一周威胁综述（4 月 6 日 - 4 月 13 日）

Size: px

Start display at page:

Download "一周威胁综述（4 月 6 日 - 4 月 13 日）"

调昆廉
4 years ago
Views:

1 2018 年 4 月 13 日, 星期五一周威胁综述 (4 月 6 日 - 4 月 13 日 ) 本文概括介绍 Talos 在 4 月 6 日至 4 月 13 日观察到的最常见威胁与之前的威胁综述一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及探讨如何自动保护我们的客户, 避免他们遭受这些威胁在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽, 但所述内容截至发稿日期为止为最新对以下威胁的检测和防护会根据进一步的威胁或漏洞分析进行更新如需获取最新信息, 请参阅 Firepower 管理中心 Snort.org 或 ClamAV.net 本威胁综述中介绍的最常见的威胁主要如下 : Win.Dropper.Fareit 植入程序凭证和敏感信息收集程序受感染的主机上会查询银行凭证或 Web 浏览器密码数据库等特定信息截获的所有数据都会传播到命令和控制 (C2) 服务器 Win.Dropper.Generickdz 植入程序该集群主要包括为实现持久性而创建 Run 键, 并使用各种 Win32 API 执行恶意活动的恶意软件 Win.Dropper.Generic 植入程序该集群主要包括为获得持久性而利用嵌入式 HTML 创建 Run 键, 以让用户下载其他文件的恶意软件 Win.Dropper.Mikey 植入程序该集群主要包括为获得持久性而创建服务的恶意软件该恶意软件的特征是具有插件架构 Win.Dropper.Neutrinopos 植入程序 Neutrino 随时间变化而不断发展变化这种变体的攻击对象为销售点 (PoS) 终端该系列的特征是使用反沙盒技术来阻碍自动分析 Win.Dropper.Shipup 植入程序典型的行为包括修改某些设备的自动运行功能它通过创建计划任务来执行活动, 从而获得持久性

2 Win.Dropper.Startsurf 植入程序一种木马, 旨在收集个人信息, 有时在其他覆盖签名中标记为可能不需要的应用 (PUA) Win.Dropper.Upatre 下载程序 Upatre 是一种恶意下载程序, 经常被攻击包和网络钓鱼活动所利用 Upatre 可下载并执行银行恶意软件等恶意可执行文件 Win.Packed.Tofsee 打包程序一种多用途恶意软件, 可以包含多个模块来执行各种活动, 包括将自身安装为服务以执行垃圾邮件僵尸网络功能威胁 Win.Dropper.Fareit 感染指标注册表项不适用互斥体 \BaseNamedObjects\00291FDE1ED E922 IP 地址 101[.]99[.]75[.]151 域名 makewebomb[.]xyz 创建的文件和 / 或目录不适用文件散列值 b4abd9556f093b7d80bdc755d a807d5ee9d9f9bac19bb0c8d596dbc 1ca88b2c00b625bf596b93abafae873a6aec5bf1afeee1e116dc402cae69f83a 3f2925b26b0f0b0f141346d8a654a74704d de17518bd6fb11671e8 ba0a2f6e001bc9c02ee8c5fbcd6cceaa74ced5ec058dfda f06ff2490 f68b0c32da95c0fb06c4cefb992e1a0039afed32f6cfcef083db39a0702a06c7 61ff6f5d48f02c0a5b7a28936f8aa9ebad2344f fae2ce3f14a9bf14d4 a7d667e9d67d4b7db00c52572ca1e945b1aba8139dce9c647b8b9bce89ba45e0 6a1a4a c2dd34ba9beec07cbfe17c8ff65a10f1bcdf8598a8f1b58e42 85d0021f75a2d312a27bc1c17702d aff590d439a90d8045d2325a04e

3 c2729c9779beee8e f932a155de278eb46d9fc557c39400 e981fd64b4c1f1d50cdf3f21d3cd07dfb04dec58c518bee8697a c aceac7e54b9d7db a52e854a5e61f5c5f2452a60432de 3ed671f4ea7e92ef0e0bf61e7bacc0b7a2a82ccea73a53e7cde66e3497a d428d1e7c7ddcc8aa b290edb12348cae2bc0ddbb32 9c6def0cb a10888e6f702d a29db1da32ab149273b3d10ca34 df58773cc519e82a8beebeca cb3cb26aa491aae89c8d68cec835a7 5eb40ac46872c6d26cd7ebdb0938a9375d7cdf28017a5c625d890a7d2ba7852d afcdd2fda5b3c9e78a977df31be307ea7323b746e07e35e4d3c39a3a3f4b4b79 a854a9702c14be3508d35873e80577ee9b1296c993ee2a4269c e 431e6a a5e1c7c98aa9b72c1df4b21e34ae8c7e f140466e 1d7a1a a7f80ed926c47cb0ebc7beb953739c9b41cec20093c b24f0523af239668ee8946c433c53d0c233b0290bbaca405885d39dff86fa1f ba54f1f58776a84e98152ae28dfbca23602cb440a830fddd4a283cf b b6a54b78141a f4b3ee93ac0a5ae0149e636e7db8c4f38a28 e5d34b53cb6e4e111e167cf13b608b87f7ab7d43d7f08f995ae9f2c1139e8f51 防护

4 检测结果屏幕截图 AMP Win.Dropper.Generickdz 感染指标注册表项 <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE o Value: kdivknmyqwz <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o Value: ProxyServer <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o Value: AutoDetect <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o Value: ProxyOverride <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o Value: ProxyEnable <HKCU>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS o Value: AutoConfigURL

5 互斥体不适用 IP 地址 66[.]171[.]248[.]178 域名 gandcrab[.]bit dns1[.]soprodns[.]ru nomoreransom[.]bit nomoreransom[.]coin ipv4bot[.]whatismyipaddress[.]com 创建的文件和 / 或目录 %LocalAppData%\Microsoft\Windows\WebCache\WebCacheV01.tmp %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\W7RSB4SE.htm %AppData%\Microsoft\zkwnlf.exe 文件散列值 599d9e37c39ec47a50b512e01449a37ff3c3354ed0b9b4de2ca7e8f2d3a33bfa 4d0f0b7c9a3b fcc45aa1df3e6f2ad0c58563a40ac80776c705f821 0aeb76bb929ea68275b c3b15a73fd6479ee3daecd5ffd4c407eb721 c76394aaf293cbf4bf3b9d7a94c251feac d700bb4bd87da3c c2586add3eac cfc7a c16dc0d1e1f874e4cd3fa c2a 02cb3c ed9658fcf68b9f776d720e2f b10875f0f9bb2b8ed161 5f7f8a6fd32cf4d91efe01c2f1b7c4fd5f509b504af134a08c6c688ba9597ea6 3c9c b97251bf5d3d12fe59fcf96d4274c4887b fe61b 4e496591b9c2c9722c07746edfc7892b178b8965bb4c452322caab68b2d5f262 2eed2f22d055d605a8387d35610e4e82815eb29b7212de efa54d3c f6d57c2e4ca1871dc1a5e270160e734b2d79bd9b7b55b82a8ddc53aaac0f c21fdd9a5d244aed75890c c2f f4bc5966ae a8 98f7b5afa98edbfcb4a6f502d9d29e6bb0912a6bcb7a14abe3a9a60e0487b201 c7e92cc3f88c7180e2774f2641c593ebebedee fdd8fa8365f6cd0000a 1937b1e07be1737d79a3a4b1ea9c5ab0a56f1c3ce44d2e34d705a7b69b9346cd da5dd6e75c8df5bc a7b7e6fbef90ca eaba546be3bd 40a0f808c1fd873c364850d95e2f0adb0ca de5c0552a5afc60612 b609c46124d069b2299de3896a5cc2f7540e4effcba462e7f efd4a d7e c9747f9c803d e86112afbe49d68b578775f1c29141d d8c2a089ea0870fa37060c a8b373ca0795d1c06db443b53dc5882 2b7662b93abcd312eb2c4d66c246af9dc7c43a511fae5dddd11617bf2ced16c3 5795c26debe0c06d1f a84efeed69f0493b23f8411b3ea60781e7a24a bb8ac5961f58831e7e4fa6debe7a4a399e5ffa56d37e7ca78f db67b808d476e aafbbe320a0884a417a7d7fae604440c6e acaa87b92f1e2ee e4760ca4f9c781e82b72949c46861c7652cf74c2

6 防护检测结果屏幕截图 AMP

7 ThreatGrid Umbrella

8 Win.Dropper.Generic 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\ EXPLORER\RUN o Value: NZVHFTBPMBN 互斥体不适用 IP 地址 198[.]54[.]117[.]217 68[.]65[.]121[.]51 104[.]200[.]23[.]95 104[.]250[.]149[.]195 域名 www[.]atopgixn[.]info www[.]gstringguitarco[.]com www[.]mymugcity[.]com WWW[.]SNHVWA[.]MEN www[.]mankafei[.]net www[.]9999zh[.]com www[.]dltecgeradores[.]com www[.]snhvwa[.]men www[.]zswlu[.]info www[.]bitstubs[.]com www[.]allsystemstoupgrades[.]win 创建的文件和 / 或目录 %AppData%\K27P0CT0\K27logrv.ini %TEMP%\Gsdf0d %TEMP%\nsnD1EF.tmp %TEMP%\zvu %AppData%\K27P0CT0\K27logim.jpeg %ProgramFiles(x86)%\Microsoft\Windows\WebCache\WebCacheV01.tmp %TEMP%\nstD210.tmp\System.dll %AppData%\K27P0CT0\K27logri.ini %TEMP%\Gsdf0d\mshlg4q6x.exe %ProgramFiles(x86)%\Gsdf0d %TEMP%\nsc8B5E.tmp %AppData%\K27P0CT0\K27log.ini %TEMP%\nsi8B7F.tmp\System.dll

9 %ProgramFiles(x86)%\Gsdf0d\mshlg4q6x.exe %AppData%\K27P0CT0\K27logrc.ini %TEMP%\nsi8B7F.tmp %AppData%\K27P0CT0 %TEMP%\nstD210.tmp 文件散列值 44f6b3cea3a371a7cd dcc6f9f96a40c8c732b1acd8042a2991a9bbf73 d62ee1186d8a8c7d84b2a03e0bee1c13c47d133a55238ba7c367f9539e6c9b17 df9f1a4e2cb c7442aedfe873c5e801ab048e c3acd5ec79b d8f1f59b81a985f538fc0a51c85c688794f94b28a06883ba9dadfb4b0c8bccd6 2ca04f3c65e3fd16b9c879c7db4cc dbb965e3954e35106fe952e c0a7785ab6d418112d10cd6844ded d18d74d9b978dea1fe1a9 09cc6c9e39425a71ccdc26ffd8a b20f eea24e6bb00b12d c4bda82acf554aad37fe97d08f4367c9a1e5d40b6fe17cdc94adf040fc 3d756dcf4397cb6b0d406b9f70eb fce0110c0290af6ad73468aa2c1f ef4d20220eaecedc0b bd5eddc196b25a9e083fd16d19ae100374df 70d50a77db7cb a7e58c354e1fbab ad9eccfb51e9b257f83c 35c996576eba666a33e26bc de365465da8ebee70930b9c4ec6be a8b46f74f5d4af759b18db64dfd9af2ef3e429d597cd fb ac6fbd8f18bb93cfac31af73eb9cf6a1aa925b95d44b42b3659ecfd49209ec de0073adc2f68fc f92f43a696bbf5d8f892f902724be37668f3 c1e a47c60daee91f9f906c2ceb03cac0c67a8ed3f0a31c37e3a f9401c7d7ac485d c64ec2de6f14783cad6150b7c6f0f368c7c dd3564a5d689bf310483fe351fac55e54a440d15e55f0bb7d35baab6 aebb84da20c2c92da398b1e5fcc8adc6bfe893d5a8b56c5cd1beb42b3fa5f069 2a0904b6301b42ed b161c947a781600fc884b0fc499f906a49ea e1c8a62bd632cd364d16dcf c8dcb443269f4478f301e4adf758977a6 f c44beee0b1d7f5cdc4a31c858eab565fc2592f96c69eb9d501e1 8ecfcfc939e40cc943df83f548286c2f7f519a53e195b3ae595e0bef39baee d6e06ded3b1a43e98eb781220c37e729ef081bd160f168fc465313ea4ff ef4b97346e1ee359feff43d136f3dd fb47bdfd25520b4fc3279d3649b

10 防护检测结果屏幕截图 AMP

$Mikey-6502276-0 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFIC$

11 ThreatGrid Win.Dropper.Mikey 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFIC ATES\9B4DFF593EC B76D97E83BADF6893F2597 o Value: Blob <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES o Value: DefaultInstance

12 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\MAGSV INSTANCE o Value: Altitude <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\MAGSV INSTANCE o Value: Flags <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK o Value: atimode <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK o Value: shield_count <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK o Value: set_pt <HKLM>\SYSTEM\CONTROLSET001\CONTROL\NETWORK o Value: set_bl <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFIC ATES o Value: 9B4DFF593EC B76D97E83BADF6893F2597 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS o Value: DisabledComponents <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: ImagePath <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: DisplayName <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: St <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: Start <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: ErrorControl <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: WOW64 <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: Group <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV o Value: Type <HKLM>\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS o Value: DisableTaskOffload <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE o Value: igfxmtc_time <HKLM>\SOFTWARE\WOW6432NODE\MICROSOFT\NETWORK\FILESERVICE o Value: Liveup

13 <HKLM>\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFIC ATES\9B4DFF593EC B76D97E83BADF6893F2597 <HKLM>\Software\Microsoft\WBEM\CIMOM <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\Instances <HKLM>\SYSTEM\CONTROLSET001\SERVICES\MAGSV\INSTANCES\magsv Instance <HKLM>\SYSTEM\CONTROLSET001\SERVICES\magsv 互斥体不适用 IP 地址 45[.]77[.]68[.]17 45[.]32[.]78[.]78 45[.]63[.]57[.]87 173[.]192[.]16[.] [.]37[.]56[.]249 域名 gpt9[.]com optcdn[.]com www[.]userbest[.]com optitm[.]com 创建的文件和 / 或目录 %System32%\drivers\spbiovxl.sys %LocalAppData%\exhpugb\dowmload.tmp %WinDir%\TEMP\UDD7B8B.tmp %System32%\pwkmbru %TEMP%\3ED5.tmp %TEMP%\400F.tmp %WinDir%\TEMP\msidntfs\SSL\cert.db %TEMP%\nsy4211.tmp\ioSpecial.ini %System32%\pwkmbru\dsieovx.exe %WinDir%\TEMP\msidntfs\SSL %WinDir%\TEMP\UDD73AE.tmp %LocalAppData%\igfxmtc\igfxmtc.exe %WinDir%\TEMP\msidntfs\SSL\SecureTrust Network Root CA 2.cer %TEMP%\4119.tmp %TEMP%\nsy4211.tmp\modern-wizard.bmp %WinDir%\TEMP\UDD6BD1.tmp %WinDir%\TEMP\msidntfs %LocalAppData%\exhpugb %TEMP%\3DCC.tmp.exe %WinDir%\TEMP\UDD63F3.tmp %WinDir%\TEMP\UDD8369.tmp

14 %TEMP%\3FFE.tmp %TEMP%\nss41A2.tmp %WinDir%\SysWOW64\pwkmbru %TEMP%\nsy4211.tmp\GetVersion.dll %System32%\pwkmbru\dsieovx.sys %System32%\pwkmbru\dsieovxdrv.sys %TEMP%\3E3A.tmp %WinDir%\TEMP\UDD4441.tmp %LocalAppData%\igfxmtc\dowmload.tmp %LocalAppData%\igfxmtc %TEMP%\nsy4211.tmp %TEMP%\3DCC.tmp %TEMP%\nsy4211.tmp\InstallOptions.dll 文件散列值 4605f6041d93c6390c1ed856336c01a6cf3982bea1987c6de846752ca a10aefc70a3d3512cf54f74e39b3ee5cc5403c003179c57aeea7fb3895ed8ace a0365a881396fa cd617e5ef7e175343f28b7ee7ec347bf c0 05be7b2de818dcb358a4f24d6050ae2b91d728c80a8af279894b5e701b a32a315ae45f62d26cdd22281a69932c83f147fc4e820a9cc7bf05bcc bd49db136718b3cef01348bc839e206d566a1e1c32e0537be61dfa2ee87de6b a677a593cebda3734ab26828b65fd93b54bbc02199a080a26da61afcff29ae48 84c269a1661a987058f51dea4644ec2703b fbeab6920e40ad1a05a54 ad7c7472d980025e3edbab89988fec2d5776b4f72b0757c2b1dac54d1c991c37 877d9c4195c38a9dc55c472f7c72ec3d6ad0d95a544458a2050edf22df3aac5c 0a6cabedfabfbab3fba2057d30b1faab2f1b2d2d47a6227aa3b677af45f92da b58c7cbc066f84c625efa0248eb89bfcd24de916f5fe600c e7 7bc897c2c55ff708cbccff1461d2406aaef bd2d6a39ad58af393f9 e1e31a797b01f5f4ec694fb03d894e5ab331f41f3bc8c34bb407d390554bfe3a fa8c301685d5ceb6a97b75f3bb665871e3ddf5b dd7a55f4f3cebf4ab 9b fe bf86d dbc1b231122e4a5d2157ba93c1b504 19a5f6fc34e531409c787b b44a5c11dec0dafab0e0ef699de29eea6d b4e2b99c18bf61acedaff5b1908a212470eb902ddfe8e164e01ffcfbab19834b db5b0bb4d05292e6649fa84f076195d7a0cfb15516ce386f214dc2dd96a5e fe96292e5d5702f2c82e4b21c3cbc4234f13417b22ad963a9f ab8e652c16836caf3b f417fab73a92e916f0c6aaf27b57f3be4

15 防护检测结果屏幕截图 AMP

$Neutrinopos-6500704-1 感染指标注册表项 <HKU>\Software\Microsoft\Windows\CurrentVersion\Run <HKLM>\SOFTWARE\Microsoft\Windows$

16 ThreatGrid Win.Dropper.Neutrinopos 感染指标注册表项 <HKU>\Software\Microsoft\Windows\CurrentVersion\Run <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\NAP\Netsh\Napmontr

17 <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\host2lc <HKLM>\SOFTWARE\Microsoft\Tracing\FWCFG <HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\Microsoft\qagent\traceIdentifier 互斥体 \BaseNamedObjects\DRBCXMtx IP 地址 216[.]58[.]217[.]174 62[.]75[.]222[.] [.]58[.]206[.]78 84[.]16[.]241[.]77 66[.]199[.]229[.]251 域名 google[.]com u[.]drawfixmydesign[.]com r[.]drawfixmydesign[.]com 创建的文件和 / 或目录不适用文件散列值 2593e0c6d66d36c7d8b3061f3c a2939f89aea73eda1397e44e31 e9a7b16189e27dff9ff67e31d09fa05e7f32658dfa56bb51feff8ca0cfb4eb85 1a adb05aee9ef8adfb3c892a97d32b870d1ee300975a5f3597f2ed638 ff5d541f260063a88b04a892cacfb3bcb13b8dd83c5f29ed dbd6662c4 b1d0bfdd95f168cea0df0e138ee627cb7feb0a26ac7a736baa031547bb6fb08d 9af34cdb7f0b01c044fdeb64f0b733d78e8b9be854c4beeee679f8ee083530b f8904bf6b9af4116f52ae2ba8b4b97ce586cd3b2b2777a8f3c76c8cc 61cb5cbccb6d1c329cb1a641c3a74fd4a4521dee0d2d03e810f3f12303e0f1f d d2d432427d33cff576d202e1fc7ea2990b21847cce1 ba975d346f8f543f348e1e42f03bf b321ae6dc8a8497e608e8766 2df889657dd28f91ea10c08d5a72cf890bf142a6fb ecdefcf708cc2b f1a0bd da989be39ef821b11fc6acccef5eabc d c1023c0baaa1e227defd c4f3c ff1cb088b40b9df7a f9b54be981e420a7bca1d33d0fa180e6c42877beddeb23836cc440f062 e9bcf e320f5031ecc8157e0498a42d699cb175d7242c95b9f d7dfa923b5b1e0e5a0d27f19eb40979dcf342f2fba01ccbb09175b9363c 973c024f2af38334bfe80a5c1fc2f96b ff08110e3c96aa986e7440

18 防护检测结果屏幕截图 AMP

19 Win.Dropper.Shipup 感染指标注册表项 <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{E5EC135A-79D A051-FFFB0E1F7FB4} o Value: data <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATUR ES o Value: aybbmte.job.fp <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\COMPATIBILITYADAPTER\SIGNATUR ES o Value: aybbmte.job <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\AYBBMTE o Value: Index <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\AYBBMTE o Value: Id <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E B6D9-1FB306F3D9D1} o Value: DynamicInfo <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E B6D9-1FB306F3D9D1} o Value: Path <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E B6D9-1FB306F3D9D1} o Value: Hash <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{DAC4F53E B6D9-1FB306F3D9D1} o Value: Triggers <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\HANDSHAKE\{E5EC135A-79D A051-FFFB0E1F7FB4}

20 互斥体不适用 IP 地址不适用域名不适用创建的文件和 / 或目录 %ProgramFiles%\Mozilla\thfirxd.exe %System32%\Tasks\aybbmte 文件散列值 082f1ce18a378ec6eb67565fb7bd89cd29db886b44fe4312a863382af9e13df7 0e1d3984bd6c33ba0fc108329e3906bd074d70ed44a4c7fa6d8f857531bbc cfde4acaf2c29969d175db1cecd28c e097e52da5c0e886a da7abee3f2ea4275c db5ba9f620fde8743eb0ff2388b e0b 9dc0c514ea1aaa91c cb261bd6c94f8565ffef4420b75c5d b dd67ac6e9bdf14255fc5c8b697d68b810e732b4ae29798b62e5ad ecdfa b2826e4de7e289b0cd12849b719c7a171ee7524bf22fe99 cc203d955e3e f7b2aea1f13c2ba5895da16159a779407e03e747d e5b40ff efe5dacfd5b6c9d744fe294f425703ddafbf687192eb8e 0a52739b2a45b1002b78230df60dd42d2ffa dd627bcc bb4ea96c6107c6660b104d60073be3a9f5c3bdbbc2c801771fc34a03e01c a1175ff8f5544f4ec078e4d55db4b6aff7a7844e9df2057d3fe906cfa77d25f0 61dede4113d1eda504f7360ae535cd88ede db4a d0312acd5a ac755dfabf99ea6fc8c334dcef526d1dce deeaac5e80077a27042af9c 786c1b55e5e73fd3c2231d7e6fa0565aacb4fb239807f42c2f0cb83f e27ccfd0c90aab501d16d45b1e9d13bde3e2d6c2ba6d230b7973dcc8567e556 c7dcf76652af54cf4cbbfdfc4fa5cc8d4a8e1807d478eceee dbfecf7 228ffe97f34e097a0cb3b3288ee56a063da65d890b1f888d59d59f0ad2b3bb71 39c05a8b0d635eb dd3e26c93d16bb5a16a2512c68bde bd38baca4b923c26628e9dcf9ee64d8bcc5c4ba9cb9f2298e32f8db7816de08 cb2155b65879f66eb449b60a90c632c701fbea7ac8d4011e3b24b238c3302de0 8fdabcedb02b4ae9364e53f a1f6e c29dbda34cf934229b47d fdb559a29e0374fa7ce71d fcc2d2db7d a5cf1e0eba5c5634c8 4a f d52315c79bfcb5fbef86f19d51beb718fe8093dc1af16 2f9ca1b196aa915e3c87dabe20f353a4a69ee5998f8559ef dc7ea9

21 防护检测结果屏幕截图 AMP

ThreatGrid Win.Dropper.Startsurf-6502245-0 感染指标注册表项不适用互斥体不适用 IP 地址 52[.]85[.]88[.]217 域名不专业 [.]basinafterthought [.

22 ThreatGrid Win.Dropper.Startsurf 感染指标注册表项不适用互斥体不适用 IP 地址 52[.]85[.]88[.]217 域名不专业 [.]basinafterthought [.]bid 创建的文件和 / 或目录不适用文件散列值 9ad10ae09760aa994fdf2d6132a60276badb77b0ab773ee5d07d5b5e7a c31ec1ded95ec22f07a3bc29c03badd9158d8ddc19e1cdb98ccdab3482f d0f f f99110a5dd35fed88260c44a022983e12bdaa1

23 a02c5f7013b02bbc f4250ea c60e8836bb676243b648dd3a0 f0bfcb def575a18a d335c95da6781b11d1ad91711cb4a81 41bf7b4e4d7a87395cc8867e026ed9d a70325a672d07ea9c1a351e0 e616d1e7e2b6e1d4f1ac2fea3e2041b842d27f5de05ff941b cfe8a dc fe7476b6ee4a81ecbed78604e4575e299f52f6b6f3c65eaaa1 bc782f40d16fd6574c1e84edd f426a31d2ff94e4bbb87a19cf ead5ee82c762a26e1dc0e6a8b21c54669c771cca0291b5d41282d2e73a7fc0 739f27ac00dc449895f589ff28e86d78ea17ca298ffc0b d7c77ed679 cc4c722e0d6e2bbff6119e1895f6dfbbb2ed75b3d786e4de507b48792a2660a e00deb562a29f3cb335167b2880f3ef3065e418f57f1b626d9ea8c94 b622971e681f9e2fa5f84bfcb9e7144b6198d3fb554de8d ca1e3f51c8 0fee9d67ef1967d2bee1f67b1dc5ae24dff5d6dba17b9247e33b87f5bf6e6856 6c8ca3ba14ee685739ea32a3ddc613d4544c69194a97c55365c570c f1dbfaf cd1758feaabe050171df1c234ddc6215df494c6592a9e92547 e586da2bd9fd b97e6e4e137249f9aff b31508e12 1d70d1eb b8d2c3c62ca6ade7b018f44688d009cbde3c2c214224a3ffb f7d963489d1d7d2d9be4bd1b1dd82e81e21f6ebf09091ee7b ddd4a7ed96a86a09413f14657c7e f6f1f6008a3a3bbe4fe af9dc27feb2b69729b82e4076dd699cc504c3c8dce943d2023c7bdeca00f2a 4694e19504a1bbc0335c213bad487727ab75faab3bf29d92cb7e3d14a2d3a8d0 0863bf4a5476b5de02a15c3bdec1604c7d8ab7c8ca1c0546edf2f16a756e0d8f 39974f2161bc ae2f380d38b626f2b47904f92ce5706e29b2fe05122d3 防护

24 检测结果屏幕截图 AMP ThreatGrid Win.Dropper.Upatre 感染指标注册表项不适用互斥体不适用 IP 地址 72[.]230[.]82[.]80 216[.]146[.]43[.]71 173[.]248[.]31[.]6

25 93[.]185[.]4[.]90 173[.]243[.]255[.]79 域名 checkip[.]dyndns[.]org 创建的文件和 / 或目录 %LocalAppData%\Microsoft\Windows\Temporary Internet Files\Content.IE5\SSZWDDXW\W7RSB4SE.htm %TEMP%\serizay.exe 文件散列值 eff79e0de0f30752e1cf9b cb2fd6ad51c6ea6f20dbdf5 fccaca287d58a30c33cc6a52e49fc16c9c5f b82c8ea1df216ec42db0 6b93b7b97c1d5f3ad00378c8ff279c2f2ef8ba4ca16fdde45fe0557c37e8630a e9574e34b580958e83aa060868edf408751f89f2844da98f2a8c4df24a175efd 2b0dbfbc6f a9ec a8bcf3ca1c4e1b23d7aab3e7e7dda5f d4be f8b720abd45b5f900e513c8e9c c673a07b a 45919cf6c7ca6e97bcbf5f3bcf670db27c29d81aaa50b3563c50ec4e80ec6f4c 388a22678ed13c5fc9a26d8d89a b38d782677b49d9abbfa1dcd47105 d9b137bba139689b08b01f59dfc61b161f522c8618cd74321a7ae4531e093ebb 702c79933e6afba fc1eb6fada3273a1a3038f4332f09eac44237 ccbf0df625484ab8244a ff698fa00fe2ed8da99e779134c4f96c2a3f 5c80cd abfb8ec87a0aceb8b9d791dfdc67259e668ec2cabab3abef4 6b6eb4cc4aa8e3d71a97a8657ffcd27d2bd12466faf3b1f7fcbcd274a4b9561c 06c65a259d7c96000fcec97a7d8c5b6c4d0c8b8e52ed1d45c934a50d0369b3eb f43312efa07fe063b6fd50de8f1bc3e7ccfe27b4d80d9082e8faaced210f6be0 84f1fd4c31d0c21517ffe56eea666d6c7954aec47e958c33238b91f6bc9ef0e0 07cb19e9013ac45d8e ebd9d1a d20800f8aaf5789b6fbb47e e122d91eb62a33c8b4ef56b2299caf2f58fd4e48694c97e06c92f858497cf860 ea284de1551e367f736ce661b7342fc3a98297cfa dd14ccf e4b38a225a2703c06bcf4d26acc22753a86b74fa461720bda700c1fa2c1b3db6 daeded4fb715741d4045fa7ff6e7d81920c3e7ce892c1c29676a51ee70d63712 bc417721acee0afa960d71a7c59acfb6d bd b a a8ccf d1c86945f9a40cd0d4ee35084b8af26c9f5ab210 53e260744b0f3d02c6d629cd466483b79c147d882e c4c7eeb e5bff8f11e5ed171ac94f1a fbffd46b66493c90aaf47b640568faa1e

26 防护检测结果屏幕截图 AMP

$Tofsee-6504793-0 感染指标注册表项 <HKLM>\SYSTEM\ControlSet001\Services\xkqrdots <HKU>\Control Panel\Buses 互斥体不适用 IP 地址 85[.]25[.$

27 ThreatGrid Win.Packed.Tofsee 感染指标注册表项 <HKLM>\SYSTEM\ControlSet001\Services\xkqrdots <HKU>\Control Panel\Buses 互斥体不适用 IP 地址 85[.]25[.]185[.]229 43[.]231[.]4[.]7 12[.]167[.]151[.]116 域名 116[.]151[.]167[.]12[.]in-addr[.]arpa 创建的文件和 / 或目录不适用

28 文件散列值 c6eeffc5eb2ee7203e7abef9e60c5edffd5471aa02760e1b2ef0cce5c5a73aa3 cd159019d822551dd72c81fc f65deaee88469c05682e7575a27e8e8 f0bd29ac4f11195c79f8b1812cbf93fcb2b8e67bd219c287e9e93c8136c44a32 40b0cde3e58f802d799ce9b3baa86d3b03582b8d52af828fcf33a7b71fa704de 842fd3e6342f2eab3bb49c69a6d963e3c bdb074b f8170b2c6f e5633dfe5df0eadc14ee162af1c1f47c6350f514f6867cdeea8efeaf2cdd4f90 ea088b b19f1b4c22823d347b734e167cb634208a204d95f6c01f5 268b1d9cc88537d6ba a82bc6df00b07a74fa7ead0242e5cf0dc9ae 9b389a4e17438eeba6cba94c b36e38329ae8ccfef2e7bc5d3b5a61 e411592afee8c0a1d6baab dea44c307ed4ea223999eb0152cd95db6 8ab34d8df dd1f4f70f407ca929cf c783ef40f64024e477b4f0 c8aeb4cf24afcabea69ac048a658fe031b033534a9cc77e249c03b1d0464a75c 10de8c9c16f71496e3c55f0d ea8f0e7b84dfabc80e13232dcee74 d2f102299b545cf1efc42b2e7d2de46dc6edf49b4da4ec4ee475539b21c7bad7 5a9b3c474315a6cc941b44e2e d7c3a8fc88653b12d3b6fa f5c742ff be30bba05c56c909b07cf7a475c570a704435e99ec925c92 8d6c39242bb75f30437e3a3712cd54e5f4a1ccba7deef3ced7607c e7847c2c9edb9a8cd764e28cdb8f575fa157846ed1b0e4ccf0612f915a794a c6caf5362a043f81d32dc30dae30f27354fa9783de374301cbf42be2ff3 35dcd9cd70c1047b835736be487536a3f3d6f2c2d40752f40ab c a316ac2f2fa0affd0977f61a97f7463f3dd77e18b217e8b97e2414d4ea a520d005f90f203e99bc325fca56eff338e6761a ac9010d d9085f4ada71d6c403e8042ffdd715974ad826a19ec2fb8a4f713ca9f 1f26c8b1dada5dc eb23f77f04d7a4818f8c8e ba4d9446e31d228b829f0f90f2f4519b87359d5d e0b986d8aad 防护

29 检测结果屏幕截图 AMP 发布者 :WILLIAM LARGENT; 发布时间 :16:11 标签 :AMP 防护威胁综述 THREATGRID UMBRELLA

一周威胁综述（8 月 11 日至 8 月 18 日）

一周威胁综述（8 月 11 日至 8 月 18 日） 2017 年 8 月 18 日, 星期五一周威胁综述 (8 月 11 日至 8 月 18 日 ) 本文概括介绍 Talos 在 8 月 11 日至 8 月 18 日观察到的最常见威胁与之前的威胁聚焦一样, 本文不进行深入分析, 而是重点从以下方面总结我们观察到的威胁 : 关键行为特征感染指标, 以及我们的客户是如何自动得到保护免受这些威胁的在此提醒, 本文中介绍的关于以下威胁的信息并不十分详尽,