Erradicando Malware de Sistemas Infectados

Quando Usar

• Infecção por malware confirmada e contenção em vigor
• Investigação forense identificou todos os mecanismos de persistência
• Todos os sistemas comprometidos foram identificados e delimitados
• Pronto para remover artefatos do atacante e restaurar o estado limpo
• Fase pós-contenção requer limpeza sistemática

Pré-requisitos

• Análise forense concluída identificando todos os artefatos de malware
• Lista de todos os sistemas e contas comprometidas
• EDR/AV com assinaturas atualizadas implantado
• Regras YARA para a família de malware específica
• Imagens de sistema limpas ou backups verificados para restauração
• Isolamento de rede ainda em vigor durante a erradicação

Fluxo de Trabalho

Passo 1: Mapear Todos os Mecanismos de Persistência

# Windows - Check all known persistence locations
# Autoruns (Sysinternals) - comprehensive autostart enumeration
autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv

# Registry Run keys
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s

# Scheduled tasks
schtasks /query /fo CSV /v > schtasks_all.csv

# WMI event subscriptions
Get-WMIObject -Namespace root\Subscription -Class __EventFilter
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer
Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding

# Services
Get-Service | Where-Object {$_.Status -eq 'Running'} | Select-Object Name, DisplayName, BinaryPathName

# Linux persistence
cat /etc/crontab
ls -la /etc/cron.*/
ls -la /etc/init.d/
systemctl list-unit-files --type=service | grep enabled
cat /etc/rc.local
ls -la ~/.bashrc ~/.profile ~/.bash_profile

Passo 2: Identificar Todos os Artefatos de Malware

# Scan with YARA rules specific to the malware family
yara -r -s malware_rules/specific_family.yar C:\ 2>/dev/null

# Scan with multiple AV engines
# ClamAV scan
clamscan -r --infected --remove=no /mnt/infected_disk/

# Check for known malicious file hashes
find / -type f -newer /tmp/baseline_timestamp -exec sha256sum {} \; 2>/dev/null | \
  while read hash file; do
    grep -q "$hash" known_malicious_hashes.txt && echo "MALICIOUS: $file ($hash)"
  done

# Check for web shells
find /var/www/ -name "*.php" -newer /tmp/baseline -exec grep -l "eval\|base64_decode\|system\|passthru\|shell_exec" {} \;

# Check for unauthorized SSH keys
find / -name "authorized_keys" -exec cat {} \; 2>/dev/null

Passo 3: Remover Arquivos e Artefatos de Malware

# Remove identified malicious files (after forensic imaging)
# Windows
Remove-Item -Path "C:\Windows\Temp\malware.exe" -Force
Remove-Item -Path "C:\Users\Public\backdoor.dll" -Force

# Remove malicious scheduled tasks
schtasks /delete /tn "MaliciousTaskName" /f

# Remove WMI persistence
Get-WMIObject -Namespace root\Subscription -Class __EventFilter -Filter "Name='MalFilter'" | Remove-WMIObject
Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer -Filter "Name='MalConsumer'" | Remove-WMIObject

# Remove malicious registry entries
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "MalEntry" /f

# Remove malicious services
sc stop "MalService" && sc delete "MalService"

# Linux - Remove malicious cron entries, binaries, SSH keys
crontab -r  # Remove entire crontab (or edit specific entries)
rm -f /tmp/.hidden_backdoor
sed -i '/malicious_key/d' ~/.ssh/authorized_keys
systemctl disable malicious-service && rm /etc/systemd/system/malicious-service.service

Passo 4: Redefinir Credenciais Comprometidas

# Redefinir todas as senhas de usuários comprometidos
Import-Module ActiveDirectory
Get-ADUser -Filter * -SearchBase "OU=CompromisedUsers,DC=domain,DC=com" |
  Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString "TempP@ss!$(Get-Random)" -AsPlainText -Force)

# Redefinir senha KRBTGT (duas vezes, com 12+ horas de intervalo para ataque de golden ticket Kerberos)
Reset-KrbtgtPassword -DomainController DC01
# Aguardar 12+ horas, depois redefinir novamente
Reset-KrbtgtPassword -DomainController DC01

# Rotacionar senhas de contas de serviço
Get-ADServiceAccount -Filter * | ForEach-Object {
  Reset-ADServiceAccountPassword -Identity $_.Name
}

# Revogar todos os tokens do Azure AD
Get-AzureADUser -All $true | ForEach-Object {
  Revoke-AzureADUserAllRefreshToken -ObjectId $_.ObjectId
}

# Rotacionar chaves e segredos de API

…