corelight/zeek-gozi-detectorUn détecteur de malware bancaire Gozi basé sur Zeek.
Ce package Zeek détecte l'activité du malware bancaire Gozi.
Les fichiers RAR que ce package recherche ont été présentés dans les articles suivants :
En outre, les longues URL encodées en base64 sont également détectées par ce package.
Vous pouvez également trouver l'activité de Gozi avec la commande suivante sur les journaux TSV de Zeek :``` find /logs -name "http*" | parallel -j 10 zcat {} :::: - | zeek-cut host uri | awk -F '\t' '$2 ~ //(stilak|cook|vnc)(32|64).rar$/ || ($2 ~ /^/\w+/([a-zA-Z0-9/]|/?2/?F|/?2/?B|/?0/?A|/?0/?D){200,}.[a-zA-Z0-9]+$/ && gsub(///, "/", $2) > 10)'
## PCAPs
Source des PCAP: https://malware-traffic-analysis.net/2023/07/12/index.html
## Exemples de logs:
### Exemple: gozi.log```
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path gozi
#open 2023-07-24-19-00-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p http_method payload
#types time string addr port addr port string string
1689201023.169002 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/8jvrTb2D/c4CxLmogLgZQGC_2FQ_2B2b/Ma3ylmhq8i/MeT_2Fmtq1zDpHZZQ/2OknTIetuvPf/SqlzkcwbzWM/aFx0b70stnXODu/WDQ2wUhiUaYRbirzPbAvc/2V_2Feb1BeDPQaU0/WZs_2FbMUKJ37c4/Gf5YYgB_2B8BS7mcYa/jECotoj7R/7bH1bkdIXbwbqpU0Nryv/_2BfEwnTZ0On333QjdJ/fdFWYGQpQofXObilmWG0P_/2BS5YP7Tcj18X/cQoSxxb6/FYqDyT3sva2N6amcI32HXsv/n6pffb_2FO/UxvFILD91uIk2oNQx/DEmgyRV_2FLi/3pF67pmCpVP/mFnn0G63A1Sv9N/05KeIqFG3zHYuPPOU/1P.pct
1689201024.619787 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/IfjXSAQlkk/LWNR4tkuOMiXdy5H_/2F55TZ5Ulkmf/KZSJQNnlKNL/oXNw6o8qzjnHJh/42iAsB5AuQ8n_2FyMP9YN/iAK5Z4rM1kiabXH3/Tbf6F39oZk8a8mY/9CVAQTHkAlTev6Vstr/ir_2FniSr/BvZGpW5mVB5nr9pTRisy/xPxWcp7jW1doRbtDMhT/9qJZuk9sdFnLKTsj12Ald9/3B3TYfDuu18i7/7LNZfim3/7nt5T5HqNSKfJKcDB7vJpeR/BoPpPolfrA/Z_2F56SDXpQJw4TYJ/45pcw80raC9d/yeDiXFQDftm/RIxazSR_2BPJ0F/wL6l8KasDC6CAzVNLSL_2/F535_2BDNH1/tcGkkEMCZrS/i.pct
1689201025.545122 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/MsY1SyBRpp3LKx93fMeITx/w33QoEW7tSfHh/8_2Fqcx1/mAOJzt3teF4AUCrc8IBMkbm/8laKdMc_2F/A0s_2B6tfYEvyAcP_/2Bk_2Buvkjcq/80G4xrhnFAN/TCW76WZrbPDSMY/_2FhKbl7f8pmHGBET0Y_2/BvcMUzja7B7xdYYK/qwpg5fbrMu6AsJ8/Dejh0cXcFfYe8h75Yx/Fn3LZFhMy/29bQzFKZyZHoHgfyV1XJ/Lw1D14ehZUiPYfQxTWv/LlBNcxqMhthgso7PYl8tLq/JhO8H_2FKdEez/1uHkLyhp/SD1X5u0VHgJvzUkDhpUUhKb/Q6cyGyHP3A/UPnKN8bJKuY7qHpRC/r94GeIuEWP3a/G9Zo2.pct
1689201032.086164 C4J4Th3PJpwUYZZ6gc 10.7.12.121 49800 151.248.117.244 80 GET /uploaded/DjeJ0blPQ/_2BkfrDEoFQgD04wO2F7/Ojqqobto35jEVZ1IQyU/G7zu4_2BFUfhIMJcKkibbg/fjjRaEElICvmR/e5DoJnsG/vsx3T8eOiuXp0AlWknwttvf/A_2FrNprrb/bHnMsv4916Q0BUf_2/B3XIECBmUK_2/FW3G5XPXaPV/ySf6P_2BIXQe7C/q0IvZNIlHZt2c8lCjnMGY/BP81zPWMMzAUn3VS/Y_2BCg7CLJsM0vz/MloZ0Th38yNZOadE6L/qwrs9PKza/13Lw9jqWnbyh08rIXwcG/mMM0HdBwcj6NPi6_2FH/5qnQe2GM1T/ZuHEvxYT/j.pmg
1689201032.792223 CtPZjS20MLrsMUOJi2 10.7.12.121 49801 91.199.147.95 80 GET /vnc32.rar
1689201033.823106 CtPZjS20MLrsMUOJi2 10.7.12.121 49801 91.199.147.95 80 GET /vnc64.rar
1689201045.338855 C4J4Th3PJpwUYZZ6gc 10.7.12.121 49800 151.248.117.244 80 POST /uploaded/3lFSQwjxUfg8HgrTtqSS/ZKopMRdt0Jtv6ehOunO/ppBgdtF3YUX5Co9W0vX2OQ/UNZWu2BHmWHLi/4Pta3IUW/h8js8gl66mR4P51kp_2B1rV/l_2BDjFJoW/DhHjLJGFTtgPfY5qz/0jnqt8GbX_2F/M2R1QPMjPhA/1LDVR2FItKJXdJ/1qIKPwGyBNh80d_2BqfF_/2F6OR9A8MzQ8A1Mu/qqkL0hlaa4U4qkx/TrAV_2BpGP_2B6FnQc/TZAppMESi/SnlO5AU6khpDGRiOveBi/R4uVGlbArQZk3cDBamb/rekwL.dib
1689201092.103798 C37jN32gN3y3AZzyf6 10.7.12.121 49804 151.248.117.244 80 GET /uploaded/2bzPCygywLAsZWyvNxjbcR/cKuODU9uu8UJj/gDXKcy4d/pxB9zipofP8_2BeS_2BpJud/wkj0W_2BrO/D0paOzWNgyCiXYNe9/AsQMoH_2BRJg/GVsPSdgJRiE/zITTWUchGJIQxc/PZZSjCwXGLw7S5vL91vcA/oe3B5CUOEdkQKGto/2ktXW4RVt_2Fmbv/n4_2FHRpBrdDPlZiJh/KmaIFjefC/fI1TDKY_2Fi19DEaFCtf/tbJcxt2An0A0fA6gNH1/boadLZ34ffeu1q1ucG9FKH/EYecNdYZoQk50/PveWZCeq/k53trqCUnPKJ1m5xUDc0yho/XZNF99CD9fsHQ2/HTO0Ek.pmg
1689201102.721168 C37jN32gN3y3AZzyf6 10.7.12.121 49804 151.248.117.244 80 POST /uploaded/FjEF3XKaILeAQXFS7ZA/6ce9M8T8314qcvkufQ9O3S/JEiYn7jw1hdk_/2FAtv4Vn/N5GtGAMF_2FYvtXXK_2F4Zl/0Y5qJKSmBu/44at7WoJqMtrEfLU4/cCeZclRfpCKD/aqpRqtgj2sE/drWQE_2FO8cplq/lY0zN1yBj_2B61heqRGGa/5HcIhc_2FvLTthv2/zJpeMsgvDci4AdQ/JdEAEDTa1bhGI6VaRH/rQTuBAqF4/MKUC3UIYW2SYFTHwfKtZ/tqpLYYZ1oSbrStWcuxS/OOYuTMB0uaGg4_2Bq0zpwn/Gww.dib
1689201152.062519 CtxTCR2Yer0FR1tIBg 10.7.12.121 49809 151.248.117.244 80 GET /uploaded/Wbfe_2B11dG116Ncm/nQpZ3IruCPSM/3Lj73LAhcds/M336HbpbJFjPEL/ZgkdjdFIqBCjLtdnX14jQ/pQ5Bv86GIP5te5wH/8b4izrx5O9qiGfp/GRUC2Np0poTRCDkKkc/F1E4cQ1R6/lwssUMXdU1nBa8LCS0k_/2BId7kfbrkQVYBR50Dx/zW_2Bmfzi9fE7K8N9p4LoV/xI2jj2pDdJhUG/_2FG3di0/_2BhPTAOji4t57Awbk_2BoP/FD_2FSdzzj/Oy86TrwY_2BeLaoSb/T3HHtuhn_2Fe/V7LWds_2FAh/JDMBWxJ2ws7_2B/H3SE1djM5W2vA05PIQhD2/cANoEAshNec/AshCNLFh.pmg
1689201152.931165 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /vnc32.rar
1689201154.267014 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /vnc64.rar
1689201212.075480 CqlVyW1YwZ15RhTBc4 10.7.12.121 49812 151.248.117.244 80 GET /uploaded/2wXajjUK6yQe/Hf4yISpkavj/9iz17_2FpADpqe/FWDEQXEZFDkmT425JjzHt/yyAY_2FjOXJCcbQn/Uawx_2FYMnhoXhg/ibKz0SNEJa5T9jTj3f/6NOt_2Fa5/Ku8TE_2FdlXWmtildKLG/gZiwSpWV6ZG600H5kL3/fgOUNq4SopgajW6DchSOfD/ouyx1xA5AWRmw/H_2FnmjS/_2BFOQbTGn_2FGrFa8mb4aT/1gPcElQ69l/HjKo4TfTciPYAtacn/mMNHAQmFl5oI/k_2BpMEeXvn/EvX7gGlJyfJbja/AEj9oZdnWgTa24IDPHMcK/D_2B7fNjNY3qwhg_/2Bfk_2BexEKG8fb/_2B2V6tJ/Z.pmg
1689201212.545740 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /stilak32.rar
1689201213.629452 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /stilak64.rar
1689201224.113946 CqlVyW1YwZ15RhTBc4 10.7.12.121 49812 151.248.117.244 80 POST /uploaded/WXSLx9k_2B82HoW2/5_2BLUFBQld8l5T/qSTWooG_2FxVNQE46u/lEUybYtwS/COcE2tivLeuVegwAhJog/faALYpov_2FC8h5u5eO/fw3u8FebEwLjC7EtSs56sq/jeBDFyP8S3aoD/khK6K1bI/hFYNrfXYtNkDgime9sa_2Bf/PexBAh2LNK/x9DDabFXM4vy1FqMl/hiJw0kWrjo17/_2BEcPVh7np/NrWpuoNVXSAumZ/w5HpM98Gc8U_2Fd9mwtWQ/JslZMqJLjs5A2cHb/dPTxBByvm2dlxKs/QZAx0q5BQy/yyQ.dib
1689201272.155278 CLNN1k2QMum1aexUK7 10.7.12.121 49813 151.248.117.244 80 GET /uploaded/NpXONA6eXmuef0TniOWSt/sbrGBURPDr67_2B9/zugzDGAY9vrWyYE/EoCvKEsas2Wm6zMwGW/cMs90msiF/gnFvn30lzjaZ5h3PdKID/6g64fT4mJRE6B4R9WUT/HKA7lMal5mey_2FPlSOLtm/XhNIsdZRWX2jS/kdCbahFx/NR1EtG6hX9iAZdhHNUXacNX/flRI_2FocO/5pJ6z880JnKjeUa00/au7MK4OJL0GY/Z3ksfmVR9IV/r3UCP3HGpLy_2F/xc5XMCSKRsk8WSBjGbRqu/PGOO7SV5Onm8JPaO/a5E2tVpUMNRT_2B/7iu1sJ94FgCmULIGUx/2xJ8pAqlA/YJI.pmg
1689201272.641361 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /cook32.rar
1689201273.697406 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /cook64.rar
1689201284.289498 CLNN1k2QMum1aexUK7 10.7.12.121 49813 151.248.117.244 80 POST /uploaded/OAoLm55_2B2OCF/rEWUf7X9OOkiz59zPQg3E/Aj5owhhIbmbWgx54/UV8kPJrYxDAnkrg/OKPbChY4KRO7PEjk_2/B43R3ufTu/uvyMeJAMJmrlIBLpmBfP/L4v_2FB_2BBaG4ladWq/3aMpm2yqqMZXZu3jf_2FVA/VTO_2FUe28w3t/tFzcTS3R/xc7hl9jMM_2BB_2BDIlMD_2/BqSLR5qL96/eKD0WGu5ydPqFhYg_/2BXCIyssztxU/cq9urrcafTw/mSgYrRpEyTyV0z/jbJLU8aVKuIk3v9MuxmYJ/_2B60trr/CQBxcRJ_2B/c.dib
1689201341.330163 CiyBAq1bBLNaTiTAc 10.7.12.121 49814 151.248.117.244 80 GET /uploaded/7chaPmanW7OMxzoNzJHScgR/EHmxsmATVa/jTfmCcJ6135be0wkb/Hg9peWe_2FuD/DggTpUxGdAt/a_2Bgx78GlYrfc/oijiGdGd1d8ljosgBQQti/4TwXqFBIUG941OT2/VKCQX023FLHkcvB/1b1mWR2MFml0MzW54N/ENj7AuThp/zdzvrxl2cpTy7sAtXYGN/FABQ17R4mAyxhHDee1G/1y87US30E6nykjpjJWy5b_/2BNhvSOgcLNRS/gmeCK_2F/_2FStMa4HGsB_2Bc5R6IDNr/rcWw1GvShf/DGf_2BhMmSqTsvWDQ/iJGrX9Z6avCeA/Iy.pmg