Endpoint Protection - Symantec EnterpriseRDP を悪用ã§ãるワームã¨ã—ã¦æœ€è¿‘発見ã•ã‚ŒãŸ W32.Morto ã«ã¤ã„ã¦ã¯ã€ã„ã‚ã„ã‚ã¨å ±é“ã•ã‚Œã¦ã„ã¾ã™ãŒã€ã“ã®ãƒ¯ãƒ¼ãƒ ã®æŒ™å‹•ã§ç‰¹ã«æ³¨ç›®ã™ã¹ã点ãŒè¦‹éŽã”ã•ã‚Œã¦ã„るよã†ã§ã™ã€‚最近確èªã•ã‚ŒãŸãƒžãƒ«ã‚¦ã‚§ã‚¢ã®ã»ã¨ã‚“ã©ã¯ã€ãƒªãƒ¢ãƒ¼ãƒˆã®ã‚³ãƒžãƒ³ãƒ‰ & コントãƒãƒ¼ãƒ«ï¼ˆC&C）サーãƒãƒ¼ã¨ã®é€šä¿¡æ‰‹æ®µã‚’何らã‹ã®å½¢ã§æŒã£ã¦ã„ã¾ã™ãŒã€é€šä¿¡ã«ä½¿ã‚れる実際ã®çµŒè·¯ã¯è„…å¨ã«ã‚ˆã£ã¦å¤‰ã‚る傾å‘ãŒã‚ã‚Šã¾ã™ã€‚ãŸã¨ãˆã°ã€W32.IRCBot ã¯ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆãƒªãƒ¬ãƒ¼ãƒãƒ£ãƒƒãƒˆã®ãƒãƒ£ãƒãƒ«ã‚’利用ã—ã¾ã™ãŒã€ã—ã°ã‚‰ãå‰ã«å¤§ãã注目を集ã‚㟠Trojan.Downbot ã«ã¯ HTML ページや画åƒãƒ•ã‚¡ã‚¤ãƒ«ã«åŸ‹ã‚è¾¼ã¾ã‚ŒãŸã‚³ãƒžãƒ³ãƒ‰ã‚’èªã¿å–る機能ãŒã‚ã‚Šã¾ã™ã€‚W32.Morto ã¯ã€DNS（Domain Name System）ã®ãƒ¬ã‚³ãƒ¼ãƒ‰ã‚’通ã˜ã¦ãƒªãƒ¢ãƒ¼ãƒˆã‚³ãƒžãƒ³ãƒ‰ã‚’指定ã—ã¦ãŠã‚Šã€ã“れも C&C ã¨ã®é€šä¿¡çµŒè·¯ã¨ã—ã¦ã¯æ–°ã—ã„手法ã§ã™ã€‚ DNS ã¯ä¸»ã¨ã—ã¦ã€äººé–“ãŒ
Report unsafe site | Microsoft Security Intelligence
Aug 28 Morto / Tsclient - RDP worm with DDoS features
北æœé®®ç·æ›¸è¨˜æ»åŽ»ã®ãƒ‹ãƒ¥ãƒ¼ã‚¹ã«ä¾¿ä¹—ã—ãŸæ¨™çš„åž‹ãƒ¡ãƒ¼ãƒ«ã‚’ç¢ºèª - Tokyo SOC Report
{{#tags}}- {{label}}
{{/tags}}