Fareit木马分析与防护 – 绿盟科技技术博客
Tags
| attack-pattern: | Software - T1592.002 Visual Basic - T1059.005 |
Common Information
| Type | Value |
|---|---|
| UUID | ddec7ca1-a20e-4aa6-b995-00c4285160ce |
| Fingerprint | 2e0d3ff602f064f2 |
| Analysis status | DONE |
| Considered CTI value | 2 |
| Text language | |
| Published | Nov. 13, 2015, 3:48 p.m. |
| Added to db | Jan. 18, 2023, 7:36 p.m. |
| Last updated | Nov. 15, 2024, 1:52 a.m. |
| Headline | Fareit木马分析与防护 |
| Title | Fareit木马分析与防护 – 绿盟科技技术博客 |
| Detected Hints/Tags/Attributes | 9/1/19 |
Source URLs
| Redirection | Url | |
|---|---|---|
| Details | Source | http://blog.nsfocus.net/fareit-trojan-analysis-protection/ |
URL Provider
Attributes
| Details | Type | #Events | CTI | Value |
|---|---|---|---|---|
| Details | Domain | 25 | blog.nsfocus.net |
|
| Details | Domain | 26 | weibo.com |
|
| Details | Domain | 2 | tekboss.xyz |
|
| Details | File | 1 | 2d908d38a3985f4e7a487ddcef164c6f.exe |
|
| Details | File | 1 | 文中重命名为123.exe |
|
| Details | File | 1 | 并且设置两个子进程的用户名为explorer.exe |
|
| Details | File | 1 | 样本会读取sm.dat |
|
| Details | File | 2 | c:\users\john\appdata\local\temp\4719217.bat |
|
| Details | File | 2 | c:\users\john\desktop\123\123.exe |
|
| Details | File | 1 | 找到explorer.exe |
|
| Details | File | 1 | 然后impersonateloggedonuser使当前进程模拟explorer.exe |
|
| Details | md5 | 1 | 2d908d38a3985f4e7a487ddcef164c6f |
|
| Details | sha1 | 1 | 409997693a8d025ace54bf0312cedc91d7175b73 |
|
| Details | sha256 | 1 | 009d8e9025122e021733e91cb1635fac57eba22de65ce8a19ea73cd54c00314b |
|
| Details | IPv4 | 2 | 198.105.221.5 |
|
| Details | Url | 4 | http://blog.nsfocus.net |
|
| Details | Url | 3 | http://weibo.com/threatresponse |
|
| Details | Url | 1 | http://tekboss.xyz等域名 |
|
| Details | Url | 1 | http://blog.nsfocus.net/fareit-trojan-analysis-prevention |