[B! malware] rgfxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rgfx id:rgfx

malwareã«é–¢ã™ã‚‹rgfxã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (8)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ãƒ¡ãƒ¢ãƒªè§£æžã«ã‚ˆã‚‹Cobalt Strikeã®æ’ƒæ²ˆ
This post is also available in: English (è‹±èªž) æ¦‚è¦ æœ¬ç¨¿ã§ã¯Unit 42ã®ãƒªã‚µãƒ¼ãƒãƒ£ãƒ¼ãŒCobalt Strikeã‚³ãƒ³ãƒãƒ¼ãƒãƒ³ãƒˆã‚’çµ„ã¿è¾¼ã‚“ã è¤‡æ•°ã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚µãƒ³ãƒ—ãƒ«ã‚’æ¤œè¨¼ã—ã¾ã™ã€‚å®Ÿè¡Œä¸Šã®é‡è¦ãƒã‚¤ãƒ³ãƒˆã«ãŠã‘ã‚‹ãƒ—ãƒã‚»ã‚¹ãƒ¡ãƒ¢ãƒªå†…ã®å·®åˆ†ã‹ã‚‰å¾—ã‚‰ã‚ŒãŸã‚¢ãƒ¼ãƒ†ã‚£ãƒ•ã‚¡ã‚¯ãƒˆã‚’åˆ†æžã—ã€ã“ã‚Œã‚‰ã‚µãƒ³ãƒ—ãƒ«ã‚’æ•æ‰ã™ã‚‹æ–¹æ³•ã‚’è§£èª¬ã—ã¾ã™ã€‚ã¾ãŸã“ã‚Œã‚‰ã®è„…å¨ãŒä½¿ã†å›žé¿æˆ¦è¡“ãªã©ã€è§£æžä¸Šå•é¡Œã¨ãªã‚‹ãƒã‚¤ãƒ³ãƒˆã«ã¤ã„ã¦ã‚‚èª¬æ˜Žã—ã¾ã™ã€‚ Cobalt Strikeã¯ãƒ¬ãƒƒãƒ‰ãƒãƒ¼ãƒ æ¼”ç¿’ç”¨ã®æ•µå¯¾çš„ã‚·ãƒŸãƒ¥ãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã®1ã¤ã§ã™ãŒã€é•·å¹´ã«ã‚ãŸã‚Šæ¤œå‡ºã‚¨ãƒ³ã‚¸ãƒ³ã‚’æ‚©ã¾ã›ã¦ããŸå›žé¿åž‹ãƒžãƒ«ã‚¦ã‚§ã‚¢ã®å…¸åž‹çš„ç‰¹å¾´ã‚’å‚™ãˆã¦ã„ã‚‹ã“ã¨ã‹ã‚‰ã€ãã®äººæ°—ã¯ãƒ¬ãƒƒãƒ‰ãƒãƒ¼ãƒ ã«ã¨ã©ã¾ã‚‰ãšã€è„…å¨ã‚¢ã‚¯ã‚¿ãƒ¼ã®å¤šããŒæ‚ªæ„ã®ã‚ã‚‹ç›®çš„ã«åˆ©ç”¨ã—ã¦ã„ã¾ã™ã€‚ ãƒ„ãƒ¼ãƒ«ã‚ãƒƒãƒˆãã®ã‚‚ã®ã¯å®Ÿè·µçš„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ†ã‚¹ãƒˆã‚’è¡Œã„ãŸã„ä¿¡é ¼ã™ã¹ãå›£ä½“ã ã‘ã«è²©å£²ã•ã‚Œã¦
rgfx 2024/07/21
security

malware
ãƒªãƒ³ã‚¯
[PDF] äº‹æ¥ç¶™ç¶šã‚’è„…ã‹ã™æ–°ãŸãªãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã«ã¤ã„ã¦ - IPA
rgfx 2020/09/17
äº‹æ¥ç¶™ç¶šã‚’è„…ã‹ã™æ–°ãŸãªãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã«ã¤ã„ã¦:ã€Œäººæ‰‹ã«ã‚ˆã‚‹ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã€ã¨ ã€ŒäºŒé‡ã®è„…è¿«ã€

security

malware
ãƒªãƒ³ã‚¯
ANY.RUN - Interactive Online Malware Sandbox
Track behavior activities in Real-time The service shows many aspects of testing, such as creation of new processes, potentially suspicious or malicious files or URLs as well as registry activity, network requests and much more in real-time, allowing to make conclusions during the task execution without having to wait for the final report. Threat intelligence database A community consisting of a l
rgfx 2020/07/21
security

sandbox

malware
ãƒªãƒ³ã‚¯
ãƒãƒƒã‚¯ãƒ‰ã‚¢åŒ–ã—ãŸASUS Live Updateã‚’é€šã˜ãŸæ”»æ’ƒï¼ˆOperation ShadowHammerï¼‰ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
Kaspersky Labã¯ASUSãŒæä¾›ã™ã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã€ŒASUS Live Updateã€ãŒãƒãƒƒã‚¯ãƒ‰ã‚¢åŒ–ã—ã€ä¸€éƒ¨ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’å¯¾è±¡ã«ãƒžãƒ«ã‚¦ã‚¨ã‚¢ã‚’é…å¸ƒã™ã‚‹æ”»æ’ƒãŒå±•é–‹ã•ã‚Œã¦ã„ãŸã¨ã—ã¦èª¿æŸ»çµæžœã®ä¸€éƒ¨ã‚’ç™ºè¡¨ã—ã¾ã—ãŸã€‚ã“ã®æ”»æ’ƒã‚’åŒç¤¾ã¯ã€ŒOperation ShadowHammerã€ã¨å‘¼ç§°ã—ã¦ã„ã¾ã™ã€‚ã“ã“ã§ã¯é–¢é€£ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ Kaspersky Labã®èª¿æŸ»å ±å‘Š securelist.com è©³ç´°ã¯2019å¹´4æœˆ8æ—¥ï½ž11æ—¥ã«ã‹ã‘ã‚·ãƒ³ã‚¬ãƒãƒ¼ãƒ«é–‹å‚¬ã•ã‚Œã‚‹SASã§å ±å‘Šã•ã‚Œã‚‹äºˆå®šã€‚ ã¾ãŸåŒç¤¾ã®èª¿æŸ»å ±å‘Šã«ã¤ã„ã¦MotherboardãŒå–æã—ãŸè¨˜äº‹ãŒå…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã€‚ motherboard.vice.com 2019å¹´3æœˆ21æ—¥ã«å–æä¾é ¼ã‚’è¡Œã£ã¦ã„ã‚‹ãŒASUSã‹ã‚‰ã®è¿”äº‹ãŒãªã„æ¨¡æ§˜ã€‚ securelist.com ASUSã®åå¿œ Secure your ASUS PC devices now! Down
rgfx 2019/03/26
ã‚¹ãƒžãƒ›ã®ã‚¢ãƒ—ãƒ‡ã‚’ã™ãæ‰“ã¡åˆ‡ã‚‹ã“ã¨ã§æœ‰åãªASUSã•ã‚“ã€‚/ Motherboardã£ã¦VICE Newsæœ¬å®¶ã®ãƒ†ãƒƒã‚¯éƒ¨é–€ã‹ã€‚ã™ã£ã±æŠœãã‚ˆã‚‹ãªãƒ¼ã€‚

security

asus

malware
ãƒªãƒ³ã‚¯
è„†å¼±æ€§ã‚’æŠ±ãˆã‚‹ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢é–‹ç™ºã‚ãƒƒãƒˆã€ŒMoplusã€ã€å®Ÿã¯ãƒãƒƒã‚¯ãƒ‰ã‚¢æ©Ÿèƒ½ã®å®Ÿè£…ãŒåˆ¤æ˜Ž |
ä¸å›½ã®æ¤œç´¢ã‚¨ãƒ³ã‚¸ãƒ³ã€Œç™¾åº¦ï¼ˆBaiduï¼‰ã€ã®ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢é–‹ç™ºã‚ãƒƒãƒˆï¼ˆSoftware Develoment Kitã€SDKï¼‰ã€ŒMoplusã€ã«ã€ŒWormholeã€ã¨å‘¼ã°ã‚Œã‚‹è„†å¼±æ€§ãŒç¢ºèªã•ã‚Œã€ã“ã®è„†å¼±æ€§ãŒåˆ©ç”¨ã•ã‚ŒãŸå ´åˆã®å½±éŸ¿ã®æ·±åˆ»ã•ã‚†ãˆã«æ³¢ç´‹ã‚’å‘¼ã‚“ã§ã„ã¾ã™ã€‚ã“ã®è„†å¼±æ€§ã¯ã€ä¸å›½ã®è„†å¼±æ€§å ±å‘Šãƒ—ãƒ©ãƒƒãƒˆãƒ›ãƒ¼ãƒ ã€ŒWooYun.ogã€ã«ã‚ˆã‚Šç¢ºèªã•ã‚Œã¾ã—ãŸã€‚ ã—ã‹ã—ãªãŒã‚‰ã€ãƒˆãƒ¬ãƒ³ãƒ‰ãƒžã‚¤ã‚¯ãƒãŒã“ã®è„†å¼±æ€§ã«ã¤ã„ã¦èª¿æŸ»ã‚’é€²ã‚ãŸã¨ã“ã‚ã€Moplus SDK è‡ªä½“ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢æ©Ÿèƒ½ãŒå‚™ã‚ã£ã¦ãŠã‚Šã€å¿…ãšã—ã‚‚ãã‚ŒãŒè„†å¼±æ€§ã«ç”±æ¥ã¾ãŸã¯é–¢é€£ã—ã¦ã„ã‚‹ã‚ã‘ã§ã¯ãªã„ã“ã¨ãŒæ˜Žã‚‰ã‹ã«ãªã‚Šã¾ã—ãŸã€‚ç¾æ™‚ç‚¹ã§ã€ã“ã®å•é¡Œã¯ Moplus SDK ã®ã‚¢ã‚¯ã‚»ã‚¹è¨±å¯åˆ¶å¾¡ã¨ã‚¢ã‚¯ã‚»ã‚¹ã®åˆ¶é™æ–¹æ³•ã«ã‚ã‚‹ã¨è¦‹ã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ãã®ãŸã‚ã€è„†å¼±æ€§ãŒé–¢ä¿‚ã—ã¦ã„ã‚‹ã¨è€ƒãˆã‚‰ã‚Œã¦ã„ã‚‹ã®ã§ã™ãŒã€å®Ÿéš›ã«ã¯ã€ã“ã® SDK ã®ãƒãƒƒã‚¯ãƒ‰ã‚¢æ©Ÿèƒ½ã«ã‚ˆã‚Šã€ãƒ¦ãƒ¼ã‚¶æ¨©é™ãªã—ã«ä»¥ä¸‹ã‚’å®Ÿè¡Œã™ã‚‹æã‚ŒãŒ
rgfx 2015/11/09
ã¹ã‚“ã‚Šãƒ©ã‚¤ãƒ–ãƒ©ãƒªã¨ã‹ã§ãªãSDKä½œã£ã¦ã¾ã§ãƒãƒƒã‚¯ãƒ‰ã‚¢ä»•è¾¼ã‚€ã®ã‹â€¦ãŸã¾ã’ãŸãªã‚ã€‚ç™ºè¦šãŒé…ã‚ŒãŸã‚‰æ—¥æœ¬ã§ã‚‚ã€ŒMoplus SDKã§å‚å…¥ã™ã‚‹Androidãƒã‚¤ãƒ†ã‚£ãƒ–ã‚¢ãƒ—ãƒªãƒ“ã‚¸ãƒã‚¹ã€ãªã‚“ã¦æœ‰å„Ÿã‚»ãƒŸãƒŠãƒ¼ãŒé–‹ã‹ã‚Œã¦ãŸã®ã§ã¯ã€‚ã€‚

baidu

security

malware
ãƒªãƒ³ã‚¯
Lenovoè£½å“ã«ãƒ—ãƒªã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ã‚¢ãƒ‰ã‚¦ã‚§ã‚¢Superfishã«é–¢é€£ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¦ã¿ãŸã€‚ - piyolog
2015å¹´2æœˆ19æ—¥ã€Lenovoè£½å“ã®PCã®ä¸€éƒ¨ã«ãƒ—ãƒªã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ã‚¢ãƒ‰ã‚¦ã‚§ã‚¢Superfishã«æ·±åˆ»ãªå•é¡ŒãŒç¢ºèªã•ã‚ŒãŸã¨ã—ã¦å ±é“ã•ã‚Œã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ å…¬å¼ç™ºè¡¨ 2015å¹´2æœˆ19æ—¥ LENOVO STATEMENT ON SUPERFISH (éšæ‹“ï¼šå½“åˆç™ºè¡¨ãƒ»å¤‰æ›´å¾Œ) 2015å¹´2æœˆ20æ—¥ Superfishã«é–¢ã™ã‚‹ãƒ¬ãƒŽãƒœã®è¦‹è§£ (éšæ‹“ï¼šå½“åˆç™ºè¡¨ãƒ»å¤‰æ›´å¾Œ) 2015å¹´2æœˆ20æ—¥ SUPERFISHã®è„†å¼±æ€§ (éšæ‹“) 2015å¹´2æœˆ21æ—¥ Updated Lenovo Statement on Superfish (éšæ‹“) 2015å¹´2æœˆ21æ—¥ Superfish ã«é–¢ã™ã‚‹ãƒ¬ãƒŽãƒœã‹ã‚‰ã®ãŠçŸ¥ã‚‰ã›ï¼ˆæ›´æ–°ï¼‰(éšæ‹“) è¦‹è§£å†…å®¹ 2015å¹´1æœˆä»¥é™Superfishã®ã‚µãƒ¼ãƒãƒ¼å´ä½œç”¨ã«ã‚ˆã‚Šå®Œå…¨ã«ç„¡åŠ¹ã¨ãªã£ã¦ãŠã‚Šã€ã“ã®ç„¡åŠ¹åŒ–ã¯å¸‚å ´ã«å‡ºå›žã£ã¦ã„ã‚‹å…¨ã¦ã®SuperfishãŒå¯¾
rgfx 2015/02/20
ä»Šå›žã®ä»¶ã¯ãƒ—ãƒªã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«åœæ¢ã€‚ã—ã‹ã—Superfishã«ã‚´ãƒ¼ã‚µã‚¤ãƒ³å‡ºã™ä¼šç¤¾ã¨ã„ã†ã®ãŒãªã‚ã€‚ä»Šåº¦ã¯ã„ã¤ç¬¬2ç¬¬3ã®ã€ŒSuperfishã®ã‚ˆã†ãªå¥´ã€ã«ã‚´ãƒ¼ã‚µã‚¤ãƒ³å‡ºã•ã‚Œã‚‹ã‹åˆ†ã‹ã£ãŸã‚‚ã‚“ã˜ã‚ƒãªã„ã‚„ã€‚

security

lenovo

ThinkPad

malware
ãƒªãƒ³ã‚¯
ä¸å›½ä¼æ¥ã®Androidã‚¹ãƒžãƒ›ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ãŒç™ºè¦‹
Palo Alto Networksã«ã‚ˆã‚‹ã¨ã€ä¸å›½ã®ãƒ¡ãƒ¼ã‚«ãƒ¼CoolpadãŒåŒå›½ã§è²©å£²ã—ã¦ã„ã‚‹ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã®å¤§å¤šæ•°ã«ã€ãƒãƒƒã‚¯ãƒ‰ã‚¢ãŒä»•è¾¼ã¾ã‚Œã¦ã„ã‚‹ã“ã¨ãŒåˆ†ã‹ã£ãŸã€‚ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¼æ¥ã®Palo Alto Networksã¯12æœˆ17æ—¥ã€ä¸å›½ã®ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ãƒ¡ãƒ¼ã‚«ãƒ¼CoolpadãŒè£½é€ ã™ã‚‹å¤šæ•°ã®ãƒã‚¤ã‚¨ãƒ³ãƒ‰å‘ã‘Androidç«¯æœ«ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢ãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹ã®ã‚’è¦‹ã¤ã‘ãŸã¨ç™ºè¡¨ã—ãŸã€‚ Coolpadã¯ã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ã§ä¸–ç•Œ6ä½ã€ä¸å›½ã§ã¯3ä½ã®ãƒ¡ãƒ¼ã‚«ãƒ¼ã€‚åŒç¤¾è£½å“ã®ä¸å¯©ãªæŒ™å‹•ã«ã¤ã„ã¦ã®è‹¦æƒ…ãŒæŽ²ç¤ºæ¿ã«æ›¸ãè¾¼ã¾ã‚Œã¦ã„ãŸã“ã¨ã‹ã‚‰ã€Palo Alto NetworksãŒä¸å›½å›½å†…ã§è²©å£²ã•ã‚Œã¦ã„ã‚‹Coolpadç«¯æœ«ã®ã‚¹ãƒˆãƒƒã‚¯ROMã‚’èª¿ã¹ãŸã¨ã“ã‚ã€å¤§å¤šæ•°ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢ã®ã€ŒCoolReaperã€ãŒä»•è¾¼ã¾ã‚Œã¦ã„ã‚‹ã“ã¨ãŒåˆ†ã‹ã£ãŸã¨ã„ã†ã€‚ Palo Alto Networkã«ã‚ˆã‚‹ã¨ã€ã“ã®ãƒãƒƒã‚¯ãƒ‰ã‚¢ã¯CoolpadãŒé‹ç”¨ã—
rgfx 2014/12/18
é…·æ´¾ã‚“ã¨ã“ã‹(;Â´Ð”`)ã²ã§ãˆã€‚OPPOã‚¹ãƒ”ãƒ³ã‚¢ã‚¦ãƒˆã®OneplusOneã«ã—ã¨ã„ã¦ã‚ˆã‹ã£ãŸã€‚CM11ãƒ™ãƒ¼ã‚¹ã ã—ã€‚

android

china

coolpad

malware

security
ãƒªãƒ³ã‚¯
Tatsuo Nagamatsu on Twitter: "è‡ªåˆ†ãŒ Google Playã§å…¬é–‹ã—ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªãŒå‹æ‰‹ã« http://t.co/14BFFuJSvq ã«ã¦é…å¸ƒã•ã‚Œã¦ã„ã‚‹ã®ã§ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã¦ã¿ãŸã‚‰ã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸ã«ã¯è‡ªåˆ†ã®çŸ¥ã‚‰ãªã„ PushNotificationReceiverã¨ã‹ã®ã‚³ãƒ¼ãƒ‰ãŒå…¥ã‚Œã‚‰ã‚Œã¦ã„ã¦æ€–ã„ã€‚"
è‡ªåˆ†ãŒ Google Playã§å…¬é–‹ã—ã¦ã„ã‚‹ã‚¢ãƒ—ãƒªãŒå‹æ‰‹ã« http://t.co/14BFFuJSvq ã«ã¦é…å¸ƒã•ã‚Œã¦ã„ã‚‹ã®ã§ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ã¦ã¿ãŸã‚‰ã€ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸ã®ä¸ã«ã¯è‡ªåˆ†ã®çŸ¥ã‚‰ãªã„ PushNotificationReceiverã¨ã‹ã®ã‚³ãƒ¼ãƒ‰ãŒå…¥ã‚Œã‚‰ã‚Œã¦ã„ã¦æ€–ã„ã€‚
rgfx 2014/01/07
playã‚¹ãƒˆã‚¢ã‹ã‚‰æ¦‚è¦ãƒ»ã‚¢ã‚¤ã‚³ãƒ³ãƒ»ãƒ‘ãƒƒã‚±ãƒ¼ã‚¸åä¸¸ãƒ‘ã‚¯ã—ã¦ã€ä¸èº«ã¯å…¨ãåˆ¥ãƒ¢ãƒ³ã®ãƒžãƒ«ã‚¦ã‚§ã‚¢ã‚’ã°ã‚‰ã¾ãã‚µã‚¤ãƒˆã«ã¤ã„ã¦ã€‚

security

android

malware
ãƒªãƒ³ã‚¯
1