{"id":65690,"date":"2020-09-16T09:00:00","date_gmt":"2020-09-16T01:00:00","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=65690"},"modified":"2020-10-21T14:14:18","modified_gmt":"2020-10-21T06:14:18","slug":"%e3%80%8a%e6%9c%80%e6%96%b0%e5%8b%92%e7%b4%a2%e7%97%85%e6%af%92%e3%80%8bdarkside-%e5%85%88%e8%a9%95%e4%bc%b0%e7%9b%ae%e6%a8%99%e4%bc%81%e6%a5%ad%e8%b2%a1%e5%8a%9b%ef%bc%8c%e5%86%8d%e6%b1%ba%e5%ae%9a","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=65690","title":{"rendered":"\u300a\u6700\u65b0\u52d2\u7d22\u75c5\u6bd2\u300bDarkside \u5148\u8a55\u4f30\u76ee\u6a19\u4f01\u696d\u8ca1\u529b\uff0c\u518d\u6c7a\u5b9a\u8d16\u91d1\u6578\u76ee\/ Crysis \u91cb\u51fa\u9023\u83dc\u9ce5\u99ed\u5ba2\u4e5f\u80fd\u4e0a\u624b\u7684\u5de5\u5177\u5957\u4ef6"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\"><\/h3>\n\n\n\n<p>\u904e\u53bb\u5e7e\u9031\uff0c<a href=\"https:\/\/t.rend.tw\/?i=OTQzMw\">\u8da8\u52e2\u79d1\u6280<\/a>\u767c\u73fe\u52d2\u7d22\u75c5\u6bd2\u51fa\u73fe\u6700\u65b0\u767c\u5c55\u3002\u9996\u5148\u662f\u4e00\u500b\u65b0\u7684\u52d2\u7d22\u75c5\u6bd2\u5bb6\u65cf (\u9ed1\u6697\u9762-Darkside) \u4e4b\u5916\uff0cCrysis\/Dharma \u52d2\u7d22\u75c5\u6bd2\u96c6\u5718\u4e5f\u91cb\u51fa\u4e86\u4e00\u500b\u99ed\u5ba2\u5de5\u5177\u5957\u4ef6\u3002<br>\u53e6\u5916,\u5728\u8a0a\u606f\u5a01\u8105\u90e8\u5206\uff0c\u6211\u5011\u767c\u73fe\u4e86\u4e00\u6ce2\u5c08\u9580\u6563\u5e03 Negasteal\/Agent Tesla \u60e1\u610f\u7a0b\u5f0f\u7684\u91dd\u5c0d\u6027\u96fb\u5b50\u90f5\u4ef6\u653b\u64ca\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"535\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-1024x535.png\" alt=\"Darkside \u5148\u8a55\u4f30\u76ee\u6a19\u4f01\u696d\u8ca1\u529b\uff0c\u518d\u6c7a\u5b9a\u8d16\u91d1\u6578\u76ee\/ Crysis \u91cb\u51fa\u9023\u83dc\u9ce5\u99ed\u5ba2\u4e5f\u80fd\u4e0a\u624b\u7684\u5de5\u5177\u5957\u4ef6\" class=\"wp-image-42281\" srcset=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-1024x535.png 1024w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-300x157.png 300w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-768x401.png 768w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-600x314.png 600w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware-800x418.png 800w, https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2017\/01\/ransomware.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Darkside \u52d2\u7d22\u75c5\u6bd2<\/strong>:\u5148\u8a55\u4f30\u653b\u64ca\u76ee\u6a19\u8ca1\u529b\uff0c\u518d\u6c7a\u5b9a\u8981\u52d2\u7d22\u591a\u5c11\u9322<\/h3>\n\n\n\n<p><br>\u4e00\u500b\u540d\u53eb\u300cDarkside(\u9ed1\u6697\u9762)\u300d\u7684\u65b0<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/ransomware\">\u52d2\u7d22\u75c5\u6bd2<\/a>\u5bb6\u65cf (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba\uff1a<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Ransom.Win32.DARKSIDE.YXAH-THA\">Ransom.Win32.DARKSIDE.YXAH-THA<\/a>)\u00a0 <a href=\"https:\/\/id-ransomware.blogspot.com\/search?q=darkside\">\u6700\u8fd1\u6d6e\u4e0a\u6aaf\u9762<\/a>\u3002\u6b64\u52d2\u7d22\u75c5\u6bd2\u6703\u8981\u8105\u53d7\u5bb3\u8005\u82e5\u4e0d\u652f\u4ed8\u8d16\u91d1\uff0c\u5c07\u516c\u5e03\u53d7\u5bb3\u8005\u7684\u8cc7\u6599\uff0c\u6b64\u624b\u6cd5\u8207\u4e4b\u524d\u7684 <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/maze-ransomware-attacks-us-it-firm\">Maze<\/a> \u548c <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/updated-analysis-on-nefilim-ransomware-s-behavior\">Nefilim<\/a> \u52d2\u7d22\u75c5\u6bd2\u985e\u4f3c\u3002\u88ab\u52a0\u5bc6\u7684\u6a94\u6848\uff0c\u5176\u526f\u6a94\u540d\u6703\u88ab\u52a0\u4e0a\u53d7\u5bb3\u8005\u96fb\u8166\u7684\u7db2\u8def\u5361 (MAC) \u4f4d\u5740\u3002<\/p>\n\n\n\n<p>\u6839\u64da\u52d2\u7d22\u75c5\u6bd2\u7684 Tor \u7db2\u9801\uff0c\u5176\u5e55\u5f8c\u72af\u7f6a\u96c6\u5718\u5176\u5be6\u6703\u8a55\u4f30\u76ee\u6a19\u4f01\u696d\u7684\u8ca1\u529b\uff0c\u7136\u5f8c\u518d\u6c7a\u5b9a\u8981\u52d2\u8d16\u7684\u91d1\u984d\u3002\u9664\u6b64\u4e4b\u5916\uff0c\u99ed\u5ba2\u4f3c\u4e4e\u4e0d\u6703\u653b\u64ca\u91ab\u7642\u3001\u6559\u80b2\u3001\u975e\u71df\u5229\u53ca\u653f\u5e9c\u7b49\u6a5f\u69cb\u3002<br><br><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/documents.trendmicro.com\/images\/TEx\/articles\/Darkside%20Ransomnote.jpg\" alt=\"\"\/><figcaption>\u5716 1\uff1aDarkside \u52d2\u7d22\u8a0a\u606f\u5167\u5bb9\u3002<\/figcaption><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Crysis \u52d2\u7d22\u75c5\u6bd2\u91cb\u51fa<\/strong>\u5c31\u9023\u83dc\u9ce5\u99ed\u5ba2\u4e5f\u80fd\u8f15\u9b06\u6ef2\u900f\u7db2\u8def\u7684<strong>\u99ed\u5ba2\u5de5\u5177\u5957\u4ef6<\/strong><\/h3>\n\n\n\n<p><br>Crysis\/Dharma \u52d2\u7d22\u75c5\u6bd2 (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba &nbsp;<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a>) \u6700\u8fd1\u91cb\u51fa\u4e86\u4e00\u500b\u540d\u70ba\u300cToolbox\u300d\u7684\u99ed\u5ba2\u5de5\u5177\u5957\u4ef6\u3002&nbsp;Toolbox \u7576\u4e2d\u5305\u542b\u4e86\u5c08\u9580\u7528\u4f86\u641c\u522e\u5bc6\u78bc\u7684 Mimikatz\u3001\u5c08\u9580\u7528\u4f86\u7aca\u53d6\u9060\u7aef\u684c\u9762\u5354\u5b9a (RDP) \u5bc6\u78bc\u7684 NirSoft Remote Desktop PassView\u3001\u5c08\u9580\u7528\u4f86\u7aca\u53d6\u96dc\u6e4a\u78bc\u7684 Hash Suite Tools Free\uff0c\u4ee5\u53ca\u5176\u4ed6\u7528\u4f86\u641c\u5c0b\u653b\u64ca\u76ee\u6a19\u96fb\u8166\u4e26\u690d\u5165\u52d2\u7d22\u75c5\u6bd2\u7684\u5de5\u5177\u3002\u6709\u4e86\u9019\u500b\u5957\u4ef6\uff0c\u5c31\u9023\u83dc\u9ce5\u99ed\u5ba2\u4e5f\u80fd\u8f15\u9b06\u6ef2\u900f\u7db2\u8def\u3002<\/p>\n\n\n\n<p>\u7531\u65bc Crysis \u63a1\u7528\u7684\u662f<a href=\"https:\/\/blog.trendmicro.com.tw\/?p=29105\">\u52d2\u7d22\u75c5\u6bd2\u670d\u52d9<\/a>&nbsp; (RaaS) \u7684\u7d93\u71df\u6a21\u5f0f\uff0c\u56e0\u6b64\u9019\u5957\u5de5\u5177\u6709\u52a9\u65bc\u8b93\u5b83\u6563\u64ad\u5f97\u66f4\u5ee3\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-background\" style=\"background-color:#eff0f1\">\u5ef6\u4f38\u95b1\u8b80:<a href=\"https:\/\/blog.trendmicro.com.tw\/?p=29105\">\u201d \u53ea\u8981 39 \u7f8e\u5143\u4fbf\u63d0\u4f9b\u300c\u7d42\u8eab\u6388\u6b0a\u300d\u201d \u2014\u6df1\u5c64\u7db2\u8def\u4e0a\u7684\u52d2\u7d22\u75c5\u6bd2\u670d\u52d9(RaaS),\u5c0d\u4f01\u696d\u7684\u610f\u7fa9\u70ba\u4f55?<\/a><\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Negasteal\/Agent Tesla \u7d93\u7531\u96fb\u5b50\u90f5\u4ef6\u6563\u767c\uff0c\u9396\u5b9a\u9280\u884c\u5ba2\u6236<\/strong><\/h3>\n\n\n\n<p><br>\u6211\u5011\u6700\u8fd1\u767c\u73fe\u4e86\u4e00\u6ce2\u96fb\u5b50\u90f5\u4ef6\u653b\u64ca\u5c08\u9580\u7d93\u7531\u60e1\u610f\u9644\u4ef6\u6563\u5e03 Negasteal\/Agent Tesla \u60e1\u610f\u7a0b\u5f0f (\u8da8\u52e2\u79d1\u6280\u547d\u540d\u70ba <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/TrojanSpy.MSIL.NEGASTEAL.DYSGXT\">TrojanSpy.MSIL.NEGASTEAL.DYSGXT<\/a>)\uff0c\u6b64\u6ce2\u653b\u64ca\u7684\u5c0d\u8c61\u662f\u6cf0\u570b\u4e00\u5bb6\u570b\u6709\u9280\u884c Krung Thai Bank (\u6cf0\u4eac\u9280\u884c) \u7684\u5ba2\u6236\u3002\u96fb\u5b50\u90f5\u4ef6\u5167\u5bb9\u662f\u6709\u95dc\u300c\u5c0d\u5916\u532f\u6b3e\u4ea4\u6613\u300d\u7684\u6536\u64da\uff0c\u532f\u6b3e\u91d1\u984d\u5c07\u8fd1 9,000 \u7f8e\u5143\uff0c\u90f5\u4ef6\u5167\u5bb9\u6703\u8acb\u4f7f\u7528\u8005\u4e0b\u8f09\u4e26\u53c3\u95b1\u9644\u4ef6\u6a94\u6848\u3002\u9644\u4ef6\u6a94\u6848\u662f\u4e00\u4efd\u6703\u653b\u64ca Microsoft Office &nbsp;<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2017-11882\">CVE-2017-11882<\/a> \u6f0f\u6d1e\u7684\u6587\u4ef6 (\u9019\u662f\u4e00\u500b\u5df2\u7d93\u6709 <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/vulnerabilities-and-exploits\/17-year-old-ms-office-flaw-cve-2017-11882-actively-exploited-in-the-wild\">17 \u5e74\u6b77\u53f2<\/a>\u7684 Microsoft Office \u8a18\u61b6\u9ad4\u5167\u5bb9\u640d\u6bc0\u6f0f\u6d1e)\uff0c\u4e00\u65e6\u653b\u64ca\u6210\u529f\uff0c\u5c31\u53ef\u4ee5\u4e0b\u8f09\u60e1\u610f\u6a94\u6848\u5230\u53d7\u5bb3\u96fb\u8166\u4e0a\u57f7\u884c\u3002<\/p>\n\n\n\n<p><a href=\"https:\/\/krebsonsecurity.com\/2018\/10\/who-is-agent-tesla\/\">\u9996\u6b21\u767c\u73fe\u65bc 2014 \u5e74<\/a>\u7684 Negasteal \u4e00\u76f4\u4ee5\u4f86\u90fd\u6703\u7d93\u7531\u7db2\u7ad9\u63a7\u5236\u53f0\u3001FTP \u6216 SMTP \u50b3\u9001\u7aca\u53d6\u7684\u8cc7\u6599\u3002\u6700\u8fd1\uff0c\u6211\u5011\u767c\u73fe\u5b83\u6703<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/negasteal-agent-tesla-now-gets-delivered-via-removable-drives-steals-credentials-from-becky-internet-mail\">\u7d93\u7531\u53ef\u5378\u9664\u5f0f\u88dd\u7f6e\u6d41\u50b3<\/a>\uff0c\u56e0\u70ba\u5b83\u6703\u7aca\u53d6 Becky!Internet Mail \u7684\u767b\u5165\u6191\u8b49\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/documents.trendmicro.com\/images\/TEx\/articles\/Negasteal%20sample%20email.jpg\" alt=\"\"\/><figcaption>\u5716 2\uff1a\u542b\u6709 Negasteal \u60e1\u610f\u9644\u4ef6\u7684\u96fb\u5b50\u90f5\u4ef6\u6a23\u672c\u3002<\/figcaption><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<pre class=\"wp-block-code\"><code><\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>\u5165\u4fb5\u6307\u6a19\u8cc7\u6599<\/strong><\/h3>\n\n\n\n<p><strong>Darkside \u52d2\u7d22\u75c5\u6bd2<\/strong><\/p>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>SHA-256<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u75c5\u6bd2\u78bc\u5075\u6e2c\u540d\u7a31<\/strong><\/td><\/tr><tr><td>9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297<br><br><\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Ransom.Win32.DARKSIDE.YXAH-THA\">Ransom.Win32.DARKSIDE.YXAH-THA<\/a><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Ransom.Win32.AVADDON.YJAF-A\"><br><\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>\u7db2\u5740<\/strong><\/p>\n\n\n\n<ul><li>hxxp:\/\/darksidedxcftmqa[.]onion\/<\/li><\/ul>\n\n\n\n<p><strong>Crysis\/Dharma <\/strong><strong>\u52d2\u7d22\u75c5\u6bd2<\/strong><\/p>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>SHA-256<\/strong><\/td><td><strong>\u6a94\u6848\u540d\u7a31<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u75c5\u6bd2\u78bc\u5075\u6e2c\u540d\u7a31<\/strong><\/td><\/tr><tr><td>1cec5e4563e2c1570353e54a4ecc12ab4d896ab7227fd8651adcd56b884c0c1c<\/td><td>GdAgentSrv.de.dll<\/td><td>HackTool.Win64.CVE20160099.A<\/td><\/tr><tr><td>28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063<\/td><td>process-hacker-2-39.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/pua.win32.prochack.a\">PUA.Win32.ProcHack.A<\/a><\/td><\/tr><tr><td>3680b9e492f49abc108313c62ceb0f009d5ed232c874cae8828c99ebf201e075<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><\/td><\/tr><tr><td>47dc3672971c242154a36622145de7060f17f56af75d21e2130e4f57089f5e48<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><\/td><\/tr><tr><td>75d9d85b152e030eb73d17c691203b49bf593ea6a4bddeae48ca255b22c2d36d<\/td><td>takeaway_ps1<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/trojan.ps1.crysis.aa\">Trojan.PS1.CRYSIS.AA<\/a><\/td><\/tr><tr><td>77cbab006cf6a801dbd1c752659bddf28562fb8681d20305dd1dc0b1e105c67a<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><\/td><\/tr><tr><td>78983ad10fe05fadccb201dd3e8c7f952e93332433a42e3d331531c5497d1330<\/td><td>winhost.exe<\/td><td>Ransom.Win32.CRYSIS.TIBGGQ<\/td><\/tr><tr><td>b0b8fd4f6ab383014ea225c2b7776735af059f526cd7c4fdbdcb2e99d074ade7<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><\/td><\/tr><tr><td>b2d2f4ecbc680d590743044744b3ff33c38e4aeb0ada990b0ae7be8291368155<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><\/td><\/tr><tr><td>b5a69f7c4a3681a753f3512e3b36ac06c6ddbb1129a3e87f8c722ff4f9834f0a<\/td><td>purgeMemory.ps1<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/trojan.ps1.killsvc.a\">Trojan.PS1.KILLSVC.A<\/a><a href=\"file:\/\/\/C:\/Users\/Kat\/Desktop\/hacktool\">hacktool<\/a><\/td><\/tr><tr><td>edef024abe48d6ed7b4757d63a8fd448a8ecf1ad15afd39cc97c97b27ed4498e<br><br><\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><br><br><\/td><\/tr><tr><td>ef5f2ce1a4d68d656400906ae906b0c7e7f61017f14840a7ac145d59ee69a4bd<\/td><td>takeaway.exe<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/ransom.win32.crysis.tibggs\">Ransom.Win32.CRYSIS.TIBGGS<\/a><br><br><\/td><\/tr><tr><td>f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446<\/td><td>NS2.ex<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/hacktool.win32.nettool.a\">HackTool.Win32.NetTool.A<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><strong>Negasteal\/Agent Tesla<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>SHA-256<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u75c5\u6bd2\u78bc\u5075\u6e2c\u540d\u7a31<\/strong><\/td><\/tr><tr><td>58e74875b3659fa34aa1ecefba1a43cc049b7bb1c83de5a26ec8045c60f1099e<br><br><\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.W97M.CVE201711882.YQUOOUM\">Trojan.W97M.CVE201711882.YQUOOUM<\/a><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Ransom.Win32.AVADDON.YJAF-A\"><br><\/a><\/td><\/tr><tr><td>6991150c06b278712b052377ef768ca80923ff9c3396e7de18fa0fbce7211c96<\/td><td><a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/TrojanSpy.MSIL.NEGASTEAL.DYSGXT\">TrojanSpy.MSIL.NEGASTEAL.DYSGXT<\/a><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>\u539f\u6587\u51fa\u8655\uff1a<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cybercrime-and-digital-threats\/threat-recap-darkside-crysis-negasteal-coinminer\">Threat Recap:Darkside, Crysis, Negasteal, Coinminer<\/a> <em>\u5206\u6790\u5e2b\uff1aMiguel Ang\u3001Raphael Centeno\u3001Don Ovid Ladores\u3001Nikko Tama\u00f1a \u8207 Llallum Victoria<\/em><\/p>\n\n\n\n<p><\/p>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/t.rend.tw\/?i=OTAwOQ\n\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2015\/08\/Windows10Banner-540x90v5.gif\" alt=\"\"\/><\/a><figcaption>  PC-cillin\u4e0d\u53ea\u9632\u6bd2\u4e5f\u9632\u8a50\u9a19 \u2713\u624b\u6a5f\u2713\u96fb\u8166\u2713\u5e73\u677f\uff0c\u8de8\u5e73\u53f0\u9632\u8b77\uff13\u5230\u4f4d\u2794<a href=https:\/\/t.rend.tw\/?i=OTAwOQ\n> \u300b\u5373\u523b\u514d\u8cbb\u4e0b\u8f09\u8a66\u7528 <\/a>,\u5206\u4eab\u4f7f\u7528\u5fc3\u5f97,\u9084\u53ef\u62bd iPhone<\/a><\/figcaption><\/figure>\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n<a href=\" https:\/\/t.rend.tw\/?i=ODUxM\"><img decoding=\"async\" src=\" https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2020\/01\/fb-540x90-1.gif\n\" alt=\"\"\/><\/a>\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n<p>&#x1f49d;\u258e\u6bcf\u67087 \u65e5\u4e0b\u5348 4 \u9ede , \u8da8\u52e2\u79d1\u6280 IG \u5e33\u865f,Fun \u9001\u7c89\u7d72\u7368\u4eab\u79ae \u258e&#x1f49d;<br> <a href=\"https:\/\/t.rend.tw\/?i=ODUzOA\">) \u5feb\u9032\u4f86\u770b\u770b<\/a> \ud83d\ude42 <\/p>\n\n<a href=\"https:\/\/t.rend.tw\/?i=ODI3Mg\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/10\/FB.png\" alt=\"FB\" \/><\/a>\n\n<a href=\"https:\/\/t.rend.tw\/?i=ODI3Mw\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/10\/ig_icon_O.png\" alt=\"IG\" \/><\/a>\n\n<a href=\"https:\/\/t.rend.tw\/?i=ODI3NA\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/10\/youtube.png\" alt=\"Youtube\" \/><\/a>\n\n <a href=\"https:\/\/t.rend.tw\/?i=ODI3NA\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/10\/Line.png\" alt=\"LINE\" \/><\/a>\n\n <a href=\"https:\/\/t.rend.tw\/?i=ODI3Ng\"><img decoding=\"async\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2019\/10\/%E5%AE%98%E7%B6%B2.png\" alt=\"\u5b98\u7db2\" \/><\/a>\n\n <div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/t.rend.tw\/?i=OTI5OQ\"><img loading=\"lazy\" decoding=\"async\" width=\"540\" height=\"90\" src=\"https:\/\/blog.trendmicro.com.tw\/wp-content\/uploads\/2020\/07\/540x90.gif\" alt=\"\" class=\"wp-image-65093\"\/><\/a><\/figure>\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u904e\u53bb\u5e7e\u9031\uff0c\u8da8\u52e2\u79d1\u6280\u767c\u73fe\u52d2\u7d22\u75c5\u6bd2\u51fa\u73fe\u6700\u65b0\u767c\u5c55\u3002\u9996\u5148\u662f\u4e00\u500b\u65b0\u7684\u52d2\u7d22\u75c5\u6bd2\u5bb6\u65cf (\u9ed1\u6697\u9762-Darkside) \u4e4b\u5916\uff0cC [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_wpscppro_dont_share_socialmedia":false,"_wpscppro_custom_social_share_image":0,"_facebook_share_type":"","_twitter_share_type":"","_linkedin_share_type":"","_pinterest_share_type":"","_linkedin_share_type_page":"","_instagram_share_type":"","_medium_share_type":"","_threads_share_type":"","_google_business_share_type":"","_selected_social_profile":[],"_wpsp_enable_custom_social_template":false,"_wpsp_social_scheduling":{"enabled":false,"datetime":null,"platforms":[],"status":"template_only","dateOption":"today","timeOption":"now","customDays":"","customHours":"","customDate":"","customTime":"","schedulingType":"absolute"},"_wpsp_active_default_template":true},"categories":[2266],"tags":[2559],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/65690"}],"collection":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=65690"}],"version-history":[{"count":5,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/65690\/revisions"}],"predecessor-version":[{"id":66000,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/65690\/revisions\/66000"}],"wp:attachment":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=65690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=65690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=65690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}