一周威胁综述（2 月 9 日至 2 月 16 日）

Size: px

Start display at page:

Download "一周威胁综述（2 月 9 日至 2 月 16 日）"

颔从
4 years ago
Views:

1 2018 年 2 月 16 日, 星期五一周威胁综述 (2 月 9 日至 2 月 16 日 ) 本文概括介绍 Talos 在 2 月 9 日至 2 月 16 日观察到的最常见威胁与之前的威胁综述一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及我们的客户是如何自动得到保护免受这些威胁的在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽, 但所述内容截至发稿日期为止为最新对以下威胁的检测和防护会根据进一步的威胁或漏洞分析进行更新如需获取最新信息, 请参阅 Firepower 管理中心 Snort.org 或 ClamAV.net 本周观察到的最常见的威胁主要如下 : Win.Packer.VBashcan 打包程序 VBashcan 是一个用 Visual Basic 编写的打包程序, 已经与 Umbra 和 Bozok 等特洛伊木马程序一起使用 Win.Ransomware.Gandcrab 勒索软件 Gandcrab 是一个勒索软件, 可对文档照片数据库和其他重要文件进行加密, 并添加文件扩展名.GDCB 或.CRAB Win.Ransomware.Godju 木马该勒索软件会将扩展名 cypher 附加到文件, 然后删除它们它还会创建一个名为 encryption_key"%appdata% 的文件与其他勒索软件系列一样, 它使用 Tor 作为其命令和控制通信 Win.Trojan.DNSLock 木马该系列会更改 DNS 设置并将流量重定向到恶意网站, 并在受害者的浏览器上插入其他广告此外, 它会与域进行通信来通知感染了病毒, 并获取命令主进程还会尝试将代码注入到其他地址空间并执行 PowerShell 命令 Win.Trojan.Generic 木马 Win.Trojan.Generic-2 是一个恶意样本, 可以执行不同的恶意操作此样本可从 Web 浏览器密码存储区中窃取密码, 然后通过合法的 SMTP 服务泄露密码请注意, 本报告中列出了此域, 但我们的产品不会阻止它, 因为它被多个用户合法使用

2 Win.Virus.VMProtBad 病毒 VMProtBad 是一个经过打包的文件感染器, 可以检测多个虚拟机环境它的特征是可安装网络浏览器工具栏, 并生成不必要的广告流量威胁 Win.Packer.VBashcan 感染指标注册表项 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN Value: internat.exe <HKCU>\SOFTWARE\MICROSOFT\SLAYER616WASD Value: UID <HKU>\Software\Microsoft\Windows\CurrentVersion\Run <HKLM>\SOFTWARE\Microsoft\slayer616wasd <HKCU>\SOFTWARE\MICROSOFT\slayer616wasd 互斥体 \BaseNamedObjects\slayer616wasd Local\ZonesCacheCounterMutex slayer616wasd DBWinMutex IP 地址 N/A 域名 ilovetehpussay[.]host4star[.]com 创建的文件和 / 或目录 %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.txt %AppData%\SystemWindows\WindowsService.exe %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\QGTPN.bat 文件散列值 014cd0a944bebca326a3bb496667c29f e67238ff4c074e789a07204d9 01cd6fc630c195ea59fb7755e530923f1cae383c57221a73bf3b6178e5d1a06d 0301c54ae3d98f0c84e03c6a64eced91f2b1130a861fd38cdd5488c25cc9844c a3a4d82639d620afbd43b2ba689970f68e29626ed15dcdbb2d a5edbab584f197d5c6075fd2b825ad94fa b1d3b77dce03aac586bfa d63b8386f2d02ebbfd3f73997cf5731dfa1f3e27b55401e55901e512c6 048c444cf63f2afd1fdb07bc036141d93bb924f6abc1cbd39fb31fcaf2cef2b5 0515b6cb220f4db eb57a8ca7703a481f5e5a9016a32cbae98425a4492

3 防护 06a30d49fc05ef2cdbc4aed1db26020a7b1ec81a6b953f44e0c62d2a3e3e c5bea52f4e5a671b58b4061fc5721bb491682dafc25b06ef d1012d1 07f21a783ce8944c9f0c40d9459a2ffdf7c15fc0c5ce ebff7f0 0833aa53278f36a75131a2534db0d28bb833fa e530469adb41d da00c849bd1aca5321e06f0e750e4d984f042d63f91db98b91f b842 0cfc1788d54d5073d445cad67edf2ee76a9228f44734ed b1cc82ee89b 16fc9a2c379c9e6664d668614a8e4df0f4c48170a aab835c08fef5f0b 181dcac94cc3df4312a36af18a9d5ae0f25b5d718116d2b7af6f4d0aaa261c2c 1c2ab5729f056f3aa5f06c8cd342f7f543d3b30c1baf2ccd1dbdf5f15234d553 1d5173fee0e02d7df5c586871e0be2f30d7e88220d77bfb63caf505c1d da5e6084bd897b84b21b787b54f17a1b8cd88c388a13f3dcf9cec6395bb28a9 1f85629cd0d0b97d5a3372dd e41bb8a74a70ab336dcf4ba8bb47b930

4 检测结果屏幕截图 AMP ThreatGrid

5 Win.Ransomware.Gandcrab 感染指标注册表项 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE Value: isnnswathsi <HKU>\Software\Microsoft\Windows\CurrentVersion\RunOnce 互斥体 \BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=359814f2 3c28b0e4 Global\pc_group=WORKGROUP&ransom_id=4a6a799098b68e3c IP 地址 95[.]142[.]39[.]101 66[.]171[.]248[.] [.]0[.]179[.]152 94[.]103[.]82[.]89 域名 nomoreransom[.]bit nomoreransom[.]coin gandcrab[.]bit 创建的文件和 / 或目录 \Win32Pipes %AppData%\Microsoft\bkxmfm.exe %AppData%\Microsoft\kqrnbq.exe 文件散列值 c7db211df7da83d533d24c795eb4178f5a7b9a27acf752874bcdbd e90fb6cd303ebced661c5c7c9af e0e64b ab8a 03c8bece3db3e2d6b26cc9769d2a cbcf21830aa143507b03b ef f5ea e6000e24dc4399ccc46d5e102ecf2ab3db 052a7544e ee911406cdaff c9d0a4070a5f7a69cc541f2e a3cca1d5c0c9f2b7f0e6b2f0f20e99b3f902e98e9e709f0bb8ac1cadb c9b925c8a0c5cea4d26b1f3c23666c99cede647c f8e35a96c098b9 084d5c da9af2b1dde0146a7f9b51491c562d8036aa28b85a4a1a32aaa 0a2ebbf4d5ba25049b8225cb253f7f99423b706f9a239c877595eaf696058f a13dc fd0af40005fb3f508d6a6d69eca897ef5af4f58f7761d3c 15b3a69b a8824ce17996c3301e96b1c629b7db3d c85 15b705ee101e26b1ba39d62d6c816409e059f395de8a1a5bfdd35d0e20b705da 1bbee00688a b40312e4109fdc58afa0b5a9e d386fca095a015

6 防护 1cbcecc05259b821d7d82f6b2e779de2f4d4dd a213a91db8617e61c4c 1f941ec87c3d98827d051ae46d a690bf1f b0ea5cbd6c5ec 22ddc024bf53ae71ff42cb79564f1bf8c9eb4f59d7c2ce3bc378c70ce067b fd62f71e3b566c8ae77e44760f0346c4f353a25f879ee5401e ba10 289d660ede22b4062d102307d5830a2af10da669ce573c279db8e055e6fbdaaa 299edfd4bbf81f20fb8f8e2dd9d0fc4d26c925dbd1cf4372d9172bc2644d3ca5 29a86b3a5c2f1a7a5ad325ccf5c906b532bb2275b79071e2ec98a281a290aadb 检测结果屏幕截图 AMP

7 ThreatGrid Umbrella

8 Win.Ransomware.Godju 感染指标注册表项 <HKU>\S _CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E Value: LanguageList <HKU>\S _CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E Value: LanguageList <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972- E325-11CE-BFC BE10318}\{9EB90D23-C5F A8-47DD7F6C4070}\CONNECTION Value: PnpInstanceID 互斥体 N/A IP 地址 185[.]100[.]85[.]150 域名 kdvm5fd6tn6jsbwh[.]onion[.]to 创建的文件和 / 或目录 500\$I0Y9SM6.txt 500\$I0Y9SM6.txt.cypher 500\$I0ZU5JT.txt 500\$I0ZU5JT.txt.cypher 500\$I478AKJ.txt 500\$I478AKJ.txt.cypher 500\$I4FI238.txt 500\$I4FI238.txt.cypher 500\$I4FKVBH.txt

9 500\$I4FKVBH.txt.cypher 500\$I4QK3KJ.txt 500\$I4QK3KJ.txt.cypher 500\$I5QX7W9.txt 500\$I5QX7W9.txt.cypher 500\$I77RW1L.txt 500\$I77RW1L.txt.cypher 500\$I7J37KF.txt 500\$I7J37KF.txt.cypher 500\$I9NSD58.txt 500\$I9NSD58.txt.cypher 500\$IANXEE8.txt 500\$IANXEE8.txt.cypher 500\$IBC53OO.xml 500\$IBC53OO.xml.cypher 500\$IC5NB1M.txt 500\$IC5NB1M.txt.cypher 500\$ID60W3E.txt 500\$ID60W3E.txt.cypher %AppData%\encryption_key %AppData%\lock_file %AppData%\uuid_file

10 文件散列值 36bba27b1fffbecb4f37400ec e39dfabbce a55a36c7696c fcb172773d8939b451c b0f91877ae05e562c60d0ca0c237a2e9c 412ce2fea4821c63074f3cd6223c9e9d7f074f18d5cd88dc1d7a36a1bb2f919c 4f888e9b f7dc2be015e7f32d677ae25fa7ff0298dc252339dce e034576fdb66b5b32eb198b48d e77bd66909f8dd7288c1e fec f8e0c7498d8ee3581fd0b074693a3a0ba07e5d95a141e 9a1794d3ae09b0a8c7a36fb bb d1ee37a7e81ffdfa9f36ec48 防护检测结果屏幕截图 AMP

11 ThreatGrid Umbrella Win.Trojan.DNSLock 感染指标注册表项 Value: AddressType Value: Lease

12 Value: DhcpDomain Value: LeaseObtainedTime <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERT IFICATES Value: 26D9E607FFF0C58C7844B47FF8B6E079E5A2220E <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\I NTERFACES\TCPIP_{9EB90D23-C5F A8-47DD7F6C4070} Value: DhcpNameServerList NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A} Value: Hash NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B- C5DC-4F54-9BDD-0DC2B010EC33} Value: DynamicInfo <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\43191B4E617CFE98 Value: 1 NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job.fp NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B- C5DC-4F54-9BDD-0DC2B010EC33} Value: Hash <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\ Value: config NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F AF0-A985-1A0086FCB8EA} Value: Triggers NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{3B84A94B-68D0-41DF-9C58-9CD44ABFE648} Value: data

13 NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A} Value: DynamicInfo <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS \PORTKEYWORDS\DHCP Value: Collection <HKLM>\SYSTEM\CONTROLSET001\SERVICES\BITS Value: Start Value: DhcpNameServer <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK\{4D36E972- E325-11CE-BFC BE10318}\{9EB90D23-C5F A8-47DD7F6C4070}\CONNECTION Value: PnpInstanceID <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\{B3797BAB} Value: nt <HKLM>\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER Value: PendingFileRenameOperations <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERT IFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E Value: Blob <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS Value: NameServer NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A} Value: Path NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\ Value: rs <HKCU>\CONSOLE\%SYSTEMROOT%_SYSTEM32_SVCHOST.EXE Value: WindowPosition

14 NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{050B0847-7A0B-787D E0C7E1109} Value: Index Value: DhcpInterfaceOptions <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS Value: DhcpNameServer <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\ Value: 0 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\ Value: rd NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{C2614C30-28EE-47BC-B044-C1025E72F15A} Value: Triggers Value: NameServer Value: T1 NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F AF0-A985-1A0086FCB8EA} Value: Hash Value: DhcpSubnetMaskOpt Value: DHCPNameServer NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET Value: {9EB90D23-C5F A8-47DD7F6C4070} NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B- C5DC-4F54-9BDD-0DC2B010EC33} Value: Path

15 NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {4797FAD9-D20B-54DC-98FE-7C614E1B1943}.job.fp NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F AF0-A985-1A0086FCB8EA} Value: DynamicInfo <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\43191B4E617CFE98 Value: 0 Value: DhcpConnForceBroadcastFlag NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {050B0847-7A0B-787D E0C7E1109}.job.fp Value: DhcpClassIdBin NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {BD2E97E1-0A85-204A-AB40-40B403D0844F}.job NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{BD2E97E1-0A85-204A-AB40-40B403D0844F} Value: Id Value: IsServerNapAware <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\{B3797BAB} Value: 0 NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{4797FAD9- D20B-54DC-98FE-7C614E1B1943} Value: Index NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{050B0847-7A0B-787D E0C7E1109} Value: Id

16 Value: LeaseTerminatesTime NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{1C8E1F AF0-A985-1A0086FCB8EA} Value: Path <HKCU>\CONSOLE\%SYSTEMROOT%_SYSTEM32_WINDOWSPOWERS HELL_V1.0_POWERSHELL.EXE Value: WindowPosition <HKLM>\SYSTEM\ControlSet001\Services\Tcpip\Parameters Value: DhcpServer Value: T2 NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{4797FAD9- D20B-54DC-98FE-7C614E1B1943} Value: Id NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNAT URES Value: {050B0847-7A0B-787D E0C7E1109}.job <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS Value: DhcpDomain Value: DhcpIPAddress NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\{BD2E97E1-0A85-204A-AB40-40B403D0844F} Value: Index <HKU>\S _CLASSES\LOCAL SETTINGS\MUICACHE\3A\52C64B7E Value: LanguageList <HKCU>\CONSOLE\TASKENG.EXE Value: WindowPosition <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS\I NTERFACES\TCPIP_{9EB90D23-C5F A8-47DD7F6C4070} Value: DhcpNetbiosOptions

17 \CURRENTVERSION\BITS Value: StateIndex <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURREN TVERSION\UNINSTALL\ Value: jc Value: DhcpSubnetMask <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS Value: DHCPNameServer <HKLM>\SYSTEM\CONTROLSET001\SERVICES\NETBT\PARAMETERS Value: DhcpScopeID NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{553E2A9B- C5DC-4F54-9BDD-0DC2B010EC33} Value: Triggers Value: DhcpDefaultGateway <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLs <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLs <HKLM>\System\CurrentControlSet\Control\Session Manager <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion \Uninstall\ <HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\BITS <HKLM>\System\CurrentControlSet\Services\Tcpip\Parameters <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\AuthRoot <HKLM>\SYSTEM\ControlSet001\services\NetBT <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLs <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion \Uninstall\{b3797bab} <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{ } <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\Certifi cates <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\In terfaces NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{3B84A94B-68D0-41DF-9C58-9CD44ABFE648} <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\ Certificates

18 <HKU>\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0_ powershell.exe <HKCU>\Console\%SystemRoot%_System32_svchost.exe <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERT IFICATES\26D9E607FFF0C58C7844B47FF8B6E079E5A2220E <HKU>\Console\%SystemRoot%_System32_svchost.exe <HKLM>\SYSTEM\ControlSet001\Control\Session Manager <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\Intranet <HKLM>\Software\Wow6432Node\Microsoft\SystemCertificates\ROOT <HKCU>\Console\%SystemRoot%_System32_WindowsPowerShell_v1.0 _powershell.exe <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6aea d233391fa002 <HKLM>\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\26 D9E607FFF0C58C7844B47FF8B6E079E5A2220E NT\CURRENTVERSION\NETWORKLIST\NLA\CACHE\INTRANET\ <HKCU>\Console\taskeng.exe <HKU>\Console\taskeng.exe <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLs 互斥体 X29d b92 IP 地址 54[.]236[.]192[.]172 81[.]171[.]14[.]67 52[.]77[.]199[.]193 52[.]206[.]149[.]50 18[.]220[.]249[.]233 82[.]163[.]143[.]176 域名 zambi[.]info amous[.]net listcool[.]info monoset[.]info riyah[.]net

19 dyn[.]com listcool[.]net www[.]hostgator[.]com dynarunner[.]info passportinfo[.]info bubblesetter[.]info hostgator[.]com 创建的文件和 / 或目录 %AppData%\{39C4A9FA-8E6F-1E51-87DB-35E186454CDD}\B063E134-07C8-569F-D FE2A8B75.exe %System32%\Tasks\{050B0847-7A0B-787D E0C7E1109} %System32%\Tasks\{BD2E97E1-0A85-204A-AB40-40B403D0844F} %WinDir%\Tasks\{ED590CE3-5AF2-BB48-A127-A8DCDA9B22BE}.job %AllUsersProfile%\617cfe \BITBA2F.tmp %SystemDrive%\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ t.exe %AllUsersProfile%\{BB098D39-0CA2-3A92-C225- C429A39F94EC}\61CC9F6E-D667-28C5-AA39-29C86F exe %AllUsersProfile%\b3797bab\9c3ac369.dll %AllUsersProfile%\{ c-0}\BITA113.tmp %WinDir%\AppCompat\Programs\RecentFileCache.bcf %AllUsersProfile%\{769e331d-612c-1}\BITA0B4.tmp %AppData%\ \2fff851b.dll %System32%\Tasks\{4797FAD9-D20B-54DC-98FE-7C614E1B1943} %WinDir%\Tasks\{780B0A47-790C-7D0A-0F11-080D D}.job %System32%\config\TxR\{016888cc-6c6f-11de-8d1d-001e0bcde3ec}.TxR.blf %TEMP%\{006714f4} %WinDir%\Tasks\{67D0E6A3-41D4-1B09-02A0-1F3933D2EA6A}.job 文件散列值 4d675c5cd24ad1fb31b0e7f69527ff5bee4fb456f981cd71423bc967af6eed e03f7c9fa eb61afd c246db67a4cd77eb328315bbe7 b0c8ca8e4d3ecaa3f77760b7e7cac04185a96ed9001b563f969b8f24378da737 99b86f98266db f850af04f f78470ab655217da79ade490 bb448628a9c7f39f c8bd27bf3b01ecca76ad1e540e511dbd72c520ae3 1749e2cac4f7c526e1dc32f0e96093cc823c581954e25ace5a479f1e19ef222d f9e0b981c4e51303f4b6f e95b1d9a822dcf28f6d8ed27733d70e5448d e59262af5fa77645cb9c081efd5c9f95dc929a bdf21e86b1 871a9d8a090dc17a0f7f49e2aa382aadf c53b4b9e77318d0dc7464d6b e802bb930657a5fad11f6f493f081f11c12b ab6aa5595af53a371

20 防护检测结果屏幕截图 AMP

21 ThreatGrid Umbrella Win.Trojan.Generic 感染指标注册表项 N/A 互斥体 N/A IP 地址 173[.]194[.]175[.] [.]194[.]175[.]109

22 域名 smtp[.]gmail[.]com 创建的文件和 / 或目录 N/A 文件散列值 41d52ddff7d3b2135ba379f7988aba7ae535dc7e628f450aff841503b020efc a0a294612e c90fd86f64eff0f244cf559bdf488f2e c10d78fd6a4accfd7533cab25068fc ad9847ec3ca42f949b 75818e658a9a4b02897a5808a2ccea33cdb7afe8c6827b13b2b4e8805de1ce2b 787de9917c7871afb7c5b13ed54adc98a0b1507d104ccd25ef ae ee01720f1c00dc3ed39d6cccc1a99cfb6f5d249f0df24a4669f2f729f9d8c a69cb9a78b6b86bfce f8c08c6ee429b4effa895d1d84da2c0d0d aed337b11888de4ec146551c1bcae46e62c3d14b20e7387ed72d0f72bbe49c61 b16228fa8feae74e5e751110b23ebb1c6aacc36cb6f2511d7e38f55c40703fd0 ce510906b b9f35845e75897f94f6530dcc1155eae1b1eb2edd49c4f d3a8088cd c66110bc6fd964abac305d77071bda7f9040c88a45f6965e d48fd05d443a1552e6affab7cfc65eb7d804a0ebe80f4b7056b8685dd9e9c70a f3c143fe7856d71ea5a91c2d8bb96ddd4cb3c4c3dc7898d766be716cb4852da6 f9ec96f821fe757421b cce312e2bf42df bcd af7415d 防护

23 检测结果屏幕截图 AMP ThreatGrid

24 Win.Virus.VMProtBad 感染指标注册表项 N/A 互斥体 N/A IP 地址 N/A 域名 N/A 创建的文件和 / 或目录 500\$RUI79S5.html 500\$RANXEE8.txt 500\$IDBK7UZ.html 500\$R9SCMWR.lnk 500\$R7QS1I3.lnk 文件散列值 66c9cd b36295f8c13cffb5a6d805f73e3086cabceaedfb361c37c 8ee03ed6082b418b4ea91cc8e63848ac8113ed29c65ec9e3403e8f1f90c41b4a a6660d a08e5dc02984affea031b7bfea22b6bba53113fe2177fab bd55e79b5813ae8b064e0f1bc11592a79494a79e e26dd2b6b7e a4cc65474efd0b0e3aeaee8614b397dbc9bd3ecf7a95a8526d8ac84ed3848ee4 4e2624a133a42107d3def6ae7ffcb5e1a5c372ca2d a03a4a b2e43a6ac8301d b8528c40da58c5e2f d9f5444d52785a 135f254c202229f708d7e4d0eb36d4d14ed8b43029b994a efb9f63461 f bdc9d23e545a4f530f eba49f8a78e53fc6b361cee499547e bb8a4694f7b48e9c7abdc6e732b7e1c73b2c802c045d5cda03ef3da 67694e083c8b54090afe2a580da0242d9d b34af1c11290efe544e ecb1e4e860ea c7411fc c956f1e21c30b5325d ac464244c14deea6569d4d79377fec91f63b7951f137bd f3f7 e70aa134607b6e5c85dad94749e382afd11052d789dad a8ad9c1b5cf fd7fe9120abfd3da acaf010d1768fdaa570e471b30207a4e8d9dae 28d f858bb7496dc8fe8fec7fb450aa083f039e90a1c9e11ed7d9094

25 防护 2e20f3dc237275d5579b96c46195aa05f79b206a356918a0e1bc990a aeab4107c498f7ebb963452b3157c70fa36f7c0c b89d6d2f2fdd7dd09 c55447abc07f82e59c4573b d494bc8069bd868e2f4755cea405ec104 81e852b22956bea616f384424f2ccbc60224bd497e0885b3472e1019ecd941aa 5aad686faa09afc69b067b67cb3db992820f96d3cadb5e dc5 09c953e9fcc681daee3f bc687f3d10d9ae4e6462cdd4b8 0507d30d8ae08a46acbfd85e6c df8b4658a5d7b846c8eec51d0a e8e31878a125c47e835ceea2f783fe7938bc a98d9d2cb67c756c8cf d1da28e300a2677e46ea1af64d664ee47f845336d1081d15df58d3e9016a

26 检测结果屏幕截图 AMP ThreatGrid 发布者 :ALEXANDER CHIU; 发布时间 :0:55 标签 :AMP 防护威胁综述 THREATGRID UMBRELLA

一周威胁综述（8 月 11 日至 8 月 18 日）

一周威胁综述（8 月 11 日至 8 月 18 日） 2017 年 8 月 18 日, 星期五一周威胁综述 (8 月 11 日至 8 月 18 日 ) 本文概括介绍 Talos 在 8 月 11 日至 8 月 18 日观察到的最常见威胁与之前的威胁聚焦一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及我们的客户是如何自动得到保护免受这些威胁的在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽,