80c9e80bda5a","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:如何选取配件是制胜的关键,这些配件扔了也不给你","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529705724992291335/","source":"玩者之心游久传承","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":2,"image_url":"//p1.pstatp.com/list/190x124/6c33000187af0c1fce61","group_id":"6529705724992291335","is_related":true,"media_url":"/c/user/6393885162/"},{"comments_count":18,"media_avatar_url":"//p3.pstatp.com/large/66b50001832328b3c897","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生: 开局落地捡尸体会被封号? 请问官方这是什么操作","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530202350869545480/","source":"帅气的胡萝卜","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/6c36000263dfeccd7c5e","group_id":"6530202350869545480","is_related":true,"media_url":"/c/user/93763026400/"},{"comments_count":9,"media_avatar_url":"//p2.pstatp.com/large/2058/1993866579","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生刺激战场死亡回放哪里可以看到","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530382918777307656/","source":"婚嫁百科","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/65c5000c92fc552c35f8","group_id":"6530382918777307656","is_related":true,"media_url":"/c/user/3892024568/"},{"comments_count":61,"media_avatar_url":"//p1.pstatp.com/large/3e6500013a028659fe3b","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:如果国内主推FPP模式,会加速这游戏凉凉吗?","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529363141090869764/","source":"狗哥说游戏","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/pgc-image/152023580384181255b5a7f","group_id":"6529363141090869764","is_related":true,"media_url":"/c/user/66160685037/"},{"comments_count":13,"media_avatar_url":"//p10.pstatp.com/large/4afe00019aad9d03dd79","is_feed_ad":false,"is_diversion_page":false,"title":"腾讯和网易旗下四款吃鸡手游争相爆料,可能只有一款最适合你","single_mode":true,"gallary_image_count":8,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530130374733857287/","source":"App小胖子","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/66c60005604959a4faaa","group_id":"6530130374733857287","is_related":true,"media_url":"/c/user/3664137414/"},{"comments_count":19,"media_avatar_url":"//p1.pstatp.com/large/4e7a0001e77e89ef26f7","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生:最强连狙SKS配件推荐用法:远比AWM强百倍!","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529816113465786893/","source":"北北菌游戏解说","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/6c31000407fca0c8ba4a","group_id":"6529816113465786893","is_related":true,"media_url":"/c/user/80155581035/"},{"comments_count":7,"media_avatar_url":"//p3.pstatp.com/large/593a00059cfdd47cfac6","is_feed_ad":false,"is_diversion_page":false,"title":"刺激战场:吃鸡手游出现无限子弹BUG,整个房子满地的子弹!","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529767759960605188/","source":"唐唐游戏解说","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p3.pstatp.com/list/190x124/6c2e0004f48bc9c5412a","group_id":"6529767759960605188","is_related":true,"media_url":"/c/user/61582458952/"},{"comments_count":0,"media_avatar_url":"//p1.pstatp.com/large/5e74000511bf838d8a04","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生: 3月9日春季试炼版要更新啦!准备好接下这大礼没?","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6530358718654054920/","source":"游戏公子","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/6c340003c42bbe75a50b","group_id":"6530358718654054920","is_related":true,"media_url":"/c/user/88966312580/"},{"comments_count":8,"media_avatar_url":"//p2.pstatp.com/large/2058/1993866579","is_feed_ad":false,"is_diversion_page":false,"title":"绝地求生刺激战场健康系统怎么解除 到时见会被强制下线","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"https://www.toutiao.com/group/6529724583052837390/","source":"婚嫁百科","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/65c2000739b7f5124e50","group_id":"6529724583052837390","is_related":true,"media_url":"/c/user/3892024568/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/item/6530058177650622984/, abstract: 0×1概述《绝地求生》、《荒野行动》等枪战竞技游戏对玩家电脑的配置要求较高,这早已不是什么新鲜事。然而“高配置”却容易成为不法分子寻找“绝佳”挖矿机器的重要诱因。
小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!



免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

最新评论


新出炉

返回顶部