Positive Technologies - NotPetya, , Petya 2016 .
, MFT. .
NotPetya
( Windows) , , — , MBR.
, 0x20 , - «» . 0x20 :
— , MFT ( 0)
— EncryptionKey ( 32 )
— Nonce ( 8 )
— Personal installation key ( 60 «123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz»)
CryptGenRandom, .
0x21 512 0x07.
0x22 MBR, XOR 0x07.
MFT. :
— 0x20,
— MFT ( 1),
— EncryptionKey ,
— EncryptionKey
— 0x20 ,
— 0x21 ( 0x07),
— EncryptionKey + Nonce,
— 0x21 .
MFT EncryptionKey + Nonce. Salsa20, . «expand 32-byte k» «-1nvalid s3ct-id». . , - , , , .
Salsa20 .
, , .
«0123456789abcdef» 32. , - , 32 . - SPONGENT ( ). 128 , EncryptionKey. 0x21, ( 0x07) – MFT MBR.
, . :
- Personal installation key, , EncryptionKey. , — . , - CryptGenRandom. — EncryptionKey + Personal installation key , ( , 100%).
- - SPONGENT, , , , (129 ), .
- EncryptionKey 32*8 == 256 . hex-, , 32*4 == 128 . . 32 32 .
Petya 9 2016
Petya . - . .
, , MBR, , .
:
- 0x36-0x39 ( 0x20-0x23 NotPetya).
- ( , / ) Petya.
- . NotPetya , , , , .
- Personal installation key 90 (15 6 ) 60 NotPetya. 58 527 ( 351 NotPetya).
- Petya secp256k1 secp192k1, , Personal installation key EncryptionKey, .
- , , «123456789abcdefghijkmnopqrstuvwxABCDEFGHJKLMNPQRSTUVWX» 16 .
- SPONGENT ( - ).
- Salsa20 «expand 32-byte k». , , Petya ( ), NotPetya, , .
Petya:
NotPetya:
, Petya, NotPetya .
, NotPetya , Petya . — . , . 2016 , Petya, .
UPD
Petya 2016 , (1, 2) mischa , PetyaGoldenEye.malware, VirusTotal .
, NotPetya , MBR, , PetyaGoldenEye: SHA256:b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690.
NotPetya PetyaGoldenEye:
- ( , );
- ( «» - );
- 0000:86E0 ( ) , ( « ») ;
- (0xE) (0xC), ;
- 0000:848E ( NOP) , ( , );
- 0000:96D4 (expand Salsa20) «expand 32-byte k» «-1nvalid s3ct-id»;
- 0000:998E (permute SPONGENT) LFSR (linear-feedback shift register), 0x9E 0xA3.
. .
- SPONGENT
, SPONGENT , . permute() «lfsr» spongent() , Null-terminated , , NotPetya.
, LFSR == 0x9E ( SPONGENT-256/256/16) 140 , NotPetya 0xA3 152 ( ).
Salsa20
, Salsa20 , , . s20_expand32() «o» s20_littleendian() «return *(__int16*)b;», NotPetya.
- , s20_littleendian() (, 16- ), «keystream» . 128-, 256-. , 128- .
Petya MFT ( ) , GitHub.
(Petya Red) , .
(Petya Green, PetyaGoldenEye) , , . , .
NotPetya, , Petya . PetyaGoldenEye, .
, NotPetya, .