2025/05/03 1
Shellcode ๋ฆฌ๋ฒ„์‹ฑ (Cobalt Strike Beacon)

์ด๋ฒˆ์—๋Š” ์‰˜์ฝ”๋“œ๋ฅผ ๋ถ„์„ํ•ด๋ณด๊ฒ ์Šต๋‹ˆ๋‹ค. ์ƒ˜ํ”Œ ํ•ด์‹œ(SHA256)๋Š” d26d5e9e0b05f94be8b86dc7410604cac85557a8f7bdf709beb95ee8cbb98c60์ž…๋‹ˆ๋‹ค. โ—‹ ์ƒ˜ํ”Œ ์ •๋ณด ์ˆ˜์ง‘์ƒ˜ํ”Œ์„ DiE๋กœ ํ™•์ธํ•ด๋ณด๋ฉด 32๋น„ํŠธ PE ๋ฐ”์ด๋„ˆ๋ฆฌ์ž…๋‹ˆ๋‹ค.๊ทธ๋ฆฌ๊ณ  MinGW ์ปดํŒŒ์ผ๋Ÿฌ๋กœ ์ปดํŒŒ์ผ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค.MinGW (Minimalist GNU for Windows)Windows์šฉ GCC(GNU Complier Colliection) ํฌํŠธWindows ํ™˜๊ฒฝ์—์„œ C/C++, Fortan ๋“ฑ์˜ ํ”„๋กœ๊ทธ๋žจ์„ ์ปดํŒŒ์ผํ•  ์ˆ˜ ์žˆ๊ฒŒ ํ•ด์ฃผ๋Š” ๋„๊ตฌ์ž…๋‹ˆ๋‹ค.์œˆ๋„์šฐ์—์„œ ๋ฆฌ๋ˆ…์Šค ์Šคํƒ€์ผ์˜ GCC ์ปดํŒŒ์ผ๋Ÿฌ๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•ฉ๋‹ˆ๋‹ค.MinGW๋Š” ๋‹จ์ˆœํ•œ ๋„ค์ดํ‹ฐ๋ธŒ EXE ํ”„๋กœ๊ทธ๋žจ, ์‰˜์ฝ”๋“œ๋ฅผ ๋งŒ๋“ค ๋•Œ ๋งŽ์ด ์‚ฌ์šฉ๋ฉ๋‹ˆ๋‹ค. PE-bear ..
Malware/malware analysis 2025.05.03
1
๋”๋ณด๊ธฐ

ํ‹ฐ์Šคํ† ๋ฆฌํˆด๋ฐ”