2026-04-13 03:01:08 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 2026年4月CPUID官网遭入侵，攻击者通过捆绑恶意CRYPTBASE.dll的CPU-Z软件包实施DLL侧加载攻击。恶意载荷采用多阶段感染链，包括反射PE加载、CloudflareDoH规避监控、四重持久化机制。文章披露了C2配置细节、TLS证书指纹及完整的YARA检测规则，为企业安全团队提供及时威胁情报与检测方案。 综合评分： 85 文章分类： 威胁情报,恶意软件,漏洞分析,应急响应,安全工具

cover_image

CPUID官网遭入侵,多款常用硬件工具被捆绑木马

原创

suntiger suntiger

二进制空间安全

2026年4月12日 08:16 北京

在小说阅读器读本章

去阅读

将二进制空间安全设为”星标⭐️”

第一时间收到文章更新

事件背景

#

2026年4月9日-10日,CPUID官方网站(cpuid.com)遭到入侵,导致多款常用硬件工具下载受到影响。恶意软件包cpu-z_2.19-en.zip将合法的CPU-Z可执行文件与恶意CRYPTBASE.dll进行捆绑,该恶意dll利用Windows DLL搜索顺序漏洞,通过DLL侧加载实现代码执行。

攻击原理和感染路径

从VT的提交路径中,发现一条内容是:cpu-z_2.19-en + CRYPT/cpuz_x32.exe, 攻击者的工作目录路径+CRYPT被暴露,说明这次攻击采用的是软件重打包攻击,攻击者下载官方的CPUID版本,添加恶意CRYPTBASE.dll文件,然后重新打包成ZIP文件进行分发,可能的传播途径包括:(1).通过Google Ads进行恶意广告投放。(2).利用钓鱼网站进行SEO攻击。(3).提供仿冒门户网站, 一旦恶意CRYPTBASE.dll被加载,将会触发多阶段感染链:

(1).利用Zip语言编译的Dll从其.rdata节中解码出349KB大小的通过十六进制编码的shellcode。

(2).利用反射式PE方式加载通过位置无关shellcode进行加密的out.dll Payload。

(3).通过Cloudflare (1.1.1.1) 进行基于 HTTPS 的 DNS 解析，以规避 DNS 监控。

(4).从C2服务器welcome.supp0v3.com下发后门到本地执行。

(5).利用Powershell加载器通过stdin管道执行C2下发的恶意代码。

(6).利用csc.exe进行内存中C#编译,生成shellcode加载器。

(7).通过MSBuild .proj文件、计划任务、COM类型库劫持（含IPv6编码的.NET反序列化链）以及PowerShell配置文件自动运行实现四重持久化

部分技术细节

CRYPTBASE.dll 是一个Windows系统 DLL，通常位于 C:\Windows\System32\ 下。合法的cpuz_x64.exe 程序会从该 DLL导入函数。当 CRYPTBASE.dll与cpuz_x64.exe程序位于同一目录下时，Windows会首先从本地目录加载 CRYPTBASE.dll（DLL 搜索顺序劫持）。

该恶意动态链接库入口函数DllMain执行流程树结构如下:

在其.rdata节中嵌入了两个JSON配置字符串:

(1).心跳模版,内容为:{“hello”:””}

(2).C2配置,内容为:{“tag”:”tbs”,”referrer”:”cpz”,”callback”:”https://welcome.supp0v3.com/d/callback”}

在C2配置中,tag和referrer字段使C2服务器能够追踪每个受害者是被哪个攻击活动和投递方式攻陷的。

使用Cloudflare的公共DoH解析器绕过企业DNS监控和NIDS, HTTP请求头内容如下:

GET https://1.1.1.1/dns-query?name=welcome.supp0v3.com&type=AHost: 1.1.1.1Accept: application/dns-json

HTTP响应头内容如下:

Server: cloudflarevia: 1.1 CaddyContent-Type: application/jsonContent-Length: 55access-control-allow-origin: *access-control-allow-headers: *cf-cache-status: DYNAMIC

via 1.1 Caddy头信息表明，C2后端在Cloudflare之后使用了Caddy Web服务器。

以下是C2加密通信过程中的TLS证书信息:

Subject: &nbsp;CN=supp0v3.comIssuer: &nbsp; CN=WE1, O=Google Trust Services, C=USSerial: &nbsp; 00c84335271751f130118159ec1cebe9fcJA3: &nbsp; &nbsp; &nbsp;3b5074b1b5d032e5620f69f9f700ff0eJA3S: &nbsp; &nbsp; 466556e923186364e82cbdb4cad8df2cJA4: &nbsp; &nbsp; &nbsp;t12d210700_76e208dd3e22_2dae41c691ec

检测规则

以下是检测恶意程序的YARA规则:

rule&nbsp;CPU_Z_DLL_Sideload_Alien_2026&nbsp;{&nbsp; &nbsp; meta:&nbsp; &nbsp; &nbsp; &nbsp; description&nbsp;=&nbsp;"Detects trojanized CPU-Z CRYPTBASE.dll proxy (April 2026 campaign)"&nbsp; &nbsp; &nbsp; &nbsp; author&nbsp;=&nbsp;"nemesis"&nbsp; &nbsp; &nbsp; &nbsp; date&nbsp;=&nbsp;"2026-04-10"&nbsp; &nbsp; &nbsp; &nbsp; reference&nbsp;=&nbsp;"VT: eff5ece65fb30b21a3ebc1ceb738556b774b452d13e119d5a2bfb489459b4a46"&nbsp; &nbsp; &nbsp; &nbsp; severity&nbsp;=&nbsp;"high"&nbsp; &nbsp; &nbsp; &nbsp; tlp&nbsp;=&nbsp;"amber"
&nbsp; &nbsp; strings:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// C2 config JSON embedded in .rdata&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$c2_config&nbsp;=&nbsp;"{\"tag\":\"tbs\",\"referrer\":\"cpz\",\"callback\":"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$c2_domain&nbsp;=&nbsp;"supp0v3.com"&nbsp;ascii wide&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$c2_callback&nbsp;=&nbsp;"/d/callback"&nbsp;ascii wide
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// DLL proxy indicators&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$real_dll&nbsp;=&nbsp;"C:\\Windows\\System32\\CRYPTBASE.dll"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$proxy_name&nbsp;=&nbsp;"proxy.dll"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$export1&nbsp;=&nbsp;"SystemFunction036"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$export2&nbsp;=&nbsp;"SystemFunction040"&nbsp;ascii
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Zig runtime strings&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$zig_panic&nbsp;=&nbsp;"thread &nbsp;panic:"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$zig_recursive&nbsp;=&nbsp;"aborting due to recursive panic"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$zig_stripped&nbsp;=&nbsp;"Unable to dump stack trace: debug info stripped"&nbsp;ascii
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// Heartbeat template&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$hello&nbsp;=&nbsp;"{\"hello\":\"\"}"&nbsp;ascii
&nbsp; &nbsp; condition:&nbsp; &nbsp; &nbsp; &nbsp; (uint16(0)&nbsp;==&nbsp;0x5A4D) and (&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$c2_config&nbsp;or&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ($proxy_name&nbsp;and&nbsp;2&nbsp;of ($export*,&nbsp;$real_dll)) or&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (2&nbsp;of ($zig_*) and&nbsp;any&nbsp;of ($c2_*,&nbsp;$proxy_name))&nbsp; &nbsp; &nbsp; &nbsp; )}
rule&nbsp;CPU_Z_Clippy_SCT_IPv6_Loader&nbsp;{&nbsp; &nbsp; meta:&nbsp; &nbsp; &nbsp; &nbsp; description&nbsp;=&nbsp;"Detects Clippy.sct IPv6-encoded .NET deserialization payload"&nbsp; &nbsp; &nbsp; &nbsp; author&nbsp;=&nbsp;"nemesis"&nbsp; &nbsp; &nbsp; &nbsp; date&nbsp;=&nbsp;"2026-04-10"&nbsp; &nbsp; &nbsp; &nbsp; severity&nbsp;=&nbsp;"high"
&nbsp; &nbsp; strings:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$ipv6_func&nbsp;=&nbsp;"decodeIpv6"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$ipv6_stream&nbsp;=&nbsp;"ipv6ToStream"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$ipv6_array&nbsp;=&nbsp;"IPV6_ARRAY"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$binfmt&nbsp;=&nbsp;"BinaryFormatter"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$dynInvoke&nbsp;=&nbsp;"DynamicInvoke"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$svcClass&nbsp;=&nbsp;"ServiceClass"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$moniker&nbsp;=&nbsp;"Moniker"&nbsp;ascii
&nbsp; &nbsp; condition:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;3&nbsp;of them}
rule&nbsp;CPU_Z_MSBuild_Shellcode_Loader&nbsp;{&nbsp; &nbsp; meta:&nbsp; &nbsp; &nbsp; &nbsp; description&nbsp;=&nbsp;"Detects MSBuild .proj shellcode loader (XOR + NtAllocateVirtualMemory)"&nbsp; &nbsp; &nbsp; &nbsp; author&nbsp;=&nbsp;"nemesis"&nbsp; &nbsp; &nbsp; &nbsp; date&nbsp;=&nbsp;"2026-04-10"&nbsp; &nbsp; &nbsp; &nbsp; severity&nbsp;=&nbsp;"high"
&nbsp; &nbsp; strings:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$proj&nbsp;=&nbsp;"<UsingTask"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$codetask&nbsp;=&nbsp;"CodeTaskFactory"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$ntallocate&nbsp;=&nbsp;"NtAllocateVirtualMemory"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$xor_key&nbsp;=&nbsp;"(1 + (i % 17))"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$buildcache&nbsp;=&nbsp;"BuildCache.dat"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$delegate&nbsp;=&nbsp;"GetDelegateForFunctionPointer"&nbsp;ascii&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$pkg_optimizer&nbsp;=&nbsp;"PackageOptimizerTask"&nbsp;ascii
&nbsp; &nbsp; condition:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;$proj&nbsp;and&nbsp;2&nbsp;of them}

(全文完)

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：二进制空间安全 suntiger suntiger《CPUID官网遭入侵,多款常用硬件工具被捆绑木马》