{"id":101390,"date":"2019-03-26T12:00:33","date_gmt":"2019-03-26T19:00:33","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=101390\/"},"modified":"2019-11-25T23:28:46","modified_gmt":"2019-11-26T07:28:46","slug":"born-this-way-origins-of-lockergoga","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/","title":{"rendered":"Born This Way? LockerGoga\u306e\u8d77\u6e90"},"content":{"rendered":"<h2>\u6982\u8981<\/h2>\n<p>\u3053\u306eUnit 42\u30d6\u30ed\u30b0\u3067\u306f\u3001LockerGoga\u3068\u547c\u3070\u308c\u308b\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u653b\u6483\u306b\u3064\u3044\u3066\u8003\u5bdf\u3057\u307e\u3059\u3002<\/p>\n<p>LockerGoga\u306f\u30011\u6708\u306bBleeping Computer\u304c\u6700\u521d\u306b\u5831\u544a\u3057\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3059\u3002\u540c\u793e\u306f\u5831\u544a\u306e\u306a\u304b\u3067\u5f53\u8a72\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u30d5\u30e9\u30f3\u30b9\u306e\u30a8\u30f3\u30b8\u30cb\u30a2\u30ea\u30f3\u30b0\u4f1a\u793eAltran Technologies\u306b\u5bfe\u3059\u308b\u653b\u6483\u3068\u7d50\u3073\u3064\u3051\u307e\u3057\u305f\u3002\u305d\u306e\u5f8c\u306f\u3044\u304f\u3064\u304b\u306e\u4e9c\u7a2e\u304c\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u3067\u767a\u898b\u3055\u308c\u3066\u304a\u308a\u3001\u305d\u308c\u3089\u306f\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005<a href=\"https:\/\/doublepulsar.com\/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880\">Norsk Hydro<\/a>\u306e\u307b\u304b\u30012\u3064\u306e\u5316\u5b66\u7cfb\u4f01\u696d<a href=\"https:\/\/www.wired.com\/story\/lockergoga-ransomware-crippling-industrial-firms\/\">Hexicon\u3001Momentive<\/a>\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>Unit 42\u3067\u3053\u308c\u3089\u306e\u653b\u6483\u3067\u5229\u7528\u3055\u308c\u305f\u30de\u30eb\u30a6\u30a7\u30a2\u30b5\u30f3\u30d7\u30eb\u3092\u30ec\u30d3\u30e5\u30fc\u3057\u305f\u3068\u3053\u308d\u3001\u8105\u5a01\u540d\u306e\u7531\u6765\u306b\u7591\u554f\u3092\u62b1\u304f\u30a8\u30d3\u30c7\u30f3\u30b9\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002Bleeping Computer\u306f\u300c\u3053\u306e\u8105\u5a01\u540d\u306fMalwareHunterTeam\u306e\u767a\u898b\u3057\u305f\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u306e\u30d1\u30b9\u306b\u7531\u6765\u3059\u308b\u300d\u3068\u5831\u544a\u3057\u3066\u3044\u305f\u306e\u3067\u3059\u304c\u300cLockerGoga\u300d\u3068\u3044\u3046\u6587\u5b57\u5217\u306fAltran Technologies\u3078\u306e\u6700\u521d\u306e\u653b\u6483\u3067\u4f7f\u7528\u3055\u308c\u305f\u30b3\u30fc\u30c9\u306e\u3069\u3053\u306b\u3082\u5b58\u5728\u3057\u3066\u3044\u306a\u304b\u3063\u305f\u306e\u3067\u3059\u3002<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">X:\\work\\Projects\\LockerGoga\\cl-src-last\\cryptopp\\src\\rijndael_simd.cpp for SHA-256 bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f<\/span><\/p>\n<p>\u3057\u304b\u3057\u306a\u304c\u3089\u3001Symantec\u304c\u5831\u544a\u3057\u305f<a href=\"https:\/\/www.virustotal.com\/gui\/file\/c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4\">Ransom.GoGalocker<\/a>\u3068\u3044\u3046\u540d\u524d\u3067\u8b58\u5225\u3055\u308c\u308b\u53e4\u3044\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u4e9c\u7a2e\u3067\u3001\u3053\u306e\u6587\u5b57\u5217\u304c\u53c2\u7167\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3057\u305f\u3002\u305f\u3060\u3057\u3053\u306e\u4e9c\u7a2e\u306fBleeping Computer\u306e\u5831\u544a\u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u308b\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u542b\u307e\u308c\u3066\u3044\u307e\u305b\u3093\u3002\u6df7\u4e71\u3092\u907f\u3051\u308b\u305f\u3081\u3001\u79c1\u305f\u3061\u306f\u521d\u671f\u306e\u4e9c\u7a2e\u3068\u305d\u306e\u4e9c\u7a2e\u306e\u7956\u5148\u3092LockerGoga\u306e\u547c\u79f0\u3067\u5f15\u304d\u7d9a\u304d\u53c2\u7167\u3059\u308b\u3053\u3068\u306b\u3057\u307e\u3059\u3002<\/p>\n<p>\u5f0a\u793e\u3067\u306f\u52d5\u4f5c\u3068\u30b3\u30fc\u30c9\u304c\u6700\u521d\u306e\u4e9c\u7a2e\u3068\u985e\u4f3c\u3057\u3066\u3044\u308b31\u500b\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u78ba\u8a8d\u3057\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u3001\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u8d77\u6e90\u3092\u3055\u304b\u306e\u307c\u308a\u3001\u305d\u306e\u9032\u5316\u306b\u3064\u3044\u3066\u8b70\u8ad6\u3057\u305f\u5f8c\u3001\u305d\u306e\u5185\u90e8\u7684\u306a\u6a5f\u80fd\u3068\u3001\u554f\u984c\u70b9\u306b\u3064\u3044\u3066\u660e\u3089\u304b\u306b\u3057\u3066\u3044\u304d\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002<\/p>\n<h2>\u6700\u521d\u306eLockerGoga\u30b5\u30f3\u30d7\u30eb<\/h2>\n<p>\u79c1\u305f\u3061\u304c\u898b\u3064\u3051\u305f\u6700\u3082\u53e4\u3044\u65e2\u77e5\u306eLockerGoga\u306e\u30b5\u30f3\u30d7\u30eb\uff08SHA-256\uff1abdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f\uff09\u306f2019\u5e741\u670824\u65e5\u306bVirusTotal\u306b\u63d0\u51fa\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u79c1\u305f\u3061\u306f\u3001\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u304cAltran Technologies\u3078\u306e\u653b\u6483\u306b\u4f7f\u7528\u3055\u308c\u305f\u3082\u306e\u3060\u3068\u8003\u3048\u3066\u3044\u307e\u3059\u3002\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u3069\u306e\u3088\u3046\u306b\u3057\u3066Altran Technologies\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u306b\u611f\u67d3\u3057\u305f\u306e\u304b\u3001\u611f\u67d3\u5f8c\u5185\u90e8\u3067\u62e1\u6563\u3057\u305f\u306e\u304b\u3069\u3046\u304b\u306b\u3064\u3044\u3066\u306f\u308f\u304b\u3063\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<h2>\u62e1\u6563<\/h2>\n<p>\u73fe\u5728\u306eLockerGoga\u306f\u3001\u6a19\u7684\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u306e\u3079\u3064\u306e\u30db\u30b9\u30c8\u306b\u611f\u67d3\u3059\u308b\u3053\u3068\u3067\u81ea\u5df1\u5897\u6b96\u3092\u3057\u3066\u3044\u304f\u30ef\u30fc\u30e0\u3068\u3057\u3066\u306e\u6a5f\u80fd\u306f\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u307e\u305b\u3093\u3002 LockerGoga\u304cSMB\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u4ecb\u3057\u3066\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u3092\u79fb\u52d5\u3059\u308b\u69d8\u5b50\u306f\u89b3\u6e2c\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304b\u3089\u3001\u653b\u6483\u8005\u306f\u5358\u7d14\u306b\u624b\u52d5\u3067\u30d5\u30a1\u30a4\u30eb\u3092\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u304b\u3089\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u306b\u30b3\u30d4\u30fc\u3057\u305f\u3053\u3068\u304c\u793a\u5506\u3055\u308c\u307e\u3059\u3002<\/p>\n<h2>LockerGoga\u306e\u7279\u5fb4<\/h2>\n<p>\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u6b63\u5e38\u306b\u5b9f\u884c\u3059\u308b\u306b\u306f\u7ba1\u7406\u8005\u7279\u6a29\u304c\u5fc5\u8981\u3067\u3059\u3002\u305f\u3060\u3057\u3001\u521d\u671f\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306e\u5177\u4f53\u7684\u306a\u30e1\u30ab\u30cb\u30ba\u30e0\u306f\u5206\u304b\u3063\u3066\u3044\u307e\u305b\u3093\u3002\u5b9f\u884c\u3055\u308c\u308b\u3068\u3001LockerGoga\u306f\u611f\u67d3\u3057\u305f\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3068\u63a5\u7d9a\u3055\u308c\u3066\u3044\u308b\u3059\u3079\u3066\u306e\u30cf\u30fc\u30c9\u30c9\u30e9\u30a4\u30d6\u4e0a\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u3059\u3079\u3066\u306e\u5b9f\u884c\u304c\u7d42\u308f\u308b\u3068\u3001\u30e6\u30fc\u30b6\u306e\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u306b\u8eab\u4ee3\u91d1\u30e1\u30e2\u3092\u6b8b\u3057\u307e\u3059\u3002\u3053\u306e\u8eab\u4ee3\u91d1\u30e1\u30e2\u306b\u306f\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u304c\u3075\u304f\u307e\u308c\u3066\u304a\u308a\u3001\u3053\u308c\u306f\u304a\u305d\u3089\u304f\u5fa9\u53f7\u5316\u3068\u652f\u6255\u3044\u306e\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u9023\u7d61\u3059\u308b\u305f\u3081\u306e\u3082\u306e\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n<p>\u6700\u521d\u306e\u30b5\u30f3\u30d7\u30eb\u306fC++\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u8a00\u8a9e\u3067\u66f8\u304b\u308c\u3066\u304a\u308a\u3001Boost\u3001Cryptopp\u3001regex\u306a\u3069\u306e\u30d1\u30d6\u30ea\u30c3\u30af\u306b\u5229\u7528\u53ef\u80fd\u306a\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u3001\u6b21\u306e\u30d5\u30a1\u30a4\u30eb\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u6697\u53f7\u5316\u304b\u3089\u9664\u5916\u3059\u308b\u305f\u3081\u306e\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>readme-now.txt<\/li>\n<li>ntsuser\u307e\u305f\u306fusrclass\u3067\u59cb\u307e\u308b\u30d5\u30a1\u30a4\u30eb<\/li>\n<li>\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u304c.dll, .lnk, .sys, .locked \u306e\u3082\u306e<\/li>\n<li>Microsoft\\Windows\\burn<\/li>\n<li>dat<\/li>\n<li>log<\/li>\n<\/ul>\n<p>\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u4e0a\u306e\u4ed6\u306e\u30db\u30b9\u30c8\u306b\u611f\u67d3\u3059\u308b\u305f\u3081\u306e\u81ea\u5df1\u5897\u6b96\u578b\u30b3\u30fc\u30c9\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u304a\u3089\u305a\u3001MIKL LIMITED\u3068\u3044\u3046\u540d\u524d\u3067\u767a\u884c\u3055\u308c\u305f\u8a3c\u660e\u66f8\u3067\u7f72\u540d\u3055\u308c\u3066\u3044\u307e\u3059\u304c\u3001\u3053\u306e\u8a3c\u660e\u66f8\u306f\u3059\u3067\u306b\u7121\u52b9\u5316\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u5f15\u6570\u3082\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 26.6212%;\">\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3<\/td>\n<td style=\"width: 72.6962%;\">\u8aac\u660e<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.6212%;\">-w<\/td>\n<td style=\"width: 72.6962%;\">Work\uff1a\u3053\u308c\u306f\u30c7\u30d5\u30a9\u30eb\u30c8\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u30d1\u30e9\u30e1\u30fc\u30bf\u3067\u3001\u30db\u30b9\u30c8\u4e0a\u306e\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3057\u307e\u3059\u3002\u307e\u305f\u3001c:\\wipe \u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u3001\u30c9\u30e9\u30a4\u30d6\u4e0a\u306e\u4f7f\u7528\u53ef\u80fd\u306a\u7a7a\u304d\u5bb9\u91cf\u3092\u540c\u3058\u30b5\u30a4\u30ba\u306e\u30e9\u30f3\u30c0\u30e0\u30c7\u30fc\u30bf\u3067\u3044\u3063\u3071\u3044\u306b\u3057\u3066\u7a7a\u304d\u5bb9\u91cf\u3092\u3059\u3079\u3066\u6d88\u53bb\u3057\u307e\u3059\u3002\u305d\u306e\u5f8c\u30d5\u30a1\u30a4\u30eb\u306f\u524a\u9664\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u5358\u4e00\u30d5\u30a1\u30a4\u30eb\u306e\u6697\u53f7\u5316\u306b\u3082\u4f7f\u7528\u3067\u304d\u307e\u3059\u3002\u4f8b\uff1a-w filename.exe<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.6212%;\">-r<\/td>\n<td style=\"width: 72.6962%;\">Dry Run:\u00a0 \u30db\u30b9\u30c8\u4e0a\u306e\u30d5\u30a1\u30a4\u30eb\u306f\u6697\u53f7\u5316\u3055\u308c\u307e\u305b\u3093\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.6212%;\">-l<\/td>\n<td style=\"width: 72.6962%;\">Log\uff1a\u30eb\u30fc\u30c8\u30c9\u30e9\u30a4\u30d6\u4e0a\u306bcl.log\u3068\u3044\u3046\u540d\u524d\u306e\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 26.6212%;\">-f<\/td>\n<td style=\"width: 72.6962%;\">File\uff1a\u5358\u4e00\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u307e\u3059\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u00a0\u00a0 \u88681 \u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u308b\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u5f15\u6570<\/em><\/p>\n<h2>\u6697\u53f7\u5316<\/h2>\n<p>LockerGoga\u306fCryptopp\u30e9\u30a4\u30d6\u30e9\u30ea\u3092\u4f7f\u7528\u3057\u3066RSA\u3092\u5b9f\u88c5\u3057\u3066\u3044\u307e\u3059\u3002RSA\u3092\u6700\u521d\u304b\u3089\u5b9f\u88c5\u3059\u308b\u306e\u306f\u975e\u5e38\u306b\u6642\u9593\u304c\u304b\u304b\u308a\u3001\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3057\u3084\u3059\u3044\u305f\u3081\u3067\u3059\u3002\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u306b\u3001\uff08\u5f37\u3044RSA\u3067\u3042\u308b\uff09RSA-OAEP MGF1\uff08SHA-1\uff09\u304c\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u3042\u308bRSA\u516c\u958b\u9375\u306f\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<table style=\"width: 779px;\" width=\"623\">\n<tbody>\n<tr>\n<td style=\"width: 769.6px;\"><span style=\"font-family: 'courier new', courier, monospace;\">00000000\u00a0\u00a0 4D 49 47 64 4D 41 30 47\u00a0 43 53 71 47 53 49 62 33\u00a0\u00a0 MIGdMA0GCSqGSIb3<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000016\u00a0\u00a0 44 51 45 42 41 51 55 41\u00a0 41 34 47 4C 41 44 43 42\u00a0\u00a0 DQEBAQUAA4GLADCB<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000032\u00a0\u00a0 68 77 4B 42 67 51 43 46\u00a0 66 33 43 54 59 79 41 79\u00a0\u00a0 hwKBgQCFf3CTYyAy<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000048\u00a0\u00a0 6F 79 5A 71 52 33 6E 48\u00a0 63 4C 4A 2B 49 2F 71 69 \u00a0\u00a0oyZqR3nHcLJ+I\/qi<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000064\u00a0\u00a0 2F 50 57 77 57 54 75 6C\u00a0 20 6C 4D 69 4E 32 54 47\u00a0\u00a0 \/PWwWTul lMiN2TG<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000080\u00a0\u00a0 4D 41 4D 62 34 39 75 58\u00a0 51 32 79 43 34 4D 5A 76\u00a0\u00a0 MAMb49uXQ2yC4MZv<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000096\u00a0\u00a0 5A 76 4B 53 50 55 44 6F\u00a0 33 61 4D 67 5A 4A 71 30\u00a0\u00a0 ZvKSPUDo3aMgZJq0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000112\u00a0\u00a0 78 75 52 53 42 34 58 6F\u00a0 73 6D 73 30 5A 39 51 4B\u00a0\u00a0 xuRSB4Xosms0Z9QK<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000128\u00a0\u00a0 70 76 47 6C 6A 4E 48 36\u00a0 79 34 50 59 4E 39 38 2F\u00a0\u00a0 pvGljNH6y4PYN98\/<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000144\u00a0\u00a0 76 20 79 31 7A 4F 6B 34\u00a0 70 45 69 53 68 43 32 49\u00a0\u00a0 v y1zOk4pEiShC2I<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000160\u00a0\u00a0 47 46 50 4A 32 47 71 33\u00a0 4F 63 2B 41 78 4F 37 57\u00a0\u00a0 GFPJ2Gq3Oc+AxO7W<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000176\u00a0\u00a0 6F 2F 62 42 76 35 34 32\u00a0 52 51 30 67 50 55 77 7A\u00a0\u00a0 o\/bBv542RQ0gPUwz<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000192\u00a0\u00a0 79 54 53 66 71 6A 44 47\u00a0 35 33 35 73 38 57 73 76\u00a0\u00a0 yTSfqjDG535s8Wsv<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000208\u00a0\u00a0 4B 73 79 77 49 42 45 51\u00a0 3D 3D\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 KsywIBEQ==<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88682 \u521d\u671f\u306eLockerGoga\u30b5\u30f3\u30d7\u30eb\u3067\u898b\u3064\u304b\u3063\u305fRSA\u516c\u958b\u9375<\/em><\/p>\n<p>RSA-OAEP MGF1\u306b\u306f\u3088\u308a\u6697\u53f7\u5316\u3092\u5b89\u5168\u306b\u3059\u308b\u305f\u3081\u306e\u6a5f\u80fd\u304c\u3042\u308a\u307e\u3059\u304c\u3001\u8a08\u7b97\u6642\u30aa\u30fc\u30d0\u30fc\u30d8\u30c3\u30c9\u304c\u5897\u3048\u308b\u305f\u3081\u305d\u306e\u5206\u6697\u53f7\u5316\u306b\u6642\u9593\u304c\u304b\u304b\u308a\u3001\u5927\u304d\u306a\u30d5\u30a1\u30a4\u30eb\u3092\u6271\u3046\u306e\u304c\u56f0\u96e3\u3067\u3059\u3002\u3053\u308c\u3092\u8efd\u6e1b\u3059\u308b\u305f\u3081\u3001\u958b\u767a\u8005\u306f\u4e26\u884c\u3057\u3066\u52d5\u4f5c\u3059\u308b\u8907\u6570\u306e\u5b50\u30d7\u30ed\u30bb\u30b9\u3092\u751f\u6210\u3057\u3066\u6697\u53f7\u5316\u901f\u5ea6\u3092\u6700\u5927\u5316\u3057\u3066\u3044\u307e\u3059\u3002\u307e\u305f\u3001\u30b5\u30a4\u30ba\u306e\u5927\u304d\u3044\u30d5\u30a1\u30a4\u30eb\u306b\u304b\u304b\u308b\u6642\u9593\u3092\u77ed\u304f\u3059\u308b\u305f\u3081\u300180,000\u30d0\u30a4\u30c8\u3054\u3068\u306b\u30d5\u30a1\u30a4\u30eb\u306e\u30c1\u30e3\u30f3\u30af\u3092\u6697\u53f7\u5316\u3057\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u6b21\u306e80,000\u30d0\u30a4\u30c8\u3092\u30b9\u30ad\u30c3\u30d7\u3059\u308b\u3053\u3068\u306b\u306a\u3063\u3066\u3044\u307e\u3057\u305f\u3002\u4f8b\uff1a<\/p>\n<figure id=\"attachment_101393\" aria-describedby=\"caption-attachment-101393\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101393 size-large lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-1024x518.png\" alt=\"\u56f31 80,000\u30d0\u30a4\u30c8\u306e\u30c1\u30e3\u30f3\u30af\u3067\u6697\u53f7\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf\" width=\"1024\" height=\"518\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-1024x518.png 1024w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-300x152.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-768x389.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-900x456.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186-370x187.png 370w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-186.png 1657w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-101393\" class=\"wp-caption-text\">\u56f31 80,000\u30d0\u30a4\u30c8\u306e\u30c1\u30e3\u30f3\u30af\u3067\u6697\u53f7\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf<\/figcaption><\/figure>\n<p>\u3053\u306e\u305f\u3081\u3001\u5fa9\u53f7\u5316\u30ad\u30fc\u304c\u306a\u304f\u3066\u3082\u3001\u5927\u304d\u306a\u30d5\u30a1\u30a4\u30eb\u306e\u90e8\u5206\u7684\u306a\u30ea\u30ab\u30d0\u30ea\u306f\u53ef\u80fd\u306b\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u958b\u767a\u8005\u306f\u30d5\u30a1\u30a4\u30eb\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\u3092\u4f7f\u7528\u3057\u3066\u30b9\u30ad\u30c3\u30d7\u3057\u3088\u3046\u3068\u3057\u3066\u3044\u307e\u3059\u304c\u3001Windows\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u306e\u30b3\u30a2\u30d5\u30a1\u30a4\u30eb\u3082\u6697\u53f7\u5316\u3055\u308c\u308b\u305f\u3081\u3001\u30aa\u30da\u30ec\u30fc\u30c6\u30a3\u30f3\u30b0\u30b7\u30b9\u30c6\u30e0\u304c\u4e0d\u5b89\u5b9a\u306b\u306a\u308a\u3001\u30af\u30e9\u30c3\u30b7\u30e5\u3057\u307e\u3059\u3002\u3053\u306e\u69d8\u5b50\u306fWindows 2012\u3092\u642d\u8f09\u3057\u305f\u30b3\u30f3\u30d4\u30e5\u30fc\u30bf\u3067\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u5b9f\u884c\u3057\u3066\u3044\u308b\u3068\u304d\u306b\u89b3\u6e2c\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<h2>\u521d\u671f\u306e\u958b\u767a<\/h2>\n<p>\u79c1\u305f\u3061\u306f\u5206\u6790\u7d50\u679c\u304b\u3089\u3053\u306e\u4e9c\u7a2e\u304cLockerGoga\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u521d\u671f\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u3082\u306e\u3068\u8003\u3048\u3066\u3044\u307e\u3059\u3002\u958b\u767a\u8005\u306f\u3001\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u6697\u53f7\u5316\u305b\u305a\u306b\u5b9f\u884c\u3059\u308b\u3053\u3068\u3092\u53ef\u80fd\u306b\u3059\u308b-r\u306a\u3069\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u30d1\u30e9\u30e1\u30fc\u30bf\u3092\u6b8b\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u3092-l\uff08log\uff09\u3068\u7d44\u307f\u5408\u308f\u305b\u3066\u4f7f\u7528\u3059\u308b\u3068\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u52d5\u4f5c\u3092\u30c6\u30b9\u30c8\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306f\u4e21\u65b9\u3068\u3082\u3001\u521d\u671f\u30d3\u30eb\u30c9\u3001\u3064\u307e\u308a\u30c6\u30b9\u30c8\u30d3\u30eb\u30c9\u3067\u3042\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u3068\u304f\u306b\u5f8c\u306e\u4e9c\u7a2e\u306b\u306f-r\u306f\u898b\u3089\u308c\u307e\u305b\u3093\u3067\u3057\u305f\u3002<\/p>\n<p>Bleeping Computer\u306e\u5831\u544a\u306b\u3088\u308c\u3070\u3001\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306f\u6b21\u306e\u7279\u5b9a\u306e\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u306e\u307f\u3092\u6697\u53f7\u5316\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf<\/p>\n<p>\u307e\u305f\u5206\u6790\u304b\u3089\u306f\u3001\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u304c\u7279\u5b9a\u306e\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3092\u30c1\u30a7\u30c3\u30af\u3059\u308b\u30b3\u30fc\u30c9\u30d6\u30ed\u30c3\u30af\u3092\u4f7f\u7528\u3057\u3066\u304a\u3089\u305a\u3001\u30d6\u30e9\u30c3\u30af\u30ea\u30b9\u30c8\u306b\u3042\u308b\u30d5\u30a1\u30a4\u30eb\u4ee5\u5916\u306e\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3059\u308b\u3053\u3068\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u307e\u305f\u3053\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306f\u30b5\u30a4\u30ba\u306e\u5927\u304d\u3044\u30d5\u30a1\u30a4\u30eb\u306b\u3064\u3044\u3066\u3082\u554f\u984c\u3092\u62b1\u3048\u3066\u3044\u307e\u3057\u305f\u3002\u305f\u3060\u3057\u3053\u308c\u306f\u5f8c\u306e\u4e9c\u7a2e\u3067\u306f\u4fee\u6b63\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h2>\u958b\u767a\u30b5\u30a4\u30af\u30eb<\/h2>\n<p>\u4ed6\u306e\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u540c\u69d8\u3001LockerGoga\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u958b\u767a\u3082\u7d99\u7d9a\u7684\u306b\u884c\u308f\u308c\u3066\u304a\u308a\u3001\u65b0\u3057\u3044\u4e9c\u7a2e\u304c\u958b\u767a\u3055\u308c\u3066\u306f\u88ab\u5bb3\u8005\u306e\u653b\u6483\u306b\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u4e9c\u7a2e\u306f\u3059\u3079\u3066\u5171\u901a\u3059\u308b\u7279\u6027\u3092\u6709\u3057\u3066\u304a\u308a\u3001\u5546\u7528\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u3067\u306e\u958b\u767a\u540c\u69d8\u306b\u3001\u5404\u30ea\u30ea\u30fc\u30b9\u306b\u306f\u6539\u5584\u70b9\u3084\u65b0\u6a5f\u80fd\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u7d99\u7d9a\u3059\u308b\u958b\u767a\u30b5\u30a4\u30af\u30eb\u306b\u5bfe\u6297\u3059\u308b\u305f\u3081\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u30e3\u30fc\u306f\u65b0\u3057\u3044\u4e9c\u7a2e\u306e\u8b58\u5225\u306b\u96c6\u4e2d\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<p>\u305d\u306e\u305f\u3081\u30011\u6708\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u306e\u51fa\u73fe\u4ee5\u964d\u306b\u898b\u3089\u308c\u305f\u9032\u5316\u306e\u5909\u5316\u306e\u3044\u304f\u3064\u304b\u306b\u3064\u3044\u3066\u3053\u3053\u3067\u5f37\u8abf\u3057\u3066\u304a\u304d\u305f\u3044\u3068\u601d\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>-r\u3068-f\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u5f15\u6570\u304c\u524a\u9664\u3055\u308c\u305f<\/li>\n<li>\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u540d\u304ccl.log\u304b\u3089.log\u306b\u5909\u66f4\u3055\u308c\u305f<\/li>\n<li>\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u8eab\u4ee3\u91d1\u8981\u6c42\u30e1\u30e2\u306f\u30d0\u30a4\u30ca\u30ea\u3067\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u306a\u304f\u306a\u3063\u305f<\/li>\n<li>\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306e\u8eab\u4ee3\u91d1\u8981\u6c42\u30e1\u30e2\u304cREADME_NOW.txt\u304b\u3089README_LOCKED.TXT\u306b\u6539\u540d\u3055\u308c\u305f<\/li>\n<li>\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u8ffd\u52a0\u3055\u308c\u305f<\/li>\n<\/ul>\n<table>\n<tbody>\n<tr>\n<td>\u30d1\u30e9\u30e1\u30fc\u30bf<\/td>\n<td>\u8aac\u660e<\/td>\n<\/tr>\n<tr>\n<td>-i<\/td>\n<td>\u30d7\u30ed\u30bb\u30b9\u9593\u901a\u4fe1\uff08IPC\uff09<\/td>\n<\/tr>\n<tr>\n<td>-s<\/td>\n<td>\u30b9\u30ec\u30fc\u30d6\uff08\u5b50\u30d7\u30ed\u30bb\u30b9\uff09<\/td>\n<\/tr>\n<tr>\n<td>-m<\/td>\n<td>\u30de\u30b9\u30bf\u30fc\u30d7\u30ed\u30bb\u30b9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<ul>\n<li>\u30d7\u30ed\u30bb\u30b9\u9593\u901a\u4fe1\u7528\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u8b58\u5225\u3059\u308b\u305f\u3081mutex\uff08\u4f8b\uff1aSM-zzbdrimp\uff09\u306e\u4f7f\u7528\u3092\u958b\u59cb\u3057\u305f<\/li>\n<li>\u30d7\u30ed\u30bb\u30b9\u540d\u3068\u3057\u3066svch0st[\u6570\u5024].exe\u3092\u4f7f\u7528\u3059\u308b\u306e\u3092\u3084\u3081\u3001\u30b5\u30f3\u30d7\u30eb\u3054\u3068\u306b\u7570\u306a\u308b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u305f\u540d\u524d\u3092\u4f7f\u7528\u3057\u59cb\u3081\u305f<\/li>\n<li>\u6587\u66f8\u5316\u3055\u308c\u3066\u3044\u306a\u3044Windows API\u547c\u3073\u51fa\u3057\u3092\u5229\u7528\u3059\u308b\uff08NtQuerySection\u306a\u3069\uff09<\/li>\n<li>\u7ba1\u7406\u8005\u30d1\u30b9\u30ef\u30fc\u30c9\u3092HuHuHUHoHo283283@dJD\u306b\u5909\u66f4\u3059\u308b<\/li>\n<li>\u7a7a\u304d\u9818\u57df\u3092\u6d88\u53bb\u3059\u308b\u305f\u3081\u306e\u30ef\u30a4\u30d7\u30d5\u30a1\u30a4\u30eb\u306e\u4f5c\u6210\u3092\u4e2d\u6b62\u3057\u3001\u4ee3\u308f\u308a\u306bWindows cipher.exe\u3092\u30b3\u30de\u30f3\u30c9\u30d1\u30e9\u30e1\u30fc\u30bf\/ w\u3068\u5171\u306b\u4f7f\u7528\u3057\u3066\u30db\u30b9\u30c8\u4e0a\u306e\u7a7a\u304d\u9818\u57df\u3092\u30ef\u30a4\u30d7\u3059\u308b<\/li>\n<li>WS2_32.dll\u306e\u30a4\u30f3\u30dd\u30fc\u30c8\u3092\u8ffd\u52a0\u3001\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u901a\u4fe1\u3092\u30b5\u30dd\u30fc\u30c8\u3059\u308b\u305f\u3081\u304b<\/li>\n<li>\u30ed\u30b0\u30d5\u30a1\u30a4\u30eb\u306b\u8a18\u9332\u3055\u308c\u308b\u30c7\u30fc\u30bf\u306e\u5f62\u5f0f\u3068\u53ce\u96c6\u5185\u5bb9\u3092\u5909\u66f4<\/li>\n<li>\u30d5\u30a1\u30a4\u30eb\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306e\u6697\u53f7\u5316\u3092\u66f4\u65b0\u30db\u30b9\u30c8\u4e0a\u306e\u3059\u3079\u3066\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3059\u308b\u304b\u308f\u308a\u306b\u7279\u5b9a\u306e\u30d5\u30a1\u30a4\u30eb\u62e1\u5f35\u5b50\u3068\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u3092\u6a19\u7684\u306b\u3059\u308b<\/li>\n<li>Windows Restart Manager\u30bb\u30c3\u30b7\u30e7\u30f3\u3092\u547c\u3073\u51fa\u3059\u3002\u30c8\u30fc\u30af\u30f3\u6607\u683c\u3067\u4fe1\u983c\u3055\u308c\u305f\u30a4\u30f3\u30b9\u30c8\u30fc\u30e9\u30d5\u30a1\u30a4\u30eb\u3092\u4e0a\u66f8\u304d\u3059\u308b\u3053\u3068\u3092\u72d9\u3063\u305f\u3082\u306e\u304b<\/li>\n<li>\u6b21\u306e\u30c7\u30b8\u30bf\u30eb\u7f72\u540d\u8005\u3092\u4f7f\u7528\u3059\u308b\n<ul>\n<li>ALISA LTD<\/li>\n<li>KITTY'S LTD<\/li>\n<li>MIKL LIMITED<\/li>\n<\/ul>\n<\/li>\n<li>\u73fe\u5728\u306e\u30e6\u30fc\u30b6\u30fc\u3092\u30ed\u30b0\u30aa\u30d5\u3059\u308b<\/li>\n<li>\u30d0\u30a4\u30ca\u30ea\u30d5\u30a1\u30a4\u30eb\u3068\u6697\u53f7\u5316\u30d5\u30a1\u30a4\u30eb\u306b\u300cGoga\u300d\u3068\u3044\u3046\u5358\u8a9e\u304c\u542b\u307e\u308c\u308b<\/li>\n<\/ul>\n<h2>\u7d50\u8ad6<\/h2>\n<p>LockerGoga\u306e\u958b\u767a\u8005\u306f\u6a5f\u80fd\u3092\u7d76\u3048\u305a\u8ffd\u52a0\u3057\u3066\u65b0\u3057\u3044\u653b\u6483\u3092\u958b\u59cb\u3057\u3066\u3044\u307e\u3059\u3002WS2_32.dll\u306e\u8ffd\u52a0\u3001\u6587\u66f8\u5316\u3055\u308c\u3066\u3044\u306a\u3044Windows API\u547c\u3073\u51fa\u3057\u306e\u4f7f\u7528\u306f\u3001\u5178\u578b\u7684\u306a\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u958b\u767a\u8005\u306e\u30ec\u30d9\u30eb\u3092\u8d85\u3048\u305f\u9ad8\u5ea6\u306a\u6280\u80fd\u3092\u793a\u3059\u3082\u306e\u3067\u3059\u3002WS2_32.dll\u306e\u8ffd\u52a0\u306fC2\u901a\u4fe1\u3084\u81ea\u52d5\u62e1\u6563\u3092\u6700\u7d42\u7684\u306b\u542b\u3081\u308b\u305f\u3081\u3068\u3044\u3046\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3057\u3001\u6587\u66f8\u5316\u3055\u308c\u3066\u3044\u306a\u3044Windows API\u547c\u3073\u51fa\u3057\u306e\u4f7f\u7528\u306fWindows\u306e\u5185\u90e8\u306b\u95a2\u3059\u308b\u3042\u308b\u7a0b\u5ea6\u306e\u5b9f\u7528\u7684\u306a\u77e5\u8b58\u3092\u5fc5\u8981\u3068\u3057\u307e\u3059\u3002<\/p>\n<p>\u4e00\u822c\u7684\u306b\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u306f\u3055\u307b\u3069\u9ad8\u5ea6\u306a\u30de\u30eb\u30a6\u30a7\u30a2\u3067\u306f\u306a\u3044\u3053\u3068\u304c\u591a\u3044\u306e\u3067\u3001\u3053\u3046\u3057\u305f\u6a5f\u80fd\u306e\u8ffd\u52a0\u304c\u898b\u3089\u308c\u308b\u3068\u3044\u3046\u4e8b\u5b9f\u306f\u3001\u653b\u6483\u8005\u306e\u610f\u56f3\u306b\u3064\u3044\u3066\u306e\u3055\u3089\u306a\u308b\u7591\u554f\u3092\u751f\u3058\u3055\u305b\u307e\u3059\u3002\u52d5\u6a5f\u304c\u6642\u9593\u306e\u7d4c\u904e\u3068\u3068\u3082\u306b\u5909\u308f\u3063\u305f\u306e\u3067\u3057\u3087\u3046\u304b\u3002\u958b\u767a\u8005\u306f\u306a\u305c\u3001\u90e8\u5206\u7684\u306b\u30d5\u30a1\u30a4\u30eb\u3092\u6697\u53f7\u5316\u3059\u308b\u305f\u3081\u3060\u3051\u306b\u305d\u308c\u307b\u3069\u307e\u306e\u52aa\u529b\u3092\u8cbb\u3084\u3059\u306e\u3067\u3057\u3087\u3046\u304b\u3002\u306a\u305c\u5f7c\u3089\u306f\u96fb\u5b50\u30e1\u30fc\u30eb\u30a2\u30c9\u30ec\u30b9\u3092\u542b\u3081\u308b\u3060\u3051\u3067\u3001\u3088\u308a\u983b\u7e41\u306b\u4f7f\u308f\u308c\u308b\u6697\u53f7\u901a\u8ca8\u3067\u306e\u652f\u6255\u3044\u3092\u6c42\u3081\u306a\u3044\u306e\u3067\u3057\u3087\u3046\u304b\u3002<\/p>\n<p>\u88ab\u5bb3\u8005\u306e\u3044\u305a\u308c\u304b\u304c\u8eab\u4ee3\u91d1\u3092\u652f\u6255\u3044\u3001\u30c7\u30fc\u30bf\u3092\u6b63\u5e38\u306b\u53d6\u5f97\u3067\u304d\u305f\u304b\u3069\u3046\u304b\u306f\u308f\u304b\u308a\u307e\u305b\u3093\u3002\u305f\u3060\u3057\u3001\u3053\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u304c\u91cd\u5927\u306a\u88ab\u5bb3\u3092\u3082\u305f\u3089\u3057\u305f\u3053\u3068\u306f\u308f\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u653b\u6483\u8005\u304c\u3053\u306e\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3092\u6539\u826f\u3057\u7d9a\u3051\u308c\u3070\u3001\u88ab\u5bb3\u306f\u3088\u308a\u751a\u5927\u306a\u3082\u306e\u306b\u306a\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002Unit 42\u306f\u5f15\u304d\u7d9a\u304dLockerGoga\u3092\u76e3\u8996\u3057\u3001\u65b0\u3057\u3044\u6d3b\u52d5\u306b\u3064\u3044\u3066\u5831\u544a\u3057\u307e\u3059\u3002<\/p>\n<p>WildFire\u306f\u3001\u672c\u7a3f\u306b\u8a18\u8f09\u3057\u305f\u3059\u3079\u3066\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u30b5\u30f3\u30d7\u30eb\u3092\u60aa\u610f\u306e\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u6b63\u3057\u304f\u8b58\u5225\u3057\u307e\u3059\u3002Traps\u306fLockerGoga\u30b5\u30f3\u30d7\u30eb\u306e\u5b9f\u884c\u3092\u9632\u6b62\u3057\u3001AutoFocus\u3092\u304a\u4f7f\u3044\u306e\u304a\u5ba2\u69d8\u306fLockerGoga\u30b5\u30f3\u30d7\u30eb\u3092<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.LockerGoga\">LockerGoga<\/a>\u30bf\u30b0\u3067\u8ffd\u8de1\u3067\u304d\u307e\u3059\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u672c\u7a3f\u3067\u898b\u3064\u304b\u3063\u305f\u30d5\u30a1\u30a4\u30eb\u30b5\u30f3\u30d7\u30eb\u3084\u4fb5\u5bb3\u306e\u5146\u5019\u306a\u3069\u3092\u3075\u304f\u3080\u8abf\u67fb\u7d50\u679c\u3092Cyber Threat Alliance(CTA \u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9)\u306e\u30e1\u30f3\u30d0\u30fc\u3068\u5171\u6709\u3057\u307e\u3057\u305f\u3002CTA \u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3053\u306e\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3001\u304a\u5ba2\u69d8\u306b\u4fdd\u8b77\u3092\u8fc5\u901f\u306b\u63d0\u4f9b\u3057\u3001\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u8005\u3092\u4f53\u7cfb\u7684\u306b\u963b\u5bb3\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002Cyber Threat Alliance\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u6b21\u306eWeb\u30b5\u30a4\u30c8\u3092\u3054\u89a7\u304f\u3060\u3055\u3044: <a href=\"https:\/\/www.cyberthreatalliance.org\">www.cyberthreatalliance.org<\/a><\/p>\n<h2>IOC<\/h2>\n<h3>LockerGoga\u306e\u30b5\u30f3\u30d7\u30eb<\/h3>\n<ul>\n<li>ae7e9839b7fb750128147a9227d3733dde2faacd13c478e8f4d8d6c6c2fc1a55<\/li>\n<li>f474a8c0f66dee3d504fff1e49342ee70dd6f402c3fa0687b15ea9d0dd15613a<\/li>\n<li>ffab69deafa647e2b54d8daf8c740b559a7982c3c7c1506ac6efc8de30c37fd5<\/li>\n<li>c1670e190409619b5a541706976e5a649bef75c75b4b82caf00e9d85afc91881<\/li>\n<li>65d5dd067e5550867b532f4e52af47b320bd31bc906d7bf5db889d0ff3f73041<\/li>\n<li>31fdce53ee34dbc8e7a9f57b30a0fbb416ab1b3e0c145edd28b65bd6794047c1<\/li>\n<li>32d959169ab8ad7e9d4bd046cdb585036c71380d9c45e7bb9513935cd1e225b5<\/li>\n<li>e00a36f4295bb3ba17d36d75ee27f7d2c20646b6e0352e6d765b7ac738ebe5ee<\/li>\n<li>6d8f1a20dc0b67eb1c3393c6c7fc859f99a12abbca9c45dcbc0efd4dc712fb7c<\/li>\n<li>79c11575f0495a3daaf93392bc8134c652360c5561e6f32d002209bc41471a07<\/li>\n<li>050b4028b76cd907aabce3d07ebd9f38e56c48c991378d1c65442f9f5628aa9e<\/li>\n<li>1f9b5fa30fd8835815270f7951f624698529332931725c1e17c41fd3dd040afe<\/li>\n<li>276104ba67006897630a7bdaa22343944983d9397a538504935f2ec7ac10b534<\/li>\n<li>88d149f3e47dc337695d76da52b25660e3a454768af0d7e59c913995af496a0f<\/li>\n<li>c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15<\/li>\n<li>06e3924a863f12f57e903ae565052271740c4096bd4b47c38a9604951383bcd1<\/li>\n<li>a845c34b0f675827444d6c502c0c461ed4445a00d83b31d5769646b88d7bbedf<\/li>\n<li>7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26<\/li>\n<li>ba15c27f26265f4b063b65654e9d7c248d0d651919fafb68cb4765d1e057f93f<\/li>\n<li>eda26a1cd80aac1c42cdbba9af813d9c4bc81f6052080bc33435d1e076e75aa0<\/li>\n<li>7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125<\/li>\n<li>14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca<\/li>\n<li>47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4<\/li>\n<li>f3c58f6de17d2ef3e894c09bc68c0afcce23254916c182e44056db3cad710192<\/li>\n<li>9128e1c56463b3ce7d4578ef14ccdfdba15ccc2d73545cb541ea3e80344b173c<\/li>\n<li>c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a<\/li>\n<li>6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77<\/li>\n<li>8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29<\/li>\n<li>bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f<\/li>\n<li>5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c<\/li>\n<li>c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4<\/li>\n<\/ul>\n<h2>\u4ed8\u9332<\/h2>\n<p>LockerGoga\u306e\u6700\u65b0\u306e\u4e9c\u7a2e\u306f\u3001\u30d7\u30ed\u30bb\u30b9\u9593\u901a\u4fe1\u306b\u30e1\u30e2\u30ea\u30de\u30c3\u30d7\u30d5\u30a1\u30a4\u30eb\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u3053\u308c\u3092\u8aac\u660e\u3059\u308b\u305f\u3081\u306b\u3001\u5b50\u30d7\u30ed\u30bb\u30b9\u306b\u3088\u3063\u3066\u4f5c\u6210\u3055\u308c\u305f\u30bb\u30af\u30b7\u30e7\u30f3\u306e\u30e1\u30e2\u30ea\u3092\u30ad\u30e3\u30d7\u30c1\u30e3\u3057\u307e\u3057\u305f\u3002<\/p>\n<table style=\"width: 785px;\" width=\"623\">\n<tbody>\n<tr>\n<td style=\"width: 776px;\"><span style=\"font-family: 'courier new', courier, monospace;\">00000000\u00a0\u00a0 02 00 00 00 00 00 00 00\u00a0 00 00 00 00 01 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000016\u00a0\u00a0 D0 02 01 00 CC 02 01 00\u00a0 C8 02 01 00 30 00 00 00\u00a0\u00a0 \u00d0\u00a0\u00a0 \u00cc\u00a0\u00a0 \u00c8\u00a0\u00a0 0\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000032\u00a0\u00a0 80 02 01 00 F8 FF 0F 00\u00a0 00 00 00 00 00 00 00 00\u00a0\u00a0 \u20ac\u00a0\u00a0 \u00f8\u00ff\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000048\u00a0\u00a0 FF FF FF FF 00 00 00 00\u00a0 01 00 00 00 24 00 00 00\u00a0\u00a0 \u00ff\u00ff\u00ff\u00ff\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000064\u00a0\u00a0 20 00 00 00 1C 00 00 00\u00a0 00 00 00 00 01 00 00 00\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000080\u00a0\u00a0 FC FF FF FF F8 FF FF FF\u00a0 F4 FF 01 00 0B 20 00 C0\u00a0\u00a0 \u00fc\u00ff\u00ff\u00ff\u00f8\u00ff\u00ff\u00ff\u00f4\u00ff\u00a0\u00a0\u00a0\u00a0 \u00c0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000096\u00a0\u00a0 DE FF FF FF 01 00 00 00\u00a0 01 00 00 00 38 00 01 00\u00a0\u00a0 \u00de\u00ff\u00ff\u00ff\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 8\u00a0\u00a0<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000112\u00a0\u00a0 01 00 04 21 10 01 00 00\u00a0 00 00 00 00 00 7A 70 63\u00a0\u00a0\u00a0\u00a0\u00a0 !\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 zpc<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000128\u00a0\u00a0 55 48 4A 76 5A 33 4A 68\u00a0 62 53 42 47 61 57 78 6C\u00a0\u00a0 UHJvZ3JhbSBGaWxl<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000144\u00a0\u00a0 63 31 78 57 54 58 64 68\u00a0 63 6D 56 63 56 6B 31 33\u00a0\u00a0 c1xWTXdhcmVcVk13<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000160\u00a0\u00a0 59 58 4A 6C 49 46 52 76\u00a0 62 32 78 7A 58 47 64 73\u00a0\u00a0 YXJlIFRvb2xzXGds<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000176\u00a0\u00a0 61 57 49 74 4D 69 34 77\u00a0 4C 6D 52 73 62 41 3D 3D\u00a0\u00a0 aWItMi4wLmRsbA==<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000192\u00a0\u00a0 64 48 42 6A 63 48 4D 75\u00a0 5A 47 78 73 63 6D 56 7A\u00a0\u00a0 dHBjcHMuZGxscmVz<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000208\u00a0\u00a0 65 43 35 6B 62 47 77 75\u00a0 62 58 56 70 4E 46 39 66\u00a0\u00a0 eC5kbGwubXVpNF9f<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000224\u00a0\u00a0 4F 48 64 6C 61 33 6C 69\u00a0 4D 32 51 34 59 6D 4A 33\u00a0\u00a0 OHdla3liM2Q4YmJ3<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000240\u00a0\u00a0 5A 54 68 68 5A 44 46 68\u00a0 4E 7A 51 77 4C 54 52 68\u00a0\u00a0 ZThhZDFhNzQwLTRh<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000256\u00a0\u00a0 4E 32 59 74 4E 47 45 78\u00a0 59 53 30 35 4F 54 45 78\u00a0\u00a0 N2YtNGExYS05OTEx<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000272\u00a0\u00a0 4C 54 51 79 4D 57 51 30\u00a0 4D 6A 49 34 4D 7A 52 6C\u00a0\u00a0 LTQyMWQ0MjI4MzRl<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000288\u00a0\u00a0 5A 46 78 42 63 33 4E 6C\u00a0 64 48 4E 63 55 6D 56 7A\u00a0\u00a0 ZFxBc3NldHNcUmVz<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000304\u00a0\u00a0 62 33 56 79 59 32 56 7A\u00a0 58 46 4A 6C 63 58 56 70\u00a0\u00a0 b3VyY2VzXFJlcXVp<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000320\u00a0\u00a0 63 6D 56 6B 55 48 4A 70\u00a0 62 6E 52 44 59 58 42 68\u00a0\u00a0 cmVkUHJpbnRDYXBh<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000336\u00a0\u00a0 59 6D 6C 73 61 58 52 70\u00a0 5A 58 4D 75 65 47 31 73\u00a0\u00a0 YmlsaXRpZXMueG1s<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000352\u00a0\u00a0 65 6D 55 74 4E 44 68 66\u00a0 59 57 78 30 5A 6D 39 79\u00a0\u00a0 emUtNDhfYWx0Zm9y<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000368\u00a0\u00a0 62 53 31 31 62 6E 42 73\u00a0 59 58 52 6C 5A 43 35 77\u00a0\u00a0 bS11bnBsYXRlZC5w<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000384\u00a0\u00a0 62 6D 63 3D 62 53 31 31\u00a0 62 6E 42 73 59 58 52 6C\u00a0\u00a0 bmc=bS11bnBsYXRl<\/span><\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">00000400\u00a0\u00a0 5A 43 35 77 62 6D 63 3D\u00a0 00 00 00 00 00 00 00 00\u00a0\u00a0 ZC5wbmc=\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88683 \u5b50\u30d7\u30ed\u30bb\u30b9\u306e\u30e1\u30e2\u30ea\u30de\u30c3\u30d7\u30d5\u30a1\u30a4\u30eb<\/em><br \/>\n<em>\u00a0<\/em><\/p>\n<p>1\u30d0\u30a4\u30c8\u76ee(02)\u306f\u3001\u30de\u30b9\u30bf\u30fc\u30d7\u30ed\u30bb\u30b9\u306b\u4ee5\u4e0b\u306e\u30c7\u30fc\u30bf\u3092\u51e6\u7406\u3059\u308b\u3088\u3046\u306b\u6307\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u30c7\u30fc\u30bf\u306fbase64\u30673\u3064\u306e\u90e8\u5206\u306b\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u3001\u6b21\u306e\u3088\u3046\u306b\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u307e\u3059\u3002<\/p>\n<p>\u30d1\u30fc\u30c81\uff1a<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">Unknown value<\/span><\/p>\n<p>\u30d1\u30fc\u30c82\uff1a<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">tpcps.dllresx.dll.mui4__8wekyb3d8bbwe8ad1a740-4a7f-4a1a-9911-421d422834ed\\Assets\\Resources\\RequiredPrintCapabilities.xmlze-48_altform-unplated.png<\/span><\/p>\n<p>\u30d1\u30fc\u30c83\uff1a<\/p>\n<p><span style=\"font-family: 'courier new', courier, monospace;\">m-unplated.png<\/span><\/p>\n<p>\u30db\u30b9\u30c8\u4e0a\u3067\u5b9f\u884c\u3055\u308c\u3066\u3044\u308bLockerGoga\u306e\u521d\u671f\u4e9c\u7a2e\u306e\u30b5\u30f3\u30d7\u30eb\uff1a<\/p>\n<figure id=\"attachment_101395\" aria-describedby=\"caption-attachment-101395\" style=\"width: 1024px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101395 size-large lozad\"  data-src=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-1024x264.png\" alt=\"\u56f32 \u5b9f\u884c\u4e2d\u306e\u521d\u671fLockerGoga\" width=\"1024\" height=\"264\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-1024x264.png 1024w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-300x77.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-768x198.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-900x232.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187-370x95.png 370w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-187.png 1555w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption id=\"caption-attachment-101395\" class=\"wp-caption-text\">\u56f32 \u5b9f\u884c\u4e2d\u306e\u521d\u671fLockerGoga<\/figcaption><\/figure>\n<h3>\u521d\u671fLockerGoga\u306e\u8eab\u4ee3\u91d1\u30e1\u30e2\uff1a<\/h3>\n<table width=\"623\">\n<tbody>\n<tr>\n<td width=\"623\">Greetings!<\/p>\n<p>&nbsp;<\/p>\n<p>There was a significant flaw in the security system of your company.<\/p>\n<p>You should be thankful that the flaw was exploited by serious people and not some rookies.<\/p>\n<p>They would have damaged all of your data by mistake or for fun.<\/p>\n<p>&nbsp;<\/p>\n<p>Your files are encrypted with the strongest military algorithms RSA4096 and AES-256.<\/p>\n<p>Without our special decoder it is impossible to restore the data.<\/p>\n<p>Attempts to restore your data with third party software as Photorec, RannohDecryptor etc.<\/p>\n<p>will lead to irreversible destruction of your data.<\/p>\n<p>&nbsp;<\/p>\n<p>To confirm our honest intentions.<\/p>\n<p>Send us 2-3 different random files and you will get them decrypted.<\/p>\n<p>It can be from different computers on your network to be sure that our decoder decrypts everything.<\/p>\n<p>Sample files we unlock for free (files should not be related to any kind of backups).<\/p>\n<p>&nbsp;<\/p>\n<p>We exclusively have decryption software for your situation<\/p>\n<p>&nbsp;<\/p>\n<p>DO NOT RESET OR SHUTDOWN - files may be damaged.<\/p>\n<p>DO NOT RENAME the encrypted files.<\/p>\n<p>DO NOT MOVE the encrypted files.<\/p>\n<p>This may lead to the impossibility of recovery of the certain files.<\/p>\n<p>&nbsp;<\/p>\n<p>To get information on the price of the decoder contact us at:<\/p>\n<p>CottleAkela@protonmail.com;QyavauZehyco1994@o2.pl<\/p>\n<p>The payment has to be made in Bitcoins.<\/p>\n<p>The final price depends on how fast you contact us.<\/p>\n<p>As soon as we receive the payment you will get the decryption tool and<\/p>\n<p>instructions on how to improve your systems security<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u56f33 \u521d\u671fLockerGoga\u306e\u8eab\u4ee3\u91d1\u30e1\u30e2<\/em><\/p>\n<h3>\u6700\u65b0\u7248LockerGoga\u306e\u8eab\u4ee3\u91d1\u30e1\u30e2\uff1a<\/h3>\n<table width=\"623\">\n<tbody>\n<tr>\n<td width=\"623\">Greetings!<\/p>\n<p>&nbsp;<\/p>\n<p>There was a significant flaw in the security system of your company.<\/p>\n<p>You should be thankful that the flaw was exploited by serious people and not some rookies.<\/p>\n<p>They would have damaged all of your data by mistake or for fun.<\/p>\n<p>&nbsp;<\/p>\n<p>Your files are encrypted with the strongest military algorithms RSA4096 and AES-256.<\/p>\n<p>Without our special decoder it is impossible to restore the data.<\/p>\n<p>Attempts to restore your data with third party software as Photorec, RannohDecryptor etc.<\/p>\n<p>will lead to irreversible destruction of your data.<\/p>\n<p>&nbsp;<\/p>\n<p>To confirm our honest intentions.<\/p>\n<p>Send us 2-3 different random files and you will get them decrypted.<\/p>\n<p>It can be from different computers on your network to be sure that our decoder decrypts everything.<\/p>\n<p>Sample files we unlock for free (files should not be related to any kind of backups).<\/p>\n<p>&nbsp;<\/p>\n<p>We exclusively have decryption software for your situation<\/p>\n<p>&nbsp;<\/p>\n<p>DO NOT RESET OR SHUTDOWN - files may be damaged.<\/p>\n<p>DO NOT RENAME the encrypted files.<\/p>\n<p>DO NOT MOVE the encrypted files.<\/p>\n<p>This may lead to the impossibility of recovery of the certain files.<\/p>\n<p>&nbsp;<\/p>\n<p>The payment has to be made in Bitcoins.<\/p>\n<p>The final price depends on how fast you contact us.<\/p>\n<p>As soon as we receive the payment you will get the decryption tool and<\/p>\n<p>instructions on how to improve your systems security<\/p>\n<p>&nbsp;<\/p>\n<p>To get information on the price of the decoder contact us at:<\/p>\n<p>&nbsp;<\/p>\n<p>MayarChenot@protonmail.com<\/p>\n<p>QicifomuEjijika@o2.pl<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u56f34 \u6700\u65b0\u7248LockerGoga\u306e\u8eab\u4ee3\u91d1\u30e1\u30e2<\/em><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 \u3053\u306eUnit 42\u30d6\u30ed\u30b0\u3067\u306f\u3001LockerGoga\u3068\u547c\u3070\u308c\u308b\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u653b\u6483\u306b\u3064\u3044\u3066\u8003\u5bdf\u3057\u307e\u3059\u3002 LockerGoga\u306f\u30011\u6708\u306bBleeping Computer\u304c\u6700\u521d\u306b\u5831\u544a\u3057\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3059\u3002\u540c\u793e\u306f\u5831\u544a\u306e\u306a<\/p>\n","protected":false},"author":61,"featured_media":101391,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4324,4434,3057,4428],"tags":[6746],"product_categories":[4444,4343,4448],"coauthors":[831],"class_list":["post-101390","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybercrime","category-cybercrime-ja","category-ransomware-ja","category-threat-research-ja","tag-lockergoga","product_categories-advanced-wildfire-ja","product_categories-cortex-xdr","product_categories-cortex-xdr-ja"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Born This Way? LockerGoga\u306e\u8d77\u6e90<\/title>\n<meta name=\"description\" content=\"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Born This Way? LockerGoga\u306e\u8d77\u6e90\" \/>\n<meta property=\"og:description\" content=\"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2019-03-26T19:00:33+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-11-26T07:28:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png\" \/>\n\t<meta property=\"og:image:width\" content=\"874\" \/>\n\t<meta property=\"og:image:height\" content=\"437\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Mike Harbison\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Born This Way? LockerGoga\u306e\u8d77\u6e90\" \/>\n<meta name=\"twitter:description\" content=\"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Born This Way? LockerGoga\u306e\u8d77\u6e90","description":"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/","og_locale":"ja_JP","og_type":"article","og_title":"Born This Way? LockerGoga\u306e\u8d77\u6e90","og_description":"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/","og_site_name":"Unit 42","article_published_time":"2019-03-26T19:00:33+00:00","article_modified_time":"2019-11-26T07:28:46+00:00","og_image":[{"width":874,"height":437,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png","type":"image\/png"}],"author":"Mike Harbison","twitter_card":"summary_large_image","twitter_title":"Born This Way? LockerGoga\u306e\u8d77\u6e90","twitter_description":"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/"},"author":{"name":"Mike Harbison","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/b4be528290190ed8c6aa6d8817df3d78"},"headline":"Born This Way? LockerGoga\u306e\u8d77\u6e90","datePublished":"2019-03-26T19:00:33+00:00","dateModified":"2019-11-26T07:28:46+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/"},"wordCount":1463,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png","keywords":["LockerGoga"],"articleSection":["Cybercrime","\u30b5\u30a4\u30d0\u30fc\u72af\u7f6a","\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/","name":"Born This Way? LockerGoga\u306e\u8d77\u6e90","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png","datePublished":"2019-03-26T19:00:33+00:00","dateModified":"2019-11-26T07:28:46+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/b4be528290190ed8c6aa6d8817df3d78"},"description":"LockerGoga\u306f2019\u5e741\u6708\u306b\u6700\u521d\u306b\u5831\u544a\u3055\u308c\u305f\u30e9\u30f3\u30b5\u30e0\u30a6\u30a7\u30a2\u3067\u3053\u308c\u307e\u3067\u3044\u304f\u3064\u304b\u4e9c\u7a2e\u304c\u898b\u3064\u304b\u3063\u3066\u3044\u307e\u3059\u3002\u30ce\u30eb\u30a6\u30a7\u30fc\u306e\u30a2\u30eb\u30df\u30cb\u30a6\u30e0\u88fd\u9020\u696d\u8005\u3092\u306f\u3058\u3081\u5316\u5b66\u7cfb\u4f01\u696dHexicon\u3001Momentive\u306b\u5bfe\u3059\u308b\u653b\u6483\u3067\u3082\u4f7f\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u672c\u7a3f\u3067\u306f\u305d\u306e\u8d77\u6e90\u3001\u9032\u5316\u3001\u4ed5\u7d44\u307f\u3001\u554f\u984c\u70b9\u3092\u89e3\u8aac\u3057\u307e\u3059\u3002","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-185.png","width":874,"height":437},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/born-this-way-origins-of-lockergoga\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Born This Way? LockerGoga\u306e\u8d77\u6e90"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/b4be528290190ed8c6aa6d8817df3d78","name":"Mike Harbison","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4ffb3c2d260a0150fb91b3715442f8b3","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Mike Harbison"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/mike-harbison\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101390","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=101390"}],"version-history":[{"count":4,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101390\/revisions"}],"predecessor-version":[{"id":101398,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101390\/revisions\/101398"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/101391"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=101390"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=101390"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=101390"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=101390"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=101390"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}