<\/a>\u30b7\u30ca\u30ea\u30aa \/ \u524d\u63d0\u6761\u4ef6 \/ \u6559\u6750<\/h2>\n\u3053\u306e\u611f\u67d3\u306f2023\u5e743\u67086\u65e5<\/a>\u306b\u5831\u544a\u3055\u308c\u305fGozi(ISFB\/Ursnif)\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3<\/a>\u306b\u3082\u3068\u3065\u3044\u3066\u3044\u307e\u3059\u3002\u4eca\u6708\u306eWireshark\u30af\u30a4\u30ba\u306epcap\u306f\u3001\u3042\u308b\u4f01\u696d\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3092\u6a21\u3057\u305fActive Directory\u74b0\u5883\u3067\u53d6\u5f97\u3057\u305f\u5b9f\u969b\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u542b\u3093\u3067\u3044\u307e\u3059\u3002\u3053\u306epcap\u306b\u542b\u307e\u308c\u308b\u30ed\u30fc\u30ab\u30eb \u30a8\u30ea\u30a2 \u30cd\u30c3\u30c8\u30ef\u30fc\u30af (LAN) \u306e\u8a73\u7d30\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/p>\n\n- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u7bc4\u56f2: 172.16.1[.]0\/24<\/span> (172.16.1[.]1<\/span>\u304b\u3089172.16.1[.]255<\/span>)<\/li>\n
- \u30c9\u30e1\u30a4\u30f3: pcapworkshop[.]net<\/span><\/li>\n
- \u30c9\u30e1\u30a4\u30f3 \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306eIP\u30a2\u30c9\u30ec\u30b9: 172.16.1[.]16<\/span><\/li>\n
- \u30c9\u30e1\u30a4\u30f3 \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306e\u30db\u30b9\u30c8\u540d: PCAPWORKSHOP-DC<\/span><\/li>\n
- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4: 172.16.1[.]1<\/span><\/li>\n
- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8 \u30a2\u30c9\u30ec\u30b9: 172.16.1[.]255<\/span><\/li>\n<\/ul>\n
\u4eca\u6708\u306e\u30af\u30a4\u30ba\u306e\u8abf\u67fb\u306b\u306fWireshark<\/a>\u304c\u5fc5\u8981\u3067\u3059\u3002\u672c\u7a3f\u3067\u306f\u6700\u8fd1\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306eWireShark\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u304c\u53e4\u304f\u3066\u30823.x\u4ee5\u964d\u306e\u5229\u7528\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n\u672c\u7a3f\u306f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u95a2\u3059\u308b\u57fa\u790e\u7684\u306a\u77e5\u8b58\u3092\u304a\u6301\u3061\u306e\u65b9\u3092\u8aad\u8005\u3068\u3057\u3066\u60f3\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u306a\u304a\u3001Web\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u5206\u6790\u3057\u3084\u3059\u3044\u3088\u3046\u3001Wireshark\u306e\u8868\u793a\u8a2d\u5b9a\u3092\u3042\u3089\u304b\u3058\u3081\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3057\u3066\u304a\u304f\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002\u305d\u306e\u65b9\u6cd5\u306b\u3064\u3044\u3066\u306f\u3001\u3053\u3061\u3089\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3084\u30d3\u30c7\u30aa\u306e\u4e00\u89a7<\/a>\u3067\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002\u6bce\u5ea6\u306e\u3053\u3068\u3067\u3059\u304c\u3001Windows\u30d9\u30fc\u30b9\u306e\u60aa\u610f\u306e\u3042\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u5206\u6790\u306b\u306f\u3001BSD\u3001Linux\u3001macOS\u306a\u3069\u3001Windows\u4ee5\u5916\u306e\u74b0\u5883\u306e\u5229\u7528\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n\u554f\u984c\u306epcap\u306f\u3053\u3061\u3089\u306eGitHub\u30ea\u30dd\u30b8\u30c8\u30ea<\/a>\u304b\u3089\u5165\u624b\u3057\u3066\u304f\u3060\u3055\u3044\u3002ZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305f\u3089pcap\u3092\u5c55\u958b\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u5c55\u958b\u7528\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u300cinfected<\/em>\u300d\u3067\u3059\u3002<\/p>\n<\/a>\u554f\u984c<\/h2>\n\u4eca\u6708\u306eGozi\u306b\u3088\u308b\u611f\u67d3\u306eWireshark\u30af\u30a4\u30ba\u306f\u3001\u3053\u3061\u3089\u306e2023\u5e743\u6708\u5206\u306eWireshark\u30af\u30a4\u30ba<\/a>\u3067\u8aac\u660e\u3057\u305f\u4ee5\u4e0b\u306e\u8cea\u554f\u306b\u7b54\u3048\u308b\u3068\u3044\u3046\u3082\u306e\u3067\u3057\u305f\u3002<\/p>\n\n- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9\u3001\u30db\u30b9\u30c8\u540d\u3001Windows\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d<\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30db\u30b9\u30c8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL\u3068SHA-256\u30cf\u30c3\u30b7\u30e5<\/li>\n
- \u4eca\u56de\u306eGozi\u611f\u67d3\u306b\u3088\u308b\u6307\u6a19\u3068Unit 42\u304c\u5831\u544a\u3057\u305f2023\u5e743\u67086\u65e5\u306eGozi\u611f\u67d3\u306b\u3088\u308b<\/a>\u6307\u6a19\u3068\u306e\u9593\u306b\u4f55\u304b\u9855\u8457\u306a\u9055\u3044\u306f\u3042\u308b\u304b<\/li>\n<\/ul>\n
<\/a>\u89e3\u7b54<\/h2>\n\u4eca\u6708\u306eWireshark\u30af\u30a4\u30ba\u306e\u89e3\u7b54\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/p>\n
\n- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9: 172.16.1[.]137<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30db\u30b9\u30c8\u540d: DESKTOP-3GJL3PV<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d: sherita.kolb<\/span><\/li>\n
- Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL: hxxp:\/\/unapromo[.]com\/mise\/Cliente.zip<\/span><\/li>\n
- Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eSHA-256\u30cf\u30c3\u30b7\u30e5: 33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209<\/span><\/li>\n
- \u521d\u671fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u6642\u306eURL\u3068\u30d5\u30a1\u30a4\u30eb\u304c\u9055\u3046\u3002\u305d\u306e\u307b\u304b\u306b\u306f\u3053\u306eGozi\u611f\u67d3\u3068\u4ee5\u524d\u5831\u544a\u3055\u308c\u305fGozi\u611f\u67d3\u3068\u306e\u9593\u306b\u76ee\u7acb\u3063\u305f\u6307\u6a19\u4e0a\u306e\u9055\u3044\u306f\u306a\u3044<\/li>\n<\/ul>\n
<\/a>Pcap\u89e3\u6790: \u88ab\u5bb3\u8005\u306e\u8a73\u7d30<\/h2>\n\u3053\u3053\u3067\u306f\u3053\u3061\u3089\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3084\u30ef\u30fc\u30af\u30b7\u30e7\u30c3\u30d7\u306e\u30d3\u30c7\u30aa\u306b\u5f93\u3063\u3066<\/a>Wireshark\u3092\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u524d\u63d0\u306b\u89e3\u6790\u3057\u307e\u3059\u3002<\/p>\n\u307e\u305a\u306f\u88ab\u5bb3\u8005\u306e\u8a73\u7d30\u3092\u7279\u5b9a\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n
\u4eca\u56de\u306epcap\u306b\u767b\u5834\u3059\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u5185\u90e8\u975e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0IP\u30a2\u30c9\u30ec\u30b9\u306f172.16.1[.]137<\/span>\u3067\u3059\u3002\u3053\u308c\u3092\u78ba\u8a8d\u3059\u308b\u306b\u306f\u3001Wireshark\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb \u30d6\u30ed\u30b0(\u300eWireshark \u306b\u3088\u308b\u30d1\u30b1\u30c3\u30c8\u89e3\u6790\u8b1b\u5ea72: \u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u8abf\u67fb\u306b\u5f79\u7acb\u3064\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u8a2d\u5b9a\u300f)\u3067\u89e3\u8aac\u3057\u305f\u300cbasic\u300d\u306e\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u7528\u3059\u308b\u304b\u3001Wireshark\u306e[Filter (\u30d5\u30a3\u30eb\u30bf)]\u30c4\u30fc\u30eb\u30d0\u30fc\u306b\u4ee5\u4e0b\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n(http.request or tls.handshake.type eq 1) and !(ssdp)<\/span><\/p>\n[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u306b\u8868\u793a\u3055\u308c\u308b\u7d50\u679c\u304b\u3089\u63a5\u7d9a\u5143IP (Source IP)\u30a2\u30c9\u30ec\u30b9\u304c172.16.1[.]137<\/span>\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059(\u56f31)\u3002<\/p>\n![\"\u56f31\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u3053\u3067\u306fWeb\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u5f8c\u306e\u63a5\u7d9a\u5143IP\u30a2\u30c9\u30ec\u30b9\u306e\u5217(Src)\u3068\u63a5\u7d9a\u5143MAC\u30a2\u30c9\u30ec\u30b9\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f31. Web\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066\u88ab\u5bb3\u8005\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092\u7279\u5b9a\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n\u901a\u5e38\u306fNetwork Basic Input\/Output System (NetBIOS)\u3001Name Service (NBNS)\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089\u88ab\u5bb3\u8005\u306e\u30db\u30b9\u30c8\u540d\u3092\u7279\u5b9a\u3059\u308b\u306e\u304c\u624b\u3063\u53d6\u308a\u65e9\u3044\u3067\u3057\u3087\u3046\u3002\u305d\u306e\u305f\u3081\u306b\u306f\u3001\u6b21\u306eWireshark\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>\n
nbns<\/span><\/p>\nWindows 10\u306a\u3044\u3057Windows 11\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u30fc\u3067\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30db\u30b9\u30c8\u540d\u304c15\u6587\u5b57\u306e\u6587\u5b57\u5217\u3067\u3059\u3002\u3053\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u540d\u306fDESKTOP-<\/span>\u3067\u59cb\u307e\u308a\u3001\u305d\u306e\u5f8c\u308d\u306b7\u6587\u5b57\u306eASCII\u6587\u5b57\u3067\u69cb\u6210\u3055\u308c\u308b\u82f1\u6570\u5b57\u306e\u6587\u5b57\u5217\u304c\u7d9a\u304d\u307e\u3059\u3002nbns<\/span>\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u3046\u3068\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u3068[Packet Details (\u30d1\u30b1\u30c3\u30c8\u8a73\u7d30)]\u30da\u30a4\u30f3\u3067DESKTOP-3GJL3PV<\/span>\u3092\u898b\u3064\u3051\u3089\u308c\u307e\u3059(\u56f32)\u3002<\/p>\n![\"\u753b\u50cf2\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001NBNS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u5185\u306eWindows\u30db\u30b9\u30c8\u540d\u306e\u7279\u5b9a\u306e\u3057\u304b\u305f(\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a)\u3092\u8aac\u660e\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f32. NBNS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u5185\u3067Windows\u30db\u30b9\u30c8\u540d\u3092\u898b\u3064\u3051\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n\u30e6\u30fc\u30b6\u30fc \u30ed\u30b0\u30a4\u30f3\u6642\u306b\u751f\u6210\u3055\u308c\u308bKerberos\u8a8d\u8a3c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304cpcap\u306b\u542b\u307e\u308c\u3066\u3044\u308c\u3070\u3001\u305d\u3053\u304b\u3089Windows\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u304c\u308f\u304b\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002kerberos.CNameString<\/span>\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u3067\u7d50\u679c\u3092\u4e00\u756a\u4e0b\u307e\u3067\u30b9\u30af\u30ed\u30fc\u30eb\u3057\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u306e\u6700\u7d42\u884c\u3042\u305f\u308a\u306e\u3044\u305a\u308c\u304b1\u884c\u3092\u9078\u629e\u3057\u307e\u3059\u3002[Packet Details (\u30d1\u30b1\u30c3\u30c8\u8a73\u7d30)]\u30da\u30a4\u30f3\u5185\u3067Kerberos\u306e\u884c\u3092\u5c55\u958b\u3057\u3066\u3044\u304d\u307e\u3059\u3002\u56f33\u306b\u3057\u305f\u304c\u3063\u3066sherita.kolb<\/span>\u3068\u3044\u3046\u5024\u3092\u6301\u3064CNameString<\/span>\u304c\u898b\u3064\u304b\u308b\u307e\u3067\u5024\u3092\u5c55\u958b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n![\"\u753b\u50cf3\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001Kerberos\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u4e2d\u304b\u3089\u88ab\u5bb3\u8005\u306eWindow\u30e6\u30fc\u30b6\u30fc]()
\u56f33. Kerberos\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u4e2d\u304b\u3089\u88ab\u5bb3\u8005\u306eWindows\u30e6\u30fc\u30b6\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u3092\u898b\u3064\u3051\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n\u300eWireshark \u306b\u3088\u308b\u30d1\u30b1\u30c3\u30c8\u89e3\u6790\u8b1b\u5ea7 3: \u30db\u30b9\u30c8\u3068\u30e6\u30fc\u30b6\u30fc\u3092\u7279\u5b9a\u3059\u308b<\/a>\u300f\u3067\u8aac\u660e\u3057\u305f\u3068\u304a\u308a\u3001CNameString<\/span>\u306e\u5024\u3092\u9078\u3093\u3067\u53f3\u30af\u30ea\u30c3\u30af\u3057\u3001\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8 \u30e1\u30cb\u30e5\u30fc\u306e[Apply as Column (\u5217\u3068\u3057\u3066\u9069\u7528)]\u3092\u5b9f\u884c\u3059\u308b\u3068\u3001Wireshark\u306e\u8868\u793a\u306bCNameString\u5217\u3092\u8868\u793a\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002CNameString<\/span>\u3092\u5217\u3068\u3057\u3066\u9069\u7528\u3057\u305f\u7d50\u679c\u3092\u4e0a\u306e\u56f33\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n<\/a>Pcap\u306e\u89e3\u6790: \u521d\u671fZip\u30a2\u30fc\u30ab\u30a4\u30d6<\/h2>\n\u4eca\u56de\u306eGozi\u611f\u67d3\u306e\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u306f\u60aa\u610f\u306e\u3042\u308bZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002\u305d\u306eURL\u306f\u6b21\u306eWireshark\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u9069\u7528\u3059\u308b\u3068\u898b\u3064\u304b\u308a\u307e\u3059\u3002<\/p>\n
http.request.uri contains \".zip\"<\/span><\/p>\n\u3053\u306e\u30d5\u30a3\u30eb\u30bf\u30fc\u3067unapromo[.]com<\/span>\u5b9b\u306e\/mise\/Cliente.zip<\/span>\u3092\u8981\u6c42\u3059\u308bHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u898b\u3064\u304b\u308b\u306f\u305a\u3067\u3059(\u4e0b\u306e\u56f34\u53c2\u7167)\u3002<\/p>\n![\"\u753b\u50cf4\u306f\u3001TCP\u30b9\u30c8\u30ea\u30fc\u30e0\u8ffd\u8de1\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u9078\u629e\u5f8c\u3001URL\u3092\u63a2\u3059\u30e1\u30cb\u30e5\u30fc]()
\u56f34. pcap\u306eHTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089.zip<\/span>\u3067\u7d42\u308f\u308bURL\u3092\u63a2\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\nWireshark\u306e[File (\u30d5\u30a1\u30a4\u30eb)]\u30e1\u30cb\u30e5\u30fc\u304b\u3089[Export Objects (\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8)]\u3001[HTTP]\u306e\u9806\u306b\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001pcap\u304b\u3089Cliente.zip<\/span>\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u307e\u3059(\u56f35\u53c2\u7167)\u3002<\/p>\n![\"\u753b\u50cf5\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File]()
\u56f35. Wireshark\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u6a5f\u80fd\u3092\u4f7f\u3063\u3066unapromo[.]com<\/span>\u304c\u8fd4\u3057\u305fZip\u30d5\u30a1\u30a4\u30eb\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>Linux\u304bmacOS\u74b0\u5883\u3067\u3042\u308c\u3070\u3001\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u5225\u3092\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3068file\u30b3\u30de\u30f3\u30c9\u3067\u7c21\u5358\u306b\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002file\u30b3\u30de\u30f3\u30c9\u3067\u78ba\u8a8d\u3059\u308b\u3068Cliente.zip<\/span>\u306fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059(\u56f36)\u3002SHA256\u30cf\u30c3\u30b7\u30e5\u3092shasum -a 256<\/span>\u30b3\u30de\u30f3\u30c9\u3067\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044(\u56f36)\u3002<\/p>\n![\"\u753b\u50cf6\u306f\u3001Linux\u306e\u30bf\u30fc\u30df\u30ca\u30eb\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\u3068SHA-256\u30cf\u30c3\u30b7\u30e5\u3092\u78ba\u8a8d\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002]()
\u56f36. Linux\u306e\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\u3068SHA-256\u30cf\u30c3\u30b7\u30e5\u3092\u7279\u5b9a\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\nCliente.zip<\/span>\u306eSHA-256\u30cf\u30c3\u30b7\u30e5\u306f33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209<\/span>\u3067\u3059\u3002\u3053\u306eZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306b\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u306f.url<\/span>\u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u6301\u3064\u30c6\u30ad\u30b9\u30c8\u30d9\u30fc\u30b9 \u30d5\u30a1\u30a4\u30eb\u3067\u3059\u3002\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067unzip<\/span>\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066Cliente.zip<\/span>\u304b\u3089\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3092\u62bd\u51fa\u3057\u3001less<\/span>\u3067\u4e2d\u8eab\u3092\u898b\u3089\u308c\u307e\u3059(\u56f37\u3001\u56f38)\u3002<\/p>\n![\"\u753b\u50cf7\u306f\u3001less\u30b3\u30de\u30f3\u30c9\u3067zip\u30d5\u30a1\u30a4\u30eb\u306e\u4e2d\u8eab\u3092\u5c55\u958b\u3059\u308b\u3088\u3046\u3059\u3092\u793a\u3057\u305fLinux\u30bf\u30fc\u30df\u30ca\u30eb\u306e\u753b\u9762\u3067\u3059\u3002]()
\u56f37 Cliente.zip<\/span>\u304b\u3089\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3092\u62bd\u51fa\u3057less<\/span>\u30b3\u30de\u30f3\u30c9\u3067\u8868\u793a\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n![\"\u753b\u50cf8\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8]()
\u56f38. \u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8 \u30ab\u30c3\u30c8\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9<\/figcaption><\/figure>\nURL\u306fhttp<\/span>\u3084https<\/span>\u3067\u59cb\u307e\u308b\u3053\u3068\u304c\u591a\u3044\u3067\u3059\u304c\u3001\u62bd\u51fa\u3057\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u306fhttp<\/span>\u3084https<\/span>\u3067\u306f\u306a\u304ffile<\/span>\u3067\u59cb\u307e\u308bURL\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059(\u56f38)\u3002\u3053\u306efile<\/span>\u3067\u59cb\u307e\u308bURL\u306f\u3001445\/tcp\u7d4c\u7531\u306eSMB (Server Message Block)\u30d7\u30ed\u30c8\u30b3\u30eb\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u751f\u6210\u3057\u307e\u3059\u3002Windows\u30db\u30b9\u30c8\u306e\u5834\u5408\u3001\u3053\u306eURL\u30b3\u30f3\u30c6\u30f3\u30c4\u306b\u306fWindows \u30d5\u30a1\u30a4\u30eb \u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u30a2\u30af\u30bb\u30b9\u3067\u304d\u307e\u3059(\u56f39)\u3002<\/p>\n![\"\u753b\u50cf9\u306f\u3001\u30d5\u30a1\u30a4\u30eb]()
\u56f39. Windows\u306e\u30d5\u30a1\u30a4\u30eb \u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u306b\u8868\u793a\u3055\u308c\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8 \u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9<\/figcaption><\/figure>\n\u4eca\u6708\u306epcap\u306b\u306f\u3001\u62bd\u51fa\u3057\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u751f\u6210\u3057\u305fserver.exe<\/span>\u306b\u5bfe\u3059\u308bSMB\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u6b21\u306f\u3001pcap\u304b\u3089server.exe<\/span>\u3092\u62bd\u51fa\u3067\u304d\u308b\u304b\u3069\u3046\u304b\u3084\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n<\/a>Pcap\u306e\u89e3\u6790: SMB\u7d4c\u7531\u306e\u30d5\u30a1\u30a4\u30eb\u8ee2\u9001<\/h2>\n\u79c1\u305f\u3061\u306f2019\u5e747\u6708\u306bpcap\u304b\u3089\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3059\u308bWireshark\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb<\/a>\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3067\u3001[File (\u30d5\u30a1\u30a4\u30eb)]\u30e1\u30cb\u30e5\u30fc\u304b\u3089[Export Objects (\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8)]\u3001[SMB]\u306e\u9806\u306b\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001SMB \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u4eca\u56de\u306epcap\u306e46.8.19[.]32\\mise\\server.exe<\/span>\u306b\u5bfe\u3057\u3066\u3053\u308c\u3092\u8a66\u3057\u3066\u307f\u3066\u304f\u3060\u3055\u3044(\u56f310)\u3002<\/p>\n![\"\u753b\u50cf10\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File]()
\u56f310. pcap\u304b\u3089SMB\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8<\/figcaption><\/figure>[Export SMB object list (\u30a8\u30af\u30b9\u30dd\u30fc\u30c8 SMB \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u4e00\u89a7)]\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u306f\\\\46.8.19[.]32\\mise<\/span>\u304b\u3089\u306eserver.exe<\/span>\u306b\u5bfe\u3059\u308b6\u3064\u306e\u9805\u76ee\u304c\u8868\u793a\u3055\u308c\u307e\u3059(\u56f311)\u3002[Content Type (\u30b3\u30f3\u30c6\u30f3\u30c8\u30bf\u30a4\u30d7)] \u5217\u3092\u78ba\u8a8d\u3057\u3001\u3053\u308c\u30896\u3064\u306e\u9805\u76ee\u306e\u3044\u305a\u308c\u304b\u304c\u300c100\uff05\u300d\u306b\u306a\u3063\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n![\"\u753b\u50cf11\u306f\u3001\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u5bfe\u8c61\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u793a\u3057\u305fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002[Content]()
\u56f311 \u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u5bfe\u8c61\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u7a2e\u985e<\/figcaption><\/figure>\u6b8b\u5ff5\u306a\u304c\u3089\u300c100\uff05\u300d\u306e\u9805\u76ee\u304c\u306a\u3044\u306e\u3067\u3053\u306e\u30c7\u30fc\u30bf\u306f\u4f7f\u3048\u307e\u305b\u3093\u3002\u3053\u306epcap\u304b\u3089server.exe\u3068\u3044\u3046SMB\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u3044\u305a\u308c\u304b\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3082\u3001\u611f\u67d3\u6642\u306b\u5b9f\u969b\u306b\u8ee2\u9001\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u3058\u5185\u5bb9\u306b\u306f\u306a\u3089\u306a\u3044\u3067\u3057\u3087\u3046\u3002\u8ee2\u9001\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u304a\u305d\u3089\u304f\u306f\u4ee5\u524dUnit 42\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u30c4\u30a4\u30fc\u30c8\u3057\u305fGozi<\/a>\u306e\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u3058\u3082\u306e\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n<\/a>Pcap\u306e\u89e3\u6790: Gozi\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/h2>\nGozi\u306e\u611f\u67d3\u5f8c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3067\u69cb\u6210\u3055\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u901a\u4fe1\u306b\u306f\u305f\u3044\u3066\u304480\/tcp\u3068\u5e73\u6587\u306eHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u3068HTTP POST<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u4f7f\u308f\u308c\u307e\u3059\u3002\u3053\u306e\u7279\u5b9a\u306e\u4e8b\u4f8b\u3067Gozi\u306eC2(\u30b3\u30de\u30f3\u30c9&\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb)\u30b5\u30fc\u30d0\u30fc\u306f\u30c9\u30e1\u30a4\u30f3\u3067\u306f\u306a\u304fIP\u30a2\u30c9\u30ec\u30b9\u3092\u4f7f\u3063\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\nWireshark\u3067http.request<\/span>\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3059\u308c\u3070\u3001Gozi\u306e\u611f\u67d3\u5f8c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u3064\u3044\u3066\u3055\u3089\u306b\u8a73\u3057\u304f\u77e5\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059(\u56f312)\u3002<\/p>\n![\"\u753b\u50cf12\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066Gozi\u306eC2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u3084\u3059\u304f\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002http.request\u3068\u3044\u3046\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f312. HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066Gozi\u306eC2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u3084\u3059\u304f\u3059\u308b<\/figcaption><\/figure>\nGozi\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306fHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u3068HTTP POST<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304b\u3089\u69cb\u6210\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u306f\u9577\u3044URL\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u3066\u3001URL\u306b\u306fBase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c6\u30ad\u30b9\u30c8\u306e\u307b\u304b\u306b\u30b9\u30e9\u30c3\u30b7\u30e5(\/)\u3084\u30a2\u30f3\u30c0\u30fc\u30b9\u30b3\u30a2(_)\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002C2\u30b5\u30fc\u30d0\u30fc\u3068\u3084\u308a\u3068\u308a\u3055\u308c\u308b\u30c7\u30fc\u30bf\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u56f313\u306fGozi\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u521d\u671fHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u4f8b\u3067\u3059\u3002<\/p>\n![\"\u753b\u50cf13\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001\u521d\u671f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002\u8d64\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u90e8\u5206\u306f\u3001Base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u9577\u3044URL\u306e\u30c6\u30ad\u30b9\u30c8\u3067\u3059\u3002\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f"Host"\u30d8\u30c3\u30c0\u30fc\u306b\u793a\u3055\u308c\u305f\u3001\u3042\u308bIP\u306b\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b5\u30fc\u30d0\u30fc\u3067\u3059\u3002\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4e0b\u306e\u65b9\u306b\u3079\u3064\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3067\u3059\u3002]()
\u56f313. pcap\u304b\u3089\u306eGozi\u306e\u521d\u671f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/figcaption><\/figure>\nGozi\u306f\u30e2\u30b8\u30e5\u30fc\u30eb\u3084\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u4f7f\u3063\u3066\u3055\u307e\u3056\u307e\u306a\u6a5f\u80fd\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u305f\u3068\u3048\u3070Web\u30d6\u30e9\u30a6\u30b6\u30fc\u306e\u30ad\u30e3\u30c3\u30b7\u30e5\u304b\u3089\u88ab\u5bb3\u8005\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u76d7\u3093\u3060\u308a\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u305f\u30d0\u30a4\u30ca\u30ea\u3068\u3057\u3066\u9001\u4fe1\u3055\u308c\u307e\u3059\u304c\u3001\u3053\u308c\u306b\u306f\u6bd4\u8f03\u7684\u77ed\u3044URL\u304c\u4f7f\u308f\u308c\u3001\u305d\u306e\u672b\u5c3e\u306f.rar<\/span>\u3067\u7d42\u308f\u308a\u307e\u3059\u3002\u4e0b\u306b\u4f8b\u3092\u3044\u304f\u3064\u304b\u3042\u3052\u307e\u3059\u3002<\/p>\n\n- GET \/stilak32.rar<\/span><\/li>\n
- GET \/stilak64.rar<\/span><\/li>\n
- GET \/cook32.rar<\/span><\/li>\n
- GET \/cook64.rar<\/span><\/li>\n<\/ul>\n
\u3053\u308c\u3089\u306e.rar<\/span>\u3067\u7d42\u308f\u308bURL\u3068C2\u30b5\u30fc\u30d0\u30fc\u304b\u3089\u306eHTTP\u30ec\u30b9\u30dd\u30f3\u30b9 \u30d8\u30c3\u30c0\u30fc\u304b\u3089\u3001\u8fd4\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304c\u300cContent-Type:application\/x-rar-compressed<\/span>\u300d\u3068\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u3053\u308c\u3089\u306e\u30d5\u30a1\u30a4\u30eb\u306f.rar<\/span>\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u306f\u306a\u304f\u3001\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u305f\u30d0\u30a4\u30ca\u30ea\u3067\u3059\u3002<\/p>\nGozi\u306eC2 URL\u306e\u5168IP\u30a2\u30c9\u30ec\u30b9\u306f\u4ee5\u4e0b\u306eIoC<\/a>\u30bb\u30af\u30b7\u30e7\u30f3\u306b\u8a18\u8f09\u3057\u307e\u3059\u3002<\/p>\n\u3053\u308c\u3089\u306eURL\u306f\u4ee5\u524d\u306bUnit 42\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u30c4\u30a4\u30fc\u30c8\u3055\u308c\u305fGozi\u4e9c\u7a2e\u306e\u3082\u306e\u3068<\/a>\u540c\u3058\u30d1\u30bf\u30fc\u30f3\u3092\u8e0f\u8972\u3057\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u4eca\u6708\u306eWireshark\u30af\u30a4\u30ba\u306b\u51fa\u3066\u304f\u308bGozi\u306eC2\u306eIP\u30a2\u30c9\u30ec\u30b9\u306f\u3044\u305a\u308c\u3082\u5f53\u8a72\u30c4\u30a4\u30fc\u30c8\u306e\u6280\u8853\u60c5\u5831<\/a>\u3067\u63d0\u4f9b\u3055\u308c\u305f\u3082\u306e\u3067\u3059\u3002\u521d\u671f\u611f\u67d3\u30d9\u30af\u30c8\u30eb\u3067\u3042\u308bZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL\u3068\u30d5\u30a1\u30a4\u30eb \u30cf\u30c3\u30b7\u30e5\u3060\u3051\u304c\u552f\u4e00\u76ee\u7acb\u3063\u305f\u9055\u3044\u3068\u3044\u3048\u307e\u3059\u3002<\/p>\n<\/a>\u7d50\u8ad6<\/h2>\n\u672c\u7a3f\u306f\u300cUnit 42 Wireshark\u30af\u30a4\u30ba 2023\u5e743\u6708\u300d\u306e\u89e3\u7b54\u7de8\u3067\u3059\u3002pcap\u304b\u3089\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u78ba\u8a8d\u3057\u3001Gozi\u306e\u611f\u67d3\u306b\u3082\u3068\u3065\u3044\u3066\u554f\u984c\u7de8\u3067\u51fa\u3055\u308c\u305f\u30af\u30a4\u30ba\u306b\u56de\u7b54\u3057\u307e\u3057\u305f\u3002<\/p>\n
\u81ea\u793eIT\u74b0\u5883\u3067\u306f\u5b8c\u5168\u306a\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u304c\u624b\u306b\u5165\u3089\u306a\u3044\u3053\u3068\u3082\u591a\u3044\u3067\u3057\u3087\u3046\u3002\u3053\u306e\u305f\u3081\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u5bb6\u304c\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u30ec\u30d3\u30e5\u30fc\u7d4c\u9a13\u3092\u7a4d\u3081\u306a\u3044\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002\u305d\u3046\u3057\u305f\u5834\u5408\u306f\u672c\u7a3f\u306e\u3088\u3046\u306aWireshark\u30af\u30a4\u30ba\u306e\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u6559\u6750\u304c\u5f79\u306b\u7acb\u3064\u3067\u3057\u3087\u3046\u3002Pcap\u306e\u89e3\u6790\u306f\u60aa\u610f\u306e\u3042\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3078\u306e\u7406\u89e3\u3092\u6df1\u3081\u308b\u306e\u306b\u5f79\u7acb\u3064\u30b9\u30ad\u30eb\u3067\u3059\u3002<\/p>\n
\u7b54\u3048\u3092\u63b2\u8f09\u3057\u3066\u3044\u306a\u3044\u554f\u984c\u7de8<\/a>\u306e\u30d6\u30ed\u30b0\u3082\u3042\u308f\u305b\u3066\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001WildFire<\/a>\u3084\u9ad8\u5ea6\u306a\u8105\u5a01\u9632\u5fa1<\/a>\u306a\u3069\u306e\u30af\u30e9\u30a6\u30c9\u578b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b5\u30fc\u30d3\u30b9\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/a>\u3068Cortex XDR<\/a>\u306b\u3088\u308aGozi\u3084\u305d\u308c\u306b\u985e\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u304b\u3089\u306e\u4fdd\u8b77\u3092\u53d7\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001\u3053\u3061\u3089<\/a>\u306e\u554f\u3044\u5408\u308f\u305b\u30d5\u30a9\u30fc\u30e0\u304b\u3089\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001infojapan@paloaltonetworks.com\u307e\u3067\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3066\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001\u4e0b\u8a18\u306e\u96fb\u8a71\u756a\u53f7\u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044(\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/p>\n\n- \u5317\u7c73\u30d5\u30ea\u30fc\u30c0\u30a4\u30e4\u30eb: 866.486.4842 (866.4.UNIT42)<\/li>\n
- \u6b27\u5dde: +31.20.299.3130<\/li>\n
- \u30a2\u30b8\u30a2\u592a\u5e73\u6d0b: +65.6983.8730<\/li>\n
- \u65e5\u672c: +81.50.1790.0200<\/li>\n<\/ul>\n
<\/a>IoC<\/h2>\npcap\u306b\u542b\u307e\u308c\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u306eSHA-256\u30cf\u30c3\u30b7\u30e5:<\/p>\n
\n- 33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209 Cliente.zip<\/span><\/li>\n
- 340a759b1c1cdc22f6fac84044d072475e1630fbb7f47d96c4e18413de34d570 Cliente.url<\/span><\/li>\n<\/ul>\n
pcap\u306b\u542b\u307e\u308c\u308bGozi\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/p>\n
\n- hxxp:\/\/unapromo[.]com\/mise\/Cliente.zip<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]103\/drew\/[long base64 string with backslashes and underscores]<\/em>.jlk<\/span><\/li>\n
- hxxp:\/\/62.173.138[.]138\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/62.173.138[.]138\/drew\/[long base64 string with backslashes and underscores]<\/em>.bmp<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/stilak32.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/stilak64.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/cook32.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/cook64.rar<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]94\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/31.41.44[.]60\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/46.8.19[.]233\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/5.44.45[.]201\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/89.116[.]236.41\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]76\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/31.41.44[.]49\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/46.8.19[.]86\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n<\/ul>\n
- \n
- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u7bc4\u56f2: 172.16.1[.]0\/24<\/span> (172.16.1[.]1<\/span>\u304b\u3089172.16.1[.]255<\/span>)<\/li>\n
- \u30c9\u30e1\u30a4\u30f3: pcapworkshop[.]net<\/span><\/li>\n
- \u30c9\u30e1\u30a4\u30f3 \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306eIP\u30a2\u30c9\u30ec\u30b9: 172.16.1[.]16<\/span><\/li>\n
- \u30c9\u30e1\u30a4\u30f3 \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u30fc\u306e\u30db\u30b9\u30c8\u540d: PCAPWORKSHOP-DC<\/span><\/li>\n
- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u30b2\u30fc\u30c8\u30a6\u30a7\u30a4: 172.16.1[.]1<\/span><\/li>\n
- LAN\u30bb\u30b0\u30e1\u30f3\u30c8\u306e\u30d6\u30ed\u30fc\u30c9\u30ad\u30e3\u30b9\u30c8 \u30a2\u30c9\u30ec\u30b9: 172.16.1[.]255<\/span><\/li>\n<\/ul>\n
\u4eca\u6708\u306e\u30af\u30a4\u30ba\u306e\u8abf\u67fb\u306b\u306fWireshark<\/a>\u304c\u5fc5\u8981\u3067\u3059\u3002\u672c\u7a3f\u3067\u306f\u6700\u8fd1\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u306eWireShark\u3092\u4f7f\u3063\u3066\u3044\u307e\u3059\u304c\u53e4\u304f\u3066\u30823.x\u4ee5\u964d\u306e\u5229\u7528\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n
\u672c\u7a3f\u306f\u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u95a2\u3059\u308b\u57fa\u790e\u7684\u306a\u77e5\u8b58\u3092\u304a\u6301\u3061\u306e\u65b9\u3092\u8aad\u8005\u3068\u3057\u3066\u60f3\u5b9a\u3057\u3066\u3044\u307e\u3059\u3002\u306a\u304a\u3001Web\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u5206\u6790\u3057\u3084\u3059\u3044\u3088\u3046\u3001Wireshark\u306e\u8868\u793a\u8a2d\u5b9a\u3092\u3042\u3089\u304b\u3058\u3081\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3057\u3066\u304a\u304f\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002\u305d\u306e\u65b9\u6cd5\u306b\u3064\u3044\u3066\u306f\u3001\u3053\u3061\u3089\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3084\u30d3\u30c7\u30aa\u306e\u4e00\u89a7<\/a>\u3067\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002\u6bce\u5ea6\u306e\u3053\u3068\u3067\u3059\u304c\u3001Windows\u30d9\u30fc\u30b9\u306e\u60aa\u610f\u306e\u3042\u308b\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u5206\u6790\u306b\u306f\u3001BSD\u3001Linux\u3001macOS\u306a\u3069\u3001Windows\u4ee5\u5916\u306e\u74b0\u5883\u306e\u5229\u7528\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/p>\n
\u554f\u984c\u306epcap\u306f\u3053\u3061\u3089\u306eGitHub\u30ea\u30dd\u30b8\u30c8\u30ea<\/a>\u304b\u3089\u5165\u624b\u3057\u3066\u304f\u3060\u3055\u3044\u3002ZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305f\u3089pcap\u3092\u5c55\u958b\u3057\u3066\u304f\u3060\u3055\u3044\u3002\u5c55\u958b\u7528\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u300cinfected<\/em>\u300d\u3067\u3059\u3002<\/p>\n
<\/a>\u554f\u984c<\/h2>\n
\u4eca\u6708\u306eGozi\u306b\u3088\u308b\u611f\u67d3\u306eWireshark\u30af\u30a4\u30ba\u306f\u3001\u3053\u3061\u3089\u306e2023\u5e743\u6708\u5206\u306eWireshark\u30af\u30a4\u30ba<\/a>\u3067\u8aac\u660e\u3057\u305f\u4ee5\u4e0b\u306e\u8cea\u554f\u306b\u7b54\u3048\u308b\u3068\u3044\u3046\u3082\u306e\u3067\u3057\u305f\u3002<\/p>\n
- \n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9\u3001\u30db\u30b9\u30c8\u540d\u3001Windows\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d<\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30db\u30b9\u30c8\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL\u3068SHA-256\u30cf\u30c3\u30b7\u30e5<\/li>\n
- \u4eca\u56de\u306eGozi\u611f\u67d3\u306b\u3088\u308b\u6307\u6a19\u3068Unit 42\u304c\u5831\u544a\u3057\u305f2023\u5e743\u67086\u65e5\u306eGozi\u611f\u67d3\u306b\u3088\u308b<\/a>\u6307\u6a19\u3068\u306e\u9593\u306b\u4f55\u304b\u9855\u8457\u306a\u9055\u3044\u306f\u3042\u308b\u304b<\/li>\n<\/ul>\n
<\/a>\u89e3\u7b54<\/h2>\n
\u4eca\u6708\u306eWireshark\u30af\u30a4\u30ba\u306e\u89e3\u7b54\u306f\u4ee5\u4e0b\u306e\u901a\u308a\u3067\u3059\u3002<\/p>\n
- \n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9: 172.16.1[.]137<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30db\u30b9\u30c8\u540d: DESKTOP-3GJL3PV<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d: sherita.kolb<\/span><\/li>\n
- Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL: hxxp:\/\/unapromo[.]com\/mise\/Cliente.zip<\/span><\/li>\n
- Zip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eSHA-256\u30cf\u30c3\u30b7\u30e5: 33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209<\/span><\/li>\n
- \u521d\u671fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u6642\u306eURL\u3068\u30d5\u30a1\u30a4\u30eb\u304c\u9055\u3046\u3002\u305d\u306e\u307b\u304b\u306b\u306f\u3053\u306eGozi\u611f\u67d3\u3068\u4ee5\u524d\u5831\u544a\u3055\u308c\u305fGozi\u611f\u67d3\u3068\u306e\u9593\u306b\u76ee\u7acb\u3063\u305f\u6307\u6a19\u4e0a\u306e\u9055\u3044\u306f\u306a\u3044<\/li>\n<\/ul>\n
<\/a>Pcap\u89e3\u6790: \u88ab\u5bb3\u8005\u306e\u8a73\u7d30<\/h2>\n
\u3053\u3053\u3067\u306f\u3053\u3061\u3089\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3084\u30ef\u30fc\u30af\u30b7\u30e7\u30c3\u30d7\u306e\u30d3\u30c7\u30aa\u306b\u5f93\u3063\u3066<\/a>Wireshark\u3092\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u3057\u3066\u3044\u308b\u3053\u3068\u3092\u524d\u63d0\u306b\u89e3\u6790\u3057\u307e\u3059\u3002<\/p>\n
\u307e\u305a\u306f\u88ab\u5bb3\u8005\u306e\u8a73\u7d30\u3092\u7279\u5b9a\u3057\u307e\u3057\u3087\u3046\u3002<\/p>\n
\u4eca\u56de\u306epcap\u306b\u767b\u5834\u3059\u308b\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u5185\u90e8\u975e\u30eb\u30fc\u30c6\u30a3\u30f3\u30b0IP\u30a2\u30c9\u30ec\u30b9\u306f172.16.1[.]137<\/span>\u3067\u3059\u3002\u3053\u308c\u3092\u78ba\u8a8d\u3059\u308b\u306b\u306f\u3001Wireshark\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb \u30d6\u30ed\u30b0(\u300eWireshark \u306b\u3088\u308b\u30d1\u30b1\u30c3\u30c8\u89e3\u6790\u8b1b\u5ea72: \u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u8abf\u67fb\u306b\u5f79\u7acb\u3064\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u8a2d\u5b9a\u300f)\u3067\u89e3\u8aac\u3057\u305f\u300cbasic\u300d\u306e\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u7528\u3059\u308b\u304b\u3001Wireshark\u306e[Filter (\u30d5\u30a3\u30eb\u30bf)]\u30c4\u30fc\u30eb\u30d0\u30fc\u306b\u4ee5\u4e0b\u3092\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
(http.request or tls.handshake.type eq 1) and !(ssdp)<\/span><\/p>\n
[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u306b\u8868\u793a\u3055\u308c\u308b\u7d50\u679c\u304b\u3089\u63a5\u7d9a\u5143IP (Source IP)\u30a2\u30c9\u30ec\u30b9\u304c172.16.1[.]137<\/span>\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059(\u56f31)\u3002<\/p>\n
![\"\u56f31\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u3053\u3067\u306fWeb\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u5f8c\u306e\u63a5\u7d9a\u5143IP\u30a2\u30c9\u30ec\u30b9\u306e\u5217(Src)\u3068\u63a5\u7d9a\u5143MAC\u30a2\u30c9\u30ec\u30b9\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f31. Web\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066\u88ab\u5bb3\u8005\u306eIP\u30a2\u30c9\u30ec\u30b9\u3092\u7279\u5b9a\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n \u901a\u5e38\u306fNetwork Basic Input\/Output System (NetBIOS)\u3001Name Service (NBNS)\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089\u88ab\u5bb3\u8005\u306e\u30db\u30b9\u30c8\u540d\u3092\u7279\u5b9a\u3059\u308b\u306e\u304c\u624b\u3063\u53d6\u308a\u65e9\u3044\u3067\u3057\u3087\u3046\u3002\u305d\u306e\u305f\u3081\u306b\u306f\u3001\u6b21\u306eWireshark\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002<\/p>\n
nbns<\/span><\/p>\n
Windows 10\u306a\u3044\u3057Windows 11\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u30fc\u3067\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30db\u30b9\u30c8\u540d\u304c15\u6587\u5b57\u306e\u6587\u5b57\u5217\u3067\u3059\u3002\u3053\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u540d\u306fDESKTOP-<\/span>\u3067\u59cb\u307e\u308a\u3001\u305d\u306e\u5f8c\u308d\u306b7\u6587\u5b57\u306eASCII\u6587\u5b57\u3067\u69cb\u6210\u3055\u308c\u308b\u82f1\u6570\u5b57\u306e\u6587\u5b57\u5217\u304c\u7d9a\u304d\u307e\u3059\u3002nbns<\/span>\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u4f7f\u3046\u3068\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u3068[Packet Details (\u30d1\u30b1\u30c3\u30c8\u8a73\u7d30)]\u30da\u30a4\u30f3\u3067DESKTOP-3GJL3PV<\/span>\u3092\u898b\u3064\u3051\u3089\u308c\u307e\u3059(\u56f32)\u3002<\/p>\n
![\"\u753b\u50cf2\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001NBNS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u5185\u306eWindows\u30db\u30b9\u30c8\u540d\u306e\u7279\u5b9a\u306e\u3057\u304b\u305f(\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a)\u3092\u8aac\u660e\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f32. NBNS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u5185\u3067Windows\u30db\u30b9\u30c8\u540d\u3092\u898b\u3064\u3051\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n \u30e6\u30fc\u30b6\u30fc \u30ed\u30b0\u30a4\u30f3\u6642\u306b\u751f\u6210\u3055\u308c\u308bKerberos\u8a8d\u8a3c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304cpcap\u306b\u542b\u307e\u308c\u3066\u3044\u308c\u3070\u3001\u305d\u3053\u304b\u3089Windows\u30e6\u30fc\u30b6\u30fc\u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u304c\u308f\u304b\u308b\u3053\u3068\u304c\u3042\u308a\u307e\u3059\u3002kerberos.CNameString<\/span>\u3067\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u3067\u7d50\u679c\u3092\u4e00\u756a\u4e0b\u307e\u3067\u30b9\u30af\u30ed\u30fc\u30eb\u3057\u3001[Packet List (\u30d1\u30b1\u30c3\u30c8\u4e00\u89a7)]\u30da\u30a4\u30f3\u306e\u6700\u7d42\u884c\u3042\u305f\u308a\u306e\u3044\u305a\u308c\u304b1\u884c\u3092\u9078\u629e\u3057\u307e\u3059\u3002[Packet Details (\u30d1\u30b1\u30c3\u30c8\u8a73\u7d30)]\u30da\u30a4\u30f3\u5185\u3067Kerberos\u306e\u884c\u3092\u5c55\u958b\u3057\u3066\u3044\u304d\u307e\u3059\u3002\u56f33\u306b\u3057\u305f\u304c\u3063\u3066sherita.kolb<\/span>\u3068\u3044\u3046\u5024\u3092\u6301\u3064CNameString<\/span>\u304c\u898b\u3064\u304b\u308b\u307e\u3067\u5024\u3092\u5c55\u958b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
![\"\u753b\u50cf3\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001Kerberos\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u4e2d\u304b\u3089\u88ab\u5bb3\u8005\u306eWindow\u30e6\u30fc\u30b6\u30fc]()
\u56f33. Kerberos\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u4e2d\u304b\u3089\u88ab\u5bb3\u8005\u306eWindows\u30e6\u30fc\u30b6\u30fc \u30a2\u30ab\u30a6\u30f3\u30c8\u540d\u3092\u898b\u3064\u3051\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n \u300eWireshark \u306b\u3088\u308b\u30d1\u30b1\u30c3\u30c8\u89e3\u6790\u8b1b\u5ea7 3: \u30db\u30b9\u30c8\u3068\u30e6\u30fc\u30b6\u30fc\u3092\u7279\u5b9a\u3059\u308b<\/a>\u300f\u3067\u8aac\u660e\u3057\u305f\u3068\u304a\u308a\u3001CNameString<\/span>\u306e\u5024\u3092\u9078\u3093\u3067\u53f3\u30af\u30ea\u30c3\u30af\u3057\u3001\u30b3\u30f3\u30c6\u30ad\u30b9\u30c8 \u30e1\u30cb\u30e5\u30fc\u306e[Apply as Column (\u5217\u3068\u3057\u3066\u9069\u7528)]\u3092\u5b9f\u884c\u3059\u308b\u3068\u3001Wireshark\u306e\u8868\u793a\u306bCNameString\u5217\u3092\u8868\u793a\u3055\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002CNameString<\/span>\u3092\u5217\u3068\u3057\u3066\u9069\u7528\u3057\u305f\u7d50\u679c\u3092\u4e0a\u306e\u56f33\u306b\u793a\u3057\u307e\u3059\u3002<\/p>\n
<\/a>Pcap\u306e\u89e3\u6790: \u521d\u671fZip\u30a2\u30fc\u30ab\u30a4\u30d6<\/h2>\n
\u4eca\u56de\u306eGozi\u611f\u67d3\u306e\u653b\u6483\u30c1\u30a7\u30fc\u30f3\u306f\u60aa\u610f\u306e\u3042\u308bZIP\u30a2\u30fc\u30ab\u30a4\u30d6\u304b\u3089\u59cb\u307e\u308a\u307e\u3059\u3002\u305d\u306eURL\u306f\u6b21\u306eWireshark\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u9069\u7528\u3059\u308b\u3068\u898b\u3064\u304b\u308a\u307e\u3059\u3002<\/p>\n
http.request.uri contains \".zip\"<\/span><\/p>\n
\u3053\u306e\u30d5\u30a3\u30eb\u30bf\u30fc\u3067unapromo[.]com<\/span>\u5b9b\u306e\/mise\/Cliente.zip<\/span>\u3092\u8981\u6c42\u3059\u308bHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u898b\u3064\u304b\u308b\u306f\u305a\u3067\u3059(\u4e0b\u306e\u56f34\u53c2\u7167)\u3002<\/p>\n
![\"\u753b\u50cf4\u306f\u3001TCP\u30b9\u30c8\u30ea\u30fc\u30e0\u8ffd\u8de1\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u9078\u629e\u5f8c\u3001URL\u3092\u63a2\u3059\u30e1\u30cb\u30e5\u30fc]()
\u56f34. pcap\u306eHTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089.zip<\/span>\u3067\u7d42\u308f\u308bURL\u3092\u63a2\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n Wireshark\u306e[File (\u30d5\u30a1\u30a4\u30eb)]\u30e1\u30cb\u30e5\u30fc\u304b\u3089[Export Objects (\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8)]\u3001[HTTP]\u306e\u9806\u306b\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001pcap\u304b\u3089Cliente.zip<\/span>\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u307e\u3059(\u56f35\u53c2\u7167)\u3002<\/p>\n
![\"\u753b\u50cf5\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File]()
\u56f35. Wireshark\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u6a5f\u80fd\u3092\u4f7f\u3063\u3066unapromo[.]com<\/span>\u304c\u8fd4\u3057\u305fZip\u30d5\u30a1\u30a4\u30eb\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>Linux\u304bmacOS\u74b0\u5883\u3067\u3042\u308c\u3070\u3001\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u5225\u3092\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3068file\u30b3\u30de\u30f3\u30c9\u3067\u7c21\u5358\u306b\u78ba\u8a8d\u3067\u304d\u307e\u3059\u3002file\u30b3\u30de\u30f3\u30c9\u3067\u78ba\u8a8d\u3059\u308b\u3068Cliente.zip<\/span>\u306fZip\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059(\u56f36)\u3002SHA256\u30cf\u30c3\u30b7\u30e5\u3092shasum -a 256<\/span>\u30b3\u30de\u30f3\u30c9\u3067\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044(\u56f36)\u3002<\/p>\n ![\"\u753b\u50cf6\u306f\u3001Linux\u306e\u30bf\u30fc\u30df\u30ca\u30eb\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\u3068SHA-256\u30cf\u30c3\u30b7\u30e5\u3092\u78ba\u8a8d\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002]()
\u56f36. Linux\u306e\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\u3068SHA-256\u30cf\u30c3\u30b7\u30e5\u3092\u7279\u5b9a\u3057\u3066\u3044\u308b\u3068\u3053\u308d<\/figcaption><\/figure>\n Cliente.zip<\/span>\u306eSHA-256\u30cf\u30c3\u30b7\u30e5\u306f33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209<\/span>\u3067\u3059\u3002\u3053\u306eZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306b\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u306f.url<\/span>\u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u6301\u3064\u30c6\u30ad\u30b9\u30c8\u30d9\u30fc\u30b9 \u30d5\u30a1\u30a4\u30eb\u3067\u3059\u3002\u30bf\u30fc\u30df\u30ca\u30eb \u30a6\u30a3\u30f3\u30c9\u30a6\u3067unzip<\/span>\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066Cliente.zip<\/span>\u304b\u3089\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3092\u62bd\u51fa\u3057\u3001less<\/span>\u3067\u4e2d\u8eab\u3092\u898b\u3089\u308c\u307e\u3059(\u56f37\u3001\u56f38)\u3002<\/p>\n
![\"\u753b\u50cf7\u306f\u3001less\u30b3\u30de\u30f3\u30c9\u3067zip\u30d5\u30a1\u30a4\u30eb\u306e\u4e2d\u8eab\u3092\u5c55\u958b\u3059\u308b\u3088\u3046\u3059\u3092\u793a\u3057\u305fLinux\u30bf\u30fc\u30df\u30ca\u30eb\u306e\u753b\u9762\u3067\u3059\u3002]()
\u56f37 Cliente.zip<\/span>\u304b\u3089\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u3092\u62bd\u51fa\u3057less<\/span>\u30b3\u30de\u30f3\u30c9\u3067\u8868\u793a\u3057\u305f\u3068\u3053\u308d<\/figcaption><\/figure>\n ![\"\u753b\u50cf8\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8]()
\u56f38. \u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8 \u30ab\u30c3\u30c8\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9<\/figcaption><\/figure>\n URL\u306fhttp<\/span>\u3084https<\/span>\u3067\u59cb\u307e\u308b\u3053\u3068\u304c\u591a\u3044\u3067\u3059\u304c\u3001\u62bd\u51fa\u3057\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u306fhttp<\/span>\u3084https<\/span>\u3067\u306f\u306a\u304ffile<\/span>\u3067\u59cb\u307e\u308bURL\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059(\u56f38)\u3002\u3053\u306efile<\/span>\u3067\u59cb\u307e\u308bURL\u306f\u3001445\/tcp\u7d4c\u7531\u306eSMB (Server Message Block)\u30d7\u30ed\u30c8\u30b3\u30eb\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u751f\u6210\u3057\u307e\u3059\u3002Windows\u30db\u30b9\u30c8\u306e\u5834\u5408\u3001\u3053\u306eURL\u30b3\u30f3\u30c6\u30f3\u30c4\u306b\u306fWindows \u30d5\u30a1\u30a4\u30eb \u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3067\u30a2\u30af\u30bb\u30b9\u3067\u304d\u307e\u3059(\u56f39)\u3002<\/p>\n
![\"\u753b\u50cf9\u306f\u3001\u30d5\u30a1\u30a4\u30eb]()
\u56f39. Windows\u306e\u30d5\u30a1\u30a4\u30eb \u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u306b\u8868\u793a\u3055\u308c\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8 \u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9<\/figcaption><\/figure>\n \u4eca\u6708\u306epcap\u306b\u306f\u3001\u62bd\u51fa\u3057\u305f\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8 \u30b7\u30e7\u30fc\u30c8\u30ab\u30c3\u30c8\u304c\u751f\u6210\u3057\u305fserver.exe<\/span>\u306b\u5bfe\u3059\u308bSMB\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u6b21\u306f\u3001pcap\u304b\u3089server.exe<\/span>\u3092\u62bd\u51fa\u3067\u304d\u308b\u304b\u3069\u3046\u304b\u3084\u3063\u3066\u307f\u307e\u3057\u3087\u3046\u3002<\/p>\n
<\/a>Pcap\u306e\u89e3\u6790: SMB\u7d4c\u7531\u306e\u30d5\u30a1\u30a4\u30eb\u8ee2\u9001<\/h2>\n
\u79c1\u305f\u3061\u306f2019\u5e747\u6708\u306bpcap\u304b\u3089\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3059\u308bWireshark\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb<\/a>\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30c1\u30e5\u30fc\u30c8\u30ea\u30a2\u30eb\u3067\u3001[File (\u30d5\u30a1\u30a4\u30eb)]\u30e1\u30cb\u30e5\u30fc\u304b\u3089[Export Objects (\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8)]\u3001[SMB]\u306e\u9806\u306b\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001SMB \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304b\u3089\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u3059\u3002\u4eca\u56de\u306epcap\u306e46.8.19[.]32\\mise\\server.exe<\/span>\u306b\u5bfe\u3057\u3066\u3053\u308c\u3092\u8a66\u3057\u3066\u307f\u3066\u304f\u3060\u3055\u3044(\u56f310)\u3002<\/p>\n
![\"\u753b\u50cf10\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File]()
\u56f310. pcap\u304b\u3089SMB\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8<\/figcaption><\/figure>[Export SMB object list (\u30a8\u30af\u30b9\u30dd\u30fc\u30c8 SMB \u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u4e00\u89a7)]\u30a6\u30a3\u30f3\u30c9\u30a6\u306b\u306f\\\\46.8.19[.]32\\mise<\/span>\u304b\u3089\u306eserver.exe<\/span>\u306b\u5bfe\u3059\u308b6\u3064\u306e\u9805\u76ee\u304c\u8868\u793a\u3055\u308c\u307e\u3059(\u56f311)\u3002[Content Type (\u30b3\u30f3\u30c6\u30f3\u30c8\u30bf\u30a4\u30d7)] \u5217\u3092\u78ba\u8a8d\u3057\u3001\u3053\u308c\u30896\u3064\u306e\u9805\u76ee\u306e\u3044\u305a\u308c\u304b\u304c\u300c100\uff05\u300d\u306b\u306a\u3063\u3066\u3044\u308b\u304b\u3069\u3046\u304b\u3092\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n ![\"\u753b\u50cf11\u306f\u3001\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u5bfe\u8c61\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u793a\u3057\u305fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002[Content]()
\u56f311 \u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u5bfe\u8c61\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u7a2e\u985e<\/figcaption><\/figure>\u6b8b\u5ff5\u306a\u304c\u3089\u300c100\uff05\u300d\u306e\u9805\u76ee\u304c\u306a\u3044\u306e\u3067\u3053\u306e\u30c7\u30fc\u30bf\u306f\u4f7f\u3048\u307e\u305b\u3093\u3002\u3053\u306epcap\u304b\u3089server.exe\u3068\u3044\u3046SMB\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u306e\u3044\u305a\u308c\u304b\u3092\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u3057\u3066\u3082\u3001\u611f\u67d3\u6642\u306b\u5b9f\u969b\u306b\u8ee2\u9001\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u3058\u5185\u5bb9\u306b\u306f\u306a\u3089\u306a\u3044\u3067\u3057\u3087\u3046\u3002\u8ee2\u9001\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u304a\u305d\u3089\u304f\u306f\u4ee5\u524dUnit 42\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u30c4\u30a4\u30fc\u30c8\u3057\u305fGozi<\/a>\u306e\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u3058\u3082\u306e\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n <\/a>Pcap\u306e\u89e3\u6790: Gozi\u611f\u67d3\u5f8c\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/h2>\n
Gozi\u306e\u611f\u67d3\u5f8c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3067\u69cb\u6210\u3055\u308c\u3066\u3044\u3066\u3001\u305d\u306e\u901a\u4fe1\u306b\u306f\u305f\u3044\u3066\u304480\/tcp\u3068\u5e73\u6587\u306eHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u3068HTTP POST<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304c\u4f7f\u308f\u308c\u307e\u3059\u3002\u3053\u306e\u7279\u5b9a\u306e\u4e8b\u4f8b\u3067Gozi\u306eC2(\u30b3\u30de\u30f3\u30c9&\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb)\u30b5\u30fc\u30d0\u30fc\u306f\u30c9\u30e1\u30a4\u30f3\u3067\u306f\u306a\u304fIP\u30a2\u30c9\u30ec\u30b9\u3092\u4f7f\u3063\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n
Wireshark\u3067http.request<\/span>\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3059\u308c\u3070\u3001Gozi\u306e\u611f\u67d3\u5f8c\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u3064\u3044\u3066\u3055\u3089\u306b\u8a73\u3057\u304f\u77e5\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059(\u56f312)\u3002<\/p>\n
![\"\u753b\u50cf12\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066Gozi\u306eC2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u3084\u3059\u304f\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002http.request\u3068\u3044\u3046\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002]()
\u56f312. HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066Gozi\u306eC2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u3084\u3059\u304f\u3059\u308b<\/figcaption><\/figure>\n Gozi\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306fHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u3068HTTP POST<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u304b\u3089\u69cb\u6210\u3055\u308c\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u306f\u9577\u3044URL\u304c\u6307\u5b9a\u3055\u308c\u3066\u3044\u3066\u3001URL\u306b\u306fBase64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c6\u30ad\u30b9\u30c8\u306e\u307b\u304b\u306b\u30b9\u30e9\u30c3\u30b7\u30e5(\/)\u3084\u30a2\u30f3\u30c0\u30fc\u30b9\u30b3\u30a2(_)\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002C2\u30b5\u30fc\u30d0\u30fc\u3068\u3084\u308a\u3068\u308a\u3055\u308c\u308b\u30c7\u30fc\u30bf\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u56f313\u306fGozi\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u521d\u671fHTTP GET<\/span>\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u4f8b\u3067\u3059\u3002<\/p>\n
![\"\u753b\u50cf13\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001\u521d\u671f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002\u8d64\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u90e8\u5206\u306f\u3001Base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u9577\u3044URL\u306e\u30c6\u30ad\u30b9\u30c8\u3067\u3059\u3002\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f"Host"\u30d8\u30c3\u30c0\u30fc\u306b\u793a\u3055\u308c\u305f\u3001\u3042\u308bIP\u306b\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b5\u30fc\u30d0\u30fc\u3067\u3059\u3002\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4e0b\u306e\u65b9\u306b\u3079\u3064\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3067\u3059\u3002]()
\u56f313. pcap\u304b\u3089\u306eGozi\u306e\u521d\u671f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af<\/figcaption><\/figure>\n Gozi\u306f\u30e2\u30b8\u30e5\u30fc\u30eb\u3084\u30d7\u30e9\u30b0\u30a4\u30f3\u3092\u4f7f\u3063\u3066\u3055\u307e\u3056\u307e\u306a\u6a5f\u80fd\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u305f\u3068\u3048\u3070Web\u30d6\u30e9\u30a6\u30b6\u30fc\u306e\u30ad\u30e3\u30c3\u30b7\u30e5\u304b\u3089\u88ab\u5bb3\u8005\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u76d7\u3093\u3060\u308a\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30e2\u30b8\u30e5\u30fc\u30eb\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u305f\u30d0\u30a4\u30ca\u30ea\u3068\u3057\u3066\u9001\u4fe1\u3055\u308c\u307e\u3059\u304c\u3001\u3053\u308c\u306b\u306f\u6bd4\u8f03\u7684\u77ed\u3044URL\u304c\u4f7f\u308f\u308c\u3001\u305d\u306e\u672b\u5c3e\u306f.rar<\/span>\u3067\u7d42\u308f\u308a\u307e\u3059\u3002\u4e0b\u306b\u4f8b\u3092\u3044\u304f\u3064\u304b\u3042\u3052\u307e\u3059\u3002<\/p>\n
- \n
- GET \/stilak32.rar<\/span><\/li>\n
- GET \/stilak64.rar<\/span><\/li>\n
- GET \/cook32.rar<\/span><\/li>\n
- GET \/cook64.rar<\/span><\/li>\n<\/ul>\n
\u3053\u308c\u3089\u306e.rar<\/span>\u3067\u7d42\u308f\u308bURL\u3068C2\u30b5\u30fc\u30d0\u30fc\u304b\u3089\u306eHTTP\u30ec\u30b9\u30dd\u30f3\u30b9 \u30d8\u30c3\u30c0\u30fc\u304b\u3089\u3001\u8fd4\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304c\u300cContent-Type:application\/x-rar-compressed<\/span>\u300d\u3068\u306a\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3059\u3002\u305f\u3060\u3057\u3053\u308c\u3089\u306e\u30d5\u30a1\u30a4\u30eb\u306f.rar<\/span>\u30a2\u30fc\u30ab\u30a4\u30d6\u3067\u306f\u306a\u304f\u3001\u30a8\u30f3\u30b3\u30fc\u30c9\u306a\u3044\u3057\u6697\u53f7\u5316\u3055\u308c\u305f\u30d0\u30a4\u30ca\u30ea\u3067\u3059\u3002<\/p>\n
Gozi\u306eC2 URL\u306e\u5168IP\u30a2\u30c9\u30ec\u30b9\u306f\u4ee5\u4e0b\u306eIoC<\/a>\u30bb\u30af\u30b7\u30e7\u30f3\u306b\u8a18\u8f09\u3057\u307e\u3059\u3002<\/p>\n
\u3053\u308c\u3089\u306eURL\u306f\u4ee5\u524d\u306bUnit 42\u30a2\u30ab\u30a6\u30f3\u30c8\u304b\u3089\u30c4\u30a4\u30fc\u30c8\u3055\u308c\u305fGozi\u4e9c\u7a2e\u306e\u3082\u306e\u3068<\/a>\u540c\u3058\u30d1\u30bf\u30fc\u30f3\u3092\u8e0f\u8972\u3057\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u4eca\u6708\u306eWireshark\u30af\u30a4\u30ba\u306b\u51fa\u3066\u304f\u308bGozi\u306eC2\u306eIP\u30a2\u30c9\u30ec\u30b9\u306f\u3044\u305a\u308c\u3082\u5f53\u8a72\u30c4\u30a4\u30fc\u30c8\u306e\u6280\u8853\u60c5\u5831<\/a>\u3067\u63d0\u4f9b\u3055\u308c\u305f\u3082\u306e\u3067\u3059\u3002\u521d\u671f\u611f\u67d3\u30d9\u30af\u30c8\u30eb\u3067\u3042\u308bZip\u30a2\u30fc\u30ab\u30a4\u30d6\u306eURL\u3068\u30d5\u30a1\u30a4\u30eb \u30cf\u30c3\u30b7\u30e5\u3060\u3051\u304c\u552f\u4e00\u76ee\u7acb\u3063\u305f\u9055\u3044\u3068\u3044\u3048\u307e\u3059\u3002<\/p>\n
<\/a>\u7d50\u8ad6<\/h2>\n
\u672c\u7a3f\u306f\u300cUnit 42 Wireshark\u30af\u30a4\u30ba 2023\u5e743\u6708\u300d\u306e\u89e3\u7b54\u7de8\u3067\u3059\u3002pcap\u304b\u3089\u306e\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u78ba\u8a8d\u3057\u3001Gozi\u306e\u611f\u67d3\u306b\u3082\u3068\u3065\u3044\u3066\u554f\u984c\u7de8\u3067\u51fa\u3055\u308c\u305f\u30af\u30a4\u30ba\u306b\u56de\u7b54\u3057\u307e\u3057\u305f\u3002<\/p>\n
\u81ea\u793eIT\u74b0\u5883\u3067\u306f\u5b8c\u5168\u306a\u30d1\u30b1\u30c3\u30c8\u30ad\u30e3\u30d7\u30c1\u30e3\u304c\u624b\u306b\u5165\u3089\u306a\u3044\u3053\u3068\u3082\u591a\u3044\u3067\u3057\u3087\u3046\u3002\u3053\u306e\u305f\u3081\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5c02\u9580\u5bb6\u304c\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u30ec\u30d3\u30e5\u30fc\u7d4c\u9a13\u3092\u7a4d\u3081\u306a\u3044\u3053\u3068\u3082\u3042\u308a\u307e\u3059\u3002\u305d\u3046\u3057\u305f\u5834\u5408\u306f\u672c\u7a3f\u306e\u3088\u3046\u306aWireshark\u30af\u30a4\u30ba\u306e\u30c8\u30ec\u30fc\u30cb\u30f3\u30b0\u6559\u6750\u304c\u5f79\u306b\u7acb\u3064\u3067\u3057\u3087\u3046\u3002Pcap\u306e\u89e3\u6790\u306f\u60aa\u610f\u306e\u3042\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3078\u306e\u7406\u89e3\u3092\u6df1\u3081\u308b\u306e\u306b\u5f79\u7acb\u3064\u30b9\u30ad\u30eb\u3067\u3059\u3002<\/p>\n
\u7b54\u3048\u3092\u63b2\u8f09\u3057\u3066\u3044\u306a\u3044\u554f\u984c\u7de8<\/a>\u306e\u30d6\u30ed\u30b0\u3082\u3042\u308f\u305b\u3066\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002<\/p>\n
\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001WildFire<\/a>\u3084\u9ad8\u5ea6\u306a\u8105\u5a01\u9632\u5fa1<\/a>\u306a\u3069\u306e\u30af\u30e9\u30a6\u30c9\u578b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30b5\u30fc\u30d3\u30b9\u3092\u6709\u52b9\u306b\u3057\u305f\u6b21\u4e16\u4ee3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb<\/a>\u3068Cortex XDR<\/a>\u306b\u3088\u308aGozi\u3084\u305d\u308c\u306b\u985e\u3059\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u304b\u3089\u306e\u4fdd\u8b77\u3092\u53d7\u3051\u3066\u3044\u307e\u3059\u3002<\/p>\n
\u4fb5\u5bb3\u306e\u61f8\u5ff5\u304c\u3042\u308a\u5f0a\u793e\u306b\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u30ec\u30b9\u30dd\u30f3\u30b9\u306b\u95a2\u3059\u308b\u3054\u76f8\u8ac7\u3092\u306a\u3055\u308a\u305f\u3044\u5834\u5408\u306f\u3001\u3053\u3061\u3089<\/a>\u306e\u554f\u3044\u5408\u308f\u305b\u30d5\u30a9\u30fc\u30e0\u304b\u3089\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001infojapan@paloaltonetworks.com\u307e\u3067\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u3066\u3054\u9023\u7d61\u3044\u305f\u3060\u304f\u304b\u3001\u4e0b\u8a18\u306e\u96fb\u8a71\u756a\u53f7\u307e\u3067\u304a\u554f\u3044\u5408\u308f\u305b\u304f\u3060\u3055\u3044(\u3054\u76f8\u8ac7\u306f\u5f0a\u793e\u88fd\u54c1\u306e\u304a\u5ba2\u69d8\u306b\u306f\u9650\u5b9a\u3055\u308c\u307e\u305b\u3093)\u3002<\/p>\n
- \n
- \u5317\u7c73\u30d5\u30ea\u30fc\u30c0\u30a4\u30e4\u30eb: 866.486.4842 (866.4.UNIT42)<\/li>\n
- \u6b27\u5dde: +31.20.299.3130<\/li>\n
- \u30a2\u30b8\u30a2\u592a\u5e73\u6d0b: +65.6983.8730<\/li>\n
- \u65e5\u672c: +81.50.1790.0200<\/li>\n<\/ul>\n
<\/a>IoC<\/h2>\n
pcap\u306b\u542b\u307e\u308c\u308b\u30de\u30eb\u30a6\u30a7\u30a2\u306eSHA-256\u30cf\u30c3\u30b7\u30e5:<\/p>\n
- \n
- 33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209 Cliente.zip<\/span><\/li>\n
- 340a759b1c1cdc22f6fac84044d072475e1630fbb7f47d96c4e18413de34d570 Cliente.url<\/span><\/li>\n<\/ul>\n
pcap\u306b\u542b\u307e\u308c\u308bGozi\u306eC2\u30c8\u30e9\u30d5\u30a3\u30c3\u30af:<\/p>\n
- \n
- hxxp:\/\/unapromo[.]com\/mise\/Cliente.zip<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]103\/drew\/[long base64 string with backslashes and underscores]<\/em>.jlk<\/span><\/li>\n
- hxxp:\/\/62.173.138[.]138\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/62.173.138[.]138\/drew\/[long base64 string with backslashes and underscores]<\/em>.bmp<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/stilak32.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/stilak64.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/cook32.rar<\/span><\/li>\n
- hxxp:\/\/62.173.149[.]243\/cook64.rar<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]94\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/31.41.44[.]60\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/46.8.19[.]233\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/5.44.45[.]201\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/89.116[.]236.41\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/62.173.140[.]76\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/31.41.44[.]49\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n
- hxxp:\/\/46.8.19[.]86\/drew\/[long base64 string with backslashes and underscores]<\/em>.gif<\/span><\/li>\n<\/ul>\n
- hxxp:\/\/62.173.140[.]103\/drew\/[long base64 string with backslashes and underscores]<\/em>.jlk<\/span><\/li>\n
- 340a759b1c1cdc22f6fac84044d072475e1630fbb7f47d96c4e18413de34d570 Cliente.url<\/span><\/li>\n<\/ul>\n
- 33db5b2a2cc592fd10c65ba38396e4c7574ad78e786d78e8a3acdc93a90c3209 Cliente.zip<\/span><\/li>\n
- GET \/stilak64.rar<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306e\u30db\u30b9\u30c8\u540d: DESKTOP-3GJL3PV<\/span><\/li>\n
- \u611f\u67d3\u3057\u305fWindows\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u306eIP\u30a2\u30c9\u30ec\u30b9: 172.16.1[.]137<\/span><\/li>\n
- \u30c9\u30e1\u30a4\u30f3: pcapworkshop[.]net<\/span><\/li>\n
![\"\u56f31\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002\u3053\u3053\u3067\u306fWeb\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u305f\u5f8c\u306e\u63a5\u7d9a\u5143IP\u30a2\u30c9\u30ec\u30b9\u306e\u5217(Src)\u3068\u63a5\u7d9a\u5143MAC\u30a2\u30c9\u30ec\u30b9\u3092\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-2.jpeg\")
![\"\u753b\u50cf2\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001NBNS\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u5185\u306eWindows\u30db\u30b9\u30c8\u540d\u306e\u7279\u5b9a\u306e\u3057\u304b\u305f(\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a)\u3092\u8aac\u660e\u3057\u3066\u3044\u307e\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-3.jpeg\")
![\"\u753b\u50cf3\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001Kerberos\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u4e2d\u304b\u3089\u88ab\u5bb3\u8005\u306eWindow\u30e6\u30fc\u30b6\u30fc](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-4.jpeg\")
![\"\u753b\u50cf4\u306f\u3001TCP\u30b9\u30c8\u30ea\u30fc\u30e0\u8ffd\u8de1\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u9078\u629e\u5f8c\u3001URL\u3092\u63a2\u3059\u30e1\u30cb\u30e5\u30fc](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-5.jpeg\")
![\"\u753b\u50cf5\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-6.jpeg\")
![\"\u753b\u50cf6\u306f\u3001Linux\u306e\u30bf\u30fc\u30df\u30ca\u30eb\u3067\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u7a2e\u985e\u3068SHA-256\u30cf\u30c3\u30b7\u30e5\u3092\u78ba\u8a8d\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u305f\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-7.jpeg\")
![\"\u753b\u50cf7\u306f\u3001less\u30b3\u30de\u30f3\u30c9\u3067zip\u30d5\u30a1\u30a4\u30eb\u306e\u4e2d\u8eab\u3092\u5c55\u958b\u3059\u308b\u3088\u3046\u3059\u3092\u793a\u3057\u305fLinux\u30bf\u30fc\u30df\u30ca\u30eb\u306e\u753b\u9762\u3067\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-8.jpeg\")
![\"\u753b\u50cf8\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-9.jpeg\")
![\"\u753b\u50cf9\u306f\u3001\u30d5\u30a1\u30a4\u30eb](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-10.jpeg\")
![\"\u753b\u50cf10\u306f\u3001Wireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001[File](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-11.jpeg\")
![\"\u753b\u50cf11\u306f\u3001\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u5bfe\u8c61\u306e\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u793a\u3057\u305fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002[Content](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-12.jpeg\")
![\"\u753b\u50cf12\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3059\u3002HTTP\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u30d5\u30a3\u30eb\u30bf\u30ea\u30f3\u30b0\u3057\u3066Gozi\u306eC2\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u78ba\u8a8d\u3057\u3084\u3059\u304f\u3059\u308b\u65b9\u6cd5\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002http.request\u3068\u3044\u3046\u30d5\u30a3\u30eb\u30bf\u30fc\u3092\u7dd1\u8272\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u8868\u793a\u3057\u3066\u3044\u307e\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-13.jpeg\")
![\"\u753b\u50cf13\u306fWireshark\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u3001\u521d\u671f\u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u3092\u8868\u3057\u3066\u3044\u307e\u3059\u3002\u8d64\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u90e8\u5206\u306f\u3001Base64\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u9577\u3044URL\u306e\u30c6\u30ad\u30b9\u30c8\u3067\u3059\u3002\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f"Host"\u30d8\u30c3\u30c0\u30fc\u306b\u793a\u3055\u308c\u305f\u3001\u3042\u308bIP\u306b\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b5\u30fc\u30d0\u30fc\u3067\u3059\u3002\u30a6\u30a3\u30f3\u30c9\u30a6\u306e\u4e0b\u306e\u65b9\u306b\u3079\u3064\u306e\u77e2\u5370\u3067\u30cf\u30a4\u30e9\u30a4\u30c8\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30c7\u30fc\u30bf\u3067\u3059\u3002](\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2023\/03\/word-image-127375-14-ja.png\")