简单常见的勒索病毒加密

关注

原创 2025-10-22 17:06:46 582 阅读 AI 写同款· GEO 优化 ›

Wannacry勒索病毒分析 Wannacry病毒分析在15pb刚毕业，准备找活了，之前有幸听过奇安信的招聘会，大佬说，永恒之蓝病毒现在还在某些地方流行着，是经典的勒索病毒。这让我觉得分析这个病毒是刷经验的好机会，所以就在决定分析一下这个在2017年的纵横江湖无敌手的勒索之王，由于是新手入坑，不对之处还请多多指教(●ˇ∀ˇ●) 分析平台：win7虚拟机分析工具：OD、IDA 辅助工具：LordPE、PEID、010Edi... 阅读详情

整体介绍

需要加密的内容：laobideng123...

用到的加密：AES加密+RSA加密

整体逻辑：明文→生成AES密钥→用AES加密对明文加密→得到密文→使用RSA公钥加密AES密钥→将加密的AES密钥传回自己服务器RSA私钥自己保留

具体实施步骤

准备好AES加密的内容:

密钥hex：5f4dcc3b5aa765d61d8327deb882cf99a6838d2917d87864126e8581d2523a1e

偏移hex：a1b2c3d4e5f678901234567890abcdef

填充模式：PKCS7

密钥长度256bits

偏移长度128bits

对laobideng123...进行加密，得到密文:DDmn5kVqXsOFQShDrmKeTw== (base64编码后)

然后准备RSA加密：

密钥位数：2048bits

密钥格式：PKCS#8

公钥：MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA495ELC0Q3m/oB2hBMkbN8y65v+ajy+YiqN09QFQ21bNXAjYeYRDLjHOCC/NnB74JOBz/z3E3y1tWo5th5tE4wfJrgpIqhOoop/bj83LSQGY+X5V3IxaBRa5BkDFp7ChetMd8ufrSKwC/fXBUlbyQavxaSGTz2j3Kc4APx6H1/FwrS+XkRA8aiNRYBB3pHc55NTErqj73+8DKVA0peqiADlDk2w3JMhzkzWUsqL+X1eDo8UcB/Uzi6vdqme/5kxIh+KaaFu9GsaWzl6CJc5yueDpFfz1Kp/X3Hksa54VTfTkXbYzMj+jK9Fm2FntHXPUnUJ7PqegN3qC6kRHxAd97UQIDAQAB

私钥：MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDj3kQsLRDeb+gHaEEyRs3zLrm/5qPL5iKo3T1AVDbVs1cCNh5hEMuMc4IL82cHvgk4HP/PcTfLW1ajm2Hm0TjB8muCkiqE6iin9uPzctJAZj5flXcjFoFFrkGQMWnsKF60x3y5+tIrAL99cFSVvJBq/FpIZPPaPcpzgA/HofX8XCtL5eREDxqI1FgEHekdznk1MSuqPvf7wMpUDSl6qIAOUOTbDckyHOTNZSyov5fV4OjxRwH9TOLq92qZ7/mTEiH4ppoW70axpbOXoIlznK54OkV/PUqn9fceSxrnhVN9ORdtjMyP6Mr0WbYWe0dc9SdQns+p6A3eoLqREfEB33tRAgMBAAECggEAAIs52ELQRj5NTGKPkJuSJ26Ds3qiW/Ij6t7CTr+/X2xdkgwH2l1Jpb9rKUpOreT3zSo74xEcXBAkVAt4JO6ivHXEE2xJYoao4QO/a10+tWLOayMmb7nrRju3p4IyrvAGuoGPtuWWGv5WC/+DYtXFIM2S4pbZF9ArcPH2jQMCMl9odNP7V+xNZxS6seYmljn5R2V0+E1jg9KEkJKGedLDpLJOHzJfRRmuPWOSWpxxuXUW7rtSKuxjAXin3jgscVtOu3wCZ9TpRAbE3B7HTcECxqp6p1XhbxlPRlwqyi6UW5Kx1aJquRpg4DfFjdEeawbn4yjKK/WND+1MiBLtOHPOsQKBgQD2+eLoIofW7hbgwmxcijATqf/VQP6sIYddzBGDb74yodrI8gPn0XTwU9wEqnktEUHNrHuCe+YCcRSmCYSJC26imndetWxlPQIId9Aka9JhQ2xq9iuXKchAueOIGUxdM7dsvRGGVOLvtCTsqW6/yvEVhbe8Ijn9bTZUG3RFmlxoeQKBgQDsMacNMuI/S2tRZ1ECevhEek3J6qRLgcqWzNkQQ4hLTkR9A+qzu5JCGhmaQobJ2uJjtdrNQXu5StcqPbNSv2u0oHuEMwezDKesZY32OvdlmmeV054DLU+bYeh80kFaaz63G4sxMbgDdsrqA5xxgnuvfJlWxV8ycI0/QFtP8yCjmQKBgQCV+J+kvnMmPGWADg+nEfKnvi8v28vJ0oJUnrpzycMBE++63dspRbNwzDtqSepTR4thzT8iuQGuseQL/vOQFHUWIB4kUJ6Fy0oUwkyOETsq/Lo1KU7G+AQ16asU1efdIK5dRWIC5ED5tbZGT4yEwkMrAovTniUAkvTOle1A5r7+YQKBgQCcX38myOJrX0ZM3acPilRmGcb4gIWHjAWRc0vebaeFm+rSDc7MccmyQ89hhtvwNh8ePp7+t3TvRvJPAAyCI0NukbVU3+ggDafRBmdHduCl/uTHmBQMLGqBCABA637jGw+pcO3lgvI+MN7EseFYcTfsBgULIp8VKNkK4FPUCbY5OQKBgQDEx14p5ubSNF8VrEaEblXDe5PO84ezzJnqB/Qxyr3RvQ+CyI+DyDigGwBzZf3meUTlXPYmCqdkidrAOVtlmuuZ1YALqTMf6+v4WV8rvJV5fKZP+i61xoyeYEUTnWbHq0P61pGdmJP4IW9UEg4/ZEeWVZobYKnInuvjfaLtix8ggQ==

对AES密钥进行加密5f4dcc3b5aa765d61d8327deb882cf99a6838d2917d87864126e8581d2523a1e

加密后:fV4+FBE8m9FXKL1YgxEWlsi+mekboKj9M60AdkDIkSl+GUU3kFoqn9aTVjJMvA3z+xv/tKC9e56hwN2m6rhleMdHsRICg+DCD4UJMkcUinBp/6q+PXQe7Bv6zcKoFLiXHRQQQad1uSvSyGi+h+cEMCWItOR67EdJ2ZkJJjglrbgWu4JwVX/JiyScVYdb6+ztAhMlNNPUSDtI3yK2YUqbrRLqwkwEXXGOpw1I3LUcsIvJthLKcwy27pJt9PT9K3dIZCYIWjYQYSdjzwg+w2jwygntOmFLHbrh9MINCpY4SDuOtjP9fdFDougDkci9B2JAay1ljuW0T9d/uO3iTBqfOA==

最后得到结果：

原文：

laobideng123...

密文：

DDmn5kVqXsOFQShDrmKeTw==

AES密钥原文：

5f4dcc3b5aa765d61d8327deb882cf99a6838d2917d87864126e8581d2523a1e

AES密钥密文：

fV4+FBE8m9FXKL1YgxEWlsi+mekboKj9M60AdkDIkSl+GUU3kFoqn9aTVjJMvA3z+xv/tKC9e56hwN2m6rhleMdHsRICg+DCD4UJMkcUinBp/6q+PXQe7Bv6zcKoFLiXHRQQQad1uSvSyGi+h+cEMCWItOR67EdJ2ZkJJjglrbgWu4JwVX/JiyScVYdb6+ztAhMlNNPUSDtI3yK2YUqbrRLqwkwEXXGOpw1I3LUcsIvJthLKcwy27pJt9PT9K3dIZCYIWjYQYSdjzwg+w2jwygntOmFLHbrh9MINCpY4SDuOtjP9fdFDougDkci9B2JAay1ljuW0T9d/uO3iTBqfOA==

AES偏移量：

a1b2c3d4e5f678901234567890abcdef

RSA公钥：

MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA495ELC0Q3m/oB2hBMkbN8y65v+ajy+YiqN09QFQ21bNXAjYeYRDLjHOCC/NnB74JOBz/z3E3y1tWo5th5tE4wfJrgpIqhOoop/bj83LSQGY+X5V3IxaBRa5BkDFp7ChetMd8ufrSKwC/fXBUlbyQavxaSGTz2j3Kc4APx6H1/FwrS+XkRA8aiNRYBB3pHc55NTErqj73+8DKVA0peqiADlDk2w3JMhzkzWUsqL+X1eDo8UcB/Uzi6vdqme/5kxIh+KaaFu9GsaWzl6CJc5yueDpFfz1Kp/X3Hksa54VTfTkXbYzMj+jK9Fm2FntHXPUnUJ7PqegN3qC6kRHxAd97UQIDAQAB

RSA私钥：

MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDj3kQsLRDeb+gHaEEyRs3zLrm/5qPL5iKo3T1AVDbVs1cCNh5hEMuMc4IL82cHvgk4HP/PcTfLW1ajm2Hm0TjB8muCkiqE6iin9uPzctJAZj5flXcjFoFFrkGQMWnsKF60x3y5+tIrAL99cFSVvJBq/FpIZPPaPcpzgA/HofX8XCtL5eREDxqI1FgEHekdznk1MSuqPvf7wMpUDSl6qIAOUOTbDckyHOTNZSyov5fV4OjxRwH9TOLq92qZ7/mTEiH4ppoW70axpbOXoIlznK54OkV/PUqn9fceSxrnhVN9ORdtjMyP6Mr0WbYWe0dc9SdQns+p6A3eoLqREfEB33tRAgMBAAECggEAAIs52ELQRj5NTGKPkJuSJ26Ds3qiW/Ij6t7CTr+/X2xdkgwH2l1Jpb9rKUpOreT3zSo74xEcXBAkVAt4JO6ivHXEE2xJYoao4QO/a10+tWLOayMmb7nrRju3p4IyrvAGuoGPtuWWGv5WC/+DYtXFIM2S4pbZF9ArcPH2jQMCMl9odNP7V+xNZxS6seYmljn5R2V0+E1jg9KEkJKGedLDpLJOHzJfRRmuPWOSWpxxuXUW7rtSKuxjAXin3jgscVtOu3wCZ9TpRAbE3B7HTcECxqp6p1XhbxlPRlwqyi6UW5Kx1aJquRpg4DfFjdEeawbn4yjKK/WND+1MiBLtOHPOsQKBgQD2+eLoIofW7hbgwmxcijATqf/VQP6sIYddzBGDb74yodrI8gPn0XTwU9wEqnktEUHNrHuCe+YCcRSmCYSJC26imndetWxlPQIId9Aka9JhQ2xq9iuXKchAueOIGUxdM7dsvRGGVOLvtCTsqW6/yvEVhbe8Ijn9bTZUG3RFmlxoeQKBgQDsMacNMuI/S2tRZ1ECevhEek3J6qRLgcqWzNkQQ4hLTkR9A+qzu5JCGhmaQobJ2uJjtdrNQXu5StcqPbNSv2u0oHuEMwezDKesZY32OvdlmmeV054DLU+bYeh80kFaaz63G4sxMbgDdsrqA5xxgnuvfJlWxV8ycI0/QFtP8yCjmQKBgQCV+J+kvnMmPGWADg+nEfKnvi8v28vJ0oJUnrpzycMBE++63dspRbNwzDtqSepTR4thzT8iuQGuseQL/vOQFHUWIB4kUJ6Fy0oUwkyOETsq/Lo1KU7G+AQ16asU1efdIK5dRWIC5ED5tbZGT4yEwkMrAovTniUAkvTOle1A5r7+YQKBgQCcX38myOJrX0ZM3acPilRmGcb4gIWHjAWRc0vebaeFm+rSDc7MccmyQ89hhtvwNh8ePp7+t3TvRvJPAAyCI0NukbVU3+ggDafRBmdHduCl/uTHmBQMLGqBCABA637jGw+pcO3lgvI+MN7EseFYcTfsBgULIp8VKNkK4FPUCbY5OQKBgQDEx14p5ubSNF8VrEaEblXDe5PO84ezzJnqB/Qxyr3RvQ+CyI+DyDigGwBzZf3meUTlXPYmCqdkidrAOVtlmuuZ1YALqTMf6+v4WV8rvJV5fKZP+i61xoyeYEUTnWbHq0P61pGdmJP4IW9UEg4/ZEeWVZobYKnInuvjfaLtix8ggQ==