频繁的 C&C Beacon 活动 域名声誉较低 新注册的域名
sxvlww.am.files.1drv.com/y4mqgb...ktaq/tradingvlev_x32_x64bit.zip?download&psid=1
(向右滑动,查看更多)
tradingview.business
。不仅该域名与合法域名 tradingview.com
很相似,网页看上去也一模一样。sxvlww[.]am[.]files[.]1drv[.]com/y4mqgbxmxiwuw8zm66u0rrrpceovu5hvhzmpooyrgnaaafadcqoiy-b3zjggi68kx_kt1c99vy4av6z5hznc6gumfg9hrnozccxmfiifzy6qf0rsqexsduxn06mtqzcccwb_iek8lvhu0wi-zupdr4sjpfack_tipf0psgzy5qw6ryzjdc8ny-zclsu716jxa7l1sss6r2jhl7lcdijpcktaq/tradingvlev_x32_x64bit.zip?download&psid=1
(向右滑动,查看更多)
Name: TradingVlev_x32_x64bit.exe
MD5: 467d42eca35c0571c30d3f20700d9dff
SHA1: e26512838e6ffb8af84743ae37821694cd380003
SHA256: 9abdfcea109db4763065fee6d3e87299f03f57dba0307c67ad10cd86f0f2acf3
(向右滑动,查看更多)
ThumbPrint: 63fb7fe4f171bd6dde774ae9365d91ac132616af
CN = AVG Technologies USA, LLC
OU = RE stapler cistodc
O = AVG Technologies USA, LLC
L = Newton
S = North Carolina
C = US
(向右滑动,查看更多)
212[.]8[.]246[.]70/builds/still[.]exe - 16857afad0b6c40469e5d9d9b63a2927
212[.]8[.]246[.]70/builds/still[.]exe - 55552ed60bddd332eee8a23f0494174f
212[.]8[.]246[.]70/builds/installer[.]exe - 4d7f538bf21bf0c42fee87d28d3f3079
212[.]8[.]246[.]70/build/bot[.]exe - 0743250f8bb1a0baa01affcfd963d171
(向右滑动,查看更多)
GET /1769 HTTP/1.1
Host: 95.217.31.208
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 26 Nov 2022 15:21:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
1,1,0,1,0,30e8151b350f29168e37e1eea06ed1b4,1,1,1,0,0,Default;%DOCUMENTS%\;*.txt;50;4;movies:music:mp3:exe;DESKTOP;%DESKTOP%\;*.txt;50;4;movies:music:mp3:exe;
(向右滑动,查看更多)
GET /547345733334.zip HTTP/1.1
Host: 95.217.31.208
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 26 Nov 2022 15:21:14 GMT
Content-Type: application/zip
Content-Length: 2685679
Last-Modified: Mon, 12 Sep 2022 13:14:59 GMT
Connection: keep-alive
ETag: "631f30d3-28faef"
Accept-Ranges: bytes
(向右滑动,查看更多)
%\ProgramData\%
目录中。fc99ea424df48f2b661219b71f33b979
1a70718eefa2aef42f4b09577aea7b43ff874e02
f4c166dddefd29eb457d0a7b426928b1123626c6c1568bc998440dac72a816b7
467d42eca35c0571c30d3f20700d9dff
e26512838e6ffb8af84743ae37821694cd380003
9abdfcea109db4763065fee6d3e87299f03f57dba0307c67ad10cd86f0f2acf3
85.208.136.162
sxvlww.am.files.1drv.com
tradingview.business
hxxps://tradingview[.]business/download.php
212[.]8[.]246[.]70/builds/still[.]exe
212[.]8[.]246[.]70/builds/installer[.]exe
212[.]8[.]246[.]70/builds/bot[.]exe
4d7f538bf21bf0c42fee87d28d3f3079
55552ed60bddd332eee8a23f0494174f
16857afad0b6c40469e5d9d9b63a2927
0743250f8bb1a0baa01affcfd963d171
https://www.zscaler.com/blog/security-research/trade-with-caution
精彩推荐