¿ËÈÕ£¬¹ú¼ÒÅÌËã»ú²¡¶¾Ó¦¼±´¦Öóͷ£ÖÐÐĺÍÅÌËã»ú²¡¶¾·ÀÖÎÊÖÒÕ¹ú¼Ò¹¤³ÌʵÑéÊÒÒÀÍйú¼ÒÅÌËã»ú²¡¶¾ÆÊÎöƽ̨¼à²â·¢Ã÷ľÂí²¡¶¾×îбäÖÖ¡ª¡ª¡°Òøºü¡±¡£´ó×Úαװ³É¡°µç×Ó·¢Æ±¿ª¾ßÀֳɡ±µÄ´¹ÂÚÓʼþÕýÔÚÁ÷ͨ£¬ÓʼþÖС°µã»÷ÏÂÔØ´Ë·¢Æ±¡±µÄÁ´½Ó£¬ÊµÔòÎªÒøºü²¡¶¾ÏÂÔØµØÖ·¡£

ͼƬȪԴ£º¹ú¼ÒÅÌËã»ú²¡¶¾Ó¦¼±´¦Öóͷ£ÖÐÐĹٷ½Î¢²©
ijµ¥Î»ÒÑ·ºÆðÓû§µã»÷ºóÖն˱»¿ØÖƵÄÇéÐΣ¬¾³ÍâÊÆÁ¦Õýͨ¹ý´ËÀàÊֶζԺ£ÄÚ¶à¸öÐÐÒµµÄÖն˾ÙÐÐÕë¶ÔÐÔÉøÍ¸¡£Ò»µ©ÖÐÕУ¬Óû§²»µ«Ð¡ÎÒ˽¼ÒÊý¾ÝÃæÁÙй¶Σº¦£¬Ð¡ÎÒ˽¼ÒÕË»§×ʽðÇå¾²Ò²½«Êܵ½ÑÏÖØÍþв¡£
ÂÄÀúÖ¤£¬BevictorΰµÂÏÂÒ»´ú·À»ðǽ¡¢EDR¡¢×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢APTÇå¾²¼à²âϵͳ¾ù¿É׼ȷ¼ì²â²¢²éɱ¸Ã²¡¶¾£¬ÌṩÖÜÈ«µÄÇå¾²±£»¤£¬ÓÐÓÃ×èÖ¹¸ÃÊÂÎñÉìÕÅ¡£
²¡¶¾ÑùÌìÖ°Îö
BevictorΰµÂÚÐÌýʵÑéÊÒÒÑ»ñÈ¡¸ÃÒøºü²¡¶¾Ñù±¾£¬²¢¾ÙÐÐÊÖÒÕÆÊÎö£¬Æä¹¥»÷°ì·¨ÈçÏ£º
ÓÃÕì¿ÇÈí¼þ¼ì²â£¬ÎÞ¿Ç

¼ì²âÊý×ÖÊðÃû£¬ÌáÐÑÎÞЧ

³ÌÐòÔËÐк󣬽âѹshellcode

½«²¡¶¾´úÂëÖü´æ³ÉÎļþ£¬ÐÞ¸´ºó£¬ÓÃÕì¿ÇÈí¼þ¼ì²â£¬ÅжÏÎÞ¿Ç

´ÓpdbÐÅÏ¢À´¿´ÓÐÀú³Ì±£»¤¹¦Ð§

»ñȡĿ½ñÖ÷»úÀú³ÌÁÐ±í£¬²éÕÒÊÇ·ñ±£´æÒÔÏÂÃû³ÆµÄÀú³Ì

ÅжÏÊÇ·ñ¹ÜÀíԱȨÏÞÔËÐÐ

½¨É軥³â£¬×èÖ¹ÖØ¸´ÔËÐÐ

·¿ªÖ¸¶¨·þÎñ

»ñÈ¡Àú³ÌÁîÅÆºó£¬ÊµÑéÌáȨ

×¼±¸ÊÂÇéÍê±Ïºó£¬×îÏÈÈëÇÖÀú³Ì

ÉêÇëÄÚ´æ¿Õ¼ä£¬Ð´ÈëÊý¾Ý

»ñȡʱ¼ä£¬ÌìÉúËæ»úÊý

ÈôÊÇvss·þÎñ×¢Èëʧ°Ü£¬ÊµÑé×¢ÈëÆäËûÖ¸¶¨Àú³Ì

½âÃܺڿÍIP

¼ÓÔØÎļþÃûºÍ·þÎñÃû

¼ì²âÖ¸¶¨Àú³ÌÊÇ·ñ±£´æ£¬ÈôÊDZ£´æµ÷½âfwpÉèÖÃ

fwp¹ýÂËÉèÖÃ

¼ÓÔØÎļþÃû²ÎÊý£¬ÌìÉúÎļþ£¬¸ÃÎļþΪÇý¶¯Îļþ£¬ÓÃÀ´¶Ô¿¹É±¶¾Èí¼þ

½¨Éè·þÎñ²¢Æô¶¯

»ñȡָ¶¨Àú³ÌÐÅÏ¢

ŲÓÃÊͷŵÄÇý¶¯Îļþ£¬¶Ô֮ǰ»ñÈ¡µÄÀú³Ì´¦Öóͷ£

н¨Ö¸¶¨Îļþ

ŲÓÃcom½Ó¿Ú£¬ÉèÖÃÍýÏëʹÃü£¬½«ÉÏÃæÌìÉúµÄÎļþ£¬ÉèÖÿª»ú×ÔÆô¶¯

ÉèÖóÌÐò×ÔÏú»Ù£¬½«Ô´Îļþɾ³ý

¶ÔÖ¸¶¨Àú³ÌÉæ¼°µÄ·þÎñɾ³ý

Òøºü²¡¶¾Ê×ÏÈͨ¹ýαװ³Éϵͳ½¹µãÀú³Ì£¨Èçsvchost.exe¡¢winlogon.exe£©×¢Èë¶ñÒâ´úÂë£¬ÆÆËðϵͳÎȹÌÔËÐУ»½ø¶øÍ¨¹ý×¢²á×ÔÆô¶¯·þÎñºÍ½¨ÉèÒþ²ØÍ¨Ñ¶Í¨µÀ£¨ÈçRPC£©ÊµÏÖ³¤ÆÚ»¯×¤Áô£¬ºã¾ÃDZÔÚÓÚ×°±¸ÖУ»ÔÚÊÍ·ÅÇý¶¯Îļþ¶Ô¿¹Çå¾²Èí¼þ²¢ÌáȨ»ñÈ¡¹ÜÀíԱȨÏ޺󣬷Å×ÝÇÔÈ¡Óû§Òþ˽¼°Ö÷ÒªÃô¸ÐÊý¾Ý£»×îÖÕ£¬²¡¶¾»áÓëºÚ¿Í¿ØÖÆ·þÎñÆ÷½¨ÉèÅþÁ¬Íê³ÉÊý¾ÝÍâй£¬²¢×Ô¶¯É¾³ýÔ´ÎļþÏú»ÙÈëÇÖºÛ¼£¡£
ÕâÖÖÒþ²ØµÄÈëÇÖÊÖ·¨²»µ«ÈÃÓû§ÄÑÒÔ²ì¾õÒì³££¬»¹ÎªºóÐø¹¥»÷ÂñÏÂÒþ»¼£¬¶Ô×°±¸ÓëÊý¾ÝÇå¾²×é³ÉϵͳÐÔµÄÑÏÖØÍþв¡£
ÔÚ´Ë£¬Ð¡ÌìÒ²ÌáÐѸ÷ÈË£¬´øÃÜÂëµÄ¼ÓÃÜѹËõ°ü²¢²»´ú±íÄÚÈÝÇå¾²£¬´Ë´Î¹¥»÷ÕßΪѹËõ°üÉèÖÃÏàʶѹÃÜÂ룬²¢ÔÚ´¹ÂÚÐÅÏ¢Öмû¸æÃÜÂ룬ÒÔ´ËÌÓ¹ýÁ˲¿·ÖÇå¾²Èí¼þµÄ¼ì²â£¬Ê¹Æä¾ßÓиüÇ¿µÄÈö²¥ÄÜÁ¦¡£
±¾´Î¹¥»÷ÕßʹÓõĴ¹ÂÚÐÅÏ¢ÈÔÈ»ÒÔαÔì¹Ù·½Í¨ÖªÎªÖ÷£¬¸÷ÈËҪʱ¿Ì¼á³ÖСÐÄÐÔÓëÌá·ÀÒâʶ£¬Ñø³É¸üÐÂɱ¶¾Èí¼þµÄϰ¹ß£¬ÊµÊ±½ÓÄÉ·À»¤²½·¥£¬½÷·ÀÖÖÖÖµçÐÅÍøÂçÕ©ÆÔ˶¯¡£
Ò»Ñùƽ³££¬Èç·¢Ã÷µçÄÔ²Ù×÷ϵͳµÄÇå¾²¹¦Ð§ºÍ·À²¡¶¾Èí¼þÔÚ·Ç×ÔÖ÷²Ù×÷µÄÇéÐÎϱ»Òì³£¹Ø±Õ£¬¾ÍÒªÒýÆðСÐÄ£¬Á¬Ã¦ÇжÏÍøÂ磬¶ÔÖ÷ÒªÊý¾Ý¾ÙÐб¸·ÝǨáãºóÔÝͣʹÓøÃ×°±¸£¬´ýרҵְԱ¼ì²â¡¢ÅŲéÈ·ÈÏÇå¾²ºó£¬ÔÙÖØÐÂͶÈëʹÓá£
BevictorΰµÂ²úÆ··ÀÓùÉèÖÃÖ¸ÄÏ
BevictorΰµÂÏÂÒ»´ú·À»ðǽϵͳ·ÀÓùÉèÖÃ
1¡¢Í¨¹ý»á¼û¿ØÖÆÕ½ÂÔ»òºÚÃûµ¥½ûÓá°13.230.98.233¡±µÈºÚ¿ÍIPµØÖ·¼°RPCÐÒ飬×è¶ÏÒøºü²¡¶¾Í¨Ñ¶ÅþÁ¬½¨É裻
2¡¢Éý¼¶µ½×îв¡¶¾ÌØÕ÷¿â£¬ÉèÖò¡¶¾·À»¤Õ½ÂÔ£¬¼ì²â²¢×è¶ÏÒøºü²¡¶¾£¬¼Í¼Ïà¹ØÈÕÖ¾£»
3¡¢ÉèÖÃÓʼþ¹ýÂ˹¦Ð§£¬½«ÒÑ·ºÆðµÄÒøºü²¡¶¾ÓʼþÄÚÈݼÓÈëºÚÃûµ¥¾ÙÐйýÂË£»
4¡¢ÆôÓÃÍþвÇ鱨¹¦Ð§£¬ÊµÊ±×èµ²ÓëÒøºü²¡¶¾Ïà¹ØµÄ×îÐÂIP»òÓòÃûµÈ£¬¼ÓËÙ×赲ЧÂÊ£»
5¡¢¿ªÆôÁª¶¯¹¦Ð§£¬»ñÈ¡BevictorΰµÂEDR¡¢½©Ê¬ÍøÂçľÂíºÍÈ䳿¼à²âÓë´¦Öóͷ£µÈ²úÆ·¼ì²âЧ¹û£¬ÊµÊ±×è¶ÏÄÚÍøÒÑѬȾÖ÷»úºáÏòÈö²¥£¬¿ØÖÆÍøÂçÈö²¥¹æÄ£¡£
BevictorΰµÂEDRϵͳ·ÀÓùÉèÖÃ
1¡¢ÆôÓÃÓʼþ¼à¿ØÄ£¿é£¬¶ÔÎüÊÕÓʼþµÄ¸½¼þʵÑéɨÃè»úÖÆ£¬¾«×¼×èµ²º¬¡°µç×Ó·¢Æ±¡±Àà´¹ÂÚÁ´½ÓµÄ¶ñÒâÓʼþ£¬´ÓÔ´Í·Çжϲ¡¶¾Èö²¥Á´£»
2¡¢¿ªÆôÎļþʵʱ¼à¿Ø¹¦Ð§£¬ÖصãÕë¶Ô¡°.pdf.exe.doc.exe¡±µÈαװÃûÌõġ°µç×Ó·¢Æ±¡±ÀàÎļþ¾ÙÐÐÉî¶ÈɨÃ裬·¢Ã÷Òì³£ÎļþÁ¬Ã¦¸ôÀ룬±ÜÃⲡ¶¾Ö´ÐÐÓëÀ©É¢£»
3¡¢¿ªÆôϵͳ¼Ó¹Ì¹¦Ð§£¬¿ÉÓÐÓÃ×èµ²¸ÃÒøºü²¡¶¾¶ÔϵͳҪº¦Î»ÖþÙÐÐÆÆËðºÍ¸Ä¶¯¡£
BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ·ÀÓùÉèÖÃ
1¡¢°²ÅÅ΢¸ôÀëÕ½ÂÔ£¬»ùÓÚÐÒé¡¢¶Ë¿Ú¡¢IPµÈά¶È×è¶ÏÒì³£Á÷Á¿Í¨Ñ¶£¬¹¹½¨ÍøÂç»á¼û¿ØÖÆÆÁÕÏ£¬ÓÐÓÃ×èÖ¹²¡¶¾ÔÚ¾ÖÓòÍøÄڵĺáÏòÀ©É¢Î£º¦£»
2¡¢½¨ÉèÖÜÆÚÐÔÎó²îɨÃè»úÖÆ£¬ÁýÕÖϵͳ¡¢Êý¾Ý¿â¡¢ÖÐÐļþµÈ×ʲú£¬ÊµÊ±ÐÞ¸´¿ÉÄܱ»²¡¶¾Ê¹ÓõÄÇå¾²Îó²î£¬ÌáǰÏû³ý¹¥»÷Ãæ£»
3¡¢ÆôÓò¡¶¾ÊµÊ±¼ì²âÒýÇæ£¬Õë¶ÔÒøºü²¡¶¾ÎÞ¿ÇÌØÕ÷£¬ÍŽáÐÐΪÆÊÎöÊÖÒÕ¶Ôδ֪²¡¶¾¾ÙÐÐÖÇÄÜ×èµ²£¬Í¨¹ý¶¯Ì¬ÌØÕ÷ʶ±ðÌáÉý·ÀÓù¾«×¼¶È¡£
BevictorΰµÂAPTÇå¾²¼à²âϵͳ¼ì²âÉèÖÃ
1¡¢ÔÚÇå¾²Õ½ÂÔÖпªÆô¶ñÒâÎļþ¼ì²â¹¦Ð§ºó£¬²úƷͨ¹ýÍþвÇ鱨¼ì²â¡¢²¡¶¾¼ì²â¡¢TAI01-¹ÌÍø¶ñÒâ³ÌÐò¼ì²âÖÇ»ÛÒýÇæÓëɳÏä¼ì²âµÈÒ»Ì廯¶àÒýÇæ¼ì²âÄÜÁ¦£¬¾«×¼Ê¶±ðÁ÷Á¿ÖеÄÒøºü²¡¶¾¡£
2¡¢ÔÚÑÐÅд¦Öóͷ£Ä£¿éÖÐÉó²éÒøºü²¡¶¾¼ì²âЧ¹û£¬µã»÷¡¾¶ñÒâÎļþÏêÇé¡¿¿É»ñÈ¡²¡¶¾ÌØÕ÷ÏêÇ鼰ɳÏäÆÊÎö±¨¸æ¡£
BevictorΰµÂ²úÆ·»ñÈ¡·½·¨
¡ñ BevictorΰµÂÏÂÒ»´ú·À»ðÇ½ÏµÍ³ÌØÕ÷¿âÏÂÔØµØÖ·£ºftp://ftp.topsec.com.cn/
¡ñ BevictorΰµÂEDRµ¥»ú°æÏÂÔØµØÖ·£ºhttp://edr.topsec.com
¡ñ BevictorΰµÂ×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢BevictorΰµÂEDRÆóÒµ°æÊÔÓÿÉͨ¹ýBevictorΰµÂ¸÷µØ·Ö¹«Ë¾»ñÈ¡£ºhttp://www.topsec.com.cn/contact/
¡ñ BevictorΰµÂAPTÇå¾²¼à²âϵͳ¹æÔò¿â»ñÈ¡·½·¨£ºhttps://knowledge.topsec.com.cn/
Ïà¹ØÔĶÁ
1¡¢ÑëÊÓµãÃû£¡GoldPickaxeÐÂÐÍAI²¡¶¾ÈëÇÖ£¬ÄãµÄÁ³»¹Çå¾²Âð£¿
2¡¢Money MessageÀÕË÷²¡¶¾Í»ÏÖ£¬BevictorΰµÂ¶à¿î²úÆ·¾ù¿É·ÀÓù£¡