analyzing-supply-chain-malware-artifacts

分析供应链恶意软件制品

概述

供应链攻击会攻陷合法的软件分发渠道，通过受信任的更新机制投递恶意软件。著名案例包括 SolarWinds SUNBURST（2020 年，影响 18,000+ 客户）、3CX SmoothOperator（2023 年，一场源自 Trading Technologies 的级联供应链攻击），以及众多 npm/PyPI 软件包投毒活动。分析工作包括：将植入木马的二进制文件与合法版本进行对比、识别构建制品中的注入代码、检查代码签名的异常情况，并追踪从初始入侵到载荷投递的感染链。截至 2025 年，供应链攻击占所有数据泄露事件的 30%，较往年增长了 100%。

何时使用

• 当调查安全事件且需要分析供应链恶意软件制品时
• 当为该领域构建检测规则或威胁狩猎查询时
• 当 SOC 分析师需要针对此类分析的结构化流程时
• 当验证相关攻击技术的安全监控覆盖情况时

前提条件

• Python 3.9+，并安装 pefile、ssdeep、hashlib
• 二进制差异比较工具（BinDiff、Diaphora）
• 代码签名验证工具（sigcheck、codesign）
• 软件成分分析（SCA）工具
• 可访问用于对比的合法软件版本
• 软件包仓库监控（npm、PyPI、NuGet）

工作流

步骤 1：二进制对比分析

#!/usr/bin/env python3
"""Compare trojanized binary against legitimate version."""
import hashlib
import pefile
import sys
import json


def compare_pe_files(legitimate_path, suspect_path):
    """Compare PE file structures between legitimate and suspect versions."""
    legit_pe = pefile.PE(legitimate_path)
    suspect_pe = pefile.PE(suspect_path)

    report = {"differences": [], "suspicious_sections": [], "import_changes": []}

    # Compare sections
    legit_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in legit_pe.sections}

    suspect_sections = {s.Name.rstrip(b'\x00').decode(): {
        "size": s.SizeOfRawData,
        "entropy": s.get_entropy(),
        "characteristics": s.Characteristics,
    } for s in suspect_pe.sections}

    # Find new or modified sections
    for name, props in suspect_sections.items():
        if name not in legit_sections:
            report["suspicious_sections"].append({
                "name": name, "reason": "New section not in legitimate version",
                "size": props["size"], "entropy": round(props["entropy"], 2),
            })
        elif abs(props["size"] - legit_sections[name]["size"]) > 1024:
            report["suspicious_sections"].append({
                "name": name, "reason": "Section size significantly changed",
                "legit_size": legit_sections[name]["size"],
                "suspect_size": props["size"],
            })

    # Compare imports
    legit_imports = set()
    if hasattr(legit_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in legit_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    legit_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    suspect_imports = set()
    if hasattr(suspect_pe, 'DIRECTORY_ENTRY_IMPORT'):
        for entry in suspect_pe.DIRECTORY_ENTRY_IMPORT:
            for imp in entry.imports:
                if imp.name:
                    suspect_imports.add(f"{entry.dll.decode()}!{imp.name.decode()}")

    new_imports = suspect_imports - legit_imports
    if new_imports:
        report["import_changes"] = list(new_imports)

    # Check code signing
    report["legit_signed"] = bool(legit_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)
    report["suspect_signed"] = bool(suspect_pe.OPTIONAL_HEADER.DATA_DIRECTORY[4].Size)

    return report


def hash_file(filepath):
    """Calculate multiple hashes for a file."""
    hashes = {}
    with open(filepath, 'rb') as f:
        data = f.read()
    for algo in ['md5', 'sha1', 'sha256']:
        h = hashlib.new(algo)
        h.update(data)
        hashes[algo] = h.hexdigest()
    return hashes


if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <legitimate_binary> <suspect_binary>")
        sys.exit(1)
    report = compare_pe_files(sys.argv[1], sys.argv[2])
    print(json.dumps(report, indent=2))

验证标准

• 通过二进制差异比较识别出被植入木马的组件
• 隔离并单独分析注入的代码
• 记录代码签名异常
• 从构建制品中重建感染时间线
• 评估受影响系统的下游影响范围
• 提取 IOC 用于检测和拦截

参考资料

• ReversingLabs - 3CX Supply Chain Analysis
• Fortinet - SolarWinds Supply Chain Attack
• Picus - 3CX SmoothOperator Analysis
• MITRE ATT&CK T1195 - Supply Chain Compromise