首页 ›资讯› 安全 › 查看内容

Windows、MacOS、Linux无一幸免间谍软件CrossRAT已战胜各大杀软

2018-1-30 15:33 |来自: 互联网 4997 59

摘要: 通常来讲，Linux和Mac OS操作系统被认为具有更高的安全性。但如果你认为它们就不容易受到计算机病毒的攻击，那么你可能需要仔细阅读下文。越开越多的网络犯罪分子正在开始使用一种新的“无法检测”的恶意软件，其目 ...

通常来讲，Linux和Mac OS操作系统被认为具有更高的安全性。但如果你认为它们就不容易受到计算机病毒的攻击，那么你可能需要仔细阅读下文。

越开越多的网络犯罪分子正在开始使用一种新的“无法检测”的恶意软件，其目标包括运行Windows、macOS、Solaris和Linux系统的设备。

这个新型的跨平台恶意软件名为“CrossRAT”，是一种远程访问木马程序，针对当前四种流行的计算机操作系统，使得攻击者能够远程操纵计算机系统、屏幕截图以及运行任意可执行文件。

据研究人员介绍，CrossRAT是由发起网络间谍活动“Dark Caracal”背后的APT组织开发的。该组织在传播CrossRAT时，并不依靠任何零日漏洞；相反，他们选择了最为基本的社会工程。

具体来讲，该组织通过利用Facebook群组和WhatsApp消息上的帖子来诱导受害者访问由黑客控制的虚假网站，由此下载用于传播CrossRAT的恶意应用程序。

另外，由于CrossRAT是采用Java编程语言编写的，这使得研究人员能够很容易对其进行反编译。

根据VirusTotal（一个提供免费的可疑文件分析服务的网站）的扫描结果，在目前流行的58款防病毒软件中，只有两款可以检测到CrossRAT。

美国国家安全局（NSA）前雇员Patrick Wardle对CrossRAT进行了深入分析，并提供了一份全面的技术概述，包括其持久性机制、命令和控制通信以及它的能力。

CrossRAT 0.1 - 跨平台持续监控恶意软件

一旦在目标系统上执行，植入物（hmar6.jar）首先检查正在运行的操作系统，然后针对性地安装对应的程序。

除此之外，hmar6.jar还会尝试收集有关受感染系统的信息，包括已安装的操作系统版本、内核版本和体系结构

对于Linux系统，CrossRAT会尝试查询systemd服务文件以确定操作系统版本，如Arch Linux、Centos、Debian、Kali Linux、Fedora和Linux Mint等等。

CrossRAT会在之后实现针对不同操作系统特定的持久性机制，它会在受感染系统重新启动时自动执行，并将其自身注册到C＆C服务器，进而允许远程攻击者发送命令以及窃取数据。

CrossRAT包含未激活的键盘记录模块

CrossRAT被设计成具有一些基本的监视功能，只有在接收到来自C＆C服务器的各种预定义命令时才会被触发。

Patrick注意到，CrossRAT在被编程时使用了“ jnativehook”。这是一个开源的Java库，用来监听键盘和鼠标事件。但在这个版本（0.1）的CrossRAT中，并没有任何预定义命令被用来激活这个键盘记录功能。

如何检查自己的设备是否感染了CrossRAT？

由于CrossRAT针对不同操作系统的会以不同的形式存在，因此检查自己的设备是否感染了CrossRAT的方法也有所不同，这将取决于你正在运行的操作系统。

针对Windows：

检查“HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run”注册表项。

如果被感染，它将包含一个命令，包含java、-jar和mediamgrs.jar。

针对macOS：

检查“�9�1/ Library”中的jar文件“mediamgrs.jar”。

还可以在“/ Library / LaunchAgent”或“�9�1/ Library / LaunchAgents”中查找启动代理（名为mediamgrs.plist）。

针对Linux：

在“/ usr / var”中检查jar文件“mediamgrs.jar”。

还可以在“�9�1/ .config / autostar”t中查找一个名为“mediamgrs.desktop”的“autostart”文件。

本文由黑客视界综合网络整理，图片源自网络；转载请注明“转自黑客视界”，并附上链接。

, groupId: 6516272368564830723, itemId: 6516272368564830723, type: 2, subInfo: { isOriginal: false, source: 黑客视界, time: 2018-01-29 09:04:50 }, tagInfo: { tags: [{"name":"Linux"},{"name":"杀毒软件"},{"name":"Windows"},{"name":"Mac"},{"name":"黑客"}], groupId: 6516272368564830723, itemId: 6516272368564830723, repin: 0, }, has_extern_link: 0 }, commentInfo: { groupId: 6516272368564830723, itemId: 6516272368564830723, comments_count: 15, ban_comment: 0 }, mediaInfo: { uid: 76207630046, name: 黑客视界, avatar: //p3.pstatp.com/large/46e80003c98b9bfd77be, openUrl: /c/user/76207630046/, follow: false }, pgcInfo: {"media_info":{"open_url":"/c/user/76207630046/","avatar_url":"https://p3.pstatp.com/large/46e80003c98b9bfd77be","media_id":1584317604543502,"name":"黑客视界","user_verified":false},"articles":[{"item_id":"6516641282746483208","url":"/item/6516641282746483208","title":"美国ATM机遭遇“Jackpotting” 攻击能像老虎机一样吐出现金"},{"item_id":"6516641102089421316","url":"/item/6516641102089421316","title":"下载量过亿的三款索尼克系列游戏应用被指泄露用户敏感数据"},{"item_id":"6516640979930317319","url":"/item/6516640979930317319","title":"流行开源论坛软件phpBB官方下载链接遭黑客“偷梁换柱”"},{"item_id":"6516640826271990285","url":"/item/6516640826271990285","title":"伊朗APT组织OilRig携新后门锁定中东国家政府、金融、教育机构"}]}, feedInfo: { url: /api/pc/feed/, category: __all__, initList: [{"comments_count":49,"is_related":true,"is_feed_ad":false,"is_diversion_page":false,"title":"双网关，可以上内网或外网。如何同时上内网和外网？","single_mode":true,"gallary_image_count":2,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515759724296667406/","source":"悟空问答","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5b0100036f0693b4ff2e","group_id":"6515759724296667406"},{"comments_count":6,"media_avatar_url":"//p4.pstatp.com/large/5b41000446f29cd05c8e","is_feed_ad":false,"is_diversion_page":false,"title":"Blackberry OS灭亡！黑莓抱安卓大腿","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6514497670076170765/","source":"热读数码","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5b4900046fa7a6312c5c","group_id":"6514497670076170765","is_related":true,"media_url":"/c/user/85900217519/"},{"comments_count":26,"media_avatar_url":"//p6.pstatp.com/large/5874000665afa96d0b09","is_feed_ad":false,"is_diversion_page":false,"title":"U盘怎么设置密码保护重要文件教程","single_mode":true,"gallary_image_count":9,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6514636504680104462/","source":"金色的眼睛","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5b5000003e84e86955a8","group_id":"6514636504680104462","is_related":true,"media_url":"/c/user/83594821999/"},{"comments_count":9,"media_avatar_url":"//p2.pstatp.com/large/54ec001511cf6b1b0f0f","is_feed_ad":false,"is_diversion_page":false,"title":"C++ 开发，是选择基于 Linux 还是 Windows 平台？","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6515251849908453892/","source":"GermsTech","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/5b5500012a79e676c900","group_id":"6515251849908453892","is_related":true,"media_url":"/c/user/78773093016/"},{"comments_count":6,"media_avatar_url":"//p10.pstatp.com/large/3642001a852e99a55c67","is_feed_ad":false,"is_diversion_page":false,"title":"处理器漏洞，给PC用户两条建议","single_mode":true,"gallary_image_count":2,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6516283075943465486/","source":"知储侠","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5e6f0000f389903f2e4c","group_id":"6516283075943465486","is_related":true,"media_url":"/c/user/50812868091/"},{"comments_count":6,"media_avatar_url":"//p3.pstatp.com/large/434c00019c81502bc8e7","is_feed_ad":false,"is_diversion_page":false,"title":"管理服务器的：nginx","single_mode":true,"gallary_image_count":1,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6516296926294442509/","source":"程序猿阿锐","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p9.pstatp.com/list/190x124/5b5a00035bdeb99df524","group_id":"6516296926294442509","is_related":true,"media_url":"/c/user/23282248558/"},{"comments_count":91,"media_avatar_url":"//p9.pstatp.com/large/46e60000ab1c7c1edf89","is_feed_ad":false,"is_diversion_page":false,"title":"想换电脑系统，为什么只能选Win？","single_mode":true,"gallary_image_count":7,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6514545220808344077/","source":"稀饭中的盐","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5b4b000180fb91e26c70","group_id":"6514545220808344077","is_related":true,"media_url":"/c/user/76091291194/"},{"comments_count":258,"media_avatar_url":"//p4.pstatp.com/large/46c500052acb6fa38178","is_feed_ad":false,"is_diversion_page":false,"title":"电脑忘记密码不用重装系统也可以进入系统的方法","single_mode":true,"gallary_image_count":6,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515926344549794312/","source":"王文新","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":130,"image_url":"//p3.pstatp.com/list/190x124/509600033731be06643f","group_id":"6515926344549794312","is_related":true,"media_url":"/c/user/5931095751/"},{"comments_count":213,"media_avatar_url":"//p1.pstatp.com/large/16ab0000c69444edcb31","is_feed_ad":false,"is_diversion_page":false,"title":"除了百度，其实还有很多不为人知的搜索引擎","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515380907723981319/","source":"木子淇","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":194,"image_url":"//p1.pstatp.com/list/190x124/5b5200036e126e906fdf","group_id":"6515380907723981319","is_related":true,"media_url":"/c/user/50517704788/"},{"comments_count":104,"media_avatar_url":"//p1.pstatp.com/large/1bf40004aa925e5840cc","is_feed_ad":false,"is_diversion_page":false,"title":"Linux之父27年前写的这段代码，你见过吗？","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6514556638882431496/","source":"W3Cschool","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":266,"image_url":"//p3.pstatp.com/list/190x124/5b4e0001178a79e52e14","group_id":"6514556638882431496","is_related":true,"media_url":"/c/user/50001408756/"},{"comments_count":167,"media_avatar_url":"//p10.pstatp.com/large/438f00004eac8bb7ece8","is_feed_ad":false,"is_diversion_page":false,"title":"卸载吧！电脑还用PDF阅读器，格式转化大师？只要一款就够了！","single_mode":true,"gallary_image_count":13,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516090106531545613/","source":"阿根Excel","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":44,"image_url":"//p9.pstatp.com/list/190x124/5b5c0001b5b55c76caf9","group_id":"6516090106531545613","is_related":true,"media_url":"/c/user/70815695983/"},{"comments_count":103,"media_avatar_url":"//p1.pstatp.com/large/3e5b0003e8b7bba867b3","is_feed_ad":false,"is_diversion_page":false,"title":"台湾黑客发现一张动图能宕掉一台服务器，运维这个腊月又要忙了","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6514551846428738055/","source":"海阳顶端","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":236,"image_url":"//p1.pstatp.com/list/190x124/5b4900057373594447ef","group_id":"6514551846428738055","is_related":true,"media_url":"/c/user/3668637589/"},{"comments_count":25,"media_avatar_url":"//p3.pstatp.com/large/46ed00036bc611c143cf","is_feed_ad":false,"is_diversion_page":false,"title":"Excel函数公式：如此漂亮的动图，你会制作吗","single_mode":true,"gallary_image_count":6,"middle_mode":true,"has_video":false,"video_duration_str":null,"source_url":"/group/6516127151987622408/","source":"Excel函数公式","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":9,"image_url":"//p1.pstatp.com/list/190x124/5e6f0000816fda54a8bd","group_id":"6516127151987622408","is_related":true,"media_url":"/c/user/59000799736/"},{"comments_count":3,"media_avatar_url":"//p1.pstatp.com/large/46de0002c0d9d2ad5f88","is_feed_ad":false,"is_diversion_page":false,"title":"教你如何从小白成长为月薪几万的嵌入式工程师","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516039968593281544/","source":"wewillknow","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p3.pstatp.com/list/190x124/5e710000e78b33cf3663","group_id":"6516039968593281544","is_related":true,"media_url":"/c/user/74097870925/"},{"comments_count":79,"media_avatar_url":"//p3.pstatp.com/large/150c000decc4ac5d1968","is_feed_ad":false,"is_diversion_page":false,"title":"你知道为什么黑客不去黑了支付宝吗？","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515588334205534723/","source":"黑客与科技","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":83,"image_url":"//p3.pstatp.com/list/190x124/5b5300048621c513ba8b","group_id":"6515588334205534723","is_related":true,"media_url":"/c/user/4220881670/"},{"comments_count":41,"media_avatar_url":"//p5a.pstatp.com/large/438f000271c88f3cfc82","is_feed_ad":false,"is_diversion_page":false,"title":"固态硬盘放久了无法格式化分区，无法初始化？问题原来如此","single_mode":true,"gallary_image_count":4,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516468347687666179/","source":"楼台","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":29,"image_url":"//p1.pstatp.com/list/190x124/5e7100048ebeb0e2e65d","group_id":"6516468347687666179","is_related":true,"media_url":"/c/user/3800943649/"},{"comments_count":7,"media_avatar_url":"//p1.pstatp.com/large/16ab0015ac854237311b","is_feed_ad":false,"is_diversion_page":false,"title":"Python操作MySQL数据库的三种方法","single_mode":true,"gallary_image_count":16,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516473434988347912/","source":"python空白","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":1,"image_url":"//p3.pstatp.com/list/190x124/5e730000133113590266","group_id":"6516473434988347912","is_related":true,"media_url":"/c/user/56929627307/"},{"comments_count":36,"media_avatar_url":"//p4.pstatp.com/large///p3.pstatp.com/thumb/56900005813c8edb6037","is_feed_ad":false,"is_diversion_page":false,"title":"电脑硬盘坏道修复，没你想的那么复杂","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6516438271608750600/","source":"启航工作室","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":24,"image_url":"//p1.pstatp.com/list/190x124/5b590005a8ef120ddf06","group_id":"6516438271608750600","is_related":true,"media_url":"/c/user/59258730065/"},{"comments_count":10,"media_avatar_url":"//p1.pstatp.com/large/50980002254e4105333b","is_feed_ad":false,"is_diversion_page":false,"title":"开源软件Mycat数据库分库分表中间件","single_mode":true,"gallary_image_count":5,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515190389001945607/","source":"铬家数据","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":15,"image_url":"//p3.pstatp.com/list/190x124/5b500004c8075b6341e5","group_id":"6515190389001945607","is_related":true,"media_url":"/c/user/81559914758/"},{"comments_count":6,"media_avatar_url":"//p3.pstatp.com/large/5b4b000533ec765e5aeb","is_feed_ad":false,"is_diversion_page":false,"title":"蓝牙掌击是手机拒绝服务攻击的典型，很多手机都容易受到蓝牙掌击","single_mode":true,"gallary_image_count":3,"middle_mode":false,"has_video":false,"video_duration_str":null,"source_url":"/group/6515193541877039624/","source":"数码界面","more_mode":null,"article_genre":"article","has_gallery":false,"video_play_count":0,"image_url":"//p1.pstatp.com/list/190x124/5b540000fc53d95beda0","group_id":"6515193541877039624","is_related":true,"media_url":"/c/user/86632056524/"}] }, shareInfo: { shareUrl: https://m.toutiao.com/item/6516272368564830723/, abstract: 通常来讲，Linux和MacOS操作系统被认为具有更高的安全性。但如果你认为它们就不容易受到计算机病毒的攻击，那么你可能需要仔细阅读下文。

声明：文章版权归原作者所有部分文章转自互联网如有侵权请联系 [邮箱地址] 删除