某黑产组织捆绑VPN和TG等安装程序进行攻击活动
Tags
Common Information
| Type | Value |
|---|---|
| UUID | ca45cf25-0848-4ea9-a9b0-8fc499d256aa |
| Fingerprint | 7bfcb1efdb77da3c |
| Analysis status | DONE |
| Considered CTI value | 0 |
| Text language | |
| Published | Sept. 19, 2023, midnight |
| Added to db | Aug. 31, 2024, 9:06 a.m. |
| Last updated | Dec. 9, 2024, 12:54 p.m. |
| Headline | 某黑产组织捆绑VPN和TG等安装程序进行攻击活动 |
| Title | 某黑产组织捆绑VPN和TG等安装程序进行攻击活动 |
| Detected Hints/Tags/Attributes | 0/0/18 |
Source URLs
URL Provider
RSS Feed
| Details | Id | Enabled | Feed title | Url | Added to db |
|---|---|---|---|---|---|
| Details | 264 | ✔ | 安全分析与研究 | https://wechat2rss.xlab.app/feed/62ba31603ffe26b5a8eca9ddaa434ea612445c10.xml | 2024-08-30 22:08 |
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 91 | xz.aliyun.com |
|
| Details | File | 1 | 解压缩msi安装包中的vs.zip |
|
| Details | File | 1 | vs.zip |
|
| Details | File | 2 | 6.py |
|
| Details | File | 1 | 然后调用python38.jpg |
|
| Details | File | 1 | 8.py |
|
| Details | File | 1 | thon38.jpg |
|
| Details | File | 1 | 脚本解密pb.txt |
|
| Details | File | 1 | 然后通过解密后的程序解压缩lnk.zip |
|
| Details | File | 1 | 解压缩lnk.zip |
|
| Details | File | 3 | 10.rar |
|
| Details | File | 1 | 最后调用python39.jpg |
|
| Details | File | 1 | 13.py |
|
| Details | File | 1 | thon39.jpg |
|
| Details | File | 1 | 脚本读取指定目录下的templatewatch.dat |
|
| Details | File | 1 | 判断是否存在kxetray.exe |
|
| Details | File | 1 | 和360tray.exe |
|
| Details | Url | 1 | https://xz.aliyun.com/t/15082 |