一周威胁综述（9 月 22 日至 9 月 29 日）

Size: px

Start display at page:

Download "一周威胁综述（9 月 22 日至 9 月 29 日）"

娈容黄
4 years ago
Views:

1 2017 年 9 月 29 日, 星期五一周威胁综述 (9 月 22 日至 9 月 29 日 ) 本文概括介绍 Talos 在 9 月 22 日至 9 月 29 日观察到的最常见威胁与之前的威胁综述一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及我们的客户是如何自动得到保护免受这些威胁的在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽, 但所述内容截至发稿日期为止为最新对以下威胁的检测和防护会根据进一步的威胁或漏洞分析进行更新如需获取最新信息, 请参阅 Firepower 管理中心 Snort.org 或 ClamAV.net 本周观察到的最常见的威胁主要如下 : Doc.Downloader.Jrat 下载程序包含嵌入式 OLE 对象的恶意 Office 文档, 嵌入式 OLE 对象主要为可执行文件或 Java JAR 模块, 用于与某个域通信并下载其他恶意代码 Doc.Dropper.Agent Office 宏下载程序这是一种经过混淆处理的 Office 宏下载程序, 它会尝试下载恶意负载可执行文件 Doc.Macro.DownloadExe Office 宏这类下载程序使用硬编码的 URL 在设备上下载并执行样本 VBA 未经过混淆处理, 只包含足以完成任务的功能 Doc.Macro.VBSDownloader 下载程序这些 Word 文档中的宏以 Base64 进行编码, 并在执行时从经过混淆处理的 URL 列表下载其他恶意文件 Win.Ransomware.TorrentLocker 勒索软件 TorrentLocker 采用 AES 加密对受感染主机上的文件进行加密, 然后要求以比特币支付赎金通过替换字符并选择性解析部分字符, 将代码从一系列字符串中脱壳, 再将最后的转换结果写入堆栈待稍后执行随后, 投放生成的子进程和其他二进制文件

2 Win.Spyware.CCBkdr APT 供应链攻击 5.33 版 CCleaner 在供应商签名前被侵入, 并在嵌入后门模块的情况下分发有关详细信息, 请参阅和 Win.Trojan.Beeldeb 木马 Win.Trojan.Beeldeb 是自执行 AutoIT 脚本恶意软件负载被注入投放的可执行文件中不仅如此, 恶意软件还会将自身添加到启动文件夹以便持久驻留在系统中 Win.Trojan.Cossta-237 木马 Win.Trojan.Cossta-237 是一种木马, 它会下载其他文件并有可能接收操纵者的进一步指令 Win.Worm.Untukmu 蠕虫此蠕虫是极度恶意的威胁并且包含多种反分析机制, 例如反调试技术, 以及在安全模式下亦可避免被删除它在感染后会持久驻留在系统中, 并禁用 cmd 和注册表编辑器威胁 Doc.Downloader.Jrat 感染指标注册表项不适用互斥体不适用 IP 地址不适用

3 域名 mike22[.]linkpc[.]net 创建的文件和 / 或目录 %AppData%\Microsoft\Office\Recent\ITT Tender - ABB Provision of Supply and Installation.LNK 文件散列值 1508a8ab14c c9f2e598a bd078f505274b5783ddda8fed0a e23a7de3a8fd965bdc2d3a96175fd8a77d284827c1ed6d58944a7e 339ceac2076e833babc1ac838848ab2787af062835a24f05e0bf20ab1ec79ccf 6f276350ce399502dbf870702e1a09ee39b591b93ebface9d3214ce9822aed61 7dd8b4746bf2de079b3b66e9d5e0492cde0a a8831c3fd64b33b 7e4ef415a75cea7d3d610c44c0fa51d0fba956cc cd470fa0 9394e12d1fe6d3627f5f928aff4a15699aa129e44fd4fd9eba29f6ad5a4f7556 a5dfb783b89232fcc317194d267b8cf7204ae457d86eb5cdf703a656c03f1b71 a601c81547e7180d284e2fa cceaf63108a11c40821edbf024 baba92ad2bf34ef af6b60f731e7cdc4a341f bb cd9b3b58c1edf8da81906ffc12e25766fb40ddabe1c383 50c1020efca c89b468fc25926d1bad2eeb421482d9c17b6ab d29a6afc4b35eef a0ecd89fc2a5eb676de9c5518c9914f2 db4d85d172b31413c1f a9a2e26b273dfdea8b7506ee8ca982e32f f745e3687dabecb07c033a70db4f8c2cb14b9fc75c896304f6e9ed4dc6e3a1ba fff d65b28590cdde1a1f1a8731f02e8c21c1a9f167d53dc1054cc865a 522a804aeee581c63049d0a5983a558c2a3225c4b14814cf0acb8912b79260d6

4 防护检测结果屏幕截图 AMP

5 ThreatGrid Umbrella Doc.Dropper.Agent 感染指标注册表项不适用互斥体不适用 IP 地址不适用

6 域名 acsbaroda[.]com a[.]pomf[.]cat b[.]reich[.]io directlink[.]cz nusacitracipta[.]co[.]id u[.]teknik[.]io wallpaperbekasi[.]co[.]id www[.]b-f-v[.]info www[.]noosabookkeepers[.]com[.]au www[.]powerplusscable[.]com www[.]styrenpack[.]com 创建的文件和 / 或目录 \Users\Administrator\Documents\ \PowerShell_transcript.PC.Pbzg9q9Z txt \TEMP\Quotation_211.xls %AppData%\Microsoft\Office\Recent\Quotation_211.LNK %AppData%\Microsoft\Office\Recent\ xls.LNK %AppData%\Jaty\WebHelper.exe 文件散列值 760d89498b3029b1c6fdc5feefa a4b61414c6b1e9d ab0bd5 19dc470f8c9a1a4e9e24707b68c e81d4ec74e c5b7 1d14387de0375c84c8c334fb4d29c8ec4e3c24cd9969bcd3acbb77cb65f77a11 a80e8da4851eccfad1b8c2b930389a1980dcdab0d193073a4d3dac2d6a0e73d7 f84e3b79c16a77db33d1f5ee66fa13d15f25fed78d219d77dfe cd944 d1e e9ffd7f7d502840ace6b0de7369c938abee8c1ddc84dcf73486dd3 81b61e9dd4682b079e0b1df c99e0228d4bdcbef5f18bf4bd8fedbff09 5af528ce89a31516eb1b5303b0789b56ab64ad16d7d15193c8b24b5ac3ff22a0 a9fec7f8f911f431dd c3206feefac7308f48087ab02fbc a1ddd820a187fd8db5ce8d595958fcfb34ea5c01b5971b359f318f8fe7bb3b 4eb507bf63d a6c7e6831b6b29363c1c37e9176b7c72a6c3faa862d cffb8b6c103a443159c94dadd5058c3c083d906600f0db6291ab0e2f4c005b68 127cae520479d08e0bfa1b569ace82203cd8154f49f7a8569bfbc54d4c8c6da8 dfca64bac0dd845e4e0d98a0f0ce3ae235cddf2f6506fabb7923a2d5e0da3129 c1f b6dab1c4516a7f c26f52cd429299d b70bd c3baeac24f2416d21e64df05b568600c3be76a6365e7cb5b8dbfdfe64ae95c46 ac535056dcd ad9e53bc5bc4e08b61ce129fb37d7f7b727c4e1a875df

7 af9f674bc5a26324b62f8c5a67f256b6133b2ec26a25a7c93564fe048ae4afd4 2b06143fffe b2ec0b6f40b5aac115f37c61db32a3be6e0ed13d8eee85 2eba0e3bb658230fe b6be0f58d042a8bb13dd4d9169e775263f82eab3 304c6f454f0efca218002c c27e63186dd5de57b652cf2d4d14c7f0a4 b75f01bb44d8a7f402bf ff bd13d7c199855a321c26b30 5b5b1960bb43c0c115080b3393aaa d53f6b173b24f6c08cbe86d2f8 51d6c81b77f098af1b463f72d236d44b21d873f3c ac93ba803db620a9 f4eb5c188028bd80eaf5e822fd6e80e6d e b72aedabc3daf d8b26ec2609f02379d8b8489f0b52f060e1d5f2dea369dbb675c408c29f dea09c54a4f26cc078d1b341d5172ceeb e c564747c83 80c8b5fad0efae1c96e51d97a3ae2ee0e3c9d802691e7178da29b12f23b0f2a0 5742ca6839d7b0b6e56f5406fcb744180bc76e81f7ebdc626b432ab3c1b3de81 c1fb997c7dd23f0bb6f19e fc890beca44fbe2f50e21a001b3aa1d c51a8951b aec9cbb7ba171da57baf733bd12c7d7741d8f17e55b bef55fe81de1a2eb2c0a9e647619a483093b031f5c797d5a8e32bb787356e33a 7f0a79692fc21938be2f2acab035a56049a9444a8e380d efd e618be36548c349562bbdc6c4d68efcb2c86b e9014fd91eea3ec0a0ca 100b1db7896fbd9c4415a96aed0383babbc43ac1f6ae589d408d39532ce9125b f48ecc2b672bc937370ef812eb1b23e3e76e680a2a96aff2d58af8331eb75cfe da2ee40c1fcf98c416132ddf8d4a533f387fcc bf2ab0967a7d1ede b5fd96e20d32e4f805c4b157037b8e382ff2ce3564fad2f5b3d3c7b6247ea1e2 bfc11420c2e7d86d66ca3c4cd495a47b7882d6abbb7a8cc87a58ce9e3daaacaa 5f5e981122a e5b c894538cb134d2c93d3f15750ec9443c7f2 76a940a6ef4397c6b7c8d1ba0dca3e891c2d526f58c03c766d041b98a8791e b55b83863c4ac1ed6ee66e4d2dc0de8b56416dd96cf712f5b889aeff5cdf f9e29f39b89918fcf26237c5002cd98a2a001c ba537eebd0e72a56cd 6264bc92083a561dd31c38fc752589eb7e8dd65fa2b6c792d2dd247b5f63ff98 544eac3c9205cc3ecaf57283c823050df3bfe4ce78d0c7e38592ef333cc8bdc8 dce3ff33424c5e43795ffba7ad33ee8a301606e3c4406e2cd1d07cf6d789ac8e 633dd2217d33b8a60f3ca98905bb7119d7d63e8db c5bfe5449b7885d 6386f608f5f0fb7007ecf808b9a96048c4fc1fe3c b9da1e c5 60d4c6a68368b14ce9aa0b6b3e8eb91e92f823f6524a49e4e7cc f30f0a4af07a729f3bf0aa2cf23ed4174c8a1a9ffd98694efb3c51e2c

8 防护检测结果屏幕截图 AMP

9 ThreatGrid

$]pomf[.]cat 创建的文件和 / 或目录 \TEMP\~$L Receipt.doc %TEMP%\CVRFC94.tmp.cvr \TEMP\gkmgax.exe \TEMP\DHL Receipt.$

10 Umbrella Doc.Macro.DownloadExe 感染指标注册表项不适用互斥体不适用 IP 地址域名 66[.]55[.]90[.]17 52[.]179[.]17[.]38 a[.]pomf[.]cat 创建的文件和 / 或目录 \TEMP\~$L Receipt.doc %TEMP%\CVRFC94.tmp.cvr \TEMP\gkmgax.exe \TEMP\DHL Receipt.doc \srvsvc

11 %AppData%\Microsoft\Office\Recent\runme.doc.LNK %SystemDrive%\~$runme.doc %AppData%\Microsoft\Office\Recent\DHL Receipt.LNK 文件散列值防护 9fa533406df0d2d165f46f37d1167fdb97ff388a5e84b60bfd75921c6f44ff6c 74805a5b0a8171f723627c8b061805a6c9c098e7ce1ea83378a774769bc7a1c6 f861caffda478a4227bf06323ef32407f774274cdacf2e5e23506d67a08cd89c 9fa533406df0d2d165f46f37d1167fdb97ff388a5e84b60bfd75921c6f44ff6c 0ef4406f5608ad25b4c61d37b6ece1b71c af550dde14917d2cb4e3 f8dcc75be0d aebb95e477fe1d4e46246e677fc0e414b7dd354f 216f09c6eff72fae7d6511a73be7530e80980ff6305e4dd2656c96aec29f242e 265de60479b8d8bd46b56a7bec778d6ef9c62a9053e42c6a632d52cdc16a9490 检测结果屏幕截图

12 AMP ThreatGrid

$VBSDownloader-6336817-0 感染指标注册表项 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\INTERNET SETTINGS\ZONEMAP o 值 :ProxyBypass <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET$

13 Umbrella Doc.Macro.VBSDownloader 感染指标注册表项 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\INTERNET SETTINGS\ZONEMAP o 值 :ProxyBypass <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP o 值 :ProxyBypass 互斥体 Global\MTX_MSO_AdHoc1_S Local\ZonesLockedCacheCounterMutex Global\MTX_MSO_Formal1_S \BaseNamedObjects\Global\I9B0091C RasPbFile Local\WinSpl64To32Mutex_e39d_0_3000 Local\MSCTF.Asm.MutexDefault1 \BaseNamedObjects\MD99F8B3

14 Local\10MU_ACB10_S Local\ZonesCacheCounterMutex Local\10MU_ACBPIDS_S Global\552FFA d BA046BB5906 \BaseNamedObjects\Global\M9B0091C IP 地址域名 50[.]63[.]119[.]1 lymanite[.]com 创建的文件和 / 或目录 %SystemDrive%\~$c69c4b9785cdc861c8fae99998a1ad011cf2e98456a1891bd29bcc f0.doc \TEMP\gescanntes-Dokument doc \Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{24E5C5A3-7CF5-41D8-94C1-47B41F61C27E}.tmp %AppData%\Microsoft\Office\Recent\fac69c4b9785cdc861c8fae99998a1ad011cf2e9 8456a1891bd29bcc990897f0.doc.LNK %TEMP%\64388.exe %AppData%\Microsoft\Templates\~$Normal.dotm \TEMP\~$scanntes-Dokument doc %AppData%\Microsoft\Office\Recent\gescanntes-Dokument LNK %SystemDrive%\Documents and Settings\Administrator\Local Settings\Temp\42994.exe %AppData%\Microsoft\Office\Recent\Local Disk (C).LNK %TEMP%\CVR26FE.tmp.cvr \Users\Administrator\Documents\ \PowerShell_transcript.PC.sJClvqz txt 文件散列值 fac69c4b9785cdc861c8fae99998a1ad011cf2e98456a1891bd29bcc990897f cb7c0bdc7f55c5b70a48ab0c a89139d bf 12b2acf3a81b16850fec270f521ba9b749a340f1357f225e da12 1d c83e62a561a1ea5cdc798aa1cdc92653f5e722dc8b22b5ed9a7c 2b4bbedb5119cd52c44fe035ee5b00b520792db60207ffd6ce3cdc d 476e8075ba4866c0a78253dcb19961b28f150aa207d50b575b0d07fdcca4aa13 477bbf a4e45331d71c6de fbbf ccfef7eb9d3e8697c7 4cfd3f25f178f5ae5dd5c5438a4bc3cd0af2ca712a5a d4b4424d4 5bb5975dd0b781d5fab3721ae66463e64825fccfdcf876bcb8899c2571ed04f4

15 防护 5dc91a43bfcf5f4b4c2a759220e9eacec671bc275572b6feeca274d9c a7a585f12f1d3e60eb084e9dac648217b922a3d68ce4024b26a6fcce3cc 69b35b1bffd2d36c06d4598de38fa4364e d89bc73fc1e9b31f57e71 6c0bf54da7ee15bf99b7ff6be57ee8331d8335a1d c6ada04c841c4de 71cc8b291e0a1ad38ed9142eb112f56c4a8a3eb00d130bfa27e5c40a08bc9e43 75eb fd9b6f2d533d3c12724cf1de2adbb925d7abfd744e6ff73633d 7cc1a551e6060d0e7a38423a2247edd4a84b6cca927f996d2bc056269dedb6e6 908b6ea63e3e916377fe bf4b55c7aaddde27292b9dce5930eede5622a a2fe92fa39d6b0f9dbfebd83be179524fadb87b11e555eee96c606af7d34ce73 b6bfdbfcbb ad8bdf9cec2592a162a27b7c367193d1fdd10d9db5182dc b7651bd99dda94f6bf962b ee145c38546cd7b3f8bb477976d9a8617 c77d0bee9502f8d4c3afc1729a7ab9721ffce9bf2b7759d086e436370af4ff5c d621d5dea6a95c31650a4c46aaf507625a8e18f33b5a4a22e8a801c25dc77a49 d919139e4965ad6c55b7f08e2f919aac5fd8deb0fd90cf65f2bd4a4aa5bd2dd8 d9c9e1fece032140a b08a4eb147598a36f8b582c796b8764ff6cd9a91 df5c68270b14d82a523a503a717de1ccfe1739c62956e7a58aa8441f117b7344 检测结果屏幕截图

16 AMP

17 ThreatGrid

18 Umbrella

$TorrentLocker-6336835-0 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :etejasix$

19 屏幕截图 Win.Ransomware.TorrentLocker 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :etejasix <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o 值 :ProxyEnable

20 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\INTERNET SETTINGS\ZONEMAP o 值 :ProxyBypass <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP o 值 :ProxyBypass <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o 值 :AutoConfigURL <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o 值 :ProxyOverride <HKLM>\SYSTEM\CurrentControlSet\Services\VSS\Diag\Shadow Copy Optimization Writer <HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 互斥体 \BaseNamedObjects\Global\otydesuxofyjyxufexycaga Global\otydesuxofyjyxufexycaga \BaseNamedObjects\Global\yjacitumaxicuqexyfitywoqewyquwy qazwsxedc Global\yjacitumaxicuqexyfitywoqewyquwy IP 地址域名不适用 wrygsxi[.]zotebsca[.]net atawgce[.]zotebsca[.]net adez[.]zotebsca[.]net uluxkqopy[.]zotebsca[.]net efedaluc[.]zotebsca[.]net mxed[.]zotebsca[.]net omywuw[.]zotebsca[.]net imjmawfcoja[.]zotebsca[.]net evycoroz[.]zotebsca[.]net erivequt[.]zotebsca[.]net aqyjo[.]zotebsca[.]net usuhazepug[.]zotebsca[.]net avev[.]zotebsca[.]net

21 fhuga[.]zotebsca[.]net uqydjnwn[.]zotebsca[.]net evehasuruzo[.]zotebsca[.]net ypyhi[.]zotebsca[.]net epabojyluko[.]zotebsca[.]net iqesex[.]zotebsca[.]net ywapivuqexe[.]zotebsca[.]net ihodi[.]zotebsca[.]net rtacin[.]zotebsca[.]net aliragifut[.]zotebsca[.]net eztcu[.]zotebsca[.]net ukajusi[.]zotebsca[.]net okypag[.]zotebsca[.]net ubapimiwdj[.]zotebsca[.]net 创建的文件和 / 或目录 %WinDir%\edaraxoz.exe %AppData%\uqetukykopefyvij\ %AllUsersProfile%\uqetukykopefyvij\ %AppData%\uqetukykopefyvij\ %AllUsersProfile%\uqetukykopefyvij\ %AppData%\uqetukykopefyvij\ %AllUsersProfile%\uqetukykopefyvij\ %WinDir%\ukavdnlj.exe 文件散列值 1a78a5c1c4ebb8a0047cbb4a8a d71cae2aeb033bceab76795a eb32d7edc49d437a598d7e0453e8c9d1222b8b9ba429c73e0598db1a9 58f36594d9502e3e8e135d0a449e5c07a62ae6fcd34a32c5c4d9243cb28d958b 5c66755aeeed65c21c8d9774baebd79c962311a57b733cb19d4d2bb6a0eb52c3 ae7a23e9b4c2645c26dce4a83a97953fa5ca008570aa9ac32e a099 ba4fe6e91aae42e7a a a4a5d cf8d42b8d5cc52 bf795a1676a6dd795fb6915ecfbfdc cae8769c55b9e26328b026f88 cc07ae7275b177c6882cffce ca2c76af5dc c9c831

22 防护检测结果屏幕截图 AMP

23 ThreatGrid Umbrella

24 Win.Spyware.CCBkdr 感染指标注册表项 <HKLM>\HKLM\SOFTWARE\Piriform\Agomo o 值 :NID <HKLM>\HKLM\SOFTWARE\Piriform\Agomo o 值 :TCID <HKLM>\HKLM\SOFTWARE\Piriform\Agomo o 值 :MUID 互斥体不适用 IP 地址域名 216[.]126[.]225[.]148 不适用创建的文件和 / 或目录不适用文件散列值 04622bcbeb45a2bd360fa0adc55a2526eac32e4ce8f522eaeb5bee1f501a7d3d 1a4a5123d7b2c534cb3e3168f7032cf9ebf38b9a2a97226d0fdb7933cf6030ff 30b1dfd6eae2e473464c7d744a094627e5a70a89b e30e3e773761c48 53c6ad85a6b0db342ce07910d355dad b4b ec81bee0f322 6f7840c77f99049d788155c1351e1560b62b8ad18ad0e9adda8218b9f432f0a9 8562c9bb71391ab40d4e bcf742afdaff9a c5e25 8a8485d2ba00eafaad2dbad5fad741a4c6af7a1eedd3010ad3693d128d94afab dbf648e5522c693a87a76657e93f4d44bfd8031c0b7587f8b751c110d3a6e09f 07fb252d2e853a9b1b32f30ede411f2efbb9f01e4a7782db5eacf3f55cf aca58be325174f0220bd7ca6030e4e206b e82da bb6f4f 27a098761e8fbf4f0a7587adeee8eb787c0224b231b3891fa9323d4a9831f7e5 2bc2dee73f9f854fe1e0e409e d9c0a1081cf5fb503264aa1bfe8aa06f 2c020ffa3436a69a1b884b5b723909c095e5e ac4c184a3c3c7da7

防护 76cd0370af69d5c76e08673976972fee53764fca67f86fcf0db208b87b7341d6 8038ea1b72a720f86397fd2ee1f386bb832e5cbd8e12f97e11e0c787bde9e47e

25 防护 76cd0370af69d5c76e fee53764fca67f86fcf0db208b87b7341d6 8038ea1b72a720f86397fd2ee1f386bb832e5cbd8e12f97e11e0c787bde9e47e dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83 e8e02191c1b38c808d27a899ac164b3675eb5cadd3a8907b0ffa e72 f0d1f88c59a005312faad902528d60acbf9cd5a7b36093db8ca811f763e1292a 检测结果屏幕截图 AMP

26 ThreatGrid Umbrella

27 屏幕截图 Win.Trojan.Beeldeb 感染指标注册表项 <HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2 互斥体 \BaseNamedObjects\hTGfNaKIQ4lPz

28 IP 地址域名 41[.]45[.]138[.]91 156[.]203[.]64[.]64 microsoft[.]net[.]linkpc[.]net 创建的文件和 / 或目录 %TEMP%\EqEhol.exe %TEMP%\JTVxon.txt %TEMP%\NJiSUL %AppData%\njisul\NJiSUL %AppData%\njisul\EqEhol.exe %AppData%\njisul\fXMlDZ.exe %AppData%\njisul\JTVxon.txt %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\gmail.lnk 文件散列值 bb8e4aec824aa052fdda739abb8472caf2bd6c34d ea3072e5c024140a 2c89cbab497a1a5219b5d66f1ba39473b6ffc15ec4f53a2bb09c070a15a537e8 36e92852d67e66cb3c99312f107f c2badf787108f619d6b54e6c85fc 1e76a00a1e6e4265ad5ff364d3139a62013a9628d90edd7e6a155e7f0a8193e8 07de12cf4c78151a0bdd6d8dcf8b5d0b91f51b606fd8ec0774e54fcb16e3440a e15dc2879dccd3c62d77169fe77d869455e61e da829013d55b42107ba ca a91d23604a7fb425ee8b47a66567a953103a9949f66d74cc c4cf29d4e6a6b905e ab07318d5704d91df50c9d5477b998a19395eff a864f592f8fd01a57cf a413e4a688f6cfa2beae8c5e136a40384f7b56 eea366f807de6e4a0834e9fcf8dc0847b7ab a22cc0dbfa76

29 防护检测结果屏幕截图 AMP

$ThreatGrid Win.Trojan.Cossta-237 感染指标注册表项 <HKLM>\SYSTEM\ControlSet001\Services\Alerter 互斥体 \BaseNamedObjects\44-41 IP 地址域名不适用 wenrou88[.]3322[.$

30 ThreatGrid Win.Trojan.Cossta-237 感染指标注册表项 <HKLM>\SYSTEM\ControlSet001\Services\Alerter 互斥体 \BaseNamedObjects\44-41 IP 地址域名不适用 wenrou88[.]3322[.]org 创建的文件和 / 或目录 %SystemDrive%\Program Files\Microsoft Explorer\AAA.exe 文件散列值 e8feccbab518346c0ec9ea3787f3b09994e41ca278aa537bc753fa1d6b40d1c4 b955412a8b6ec7d48b70bc2ed c2b418a075fd0e3f98ba52086caa495

31 防护 de d4a1b6f12a9c6e047fd93a9645f8acdbcc2f36f65d00226af2d 2e3b79c0bc90f afba5d5a55cb a00f254ec113d342d76a992 38a58d5c41f91b483ae727e e14410c485db577cd0e21ee28e8fa e36fd9975a43f25fad06e d1280bcd9e6d5ef8221dc322fd16fbaa a56de8404db9311d60c87cccc4c25a e695e5ffa0ac bc3ce60f c e1196eb8a3294fcd79441ef7250e8fdf7885 5ed30bc2f ccba2ade6e124154eda0788d555978ab6b60a69dbdf0bac1 f81a fa49b7008cffe93365ef be9a935ae17acc2bafa8f983d9 6e678b7d3a7a46f20a f0d879f03b1cad83e441ca64a4c0d1076d9ebb f9e9a3d7b7bffae8cda1b3ff4c893933eff386b26fd035fa4bb61c7c31bf c7cececf2d29386f3184e588c5a0ec558292ff227891d3ce5605f82a5f9688 dfbafa207c90d3d4e20dabe7620f901e1abe30fa0fa4dd06bfabe852f8f1f0bc 检测结果屏幕截图

32 AMP ThreatGrid

$Untukmu-5949608-0 感染指标注册表项 <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER o 值 :DisableMSI <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\RUN o 值 :System Monitoring$

33 Umbrella Win.Worm.Untukmu 感染指标注册表项 <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER o 值 :DisableMSI <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\RUN o 值 :System Monitoring <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EX PLORER o 值 :NoFolderOptions <HKCU>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM o 值 :DisableCMD <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SY STEM o 值 :DisableRegistryTools <HKCU>\CONTROL PANEL\DESKTOP o 值 :ScreenSaveTimeOut

34 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\C ABINETSTATE o 值 :FullPathAddress <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :xk <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE o 值 :DisableConfig <HKLM>\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT o 值 :AlternateShell <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\AEDEBUG o 值 :Debugger <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\INSTALLER o 值 :LimitSystemRestoreCheckpointing <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON o 值 :Userinit <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :internat.exe <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SY STEM o 值 :DisableRegistryTools <HKCU>\CONTROL PANEL\DESKTOP o 值 :SCRNSAVE.EXE <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\AEDEBUG o 值 :Auto <HKLM>\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\SYSTEMRESTORE o 值 :DisableSR <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\A DVANCED o 值 :HideFileExt <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\A DVANCED o 值 :ShowSuperHidden <HKCU>\CONTROL PANEL\DESKTOP o 值 :ScreenSaverIsSecure <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :MSMSGS

35 <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSI ON\RUN o 值 :LogonAdministrator <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\A DVANCED o 值 :Hidden <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\ACTION CENTER\CHECKS\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.CHECK.0 o 值 :CheckSetting <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON o 值 :Shell <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EX PLORER o 值 :NoFolderOptions <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN o 值 :ServiceAdministrator <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policie s\system\ <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Policie s\explorer\ <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ <HKLM>\SOFTWARE\CLASSES\lnkfile\shell\open\command <HKCU>\Control Panel\Desktop\ <HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows NT\SystemRestore <HKLM>\SOFTWARE\CLASSES\batfile\shell\open\command <HKCU>\Software\Policies\Microsoft\Windows\System\ <HKLM>\SOFTWARE\CLASSES\piffile\shell\open\command <HKLM>\SYSTEM\CurrentControlSet\Control\SafeBoot\ <HKLM>\SOFTWARE\CLASSES\LNKFILE\SHELL\open <HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ <HKCU>\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug <HKLM>\SOFTWARE\CLASSES\lnkfile <HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\ <HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ <HKLM>\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\Installer <HKLM>\SOFTWARE\CLASSES\exefile

36 <HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon <HKLM>\SOFTWARE\CLASSES\exefile\shell\open\command <HKLM>\SOFTWARE\CLASSES\LNKFILE\shell <HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\System\ <HKLM>\SOFTWARE\CLASSES\comfile\shell\open\command 互斥体不适用 IP 地址域名不适用不适用创建的文件和 / 或目录 %System32%\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C A d D005A0 %WinDir%\setupact.log %System32%\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C A d D005A0 %System32%\wdi\LogFiles\BootCKCL.etl %WinDir%\Tasks\SCHEDLGU.TXT %System32%\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S _UserData.bin %System32%\wfp\wfpdiag.etl 文件散列值 9e e2d948623f74a1443a beaaa1c902ddc2741b1586a3bd a112e87550dba81d ff78959cdfe c35895a4a53635 fdb82a1a0c8b84d22d87e373d37a09cbbee481eca77a695f0a42b0ce8e7d15fb 1c3d a96d8dac17ef186e1d10e6520fc82d f4191d437bfa106a c7e85bc2b8120dec204e5592ab9254e90030cf3a13a2281d047c1d0bcb878d10

37 防护检测结果屏幕截图 AMP

38 ThreatGrid 发布者 :ALEXANDER CHIU; 发布时间 :16:56 标签 :AMP CLAMAV 防护 SNORT 一周威胁综述 UMBRELLA

一周威胁综述（8 月 11 日至 8 月 18 日）

一周威胁综述（8 月 11 日至 8 月 18 日） 2017 年 8 月 18 日, 星期五一周威胁综述 (8 月 11 日至 8 月 18 日 ) 本文概括介绍 Talos 在 8 月 11 日至 8 月 18 日观察到的最常见威胁与之前的威胁聚焦一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及我们的客户是如何自动得到保护免受这些威胁的在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽,