corelight/zeek-gozi-detectorZeek 기반 Gozi 뱅킹 멀웨어 탐지기.
이 Zeek 패키지는 Gozi 뱅킹 멀웨어 활동을 탐지합니다.
이 패키지가 찾는 RAR 파일은 다음 문서에서 다루어졌습니다:
또한 긴 base64 인코딩 URL도 이 패키지에서 탐지됩니다.
다음 명령어로 Zeek의 TSV 로그에서도 Gozi 활동을 찾을 수 있습니다:``` find /logs -name "http*" | parallel -j 10 zcat {} :::: - | zeek-cut host uri | awk -F '\t' '$2 ~ //(stilak|cook|vnc)(32|64).rar$/ || ($2 ~ /^/\w+/([a-zA-Z0-9/]|/?2/?F|/?2/?B|/?0/?A|/?0/?D){200,}.[a-zA-Z0-9]+$/ && gsub(///, "/", $2) > 10)'
## PCAP 파일
PCAP 출처: https://malware-traffic-analysis.net/2023/07/12/index.html
## 예제 로그:
### gozi.log 예제:```
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path gozi
#open 2023-07-24-19-00-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p http_method payload
#types time string addr port addr port string string
1689201023.169002 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/8jvrTb2D/c4CxLmogLgZQGC_2FQ_2B2b/Ma3ylmhq8i/MeT_2Fmtq1zDpHZZQ/2OknTIetuvPf/SqlzkcwbzWM/aFx0b70stnXODu/WDQ2wUhiUaYRbirzPbAvc/2V_2Feb1BeDPQaU0/WZs_2FbMUKJ37c4/Gf5YYgB_2B8BS7mcYa/jECotoj7R/7bH1bkdIXbwbqpU0Nryv/_2BfEwnTZ0On333QjdJ/fdFWYGQpQofXObilmWG0P_/2BS5YP7Tcj18X/cQoSxxb6/FYqDyT3sva2N6amcI32HXsv/n6pffb_2FO/UxvFILD91uIk2oNQx/DEmgyRV_2FLi/3pF67pmCpVP/mFnn0G63A1Sv9N/05KeIqFG3zHYuPPOU/1P.pct
1689201024.619787 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/IfjXSAQlkk/LWNR4tkuOMiXdy5H_/2F55TZ5Ulkmf/KZSJQNnlKNL/oXNw6o8qzjnHJh/42iAsB5AuQ8n_2FyMP9YN/iAK5Z4rM1kiabXH3/Tbf6F39oZk8a8mY/9CVAQTHkAlTev6Vstr/ir_2FniSr/BvZGpW5mVB5nr9pTRisy/xPxWcp7jW1doRbtDMhT/9qJZuk9sdFnLKTsj12Ald9/3B3TYfDuu18i7/7LNZfim3/7nt5T5HqNSKfJKcDB7vJpeR/BoPpPolfrA/Z_2F56SDXpQJw4TYJ/45pcw80raC9d/yeDiXFQDftm/RIxazSR_2BPJ0F/wL6l8KasDC6CAzVNLSL_2/F535_2BDNH1/tcGkkEMCZrS/i.pct
1689201025.545122 ClEkJM2Vm5giqnMf4h 10.7.12.121 49799 151.248.117.244 80 GET /uploaded/MsY1SyBRpp3LKx93fMeITx/w33QoEW7tSfHh/8_2Fqcx1/mAOJzt3teF4AUCrc8IBMkbm/8laKdMc_2F/A0s_2B6tfYEvyAcP_/2Bk_2Buvkjcq/80G4xrhnFAN/TCW76WZrbPDSMY/_2FhKbl7f8pmHGBET0Y_2/BvcMUzja7B7xdYYK/qwpg5fbrMu6AsJ8/Dejh0cXcFfYe8h75Yx/Fn3LZFhMy/29bQzFKZyZHoHgfyV1XJ/Lw1D14ehZUiPYfQxTWv/LlBNcxqMhthgso7PYl8tLq/JhO8H_2FKdEez/1uHkLyhp/SD1X5u0VHgJvzUkDhpUUhKb/Q6cyGyHP3A/UPnKN8bJKuY7qHpRC/r94GeIuEWP3a/G9Zo2.pct
1689201032.086164 C4J4Th3PJpwUYZZ6gc 10.7.12.121 49800 151.248.117.244 80 GET /uploaded/DjeJ0blPQ/_2BkfrDEoFQgD04wO2F7/Ojqqobto35jEVZ1IQyU/G7zu4_2BFUfhIMJcKkibbg/fjjRaEElICvmR/e5DoJnsG/vsx3T8eOiuXp0AlWknwttvf/A_2FrNprrb/bHnMsv4916Q0BUf_2/B3XIECBmUK_2/FW3G5XPXaPV/ySf6P_2BIXQe7C/q0IvZNIlHZt2c8lCjnMGY/BP81zPWMMzAUn3VS/Y_2BCg7CLJsM0vz/MloZ0Th38yNZOadE6L/qwrs9PKza/13Lw9jqWnbyh08rIXwcG/mMM0HdBwcj6NPi6_2FH/5qnQe2GM1T/ZuHEvxYT/j.pmg
1689201032.792223 CtPZjS20MLrsMUOJi2 10.7.12.121 49801 91.199.147.95 80 GET /vnc32.rar
1689201033.823106 CtPZjS20MLrsMUOJi2 10.7.12.121 49801 91.199.147.95 80 GET /vnc64.rar
1689201045.338855 C4J4Th3PJpwUYZZ6gc 10.7.12.121 49800 151.248.117.244 80 POST /uploaded/3lFSQwjxUfg8HgrTtqSS/ZKopMRdt0Jtv6ehOunO/ppBgdtF3YUX5Co9W0vX2OQ/UNZWu2BHmWHLi/4Pta3IUW/h8js8gl66mR4P51kp_2B1rV/l_2BDjFJoW/DhHjLJGFTtgPfY5qz/0jnqt8GbX_2F/M2R1QPMjPhA/1LDVR2FItKJXdJ/1qIKPwGyBNh80d_2BqfF_/2F6OR9A8MzQ8A1Mu/qqkL0hlaa4U4qkx/TrAV_2BpGP_2B6FnQc/TZAppMESi/SnlO5AU6khpDGRiOveBi/R4uVGlbArQZk3cDBamb/rekwL.dib
1689201092.103798 C37jN32gN3y3AZzyf6 10.7.12.121 49804 151.248.117.244 80 GET /uploaded/2bzPCygywLAsZWyvNxjbcR/cKuODU9uu8UJj/gDXKcy4d/pxB9zipofP8_2BeS_2BpJud/wkj0W_2BrO/D0paOzWNgyCiXYNe9/AsQMoH_2BRJg/GVsPSdgJRiE/zITTWUchGJIQxc/PZZSjCwXGLw7S5vL91vcA/oe3B5CUOEdkQKGto/2ktXW4RVt_2Fmbv/n4_2FHRpBrdDPlZiJh/KmaIFjefC/fI1TDKY_2Fi19DEaFCtf/tbJcxt2An0A0fA6gNH1/boadLZ34ffeu1q1ucG9FKH/EYecNdYZoQk50/PveWZCeq/k53trqCUnPKJ1m5xUDc0yho/XZNF99CD9fsHQ2/HTO0Ek.pmg
1689201102.721168 C37jN32gN3y3AZzyf6 10.7.12.121 49804 151.248.117.244 80 POST /uploaded/FjEF3XKaILeAQXFS7ZA/6ce9M8T8314qcvkufQ9O3S/JEiYn7jw1hdk_/2FAtv4Vn/N5GtGAMF_2FYvtXXK_2F4Zl/0Y5qJKSmBu/44at7WoJqMtrEfLU4/cCeZclRfpCKD/aqpRqtgj2sE/drWQE_2FO8cplq/lY0zN1yBj_2B61heqRGGa/5HcIhc_2FvLTthv2/zJpeMsgvDci4AdQ/JdEAEDTa1bhGI6VaRH/rQTuBAqF4/MKUC3UIYW2SYFTHwfKtZ/tqpLYYZ1oSbrStWcuxS/OOYuTMB0uaGg4_2Bq0zpwn/Gww.dib
1689201152.062519 CtxTCR2Yer0FR1tIBg 10.7.12.121 49809 151.248.117.244 80 GET /uploaded/Wbfe_2B11dG116Ncm/nQpZ3IruCPSM/3Lj73LAhcds/M336HbpbJFjPEL/ZgkdjdFIqBCjLtdnX14jQ/pQ5Bv86GIP5te5wH/8b4izrx5O9qiGfp/GRUC2Np0poTRCDkKkc/F1E4cQ1R6/lwssUMXdU1nBa8LCS0k_/2BId7kfbrkQVYBR50Dx/zW_2Bmfzi9fE7K8N9p4LoV/xI2jj2pDdJhUG/_2FG3di0/_2BhPTAOji4t57Awbk_2BoP/FD_2FSdzzj/Oy86TrwY_2BeLaoSb/T3HHtuhn_2Fe/V7LWds_2FAh/JDMBWxJ2ws7_2B/H3SE1djM5W2vA05PIQhD2/cANoEAshNec/AshCNLFh.pmg
1689201152.931165 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /vnc32.rar
1689201154.267014 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /vnc64.rar
1689201212.075480 CqlVyW1YwZ15RhTBc4 10.7.12.121 49812 151.248.117.244 80 GET /uploaded/2wXajjUK6yQe/Hf4yISpkavj/9iz17_2FpADpqe/FWDEQXEZFDkmT425JjzHt/yyAY_2FjOXJCcbQn/Uawx_2FYMnhoXhg/ibKz0SNEJa5T9jTj3f/6NOt_2Fa5/Ku8TE_2FdlXWmtildKLG/gZiwSpWV6ZG600H5kL3/fgOUNq4SopgajW6DchSOfD/ouyx1xA5AWRmw/H_2FnmjS/_2BFOQbTGn_2FGrFa8mb4aT/1gPcElQ69l/HjKo4TfTciPYAtacn/mMNHAQmFl5oI/k_2BpMEeXvn/EvX7gGlJyfJbja/AEj9oZdnWgTa24IDPHMcK/D_2B7fNjNY3qwhg_/2Bfk_2BexEKG8fb/_2B2V6tJ/Z.pmg
1689201212.545740 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /stilak32.rar
1689201213.629452 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /stilak64.rar
1689201224.113946 CqlVyW1YwZ15RhTBc4 10.7.12.121 49812 151.248.117.244 80 POST /uploaded/WXSLx9k_2B82HoW2/5_2BLUFBQld8l5T/qSTWooG_2FxVNQE46u/lEUybYtwS/COcE2tivLeuVegwAhJog/faALYpov_2FC8h5u5eO/fw3u8FebEwLjC7EtSs56sq/jeBDFyP8S3aoD/khK6K1bI/hFYNrfXYtNkDgime9sa_2Bf/PexBAh2LNK/x9DDabFXM4vy1FqMl/hiJw0kWrjo17/_2BEcPVh7np/NrWpuoNVXSAumZ/w5HpM98Gc8U_2Fd9mwtWQ/JslZMqJLjs5A2cHb/dPTxBByvm2dlxKs/QZAx0q5BQy/yyQ.dib
1689201272.155278 CLNN1k2QMum1aexUK7 10.7.12.121 49813 151.248.117.244 80 GET /uploaded/NpXONA6eXmuef0TniOWSt/sbrGBURPDr67_2B9/zugzDGAY9vrWyYE/EoCvKEsas2Wm6zMwGW/cMs90msiF/gnFvn30lzjaZ5h3PdKID/6g64fT4mJRE6B4R9WUT/HKA7lMal5mey_2FPlSOLtm/XhNIsdZRWX2jS/kdCbahFx/NR1EtG6hX9iAZdhHNUXacNX/flRI_2FocO/5pJ6z880JnKjeUa00/au7MK4OJL0GY/Z3ksfmVR9IV/r3UCP3HGpLy_2F/xc5XMCSKRsk8WSBjGbRqu/PGOO7SV5Onm8JPaO/a5E2tVpUMNRT_2B/7iu1sJ94FgCmULIGUx/2xJ8pAqlA/YJI.pmg
1689201272.641361 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /cook32.rar
1689201273.697406 CpmdRlaUoJLN3uIRa 10.7.12.121 49810 91.199.147.95 80 GET /cook64.rar
1689201284.289498 CLNN1k2QMum1aexUK7 10.7.12.121 49813 151.248.117.244 80 POST /uploaded/OAoLm55_2B2OCF/rEWUf7X9OOkiz59zPQg3E/Aj5owhhIbmbWgx54/UV8kPJrYxDAnkrg/OKPbChY4KRO7PEjk_2/B43R3ufTu/uvyMeJAMJmrlIBLpmBfP/L4v_2FB_2BBaG4ladWq/3aMpm2yqqMZXZu3jf_2FVA/VTO_2FUe28w3t/tFzcTS3R/xc7hl9jMM_2BB_2BDIlMD_2/BqSLR5qL96/eKD0WGu5ydPqFhYg_/2BXCIyssztxU/cq9urrcafTw/mSgYrRpEyTyV0z/jbJLU8aVKuIk3v9MuxmYJ/_2B60trr/CQBxcRJ_2B/c.dib
1689201341.330163 CiyBAq1bBLNaTiTAc 10.7.12.121 49814 151.248.117.244 80 GET /uploaded/7chaPmanW7OMxzoNzJHScgR/EHmxsmATVa/jTfmCcJ6135be0wkb/Hg9peWe_2FuD/DggTpUxGdAt/a_2Bgx78GlYrfc/oijiGdGd1d8ljosgBQQti/4TwXqFBIUG941OT2/VKCQX023FLHkcvB/1b1mWR2MFml0MzW54N/ENj7AuThp/zdzvrxl2cpTy7sAtXYGN/FABQ17R4mAyxhHDee1G/1y87US30E6nykjpjJWy5b_/2BNhvSOgcLNRS/gmeCK_2F/_2FStMa4HGsB_2Bc5R6IDNr/rcWw1GvShf/DGf_2BhMmSqTsvWDQ/iJGrX9Z6avCeA/Iy.pmg