{"id":106796,"date":"2017-02-14T15:59:51","date_gmt":"2017-02-14T23:59:51","guid":{"rendered":"https:\/\/unit42.paloaltonetworks.com\/?p=106796"},"modified":"2020-05-21T21:05:10","modified_gmt":"2020-05-22T04:05:10","slug":"unit42-xagentosx-sofacys-xagent-macos-tool","status":"publish","type":"post","link":"https:\/\/unit42.paloaltonetworks.com\/ja\/unit42-xagentosx-sofacys-xagent-macos-tool\/","title":{"rendered":"XAgentOSX: Sofacy\u306eXAgent\u306bmacOS\u7248\u4e9c\u7a2e"},"content":{"rendered":"

\u6982\u8981<\/h2>\n

Palo Alto Networks\u306e\u8105\u5a01\u30a4\u30f3\u30c6\u30ea\u30b8\u30a7\u30f3\u30b9\u30c1\u30fc\u30e0\u300cUnit 42\u300d\u306f\u3001\u7d99\u7d9a\u4e2d\u306eSofacy\u306eKomplex\u30c8\u30ed\u30a4\u306e\u6728\u99ac<\/a>\u306b\u95a2\u3059\u308b\u30ea\u30b5\u30fc\u30c1\u306b\u304a\u3044\u3066\u3001Sofacy\u306eWindows\u7248\u30c8\u30ed\u30a4\u306e\u6728\u99acXAgent\u306emacOS\u7248\u306e\u65b0\u305f\u306a\u4e9c\u7a2e\u3092\u767a\u898b\u3057\u307e\u3057\u305f\u3002\u3053\u306e\u30d0\u30c3\u30af\u30c9\u30a2\u578b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001macOS\u30b7\u30b9\u30c6\u30e0\u3092\u4f7f\u3063\u3066\u3044\u308b\u500b\u4eba\u3092\u6a19\u7684\u306b\u3059\u308b\u969b\u306bSofacy\u30b0\u30eb\u30fc\u30d7\u304c\u4f7f\u7528\u3057\u3066\u3044\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002\u4f5c\u6210\u8005\u306f\u3001XAgentOSX\u3068\u540d\u524d\u3092\u4ed8\u3051\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001Sofacy\u306eWindows\u7248\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e1\u3064\u3068XAgent\u3068\u3044\u3046\u540d\u524d\u3092\u4f7f\u3044\u3001\u3055\u3089\u306bApple\u306emacOS\u306e\u5f93\u6765\u306e\u540d\u79f0OS X\u3092\u7d44\u307f\u5408\u308f\u305b\u305f\u3082\u306e\u3067\u3059\u3002Komplex\u30c4\u30fc\u30eb\u3068XAgentOSX\u30c4\u30fc\u30eb\u306e\u5185\u90e8\u306b\u3042\u308b\u4ee5\u4e0b\u306e\u30d7\u30ed\u30b8\u30a7\u30af\u30c8 \u30d1\u30b9\u306b\u985e\u4f3c\u70b9\u304c\u898b\u3089\u308c\u308b\u3053\u3068\u304b\u3089\u3001\u3069\u3061\u3089\u306e\u30c4\u30fc\u30eb\u3082\u540c\u3058\u653b\u6483\u8005\u304c\u958b\u767a\u3057\u305f\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n

Komplex: \/Users\/kazak\/Desktop\/Project\/komplex<\/p>\n

XAgent OSX: \/Users\/kazak\/Desktop\/Project\/XAgentOSX<\/p>\n

Sofacy\u304cKomplex\u3092\u4f7f\u3063\u3066XAgentOSX\u30c4\u30fc\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3001\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3001\u4fb5\u5165\u3055\u308c\u305f\u30b7\u30b9\u30c6\u30e0\u3067\u3053\u306e\u30c4\u30fc\u30eb\u306e\u62e1\u5f35\u30b3\u30de\u30f3\u30c9 \u30bb\u30c3\u30c8\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n

XAgent\u306eC2\u901a\u4fe1<\/h3>\n

XAgent \u306emacOS\u7248\u4e9c\u7a2e\u3001XAgent\u306f\u30b3\u30de\u30f3\u30c9 \u30a2\u30f3\u30c9\u30b3\u30f3\u30c8\u30ed\u30fc\u30eb \uff08C2\uff09\u30c1\u30e3\u30cd\u30eb\u3092\u4ecb\u3057\u3066\u653b\u6483\u8005\u304b\u3089\u30b3\u30de\u30f3\u30c9\u3092\u53d7\u4fe1\u3059\u308b\u80fd\u529b\u304c\u3042\u308a\u307e\u3059\u304c\u3001\u81ea\u8eab\u306e\u30ad\u30fc\u30ed\u30ac\u30fc\u6a5f\u80fd\u3092\u4f7f\u3063\u3066\u30ad\u30fc\u30b9\u30c8\u30ed\u30fc\u30af\u3092\u8a18\u9332\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002XAgent\u306fHTTP\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f7f\u3063\u3066\u81ea\u8eab\u306eC2\u30b5\u30fc\u30d0\u3068\u901a\u4fe1\u3092\u884c\u3044\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u653b\u6483\u8005\u306f\u4fb5\u5bb3\u3092\u53d7\u3051\u305f\u30b7\u30b9\u30c6\u30e0\u3068\u7e4b\u304c\u308b\u3053\u3068\u304c\u3067\u304d\u307e\u3059\u3002<\/p>\n

\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001HTTP POST\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f7f\u3063\u3066\u56f31\u306e\u3088\u3046\u306bC2\u30b5\u30fc\u30d0\u306b\u30c7\u30fc\u30bf\u3092\u9001\u4fe1\u3057\u3001GET\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4f7f\u3063\u3066\u56f32\u306e\u3088\u3046\u306b\u30b5\u30fc\u30d0\u304b\u3089\u30b3\u30de\u30f3\u30c9\u3092\u53d7\u4fe1\u3057\u307e\u3059\u3002\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u3068C2\u30b5\u30fc\u30d0\u3068\u306e\u9593\u3067\u3084\u308a\u53d6\u308a\u3055\u308c\u308b\u30c7\u30fc\u30bf\u306e\u7279\u5b9a\u3092\u7a81\u304d\u6b62\u3081\u308b\u305f\u3081\u3001\u79c1\u305f\u3061\u306f\u4eca\u3067\u3082\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306e\u5206\u6790\u3092\u7d9a\u3051\u3066\u3044\u307e\u3059\u304c\u3001HTTP POST\u30ea\u30af\u30a8\u30b9\u30c8\u5185\u306eC2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u308b\u30c7\u30fc\u30bf\u3092\u6697\u53f7\u5316\u3059\u308b\u306e\u306b\u3001\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304cRC4\u30a2\u30eb\u30b4\u30ea\u30ba\u30e0\u3092\u4f7f\u3063\u3066\u3044\u308b\u3053\u3068\u306f\u660e\u3089\u304b\u3067\u3059\u3002<\/p>\n

\"\u56f31<\/a>
\u56f31 XAgent macOS\u306eHTTP POST\u30ea\u30af\u30a8\u30b9\u30c8<\/figcaption><\/figure>\n
\"\u56f32<\/a>
\u56f32 XAgent macOS\u306eHTTP GET\u30ea\u30af\u30a8\u30b9\u30c8<\/figcaption><\/figure>\n

XAgentOSX\u304c\u751f\u6210\u3059\u308bC2 URL\u306f\u3001Windows\u7248\u304c\u751f\u6210\u3059\u308b\u3082\u306e\u306b\u6975\u3081\u3066\u985e\u4f3c\u3057\u3066\u3044\u307e\u3059\u3002C2\u30b5\u30fc\u30d0\u306b\u5bfe\u3057\u3066\u767a\u884c\u3055\u308c\u308bHTTP\u30ea\u30af\u30a8\u30b9\u30c8\u7528\u306bURL\u3092\u751f\u6210\u3059\u308b\u969b\u3001\u3053\u306e\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u4e0b\u8a18\u306e\u4e2d\u304b\u3089\u30e9\u30f3\u30c0\u30e0\u306b\u30d5\u30a9\u30eb\u30c0\u30921\u3064\u9078\u3093\u3067URL\u30d1\u30b9\u306b\u542b\u3081\u307e\u3059\u3002<\/p>\n

watch\/?
\nsearch\/?
\nfind\/?
\nresults\/?
\nopen\/?
\nsearch\/?
\nclose\/?<\/p>\n

\u307e\u305f\u3001XAgent\u306fC2 URL\u306e\u69cb\u7bc9\u304c\u5b8c\u4e86\u3059\u308b\u3068\u3001\u4e0b\u8a18\u30ea\u30b9\u30c8\u306e\u4e2d\u304b\u3089\u30d1\u30e9\u30e1\u30fc\u30bf\u540d\u3082\u3044\u304f\u3064\u304b\u9078\u3073\u307e\u3059\u3002<\/p>\n

itwm=
\ntext=
\nfrom=.
\nitwm=
\nags=
\noe=
\naq=
\nbtnG=
\noprnd=
\nitwm=
\nutm=
\nchannel=<\/p>\n

XAgent OSX\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u201cagent_id\u201d\u3068\u3057\u3066\u53c2\u7167\u3059\u308b\u30b7\u30b9\u30c6\u30e0\u7279\u5b9a\u306e\u5024\u3092\u751f\u6210\u3057\u307e\u3059\u3002\u3053\u308c\u306f\u4fb5\u5bb3\u3092\u53d7\u3051\u305f\u5404\u30db\u30b9\u30c8\u306b\u4ed8\u3051\u3089\u308c\u305f\u56fa\u6709\u306e\u8b58\u5225\u5b50\u3067\u3059\u3002\u3053\u306e\u5024\u306fIOPlatformUUID\u30d7\u30ed\u30d1\u30c6\u30a3\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u305f\u3081\u306eIOService\u306b\u7531\u6765\u3057\u3066\u304a\u308a\u3001\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u5185\u3067\u30ea\u30b9\u30c8\u30a2\u30c3\u30d7\u3055\u308c\u308b\u201cHardware UUID\u201d\u306b\u76f8\u5f53\u3059\u308b\u3082\u306e\u3067\u3059\u3002\u56f33\u306b\u793a\u3059\u5206\u6790\u30b7\u30b9\u30c6\u30e0\u306e\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3067\u306f\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u3053\u306e\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2ID\u306e\u5148\u982d4\u30d0\u30a4\u30c8\u3092\u4e00\u610f\u306e\u30b7\u30b9\u30c6\u30e0\u8b58\u5225\u5b50\u3068\u3057\u3066\u4f7f\u3063\u3066\u304a\u308a\u3001\u4eca\u56de\u306e\u5834\u5408\u306f\u201c0000\u201d\u3068\u8868\u793a\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n

\"\u56f33<\/a>
\u56f33 XAgent\u304c\u4fb5\u5bb3\u3055\u308c\u305f\u30db\u30b9\u30c8\u3092\u4e00\u610f\u7684\u306b\u8b58\u5225\u3059\u308b\u305f\u3081\u306b\u4f7f\u7528\u3059\u308b\u30cf\u30fc\u30c9\u30a6\u30a7\u30a2ID<\/figcaption><\/figure>\n

HTTP POST\u30ea\u30af\u30a8\u30b9\u30c8\u304a\u3088\u3073GET\u30ea\u30af\u30a8\u30b9\u30c8\u5185\u306eURL\u3092\u751f\u6210\u3059\u308b\u969b\u3001XAgent\u306f\u3001\u3053\u306eagent_id\u5024\u3092\u542b\u3080\u7279\u5b9a\u306e\u30c7\u30fc\u30bf\u69cb\u9020\u4f53\u3092\u4f7f\u3063\u3066\u3001HTTP\u30d1\u30e9\u30e1\u30fc\u30bf\u30921\u3064\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u3053\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\u306b\u3088\u308a\u3001agent_id\u304cC2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u307e\u3059\u304c\u3001\u305d\u306e\u76ee\u7684\u306f\u653b\u6483\u8005\u304c\u4fb5\u5165\u3055\u308c\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u5b9f\u884c\u3057\u305f\u3044\u30b3\u30de\u30f3\u30c9\u3092\u53d6\u5f97\u3059\u308b\u3053\u3068\u3067\u3059\u3002\u3053\u306eagent_id\u3092C2\u306b\u9001\u4fe1\u3059\u308b\u306e\u306b\u4f7f\u308f\u308c\u308b\u30c7\u30fc\u30bf\u69cb\u9020\u4f53\u306f\u6b21\u306e\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n

struct {
\nDWORD random_value_for_key;
\nCHAR[7] constant_value;
\nDWORD agent_id;
\n}<\/p>\n

\u30c7\u30fc\u30bf\u69cb\u9020\u4f53\u306b\u542b\u307e\u308c\u308b\u5b9a\u6570\u5024\u306f7\u30d0\u30a4\u30c8\u306e\u6587\u5b57\u5217\u3067\u3001\u201c\\x56\\x0E\\x9F\\xF0\\xEB\\x98\\x43\u201d\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u5316\u3055\u308c\u3066\u304a\u308a\u3001\u3053\u306e\u5f8c\u306bagent_id\u5024(\u4eca\u56de\u306e\u5834\u5408\u306f\u201c0000\u201d)\u304c\u7d9a\u304d\u307e\u3059\u3002\u30c7\u30fc\u30bf\u5185\u306e\u6700\u521d\u306eDWORD\u306f\u30e9\u30f3\u30c0\u30e0\u306a\u5024\u3067\u3042\u308a\u3001\u3053\u308c\u3092\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306fXOR\u30ad\u30fc\u3068\u3057\u3066\u4f7f\u3063\u3066\u3001\u524d\u8a18\u306e\u5b9a\u6570\u5024\u3068agent_id\u3092\u6697\u53f7\u5316\u3057\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001\u5206\u6790\u4e2d\u3001\u4e0b\u8a18\u306e15\u30d0\u30a4\u30c8\u306fHTTP\u3092\u751f\u6210\u3059\u308b\u306e\u306b\u4f7f\u308f\u308c\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n\n\n\n\n
\u30e9\u30f3\u30c0\u30e0\u5024<\/td>\n\u5b9a\u6570\u5024<\/td>\nagent_id<\/td>\n<\/tr>\n
0F EE C8 83<\/td>\n56 0E 9F F0 EB 98 43<\/td>\n30 30 30 30<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u305d\u306e\u3042\u3068\u3001\u7d50\u679c\u3068\u3057\u3066\u5f97\u3089\u308c\u305f\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c8\u306f\u3001XAgent\u306eBase64\u30a8\u30f3\u30b3\u30fc\u30c9\u51e6\u7406\u30eb\u30fc\u30c1\u30f3\u3092\u4f7f\u3063\u3066\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u30eb\u30fc\u30c1\u30f3\u306f\u3001\u307e\u305a\u3001\u6b21\u306e\u30a8\u30f3\u30b3\u30fc\u30c9\u7528\u30a2\u30eb\u30d5\u30a1\u30d9\u30c3\u30c8\u306e\u69cb\u7bc9\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_<\/p>\n

\u898b\u3066\u5206\u304b\u308b\u3068\u304a\u308a\u3001\u3053\u308c\u306f\u6a19\u6e96\u306eBase64\u30a2\u30eb\u30d5\u30a1\u30d9\u30c3\u30c8\u3067\u306f\u306a\u304f\u3001RFC 4648\u306e\u201cURL and Filename safe\u201d\u306eBase 64\u30a2\u30eb\u30d5\u30a1\u30d9\u30c3\u30c8\u3067\u3042\u308a\u3001\u6a19\u6e96\u30a2\u30eb\u30d5\u30a1\u30d9\u30c3\u30c8\u306e\u201c+\u201d\u304c\u201c-\u201d\u3067\u3001\u3055\u3089\u306b\u306f\u201c\/\u201d\u304c\u201c_\u201d\u3067\u7f6e\u304d\u63db\u3048\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u30a2\u30eb\u30d5\u30a1\u30d9\u30c3\u30c8\u306b\u3088\u308aBase64\u30a8\u30f3\u30b3\u30fc\u30c9\u51e6\u7406\u95a2\u6570\u3092\u4f7f\u3063\u3066\u30c7\u30fc\u30bf\u3092\u30a8\u30f3\u30b3\u30fc\u30c9\u3059\u308b\u3068\u3001\u4e0a\u8a18\u306e\u4f8b\u306e\u5834\u5408\u3001\u6b21\u306e\u7d50\u679c\u3092\u5f97\u307e\u3059\u3002<\/p>\n

D-7Ig1ngV3PkdouzP974<\/p>\n

\u6b21\u306b\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f9\u500b\u306e\u30e9\u30f3\u30c0\u30e0\u306a\u30b7\u30f3\u30dc\u30eb\u304b\u3089\u69cb\u6210\u3055\u308c\u308b\u6587\u5b57\u5217\u3092\u4f5c\u6210\u3057\u3001\u3053\u306e\u30e9\u30f3\u30c0\u30e0\u6587\u5b57\u5217\u306e\u5f8c\u306b\u524d\u8a18\u30a8\u30f3\u30b3\u30fc\u30c9\u6e08\u307f\u6697\u53f7\u5316\u30c6\u30ad\u30b9\u30c8\u3092\u4ed8\u52a0\u3057\u307e\u3059\u3002\u4f8b\u3048\u3070\u3001\u4e0b\u8a18\u6587\u5b57\u5217\u306f\u3001C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u308bHTTP\u30d1\u30e9\u30e1\u30fc\u30bf\u306e1\u3064\u306e\u4e2d\u306b\u542b\u307e\u308c\u308b\u3053\u3068\u306b\u306a\u308b\u3067\u3057\u3087\u3046\u3002<\/p>\n

eRmaVsr90D-7Ig1ngV3PkdouzP974<\/p>\n

\u672c\u4ef6\u306e\u5834\u5408\u3001\u653b\u6483\u8005\u306f\u3053\u306eXAgent\u30b5\u30f3\u30d7\u30eb\u306eC2\u4f4d\u7f6e\u306b\u95a2\u3059\u308b\u8a2d\u5b9a\u3092\u884c\u3046\u969b\u306b\u30df\u30b9\u3092\u3057\u307e\u3057\u305f\u3002\u30b5\u30f3\u30d7\u30eb\u306f\u914d\u5217\u3092\u4f5c\u6210\u3057\u3001\u305d\u306e\u4e2d\u306b\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304cC2\u4f4d\u7f6e\u3068\u3057\u3066\u4f7f\u3046\u3001\u4ee5\u4e0b\u306e\u6587\u5b57\u5217\u3092\u5165\u308c\u307e\u3059\u3002<\/p>\n

http:\/\/23.227.196[.]215\/
\nhttp:\/\/apple-iclods[.]org\/
\nhttp:\/\/apple-checker[.]org\/
\nhttp:\/\/apple-uptoday[.]org\/
\nhttp:\/\/apple-search[.]info<\/p>\n

\u6700\u5f8c\u306e\u6587\u5b57\u5217\u306b\u672b\u5c3e\u306b\u7f6e\u304b\u308c\u308b\u201c\/\u201d\u304c\u306a\u3044\u3053\u3068\u3067\u3001\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u3053\u306e\u6587\u5b57\u5217\u3092\u4f7f\u3063\u3066C2\u306eURL\u306e\u6b8b\u308a\u306e\u90e8\u5206\u3092\u69cb\u7bc9\u3059\u308b\u969b\u3001\u554f\u984c\u304c\u751f\u3058\u307e\u3059\u3002\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u3053\u306e\u6587\u5b57\u5217\u306e\u76f4\u5f8c\u306b\u3001URL\u5185\u306b\u3042\u308b\u5f8c\u7d9a\u6587\u5b57\u5217\u3092\u4ed8\u52a0\u3059\u308b\u304b\u3089\u3067\u3059\u3002\u4f8b\u3048\u3070\u3001\u3053\u306e\u5b57\u5217\u3092\u4f7f\u3063\u3066\u3044\u308b\u5834\u5408\u3001\u201capple-search.infoclose\u201d\u3092\u63a2\u3059DNS\u30af\u30a8\u30ea\u3092\u78ba\u8a8d\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u6587\u5b57\u5217\u201cclose\u201d\u304cC2\u306eURL\u306e\u5f8c\u7d9a\u90e8\u5206\u3067\u3042\u308b\u3068\u60f3\u5b9a\u3055\u308c\u3066\u3044\u305f\u305f\u3081\u3067\u3059\u3002<\/p>\n

\u63d0\u4f9b\u30b3\u30de\u30f3\u30c9<\/h3>\n

XAgent\u306eC2\u30b5\u30fc\u30d0\u306f\u3001\u4fb5\u5bb3\u3055\u308c\u305f\u30b7\u30b9\u30c6\u30e0\u4e0a\u3067\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u304c\u5b9f\u884c\u3059\u308b\u305f\u3081\u306e\u30b3\u30de\u30f3\u30c9\u3092\u3001\u30a4\u30f3\u30d0\u30a6\u30f3\u30c9\u306eHTTP\u30ea\u30af\u30a8\u30b9\u30c8\u306b\u5bfe\u3059\u308b\u5fdc\u7b54\u306e\u4e2d\u306b\u542b\u3081\u3066\u63d0\u4f9b\u3057\u307e\u3059\u3002XAgentOSX\u30c8\u30ed\u30a4\u306e\u6728\u99ac\u306f\u3001\u30b3\u30de\u30f3\u30c9\u306b\u5bfe\u3059\u308b\u5fdc\u7b54\u3092HTML\u30bf\u30b0\u3067\u631f\u307f\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308aC2\u30b5\u30fc\u30d0\u304c\u95b2\u89a7\u76ee\u7684\u3067\u30ed\u30b0\u3092\u6210\u5f62\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002<\/p>\n

\u307b\u3068\u3093\u3069\u306e\u5834\u5408\u3001C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3055\u308c\u308b\u30ec\u30b9\u30dd\u30f3\u30b9\u306f\u201c<font size=4 color=000066><pre>\u201d\u304a\u3088\u3073\u201c<\/pre><\/font>\u201d\u3068\u3044\u3046HTML\u30bf\u30b0\u306e\u9593\u306b\u7f6e\u304b\u308c\u307e\u3059\u3002\u3053\u306e\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u3092\u5206\u6790\u3057\u305f\u3068\u3053\u308d\u3001\u5b8c\u5168\u306b\u6a5f\u80fd\u3059\u308b\u30d0\u30c3\u30af\u30c9\u30a2\u306b\u5fc5\u8981\u306a\u30b3\u30de\u30f3\u30c9(\u88681)\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3057\u305f\u3002\u30b3\u30de\u30f3\u30c9 \u30cf\u30f3\u30c9\u30e9\u306f\u30b3\u30de\u30f3\u30c9\u8b58\u5225\u5b50\u3092C2\u30b5\u30fc\u30d0\u304b\u3089\u53d6\u5f97\u3057\u30010xFFFFFF9B\u3092\u3053\u306e\u5024\u306b\u53ef\u7b97\u3057\u307e\u3059\u3002\u6b21\u306b\u3001switch\u6587\u3092\u4f7f\u3063\u3066\u9069\u5207\u306a\u30b3\u30de\u30f3\u30c9\u3092\u6c42\u3081\u3001\u5b9f\u884c\u3057\u307e\u3059\u3002\u3053\u306eswitch\u6587\u306b\u3088\u308b\u30c1\u30a7\u30c3\u30af\u304c19\u500b\u306e\u5834\u5408\u5206\u3051\u3092\u3057\u3066\u3044\u308b\u305f\u3081\u3001\u30b3\u30de\u30f3\u30c9\u8b58\u5225\u5b50\u306e\u5024\u306f100\u304b\u3089118\u307e\u3067\u3067\u3042\u308b\u3053\u3068\u304c\u4f3a\u3048\u307e\u3059\u3002<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\u30b3\u30de\u30f3\u30c9ID<\/b><\/td>\n\u6a5f\u80fd<\/b><\/td>\n\u00a0\u8aac\u660e<\/b><\/td>\n<\/tr>\n
100<\/td>\ngetInfoOSX<\/td>\n\u30e6\u30fc\u30b6\u30fc\u540d\u304a\u3088\u3073OSX\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u53ce\u96c6\u3057\u3001\u6b21\u306e\u6587\u5b57\u5217\u3092\u6697\u53f7\u5316\u3057\u305f\u5f62\u3067\u4f7f\u3063\u3066\u5fdc\u7b54\u3057\u307e\u3059\u3002\u201cMac OS X \u2013 [OSX\u306e\u30d0\u30fc\u30b8\u30e7\u30f3] x64<br>\\nUser name \u2013 [\u30e6\u30fc\u30b6\u30fc\u540d]\u201d<\/td>\n<\/tr>\n
101<\/td>\ngetProcessList<\/td>\n\u201cps aux\u201d\u3092\u5b9f\u884c\u3057\u3066\u8d77\u52d5\u4e2d\u306e\u30d7\u30ed\u30bb\u30b9\u306e\u4e00\u89a7\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
102<\/td>\nremoteShell<\/td>\n\u4e0e\u3048\u3089\u308c\u305f\u30b3\u30de\u30f3\u30c9\u3001\u201c\/bin\/sh\u201d\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
103<\/td>\ngetInstalledAPP<\/td>\n\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u6e08\u307f\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u306e\u4e00\u89a7\u3092\u30b3\u30de\u30f3\u30c9\u201cls -la \/Applications\u201d\u306e\u5b9f\u884c\u306b\u3088\u308a\u53d6\u5f97\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
104<\/td>\nshowBackupIosFolder<\/td>\nIOS\u30c7\u30d0\u30a4\u30b9\u306e\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u304c\u30b7\u30b9\u30c6\u30e0\u306b\u7f6e\u304b\u308c\u305f\u304b\u5426\u304b\u3001\u30b3\u30de\u30f3\u30c9\u201cls -la ~\/Library\/Application\\ Support\/MobileSync\/Backup\/\u201d\u3092\u5b9f\u884c\u3059\u308b\u3053\u3068\u3067\u5224\u65ad\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
105<\/td>\ndownloadFileFromPath<\/td>\n\u6307\u5b9a\u3055\u308c\u305f\u30d1\u30b9\u304b\u3089\u30d5\u30a1\u30a4\u30eb\u3092\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
106<\/td>\ncreateFileInSystem<\/td>\nC2\u30b5\u30fc\u30d0\u306eHTTP\u5fdc\u7b54\u5185\u306e\u7279\u5b9a\u30d5\u30a1\u30a4\u30eb\u3092\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\u3057\u3001\u63d0\u4f9b\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
107<\/td>\nexecFile<\/td>\nNSTask:launch\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u3063\u3066\u3001\u30b7\u30b9\u30c6\u30e0\u4e0a\u306e\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u5b9f\u884c\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
108<\/td>\ndeletFileFromPath<\/td>\nNSFileManager:removeFileAtPath\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u3063\u3066\u3001\u6307\u5b9a\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u524a\u9664\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
109<\/td>\ntakeScreenShot<\/td>\nCGGetActiveDisplayList\u30e1\u30bd\u30c3\u30c9\u3001CGDisplayCreateImage\u30e1\u30bd\u30c3\u30c9\u3001NSImage:initWithCGImage\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u3063\u3066\u3001\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u64ae\u308a\u307e\u3059\u3002\u6b21\u306e\u30b3\u30fc\u30c9\u3092\u4f7f\u3063\u3066C2\u306b\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u8fd4\u3057\u307e\u3059\u3002 <img src=\u2019data:image\/jpeg;base64,[base64 of screenshot]\u2019 width=800 height=500 \/><br><\/td>\n<\/tr>\n
110<\/td>\nstartTakeScreenShot<\/td>\n\u30b9\u30ec\u30c3\u30c9\u3092\u751f\u6210\u3057\u3001\u8a2d\u5b9a\u6e08\u307f\u306e\u9593\u9694(\u30c7\u30d5\u30a9\u30eb\u30c8\u306f10\u79d2\u3054\u3068)\u3067\u30b9\u30af\u30ea\u30fc\u30f3\u30b7\u30e7\u30c3\u30c8\u3092\u64ae\u308a\u307e\u3059\u3002\u201ctakeScreenShot\u201d\u95a2\u6570\u5185\u306e\u540c\u3058\u30e1\u30bd\u30c3\u30c9\u3092\u4f7f\u3044\u307e\u3059\u3002<\/td>\n<\/tr>\n
111<\/td>\nstopTakeScreenShot<\/td>\n\u201cstartTakeScreenShot\u201d\u95a2\u6570\u5185\u3067\u751f\u6210\u3055\u308c\u305f\u30b9\u30ec\u30c3\u30c9\u3092\u7d42\u4e86\u3057\u307e\u3059\u3002<\/td>\n<\/tr>\n
115<\/td>\ngetFirefoxPassword<\/td>\n\u30d1\u30b9\u5185\u306e\u201c\/Firefox\/Profiles\u201d\u3068\u3044\u3046\u30d5\u30a9\u30eb\u30c0\u3092\u63a2\u3057\u3001\u201clogins.json\u201d\u30d5\u30a1\u30a4\u30eb\u306e\u5185\u5bb9\u3092\u8aad\u307f\u3001\u201chostname\u201d\u3001\u201cencryptedUsername\u201d\u3001\u304a\u3088\u3073\u201cencryptedPassword\u201d\u306e\u30a8\u30f3\u30c8\u30ea\u3092\u63a2\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u201csignons.sqlite\u201d\u30d5\u30a1\u30a4\u30eb\u306b\u95a2\u3059\u308b\u6b21\u306eSQL\u30af\u30a8\u30ea\u306e\u767a\u884c\u3082\u8a66\u307f\u307e\u3059\u3002\u201cSELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins WHERE timePasswordChanged\/1000 BETWEEN ? AND ?\u201d<\/td>\n<\/tr>\n
116<\/td>\nftpUpload<\/td>\nFTPManager:uploadFile\u30e1\u30bd\u30c3\u30c9\u304a\u3088\u3073\u4e0e\u3048\u3089\u308c\u305f\u30b5\u30fc\u30d0\u540d\u3001\u30e6\u30fc\u30b6\u30fc\u540d\u3001\u304a\u3088\u3073\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u4f7f\u3044\u307e\u3059\u3002<\/td>\n<\/tr>\n
117<\/td>\nftpStop<\/td>\n\u201cstopOperation\u201d\u30e1\u30bd\u30c3\u30c9\u3092\u547c\u3073\u51fa\u3057\u307e\u3059\u304c\u3001FTP\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306f\u505c\u6b62\u3055\u305b\u306a\u3044\u3088\u3046\u3067\u3059\u3002<\/td>\n<\/tr>\n
118<\/td>\nreadFiles<\/td>\n\u30d5\u30a1\u30a4\u30eb\u307e\u305f\u306f\u30d5\u30a9\u30eb\u30c0\u306b\u95a2\u3059\u308b\u30d5\u30a1\u30a4\u30eb\u60c5\u5831\u3092\u53d6\u5f97\u3057\u307e\u3059\u3002\u307e\u305f\u3001\u201c*\u201d\u30ef\u30a4\u30eb\u30c9\u30ab\u30fc\u30c9\u304a\u3088\u3073\u518d\u5e30\u7684\u306a\u30d5\u30a1\u30a4\u30eb\u4e00\u89a7\u306b\u5bfe\u5fdc\u3057\u3066\u3044\u307e\u3059\u3002\u30b3\u30fc\u30c9\u306f\u3001\u60c5\u5831\u3092\u53ce\u96c6\u3057\u3001\u8868\u4f5c\u6210\u7528\u306e\u4ee5\u4e0b\u306eHTML\u3092\u4f7f\u3063\u3066\u4e00\u89a7\u3092\u6574\u5f62\u3057\u307e\u3059\u3002<\/p>\n

<table>
\n<tr><td><table>
\n<tr><td>Type<\/td><td>Owner<\/td><td>Permissions<\/td><td>Created<\/td><td>Modificated<\/td><td>Size<\/td><td>Path<\/td><\/tr>
\n<tr><td>[fileType]<\/td><td>[fileOwnerAccountName]<\/td><td>[number filePosixPermissions]<\/td><td>[fileCreationDate]<\/td><td>[fileModificationDate]<\/td><td>[fileSize]<\/td><td>[file path?]<\/td><\/tr><\/td><\/tr>
\n\u2026
\n<\/table>
\n<\/table><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u88681 XAgent OSX\u5185\u3067\u5229\u7528\u53ef\u80fd\u306a\u30b3\u30de\u30f3\u30c9<\/i><\/span><\/p>\n

\u4e0a\u8a18\u2018showBackupIosFolder\u2019\u306f\u8208\u5473\u6df1\u3044\u30b3\u30de\u30f3\u30c9\u3067\u3059\u3002\u3053\u306e\u30b3\u30de\u30f3\u30c9\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u4fb5\u5165\u3055\u308c\u305f\u30b7\u30b9\u30c6\u30e0\u304ciPhone\u307e\u305f\u306fiPad\u306a\u3069\u306eIOS\u30c7\u30d0\u30a4\u30b9\u3092\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3059\u308b\u306e\u306b\u4f7f\u308f\u308c\u3066\u3044\u305f\u304b\u5426\u304b\u3001\u5224\u65ad\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u304b\u3089\u3067\u3059\u3002\u30e2\u30d0\u30a4\u30eb\u30c7\u30d0\u30a4\u30b9\u304c\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u3055\u308c\u3066\u3044\u305f\u304b\u5426\u304b\u306e\u5224\u65ad\u306b\u3001\u3053\u306e\u30b3\u30de\u30f3\u30c9\u304c\u4f7f\u308f\u308c\u3066\u3044\u308b\u3082\u306e\u3068\u8003\u3048\u3089\u308c\u307e\u3059\u3002\u307e\u305f\u3001\u653b\u6483\u8005\u304cXAgent\u5185\u306e\u5225\u306e\u30b3\u30de\u30f3\u30c9\u3092\u4f7f\u3063\u3066\u3053\u3046\u3057\u305f\u30d5\u30a1\u30a4\u30eb\u3092\u629c\u304d\u53d6\u308d\u3046\u3068\u3059\u308b\u3053\u3068\u3082\u3042\u308b\u3068\u601d\u308f\u308c\u307e\u3059\u3002<\/p>\n

\u30ad\u30fc\u30ed\u30ae\u30f3\u30b0\u6a5f\u80fd<\/h3>\n

XAgent\u306b\u306f\u30ad\u30fc\u30ed\u30ac\u30fc\u6a5f\u80fd\u3082\u5099\u3048\u3066\u304a\u308a\u3001\u3053\u306e\u6a5f\u80fd\u306b\u3088\u308a\u3001\u653b\u6483\u8005\u306f\u3001\u30e6\u30fc\u30b6\u30fc\u304c\u30ad\u30fc\u5165\u529b\u3092\u3059\u308b\u3068\u304d\u306b\u8a8d\u8a3c\u60c5\u5831\u3092\u76d7\u307f\u51fa\u3057\u307e\u3059\u3002XAgent\u306f\u3001\u30ad\u30fc\u62bc\u4e0b\u3092\u691c\u51fa\u3057\u305f\u3068\u304d\u306b\u3001CGEventTapCreate\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u3053\u3068\u3067\u30ad\u30fc\u30b9\u30c8\u30ed\u30fc\u30af\u3092\u30ed\u30ae\u30f3\u30b0\u3057\u307e\u3059\u3002\u3053\u306e\u95a2\u6570\u306f\u3001_myCGEventTapCallBack\u3068\u3044\u3046\u540d\u524d\u306e\u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u95a2\u6570\u3092\u547c\u3073\u51fa\u3059\u305f\u3081\u306e\u30a4\u30d9\u30f3\u30c8 \u30d5\u30c3\u30af\u3092\u8a2d\u5b9a\u3057\u307e\u3059\u3002\u3053\u306e\u30b3\u30fc\u30eb\u30d0\u30c3\u30af\u95a2\u6570\u306f\u3001\u30ad\u30fc\u30b9\u30c8\u30ed\u30fc\u30af\u3092\u30ed\u30ae\u30f3\u30b0\u3059\u308b\u5f79\u76ee\u3092\u62c5\u3063\u3066\u3044\u308bpressedKeyWithKeyCode\u3068\u3044\u3046\u540d\u524d\u306e\u95a2\u6570\u3092\u547c\u3073\u51fa\u3057\u307e\u3059\u3002\u3053\u306e\u30ad\u30fc\u30ed\u30ac\u30fc\u306f\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3 \u30a6\u30a3\u30f3\u30c9\u30a6\u3092\u76e3\u8996\u3057\u3001\u6b21\u306e\u5f62\u5f0f\u3067\u30ed\u30b0\u306b\u66f8\u304d\u8fbc\u307f\u307e\u3059\u3002<\/p>\n

<span class=\u2019keylog_process\u2019>[\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u540d]<\/span><\/p>\n

\u30ad\u30fc\u30ed\u30ac\u30fc\u306f\u3001\u8a2d\u5b9a\u53ef\u80fd\u306a\u6570\u306e\u30ad\u30fc\u30b9\u30c8\u30ed\u30fc\u30af(\u30c7\u30d5\u30a9\u30eb\u30c8\u306f50)\u3092\u30ed\u30ae\u30f3\u30b0\u3057\u305f\u5f8c\u3001\u3053\u306e\u30ed\u30b0\u3092\u6b21\u306e\u5f62\u5f0f\u3067C2\u30b5\u30fc\u30d0\u306b\u9001\u4fe1\u3057\u307e\u3059\u3002<\/p>\n

<span class=\u2019keylog_user_keys\u2019>[\u30ed\u30ae\u30f3\u30b0\u3055\u308c\u305f\u30ad\u30fc\u30b9\u30c8\u30ed\u30fc\u30af]<\/span><\/p>\n

\u30ad\u30fc\u30ed\u30ac\u30fc\u306f\u3001\u30ea\u30bf\u30fc\u30f3 \u30ad\u30fc\u3084\u30d5\u30a1\u30f3\u30af\u30b7\u30e7\u30f3 \u30ad\u30fc\u306a\u3069\u306e\u7279\u6b8a\u30ad\u30fc\u306e\u30ed\u30ae\u30f3\u30b0\u3092\u51e6\u7406\u3059\u308b\u3053\u3068\u304c\u3067\u304d\u3001\u3053\u308c\u3089\u3092\u6b21\u306e\u5f62\u5f0f\u3067\u30ed\u30b0\u5185\u306b\u8a18\u9332\u3057\u307e\u3059\u3002<\/p>\n

<span class=\u2019keylog_spec_key\u2019>[\u7279\u6b8a\u6587\u5b57]<\/span><\/p>\n

\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3<\/h3>\n

Unit 42\u304c\u5206\u6790\u3057\u305fXAgentOSX\u30b5\u30f3\u30d7\u30eb\u306f\u3001\u4ee5\u4e0b\u306eIP\u30a2\u30c9\u30ec\u30b9\u304a\u3088\u3073\u30c9\u30e1\u30a4\u30f3\u540d\u3092C2\u30b5\u30fc\u30d0\u3068\u3057\u3066\u4f7f\u3046\u3088\u3046\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u307e\u3057\u305f\u3002:<\/p>\n

23.227.196[.]215
\napple-iclods[.]org
\napple-checker[.]org
\napple-uptoday[.]org
\napple-search[.]info<\/p>\n

\u3053\u306e\u30b5\u30f3\u30d7\u30eb\u3092\u5206\u6790\u3057\u305f\u969b\u3001\u4e88\u5099\u306eC2\u4f4d\u7f6e\u3068\u3057\u3066\u4f7f\u308f\u308c\u3066\u3044\u305f\u30c9\u30e1\u30a4\u30f3\u540d\u306f\u767b\u9332\u3055\u308c\u3066\u3044\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u3057\u305f\u304c\u3063\u3066\u3001\u3053\u308c\u3089\u306e\u30c9\u30e1\u30a4\u30f3\u306f\u3001\u5225\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3078\u306e\u30ea\u30f3\u30af\u304c\u3042\u308a\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u307e\u305f\u3001\u4e3b\u8981\u306eC2\u4f4d\u7f6e\u3067\u3042\u308b23.227.196[.]215\u306b\u57fa\u3065\u304f\u3001\u5225\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u306f\u4f55\u3082\u898b\u3064\u304b\u308a\u307e\u305b\u3093\u3067\u3057\u305f\u3002\u3057\u304b\u3057\u3001CrowdStrike<\/a>\u306b\u3088\u308c\u3070\u3001\u8fd1\u63a5\u3059\u308bIP\u30a2\u30c9\u30ec\u30b923.227.196[.]217\u306fSofacy\u30b0\u30eb\u30fc\u30d7\u304c\u7c73\u56fd\u306e\u6c11\u4e3b\u515a\u5168\u56fd\u59d4\u54e1\u4f1a\u3078\u306e\u653b\u6483\u306b\u4f7f\u3063\u305fXTunnel\u30da\u30a4\u30ed\u30fc\u30c9\u7528\u306eC2\u4f4d\u7f6e\u3060\u3068\u5224\u660e\u3057\u307e\u3057\u305f\u3002\u3053\u308c\u3089\u306eIP\u30a2\u30c9\u30ec\u30b9\u306f\u76f4\u63a5\u7684\u306b\u91cd\u8907\u3057\u3066\u306f\u3044\u307e\u305b\u3093\u304c\u3001Sofacy\u30b0\u30eb\u30fc\u30d7\u304c\u81ea\u5206\u305f\u3061\u306e\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u3092\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u3059\u308b\u305f\u3081\u3001\u540c\u3058\u30db\u30b9\u30c6\u30a3\u30f3\u30b0\u30b5\u30fc\u30d3\u30b9\u3092\u5229\u7528\u3057\u7d9a\u3051\u3066\u3044\u308b\u3053\u3068\u306f\u660e\u3089\u304b\u3067\u3059\u3002<\/p>\n

\u7d50\u8ad6<\/h2>\n

Sofacy\u30b0\u30eb\u30fc\u30d7\u306f\u3001\u8907\u6570\u306e\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3067\u653b\u6483\u6d3b\u52d5\u3092\u6210\u3057\u9042\u3052\u308b\u305f\u3081\u3001\u81ea\u5206\u305f\u3061\u306e\u30c4\u30fc\u30eb\u306e\u5f37\u5316\u3092\u3057\u7d9a\u3051\u3066\u3044\u307e\u3059\u3002\u672c\u4ef6\u306e\u5834\u5408\u3001\u3053\u306e\u8105\u5a01\u30b0\u30eb\u30fc\u30d7\u306f\u3001Windows\u7248\u306e\u30c4\u30fc\u30eb\u306e1\u3064\u3068\u540c\u3058\u540d\u524d\u306eXAgent\u3092\u3053\u306emacOS\u7248\u306e\u30c4\u30fc\u30eb\u5411\u3051\u306b\u4f7f\u3044\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u3053\u306e\u30c4\u30fc\u30eb\u306emacOS\u7248\u4e9c\u7a2e\u306f\u3001Windows\u7248\u3068\u985e\u4f3c\u306e\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u901a\u4fe1\u65b9\u6cd5\u3092\u4f7f\u3063\u3066\u3044\u308b\u305f\u3081\u3001Unit 42\u304cKomplex\u3068Seduploader<\/a>\u00a0(\u4ee5\u524d\u306e\u547c\u79f0\u306fSofacy Carberp)\u30c4\u30fc\u30eb\u306e\u6bd4\u8f03\u3092\u3057\u3066\u3044\u308b\u4e2d\u3067\u3001\u3053\u306e\u30b0\u30eb\u30fc\u30d7\u304c\u4fb5\u5bb3\u3055\u308c\u305f\u30db\u30b9\u30c8\u3092\u5236\u5fa1\u3059\u308b\u305f\u3081\u306b\u3001\u7d71\u5408\u5316\u3055\u308c\u305fC2\u30b5\u30fc\u30d3\u30b9\u3092\u5229\u7528\u3057\u7d9a\u3051\u3066\u3044\u308b\u3053\u3068\u304c\u5206\u304b\u308a\u307e\u3057\u305f\u3002\u307e\u305f\u3001\u653b\u6483\u30c6\u30ec\u30e1\u30c8\u30ea\u3092\u6b20\u3044\u3066\u3044\u308b\u3082\u306e\u306e\u3001\u79c1\u305f\u3061\u306fSofacy\u306b\u3088\u3063\u3066\u4ed5\u639b\u3051\u3089\u308c\u305f\u7c73\u56fd\u6c11\u4e3b\u515a\u5168\u56fd\u59d4\u54e1\u4f1a\u3078\u306e\u653b\u6483\u6d3b\u52d5\u3068\u306e\u7de9\u3084\u304b\u306a\u7e4b\u304c\u308a\u304c2\u3064\u306e\u653b\u6483\u306b\u304a\u3051\u308b\u30db\u30b9\u30c6\u30a3\u30f3\u30b0 \u30c7\u30fc\u30bf\u3092\u898b\u3066\u5224\u65ad\u3067\u304d\u307e\u3057\u305f\u3002<\/p>\n

Palo Alto Networks\u306e\u304a\u5ba2\u69d8\u306f\u3001\u4ee5\u4e0b\u306e\u901a\u308a\u3001XAgentOSX \u306e\u653b\u6483\u304b\u3089\u4fdd\u8b77\u3055\u308c\u3066\u3044\u307e\u3059\u3002<\/p>\n