{"id":2574,"date":"2023-04-15T18:07:54","date_gmt":"2023-04-15T10:07:54","guid":{"rendered":"https:\/\/blog.billows.com.tw\/?p=2574"},"modified":"2023-04-17T10:55:31","modified_gmt":"2023-04-17T02:55:31","slug":"%e5%82%b3%e5%87%ba%e5%be%ae%e6%98%9f%e6%b2%92%e4%bb%98%e8%b4%96%e9%87%91%ef%bc%8c%e7%b4%84528gb%e7%9a%84%e8%b3%87%e6%96%99%e9%81%admoney-message%e5%85%ac%e9%96%8b%e5%9c%a8%e6%9a%97%e7%b6%b2%e4%b8%8a","status":"publish","type":"post","link":"https:\/\/blog.billows.com.tw\/?p=2574","title":{"rendered":"\u50b3\u51fa\u5fae\u661f\u6c92\u4ed8\u8d16\u91d1\uff0c\u7d04528GB\u7684\u8cc7\u6599\u906dMoney Message\u516c\u958b\u5728\u6697\u7db2\u4e0a"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

Photo Credit:Dominic Alvieri<\/a><\/p>\n\n\n\n

\u5728\u4e0a\u9031\u7ae3\u76df\u79d1\u6280<\/a>\u90e8\u843d\u683c\u5831\u5c0e\u4e86\u57284\u67086\u65e5<\/a>\u5916\u5a92\u900f\u9732\u6709\u95dc\u96fb\u7af6\u7b46\u96fb\u5927\u5ee0\u5fae\u661f\u79d1\u6280\u906d\u65b0\u578b\u52d2\u7d22\u8edf\u9ad4Money Message\u5165\u4fb5\u7684\u8cc7\u5b89\u4e8b\u4ef6\u30024\u67087\u65e5\uff0c\u5fae\u661f\u767c\u5e03\u91cd\u8a0a\u8b49\u5be6\u5176\u90e8\u5206\u7cfb\u7d71\u906d\u99ed\u5ba2\u653b\u64ca\uff0c\u4f46\u6c92\u6709\u900f\u9732\u4efb\u4f55\u6709\u95dc\u5176\u906d\u53d7\u7db2\u8def\u653b\u64ca\u6027\u8cea\u7684\u8cc7\u8a0a\uff0c\u4e5f\u6c92\u6709\u8aaa\u662f\u5426\u5982\u540c\u99ed\u5ba2\u6240\u8072\u7a31\u6578\u64da\u5728\u653b\u64ca\u904e\u7a0b\u4e2d\u88ab\u7aca\u53d6\u3002\u7ae3\u76df\u79d1\u6280\u7576\u6642\u5f15\u8ff0\u4e86\u8cc7\u5b89\u5916\u5a92Bleeping Computer\u7684\u5831\u5c0e<\/a>\uff0cMoney Message\u5f9e\u5fae\u661f\u76dc\u7aca\u4e86\u7d041.5TB\u7684\u6578\u64da\uff0c\u64da\u5831\u7576\u4e2d\u5305BIOS \u97cc\u9ad4\u6a94\u6848\u3001ERP\u8cc7\u6599\u5eab\u3001\u91d1\u9470\u3001\u8edf\u9ad4\u539f\u59cb\u78bc\u7b49\u6a94\u6848\uff0c\u82e5\u5fae\u661f\u4e0d\u80fd\u6eff\u8db3Money Message\u7684\u8d16\u91d1\u8981\u6c42\u5373\u7d04\u53f0\u5e631.2\u5104\uff0c\u5c07\u88ab\u516c\u958b\u8a72\u6279\u654f\u611f\u8cc7\u6599\u3002<\/p>\n\n\n\n

4\u670814\u65e5\uff0c\u5728 Money Message\u7684\u63ed\u79d8\u7db2\u7ad9\u4e0a\u5df2\u51fa\u73fe\u7591\u5c6c\u65bc\u5fae\u661f\u76843\u500b\u8cc7\u6599\u593e\uff0c\u5176\u4e2d2\u500b\u53ef\u8ffd\u6eaf\u52302022\u5e741\u670819\u548c9 \u670817\u65e5\uff1b\u53e6\u4e00\u500b\u53ef\u8ffd\u6eaf\u5230\u4eca\u5e74\u76841\u670823\u65e5\uff0c\u5224\u65b7\u5fae\u661f\u6c92\u6709\u59a5\u5354\u99ed\u5ba2\u52d2\u7d22\u7684\u8981\u6c42\u800c\u906dMoney Message\u5916\u6d29\u8cc7\u6599\u3002\u6b64\u5916\uff0c\u8cc7\u5b89\u8cc7\u5b89\u5c08\u5bb6Dominic Alvieri<\/a>\u4e5f\u5728\u5176Twitter\u4e0a\u516c\u958b\u4e86\u5fae\u661f\u5916\u6d29\u8cc7\u6599\u7684\u622a\u5716\u3002<\/p>\n\n\n\n

\u53e6\u5916\uff0c\u8cc7\u5b89\u784f\u7a76\u5718\u968aMalwareHunterTeam<\/a>\u516c\u958b\u7591\u4f3c\u5fae\u661f\u4ee3\u8868\u57283\u6708\u5e95\u8207Money Message\u7684\u90e8\u5206\u5c0d\u8a71\u4ee3\u5bb9\uff0c\u6709\u8da3\u7684\u662f\u5167\u5bb9\u662f\u5468\u6770\u502b\u7684\u6b4c\u66f2\u201d\u9752\u82b1\u74f7\u201d\u6b4c\u8a5e\u7684\u4e00\u5c0f\u6bb5:<\/p>\n\n\n\n

\u300c\u5929\u9752\u8272\u7b49\u7159\u96e8 \u800c\u6211\u5728\u7b49\u4f60<\/p>\n\n\n\n

\u708a\u7159\u5acb\u5acb\u5347\u8d77 \u9694\u6c5f\u5343\u842c\u88cf<\/p>\n\n\n\n

\u5728\u74f6\u5e95\u66f8\u6f22\u96b8\u4eff\u524d\u671d\u7684\u98c4\u9038<\/p>\n\n\n\n

\u5c31\u7576\u6211\u70ba\u9047\u898b\u4f60\u4f0f\u7b46\u300d<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u7ae3\u76df\u79d1\u6280<\/a>\u5c0d\u6bd4\u4e86BleepingComputer<\/a>\u57284\u67086\u65e5\u7684\u5831\u5c0e\uff0c\u8a72\u5916\u5a92\u5f35\u8cbc\u4e86\u4e00\u5f35\u7591\u70ba\u5fae\u661f\u4ee3\u8868\u8207Money Message \u7684\u804a\u5929\u8a18\u9304\uff0c\u96d6\u7136\u804a\u5929\u5ba4\u622a\u5716\u7d93\u99ac\u585e\u514b\u8655\u7406\u904e\uff0c\u4f46\u4ecd\u96b1\u7d04\u770b\u51fa\u662f\u9752\u82b1\u74f7\u7684\u6b4c\u8a5e\u3002<\/p>\n\n\n\n

\u4e00\u822c\u4f86\u8aaa\uff0c\u906d\u53d7\u52d2\u7d22\u8edf\u9ad4\u653b\u64ca\u7684\u53d7\u5bb3\u8005\u6703\u5f97\u5230\u4e00\u500b\u6307\u5b9a\u7684\u804a\u5929\u5ba4\u9023\u7d50\u7528\u4ee5\u8207\u653b\u64ca\u8005\u8ac7\u5224\uff0c\u7136\u800c\u76ee\u524d\u66ab\u672a\u80fd\u78ba\u8a8d\u6b64\u804a\u5929\u5ba4\u662f\u5426\u906d\u5225\u7684\u99ed\u5ba2\u9a0e\u52ab\u6216\u53d7\u5bb3\u8005\u6709\u4ec0\u9ebc\u7279\u5225\u7684\u610f\u601d\u60f3\u8868\u9054\u3002<\/p>\n\n\n\n

\"\u7d05\u6846\u90e8\u5206\u96b1\u7d04\u770b\u51fa\u662f\u9752\u82b1\u74f7\u7684\u6b4c\u8a5e<\/figure>\n\n\n\n

\u7d05\u6846\u90e8\u5206\u96b1\u7d04\u770b\u51fa\u662f\u9752\u82b1\u74f7\u7684\u6b4c\u8a5e Photo Credit: BleepingComputer<\/a><\/p>\n\n\n\n

Money Message \u662f\u52d2\u7d22\u8edf\u9ad4\u5e02\u5834\u4e0a\u7684\u4e00\u500b\u76f8\u5c0d\u8f03\u65b0\u7684\u7d44\u7e54\uff0c\u65bc\u4eca\u5e743\u6708\u9996\u6b21\u88ab\u767c\u73fe\uff0cWindows \u548c Linux \u64cd\u4f5c\u7cfb\u7d71\u90fd\u662f\u6b64\u52d2\u7d22\u8edf\u9ad4\u7684\u76ee\u6a19\uff0c\u5b83\u53ef\u4ee5\u52a0\u5bc6\u7db2\u8def\u5171\u4eab\u8cc7\u6599\u593e\uff0c\u5176\u91dd\u5c0d\u7db2\u8def\u5171\u4eab\u7684\u65b9\u6cd5\u8207Maze \u548c Petya \u52d2\u7d22\u8edf\u9ad4\u985e\u4f3c\u3002\u64da\u6089\uff0c\u653b\u64ca\u8005\u6703\u5728\u5176\u64cd\u4f5c\u4e2d\u4f7f\u7528Stealer\u4f86\u7aca\u53d6\u65e5\u8a8c\u8cc7\u6599\u3002\u5728\u5176\u555f\u52d5\u52a0\u5bc6\u904e\u7a0b\u4e2d\uff0c\u4f7f\u7528\u6a62\u5713\u66f2\u7dda\u8fea\u83f2-\u8d6b\u723e\u66fc\u5bc6\u9470\u4ea4\u63db(Elliptic Curve Diffie\u2013Hellman key exchange)\u548c ChaCha \u4e32\u6d41\u52a0\u5bc6\u6f14\u7b97\u6cd5\u4f86\u52a0\u5bc6\u3002\u6839\u64daBleeping Computer \u7684<\/strong><\/a>\u8aaa\u6cd5\uff0cMoney Message\u4e0d\u5982\u5176\u4ed6\u52d2\u7d22\u8edf\u9ad4\u7cfb\u5217\u90a3\u9ebc\u6709\u6548\u3002\u4e8b\u5be6\u4e0a\uff0c\u8207\u5176\u4ed6\u52a0\u5bc6\u5de5\u5177\u76f8\u6bd4\uff0c\u5b83\u5be6\u969b\u4e0a\u975e\u5e38\u6162\u3002\u4e00\u65e6\u52d2\u7d22\u8edf\u9ad4\u9032\u5165\uff0c\u5b83\u5c31\u6703\u7559\u4e0b\u4e00\u500b\u540d\u70ba money_message.log\u7684\u52d2\u7d22\u5b57\u689d\uff0c\u5176\u4e2d\u5305\u542b\u4e00\u500b\u6307\u5411 TOR \u7ad9\u9ede\u7684\u93c8\u63a5\u4ee5\u5354\u5546\u8d16\u91d1\u3002\u5728\u4e00\u500b\u6848\u4f8b\u7814\u7a76\u4e2d\uff0c\u767c\u73feMoney Message \u52d2\u7d22\u8edf\u9ad4\u8a66\u5716\u901a\u904e\u4f7f\u7528\u914d\u7f6e\u4e2d\u5b58\u5728\u7684\u7ba1\u7406\u54e1\u8eab\u4efd\u9a57\u8b49\u6191\u8b49\u547c\u53ebWNetAddConnection2W()\u4f86\u5b58\u53d6\u7ba1\u7406\u7db2\u8def\u5171\u4eab\u3002\u4e00\u65e6\u4f7f\u7528\u9019\u4e9b\u6191\u8b49\u7372\u5f97\u7db2\u8def\u5b58\u53d6\u6b0a\u9650\uff0c\u52d2\u7d22\u8edf\u9ad4\u5c31\u6703\u958b\u59cb\u52a0\u5bc6\u7db2\u8def\u5171\u4eab\u4e2d\u7684\u6a94\u6848\u3002<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Photo Credit : Cyble<\/a><\/p>\n\n\n\n

Money Message\u52d2\u7d22\u8edf\u9ad4\u7684\u90e8\u5206\u5165\u4fb5\u6307\u6a19(Indicator of compromise -IOCs):<\/p>\n\n\n\n

SHA 256<\/p>\n\n\n\n

dc563953f845fb88c6375b3e9311ebed49ce4bcd613f7044989304dc8de384 –>Money Message Windows \u57f7\u884c\u6a94<\/p>\n\n\n\n

4f8bd37851b772ee91ba54b8fd48304a6520d49ea4a81d751570ea67ef0a9904 –>Money Message Linux\u57f7\u884c\u6a94<\/p>\n\n\n\n

\u7ae3\u76df\u79d1\u6280<\/a>\u5efa\u8b70\u91dd\u5c0d\u52d2\u7d22\u8edf\u9ad4\u7684\u61c9\u5c0d\u63aa\u65bd:<\/p>\n\n\n\n

\uff0a\u7531\u65bc\u60a8\u7684\u6240\u6709\u6587\u4ef6\u90fd\u662f\u4f7f\u7528\u8ecd\u7528\u7d1a\u52a0\u5bc6\u7b97\u6cd5\u9032\u884c\u52a0\u5bc6\u7684\uff0c\u800c\u4e14\u5bc6\u9470\u5728\u72af\u7f6a\u8005\u624b\u4e0a\uff0c\u56e0\u6b64\u57fa\u65bc\u539f\u59cb\u6578\u64da\u5fa9\u539f(\u6307\u89e3\u5bc6)\uff0c\u9019\u662f\u500b\u7121\u89e3\u7684\u56f0\u5883\u3002<\/p>\n\n\n\n

\uff0a\u5411\u72af\u7f6a\u8005\u652f\u4ed8\u8d16\u91d1\u6216\u8a66\u5716\u8207\u4e4b\u806f\u7e6b\u6709\u5f88\u5927\u7684\u98a8\u96aa\u3002\u56e0\u70ba\u5728\u4ed8\u6b3e\u5f8c\uff0c\u5c0d\u65b9\u6709\u53ef\u80fd\u6703\u5c31\u6b64\u505c\u6b62\u806f\u7e6b\uff0c\u751a\u81f3\u89e3\u5bc6\u5668\u53ef\u80fd\u7121\u6cd5\u5de5\u4f5c\uff0c\u6216\u5176\u672c\u8eab\u5e36\u4f86\u4e86\u66f4\u591a\u5a01\u8105\u3002<\/p>\n\n\n\n

\uff0a\u5343\u842c\u4e0d\u8981\u4f7f\u7528\u865f\u7a31\u529f\u80fd\u5f37\u5927\u7684\u53cd\u60e1\u610f\u8edf\u9ad4\uff0c\u9019\u7a2e\u8edf\u9ad4\u8072\u7a31\u53ef\u4ee5\u5b8c\u5168\u6d88\u9664\u7cfb\u7d71\u4e2d\u7684\u6709\u5bb3\u5a01\u8105\u3002\u4f46\u4f7f\u7528\u4e4b\u5f8c\uff0c\u60a8\u53ef\u80fd\u5931\u53bb\u7684\u66f4\u591a\u3002<\/p>\n\n\n\n

\uff0a\u91dd\u5c0d\u52d2\u7d22\u75c5\u6bd2\u7684\u5371\u5bb3\uff0c\u6b63\u78ba\u7684\u61c9\u5c0d\u63aa\u65bd\u662f\u5e73\u65e5\u7684\u591a\u91cd\u5099\u4efd\u6a5f\u5236\u8207\u5b9a\u6642\u7684\u9084\u539f\u6f14\u7df4\u3002<\/p>\n\n\n\n

\uff0a\u9664\u4e86\u57fa\u672c\u7684\u9632\u706b\u7246\u5916\uff0c\u9084\u8981\u7a4d\u6975\u4f48\u7f72\u5177\u5099\u7be9\u9078\u529f\u80fd\u7684\u4ee3\u7406\u4f3a\u670d\u5668\u3001\u9598\u9053\u904e\u6ffe\u3001\u96fb\u5b50\u90f5\u4ef6\u9598\u9053\u9632\u8b77\uff0c\u4ee5\u53ca\u7d42\u7aef\u96fb\u8166\u7684\u5f31\u9ede\u66f4\u65b0\u3001\u9632\u6bd2\u78bc\u66f4\u65b0\u7b49\u5b89\u5168\u9632\u8b77\u4f48\u7f72\u3002<\/p>\n\n\n\n

\uff0a\u4f48\u7f72\u5a01\u8105\u5075\u6e2c\u6a5f\u5236\uff0c\u5982 SIEM\u3001HIDS\u3001\u5c01\u5305\u6aa2\u6e2c\u53ca\u9032\u968e\u6b3a\u6575\u7cfb\u7d71<\/a>\u7b49\u7522\u54c1\uff0c\u53ef\u4ee5\u65e9\u671f\u767c\u73fe\uff0c\u4e26\u9632\u6b62\u5a01\u8105\u64f4\u6563\u3002<\/p>\n\n\n\n

\u5c0d\u65bc\u91cd\u8981\u7684\u4ea4\u6613\u7cfb\u7d71\uff0c\u53ef\u4ee5\u4f48\u7f72\u57f7\u884c\u7a0b\u5e8f\u9650\u5236\u65b9\u6848\uff0c\u9632\u6b62\u60e1\u610f\u7a0b\u5f0f\u7684\u57f7\u884c\u3002<\/p>\n\n\n\n

\uff0a\u900f\u904e\u6559\u80b2\u8a13\u7df4\u8207\u5404\u7a2e\u653b\u64ca\u6f14\u7df4\uff0c\u52a0\u5f37\u7d42\u7aef\u7528\u6236\u7684\u8cc7\u5b89\u9632\u8b77\u610f\u8b58\u3002<\/p>\n\n\n\n

\u201c\u8f49\u8cbc\u3001\u5206\u4eab\u6216\u5f15\u7528\u6587\u7ae0\u5167\u5bb9\uff0c\u8acb\u8a3b\u660e\u51fa\u8655\u70ba\u7ae3\u76df\u79d1\u6280https:\/\/www.billows.tech\/,<\/a> \u4ee5\u514d\u89f8\u6cd5\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"

Photo Credit:Dominic Alvieri \u5728\u4e0a\u9031\u7ae3\u76df\u79d1\u6280\u90e8\u843d\u683c\u5831\u5c0e\u4e86\u57284\u67086\u65e5\u5916\u5a92\u900f\u9732\u6709\u95dc\u96fb\u7af6 READ MORE<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[242,174],"class_list":["post-2574","post","type-post","status-publish","format-standard","hentry","category-6","tag-money-message","tag-news"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/2574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2574"}],"version-history":[{"count":6,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/2574\/revisions"}],"predecessor-version":[{"id":2591,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/2574\/revisions\/2591"}],"wp:attachment":[{"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.billows.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}