dasdcasd

dasdcasd

-
V2EX member #499825, joined on 2020-07-19 16:24:13 +08:00
Per dasdcasd's settings, the topics list is hidden
Deals info, including closed deals, is not hidden
dasdcasd's recent replies
Sep 8, 2022
Replied to a topic by KomeijiSatori 宽带症候群 Everything 更新服务疑被劫持
你这是遇到 APT 了 2333
我根据木马样本包含的字符串追踪到了一个极为相似的历史木马样本
两者代码结构和命名方式都即为相似
https://www.hybrid-analysis.com/sample/1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128/617b7a1c54d0d627e6115d93
https://app.any.run/tasks/87f12d0c-9877-483b-aded-a00f59ec82bf/ 可以从 any.run 下载样本
该木马出现在一个安全报告中
https://www.stormshield.com/news/security-alert-windealer-stormshield-response/
木马家族命名为 WinDealer
https://teamt5.org/en/posts/japan-security-analyst-conference-2022/
https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf

https://www.hake.cc/page/article/3881.html
"中国罗宇黑客利用旁人攻击部署 WinDealer 后门"
这个马的传播方法非常高级 通过劫持骨干网路由器替换更新文件 进行木马植入
SELF-XSS
About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   1018 Online   Highest 6679   ·     Select Language
创意工作者们的社区
World is powered by solitude
VERSION: 3.9.8.5 · 12ms · UTC 19:04 · PVG 03:04 · LAX 12:04 · JFK 15:04
♥ Do have faith in what you're doing.