{"id":66488,"date":"2021-01-18T09:00:00","date_gmt":"2021-01-18T01:00:00","guid":{"rendered":"https:\/\/blog.trendmicro.com.tw\/?p=66488"},"modified":"2020-12-21T16:29:18","modified_gmt":"2020-12-21T08:29:18","slug":"%e9%96%8b%e6%94%be%e5%8e%9f%e5%a7%8b%e7%a2%bc%e8%bb%9f%e9%ab%94%e5%a6%82%e4%bd%95%e8%ae%8a%e6%88%90%e6%9c%a8%e9%a6%ac%e7%a8%8b%e5%bc%8f%ef%bc%9f%e5%a6%82%e4%bd%95%e6%88%90%e7%9b%ae%e6%a8%99%e5%bc%8f","status":"publish","type":"post","link":"https:\/\/blog.trendmicro.com.tw\/?p=66488","title":{"rendered":"\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u5982\u4f55\u8b8a\u6210\u6728\u99ac\u7a0b\u5f0f\uff1f\u5982\u4f55\u6210\u76ee\u6a19\u5f0f\u653b\u64ca\u6b66\u5668?"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\"><\/h1>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u5982\u4f55\u8b8a\u6210\u6728\u99ac\u7a0b\u5f0f\uff1f\u6211\u5011\u53c8\u8a72\u5982\u4f55\u5075\u6e2c\u9019\u985e\u7a0b\u5f0f\uff1f\u8981\u56de\u7b54\u9019\u4e9b\u554f\u984c\uff0c\u8b93\u6211\u5011\u4f86\u770b\u4e00\u4e0b\u6700\u8fd1\u6211\u5011\u91dd\u5c0d\u9019\u985e\u6a94\u6848\u6240\u505a\u7684\u4e00\u4efd\u7814\u7a76\u3002<\/p><\/blockquote>\n\n\n\n<p><\/p>\n\n\n\n<p>\u6728\u99ac\u5316\u7684\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u5f88\u4e0d\u5bb9\u6613\u88ab\u767c\u6398\uff0c\u56e0\u70ba\u5b83\u5011\u770b\u8d77\u4f86\u5c31\u8ddf\u6b63\u5e38\u7684\u8edf\u9ad4\u4e00\u6a23\uff0c\u6240\u4ee5\u9019\u985e\u7a0b\u5f0f\u6beb\u4e0d\u8d77\u773c\uff0c\u56e0\u6b64\u7279\u5225\u9069\u5408\u7528\u65bc\u76ee\u6a19\u5f0f\u653b\u64ca\u3002\u4f46\u5176\u5be6\u82e5\u6df1\u5165\u8ffd\u67e5\uff0c\u9084\u662f\u53ef\u4ee5\u770b\u5230\u4e00\u4e9b\u53ef\u7591\u7684\u884c\u70ba\uff0c\u4e26\u63ed\u767c\u5b83\u7684\u4e0d\u8096\u610f\u5716\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">\u7814\u7a76\u904e\u7a0b<\/h1>\n\n\n\n<p><br><a href=\"https:\/\/t.rend.tw\/?i=OTQzMw\">\u8da8\u52e2\u79d1\u6280<\/a>\u5728\u5206\u6790\u4e00\u8d77\u8cc7\u5b89\u4e8b\u4ef6\u6642\u767c\u73fe\u4e86\u4e00\u500b\u540d\u70ba\u300cnotepad.exe\u300d\u7684\u6a94\u6848\u76f8\u7576\u53ef\u7591\u3002\u56e0\u70ba\uff0c\u5927\u5bb6\u90fd\u77e5\u9053 notepad.exe \u662f Windows \u7cfb\u7d71\u5167\u5efa\u7684\u300c\u7b46\u8a18\u672c\u300d\u7a0b\u5f0f\uff0c\u800c\u6709\u4e9b\u60e1\u610f\u7a0b\u5f0f\u4f5c\u8005\u5c31\u662f\u559c\u6b61\u507d\u88dd\u6210\u9019\u985e\u7a0b\u5f0f\u4f86\u8eb2\u907f\u5075\u6e2c\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-1-Telemetry-data.png\" alt=\"Fig-1-Telemetry-Data\"\/><figcaption>\u5716 1\uff1a\u76e3\u6e2c\u8cc7\u6599\u986f\u793a\u67d0\u500b\u540d\u70ba\u300cnotepad.exe\u300d\u7684\u6a94\u6848\u76f8\u7576\u53ef\u7591\u3002<\/figcaption><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>\u9019\u500b notepad.exe \u6a94\u6848\u662f\u7d93\u7531 ntoskrnl.exe (Windows NT \u4f5c\u696d\u7cfb\u7d71\u6838\u5fc3\u57f7\u884c\u6a94) \u9032\u5165\u7cfb\u7d71\u3002\u5b83\u5f88\u53ef\u80fd\u662f\u7d93\u7531 ntoskrnl.exe \u7684\u6f0f\u6d1e\u6216\u662f\u7db2\u8def\u5171\u7528\u8cc7\u6599\u593e\u9032\u5165\u7cfb\u7d71\uff0c\u4e0d\u904e\u6839\u64da\u6211\u5011\u5f97\u5230\u7684\u76e3\u6e2c\u8cc7\u6599\u986f\u793a\u6bd4\u8f03\u53ef\u80fd\u662f\u5f8c\u8005\u3002\u63a5\u8457\uff0c\u6211\u5011\u53c8\u5229\u7528\u6839\u6e90\u5206\u6790 (Root Cause Analysis\uff0c\u7c21\u7a31 RCA) \u767c\u73fe\uff0c\u9019\u500b\u4e0d\u8096\u7684 notepad.exe \u6a94\u6848\u6703\u547c\u53eb\u4ee5\u4e0b\u5e7e\u500b\u5de5\u5177\u4f86\u57f7\u884c\u4e00\u4e9b\u53ef\u7591\u52d5\u4f5c\uff1a<\/p>\n\n\n\n<!--more-->\n\n\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>\u57f7\u884c\u6a94<\/strong><\/td><td><strong>\u529f\u80fd<\/strong><\/td><\/tr><tr><td>ipconfig.exe<\/td><td>\u53d6\u5f97 Windows IP \u7d44\u614b\u8a2d\u5b9a\u3002<\/td><\/tr><tr><td>net.exe<\/td><td><strong>&nbsp;<\/strong>\u5217\u51fa\u672c\u5730\u7aef\u8207\u7db2\u57df\u5167\u7684\u5168\u57df\u7fa4\u7d44\u3002\u5217\u51fa\u4f3a\u670d\u5668\u8207\u5de5\u4f5c\u7ad9\u7684\u670d\u52d9\u8a2d\u5b9a\u3002\u627e\u51fa\u6240\u6709\u672c\u5730\u7aef\u8207\u7db2\u57df\u4e2d\u7684\u6240\u6709\u7db2\u8def\u5171\u7528\u8cc7\u6599\u593e\u3002\u5217\u51fa\u672c\u5730\u7aef\u4f7f\u7528\u8005\u8207\u7db2\u57df\u4f7f\u7528\u8005\u5e33\u865f\u3002<strong><\/strong><\/td><\/tr><tr><td>reg.exe<\/td><td>\u5c07\u7cfb\u7d71\u767b\u9304\u6a5f\u78bc\u8207\u6578\u503c\u532f\u51fa\u5230\u67d0\u500b\u6a94\u6848\u3002<\/td><\/tr><tr><td>systeminfo.exe<\/td><td>\u8490\u96c6\u672c\u5730\u7aef\u6216\u9060\u7aef\u96fb\u8166\u7684\u4f5c\u696d\u7cfb\u7d71\u7d44\u614b\u8a2d\u5b9a\u8cc7\u8a0a\uff0c\u5305\u62ec Service Pack \u7248\u672c\u3002<\/td><\/tr><tr><td>tasklist.exe<\/td><td>\u5217\u51fa\u67d0\u53f0\u672c\u5730\u7aef\u6216\u9060\u7aef\u96fb\u8166\u4e0a\u6b63\u5728\u57f7\u884c\u7684\u8655\u7406\u7a0b\u5e8f\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u8868 1\uff1a\u57f7\u884c\u6a94\u540d\u7a31\u8207\u529f\u80fd\u3002<\/p>\n\n\n\n<p>\u300cnotepad.exe\u300d\u6a94\u6848\u7adf\u7136\u6703\u547c\u53eb\u9019\u4e9b\u7a0b\u5f0f\u4f86\u57f7\u884c\u9019\u4e9b\u529f\u80fd\uff0c\u8b49\u660e\u5b83\u5c31\u662f\u4e00\u500b\u5178\u578b\u7684\u5f8c\u9580\u7a0b\u5f0f\uff0c\u800c\u4e14\u9084\u6703\u63a5\u6536\u4f86\u81ea\u9060\u7aef\u99ed\u5ba2\u7684\u6307\u4ee4\u3002\u4e0d\u904e\u9084\u6709\u53e6\u4e00\u9ede\u5f15\u8d77\u6211\u5011\u7684\u6ce8\u610f\uff0c\u90a3\u5c31\u662f\u9019\u500b notepad.exe \u6a94\u6848\u7684\u5c6c\u6027\u8cc7\u8a0a\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-2-Notepad-properties.png\" alt=\"Fig-2-Notepad-properties\"\/><figcaption>\u5716 2\uff1aNotepad.exe \u7684\u6a94\u6848\u5c6c\u6027\u8cc7\u8a0a\u3002<\/figcaption><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>\u5176\u6a94\u6848\u6558\u8ff0\u3001\u7522\u54c1\u540d\u7a31\u4ee5\u53ca\u539f\u59cb\u6a94\u540d\u90fd\u63d0\u5230\u4e86\u300cNotepad++\u300d\uff0c\u9019\u662f\u4e00\u500b\u958b\u653e\u539f\u59cb\u78bc\u7684\u7a0b\u5f0f\u7de8\u8f2f\u5668\uff0c\u4f46\u6211\u5011\u89ba\u5f97\u5c31\u9023\u9019\u4e9b\u5c6c\u6027\u8cc7\u8a0a\u4e5f\u5f88\u53ef\u7591\uff0c\u56e0\u70ba\uff0cNotepad++ \u7684\u6a94\u6848\u540d\u7a31\u901a\u5e38\u53eb\u4f5c\u300cnotepad++.exe\u300d\u800c\u4e0d\u662f\u6b64\u8655\u7684\u300cnotepad.exe\u300d\u3002\u800c\u4e14\u7248\u672c <a href=\"https:\/\/notepad-plus-plus.org\/downloads\/v7.8.6\/\">v7.8.6 \u662f\u65e9\u5728 4 \u6708\u5c31\u767c\u8868<\/a>\uff0c\u76ee\u524d\u5df2\u7d93\u6709\u9ede\u8001\u820a\uff0c\u6700\u65b0\u7684\u7248\u672c\u662f 11 \u6708\u521d\u6240\u767c\u8868\u7684 &nbsp;<a href=\"https:\/\/notepad-plus-plus.org\/downloads\/v7.9.1\/\">v7.9.1<\/a> \u7248\u3002<\/p>\n\n\n\n<p>\u53ef\u7591\u7684 notepad.exe \u57f7\u884c\u8d77\u4f86\u7684\u756b\u9762\u5982\u4e0b\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-3-Executed-notepad.png\" alt=\"Fig-4-config-file\"\/><figcaption>\u5716 3\uff1a\u53ef\u7591\u7684 notepad.exe \u57f7\u884c\u8d77\u4f86\u7684\u756b\u9762\u3002<\/figcaption><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>\u5176\u4f7f\u7528\u8005\u4ecb\u9762\u548c\u529f\u80fd\u770b\u8d77\u4f86\u90fd\u8ddf\u6b63\u5e38\u7684 Notepad++ \u5982\u51fa\u4e00\u8f4d\uff0c\u4e4d\u770b\u4e4b\u4e0b\u6c92\u751a\u9ebc\u53ef\u7591\u4e4b\u8655\u3002\u4f46\u5982\u679c\u4ed4\u7d30\u7814\u7a76\u5b83\u7684\u884c\u70ba\uff0c\u5c31\u6703\u767c\u73fe\u6b64\u6a23\u672c\u6703\u505a\u51fa\u4e00\u4e9b\u6b63\u5e38 Notepad++ \u4e0d\u6703\u505a\u7684\u4e8b\uff0c\u4f8b\u5982\uff1a\u641c\u5c0b\u300cc:\\windows\\debug\u300d\u8cc7\u6599\u593e\u4e0b\u4e00\u500b\u540d\u70ba\u300cconfig.dat\u300d\u7684\u6a94\u6848\uff0c\u6b64\u884c\u70ba\u53ef\u5f9e\u8a72\u6a23\u672c\u7684\u7a0b\u5f0f\u78bc\u5206\u6790\u4e2d\u770b\u5230\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-4-Searching-for-config.png\" alt=\"\" width=\"580\" height=\"168\"\/><figcaption>\u5716 4\uff1a\u641c\u5c0b config.dat \u6a94\u6848\u3002<\/figcaption><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">\u7a0b\u5f0f\u78bc\u5206\u6790<\/h1>\n\n\n\n<p>\u9019\u500b\u60e1\u610f\u7684 Notepad++ \u6a94\u6848\u7d93\u904e\u53cd\u7d44\u8b6f\u4e4b\u5f8c\u7684\u7a0b\u5f0f\u78bc\u5982\u4e0b\u5716\u6240\u793a\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-5-Code-snippet-malicious.png\" alt=\"Fig-5-Code-snippet-malicious-notepad\"\/><figcaption>\u5716 5\uff1a\u60e1\u610f Notepad++ \u7684\u7a0b\u5f0f\u78bc\u7247\u6bb5\u3002<\/figcaption><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>\u540c\u6a23\u7684\u7a0b\u5f0f\u78bc\u7247\u6bb5\uff0c\u5728\u6b63\u5e38\u7684 Notepad++ \u6a94\u6848\u4e2d\u9577\u9019\u6a23\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks\/Fig-6-Code-snippet-non-malicious.png\" alt=\"Fig-6-Code-snippet-non-malicious-notepad\"\/><figcaption>\u5716 6\uff1a\u6b63\u5e38 Notepad++ \u7684\u7a0b\u5f0f\u78bc\u7247\u6bb5\u3002<\/figcaption><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>\u9019\u5169\u6bb5\u7a0b\u5f0f\u78bc\u6709\u8a31\u591a\u76f8\u4f3c\u4e4b\u8655\uff0c\u4f46\u60e1\u610f Notepad++ \u6a94\u6848\u542b\u6709\u8f09\u5165\u67d0\u500b\u52a0\u5bc6\u4e8c\u9032\u4f4d\u6a94\u6848 (config.dat) \u7684\u7a0b\u5f0f\u78bc\uff0c\u9019\u500b\u4e8c\u9032\u4f4d\u6a94\u6848\u6703\u5728\u8a18\u61b6\u9ad4\u4e2d\u89e3\u958b\u4f86\u57f7\u884c\uff0c\u56e0\u6b64\u5f88\u53ef\u80fd\u542b\u6709\u5f8c\u9580\u884c\u70ba\u3002\u9019\u8b93\u6211\u5011\u60f3\u8d77\u4e86\u8f03\u65e9\u7684\u4e00\u4e9b\u60e1\u610f\u7a0b\u5f0f\u5bb6\u65cf\uff0c\u5982\uff1a&nbsp;<a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/PLUGX\">PLUGX<\/a>\u3002<\/p>\n\n\n\n<p>\u6211\u5011\u767c\u73fe\u5169\u8005\u90fd\u4f7f\u7528\u76f8\u540c\u7684\u8f09\u5165\u5668\uff0c\u53ea\u662f\u8f09\u5165\u7684\u60e1\u610f\u6a94\u6848\u4e0d\u540c\u3002\u5176\u4e2d\u4e00\u500b\u60e1\u610f\u6a94\u6848\u5c31\u662f\u6211\u5011\u5075\u6e2c\u5230\u7684\u300cTrojanSpy.Win32.LAZAGNE.B\u300d\uff0c\u53e6\u4e00\u500b\u5247\u662f\u300cRansom.Win32.EXX.YAAK-B\u300d(\u4e5f\u5c31\u662f <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/news\/cyber-attacks\/defray-ransomware-sets-sights-on-healthcare-and-other-industries\">Defray \u52d2\u7d22\u75c5\u6bd2<\/a>)\u3002\u5728\u6df1\u5165\u8abf\u67e5\u5f8c\uff0c\u6211\u5011\u9084\u767c\u73fe\u540c\u6a23\u7684\u8f09\u5165\u5668\u9084\u7528\u4f86\u8f09\u5165\u5176\u4ed6\u60e1\u610f\u6a94\u6848\u3002<\/p>\n\n\n\n<p>\u6211\u5011\u61f7\u7591\u672c\u6848\u4f8b\u4e2d\u7684\u6a94\u6848\u662f\u7d93\u7531\u76ee\u6a19\u5f0f\u6c34\u5751\u5f0f\u653b\u64ca\u9032\u5165\u88ab\u653b\u64ca\u7684\u4f01\u696d\u3002\u99ed\u5ba2\u5728\u611f\u67d3\u4e86\u7b2c\u4e00\u53f0\u96fb\u8166\u4e4b\u5f8c\uff0c\u5c31\u80fd\u8f15\u6613\u5730\u900f\u904e\u7cfb\u7d71\u7ba1\u7406\u5171\u4eab\u8cc7\u6599\u593e\u6563\u5e03\u60e1\u610f\u7684 Notepad++ \u7a0b\u5f0f\u8207 config.dat \u6a94\u6848\u3002\u4e0d\u904e\u6211\u5011\u7814\u7a76\u4e2d\u4f7f\u7528\u7684 notepad.exe \u6a94\u6848\u4f86\u81ea\u67d0\u500b\u60e1\u610f\u4f86\u6e90\uff0c\u800c\u4e14\u8207 Notepad \u8207 Notepad++.exe \u6a94\u6848\u7684\u5b98\u65b9\u4f86\u6e90\u7121\u95dc\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">\u5c07\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u8b8a\u6210\u653b\u64ca\u6b66\u5668<\/h1>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>\u7531\u65bc\u60e1\u610f\u7684 Notepad++ \u6a94\u6848\u8207\u539f\u672c\u6b63\u5e38\u7684\u6a94\u6848\u975e\u5e38\u76f8\u4f3c\uff0c\u56e0\u6b64\u5f88\u5bb9\u6613\u88ab\u8aa4\u8a8d\u70ba\u662f\u6b63\u5e38\u8edf\u9ad4\uff0c\u5c24\u5176\u662f\u4e00\u4e9b\u5c0d\u96fb\u8166\u4e0d\u719f\u7684\u54e1\u5de5\u3002\u6b79\u5f92\u7d93\u5e38\u6703\u4f7f\u7528\u6728\u99ac\u5316\u7684\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u4f86\u63a9\u4eba\u8033\u76ee\u3002\u7531\u65bcNotepad++ \u7684\u539f\u59cb\u7a0b\u5f0f\u78bc\u53ef\u4ee5\u5f9e\u7db2\u8def\u4e0a<a href=\"https:\/\/github.com\/notepad-plus-plus\/notepad-plus-plus\">\u516c\u958b\u4e0b\u8f09<\/a>\uff0c\u6240\u4ee5\u4efb\u4f55\u4eba (\u5305\u62ec\u99ed\u5ba2) \u90fd\u80fd\u62ff\u5230\u3002<\/p>\n\n\n\n<p>\u99ed\u5ba2\u7d93\u5e38\u5c0b\u627e\u4e00\u4e9b\u71b1\u9580\u8edf\u9ad4\u7684\u539f\u59cb\u7a0b\u5f0f\u78bc\uff0c\u7136\u5f8c\u5728\u7a0b\u5f0f\u7576\u4e2d\u63d2\u5165\u4e00\u4e9b\u60e1\u610f\u529f\u80fd (\u4f8b\u5982\u8f09\u5165\u52a0\u5bc6\u904e\u7684\u4e8c\u9032\u4f4d\u6a94\u6848) \u4f86\u5c07\u5b83\u5011\u6728\u99ac\u5316\u3002\u9019\u610f\u5473\u8457\uff0c\u9019\u4e9b\u7a0b\u5f0f\u672c\u8eab\u4e26\u4e0d\u542b\u60e1\u610f\u7a0b\u5f0f\u78bc\uff0c\u800c\u662f\u5728\u57f7\u884c\u6642\u624d\u8f09\u5165\u60e1\u610f\u6a94\u6848\uff0c\u4f46\u9019\u6a23\u7684\u884c\u70ba\u5f88\u96e3\u88ab\u8a8d\u5b9a\u70ba\u53ef\u7591\u3002\u4e0d\u4f46\u5982\u6b64\uff0c\u52a0\u5bc6\u904e\u7684\u4e8c\u9032\u4f4d\u6a94\u4e26\u6c92\u6709\u6a94\u6848\u6a19\u982d\uff0c\u6240\u4ee5\u60e1\u610f\u7a0b\u5f0f\u9632\u8b77\u8edf\u9ad4\u5f88\u96e3\u5075\u6e2c\uff0c\u5c31\u9023\u5177\u5099 AI \u548c ML \u6280\u8853\u7684\u89e3\u6c7a\u65b9\u6848\u4e5f\u96e3\u4ee5\u505a\u5230\uff0c\u66f4\u4f55\u6cc1\u90a3\u4e9b\u53ea\u91dd\u5c0d\u55ae\u4e00\u9632\u8b77\u5c64\u7684\u89e3\u6c7a\u65b9\u6848\u3002\u8981\u9632\u7bc4\u9019\u985e\u5a01\u8105\uff0c\u53ef\u6db5\u84cb\u591a\u91cd\u9632\u8b77\u5c64\u7684\u8cc7\u5b89\u89e3\u6c7a\u65b9\u6848\u4e5f\u8a31\u80fd\u767c\u63ee\u4f5c\u7528\uff0c\u56e0\u70ba\u8cc7\u5b89\u5718\u968a\u53ef\u4ea4\u53c9\u95dc\u806f\u6574\u500b\u74b0\u5883\u5167\u7684\u6240\u6709\u8cc7\u6599\u8207\u884c\u70ba\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">\u5efa\u8b70<\/h1>\n\n\n\n<p><br>\u4f7f\u7528\u8005\u52d9\u5fc5\u53ea\u5f9e\u53ef\u4fe1\u8cf4\u7684\u5408\u6cd5\u4f86\u6e90\u4e0b\u8f09\u6a94\u6848\u3001\u61c9\u7528\u7a0b\u5f0f\u53ca\u8edf\u9ad4 (\u5982\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4)\uff0c\u4ee5\u514d\u9047\u5230\u9019\u985e\u5a01\u8105\uff0c\u4f8b\u5982\u4f7f\u7528\u8005\u53ef\u5230 Notepad++ \u7684&nbsp;<a href=\"https:\/\/notepad-plus-plus.org\/\">\u5b98\u65b9\u7db2\u7ad9<\/a>\u4e0b\u8f09\u6240\u6709\u76f8\u95dc\u6a94\u6848\u3002\u6b64\u5916\uff0c\u4f01\u696d\u4e5f\u53ef\u4ee5\u5efa\u7acb\u4e00\u500b\u7d93\u904e\u6838\u51c6\u7684\u4e0b\u8f09\u7db2\u7ad9\u6e05\u55ae\u4ee5\u4f9b\u54e1\u5de5\u9075\u5b88\u3002\u82e5\u8981\u4fdd\u96aa\u4e00\u9ede\uff0c\u4f01\u696d\u53ef\u8981\u6c42\u54e1\u5de5\u5fc5\u9808\u7d93\u904e IT \u90e8\u9580\u6838\u51c6\u624d\u80fd\u5728\u516c\u53f8\u96fb\u8166\u4e0a\u5b89\u88dd\u4efb\u4f55\u8edf\u9ad4\u3002\u6b64\u5916\uff0c\u6211\u5011\u4e5f\u5f37\u70c8\u5efa\u8b70\u8cc7\u5b89\u53ca IT \u5718\u968a\u5728\u4e0b\u8f09\u4e8c\u9032\u4f4d\u6a94\u6848\u4e4b\u5f8c\u52d9\u5fc5\u6838\u5c0d\u6a94\u6848\u7684\u7e3d\u548c\u6aa2\u67e5\u78bc (checksum) \u662f\u5426\u6b63\u78ba\uff0c\u56e0\u70ba\u597d\u7684\u958b\u653e\u539f\u59cb\u78bc\u5c08\u6848\u901a\u5e38\u6703\u5728\u91cb\u51fa\u4e8c\u9032\u4f4d\u6a94\u6848\u6642\u4e00\u4f75\u63d0\u4f9b\u7e3d\u548c\u6aa2\u67e5\u78bc\u4f9b\u4f7f\u7528\u8005\u6bd4\u5c0d\u3002<\/p>\n\n\n\n<p>\u9664\u6b64\u4e4b\u5916\u6211\u5011\u4e5f\u63a8\u85a6\u4f01\u696d\u63a1\u7528 <a href=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/detection-response\/xdr.html\">Trend Micro&#x2122; XDR<\/a> \u4f86\u8490\u96c6\u4e26\u4ea4\u53c9\u95dc\u806f\u4f86\u81ea\u7aef\u9ede\u3001\u96fb\u5b50\u90f5\u4ef6\u3001\u96f2\u7aef\u5de5\u4f5c\u8ca0\u8f09\u4ee5\u53ca\u7db2\u8def\u7684\u8cc7\u6599\uff0c\u9019\u6a23\u4e0d\u50c5\u80fd\u63d0\u4f9b\u66f4\u5b8c\u6574\u7684\u80cc\u666f\u8cc7\u8a0a\uff0c\u540c\u6642\u4e5f\u5c07\u8abf\u67e5\u5de5\u4f5c\u5f59\u6574\u5230\u540c\u4e00\u5730\u9ede\uff0c\u800c\u9019\u5c07\u6709\u52a9\u65bc\u8cc7\u5b89\u5718\u968a\u63d0\u65e9\u767c\u6398\u9032\u968e\u5a01\u8105\u8207\u76ee\u6a19\u5f0f\u653b\u64ca\u3002<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h1 class=\"wp-block-heading\">\u5165\u4fb5\u6307\u6a19\u8cc7\u6599<br><\/h1>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>\u6a94\u6848\u540d\u7a31<\/strong><\/td><td><strong>SHA-256<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u75c5\u6bd2\u78bc\u5075\u6e2c\u540d\u7a31<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u6a5f\u5668\u5b78\u7fd2\u5075\u6e2c\u540d\u7a31<\/strong><\/td><\/tr><tr><td>notepad.exe (\u540c\u540d\u7684\u60e1\u610f\u6a94\u6848)<\/td><td>bacc02fd23c4f95da0fbc5c490b1278d327fea0878734ea9a55f108ef9f4312e<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002 &nbsp;<\/td><\/tr><tr><td>config.dat<\/td><td>64ba94000e2815898fb17e93deaa44ac0e1b4c55316af727b908dfe74c3b7ef6<\/td><td>Trojan.Win32.VATET.ENC<\/td><td>\u7121<\/td><\/tr><tr><td>config.dat<\/td><td>33234dc94d926f1fc2831f40e27080739b415d485aa457d14a83617a3996089b<\/td><td>Trojan.Win32.VATET.ENC<\/td><td>\u7121<\/td><\/tr><tr><td>release.exe<\/td><td>09c99e37121722dd45a2c19ff248ecfe2b9f1e082381cc73446e0f4f82e0c468<\/td><td>TrojanSpy.Win32.LAZAGNE.B<\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><tr><td>virus2.dll<\/td><td>1c3331b87dc55a8cc491846f2609d6226f66eb372716df349567ed619dd1b731<\/td><td>Ransom.Win32.EXX.YAAK-B<\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u5176\u4ed6\u76f8\u95dc\u96dc\u6e4a\u78bc\uff1a<\/p>\n\n\n\n<style>\n   table {border-collapse:collapse; table-layout:fixed; width:310px;}\n   table td {border:solid 1px ; width:100px; word-wrap:break-word;}\n   <\/style>\n\n<figure class=\"wp-block-table\"><table  class=\" table table-hover\" ><tbody><tr><td><strong>SHA-256<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u75c5\u6bd2\u78bc\u5075\u6e2c\u540d\u7a31<\/strong><\/td><td><strong>\u8da8\u52e2\u79d1\u6280\u6a5f\u5668\u5b78\u7fd2\u5075\u6e2c\u540d\u7a31<\/strong><\/td><\/tr><tr><td>0b42bf15b77cfe9f9e693f2776691647e78a91be27f5bdb8d1a366be510a773f<\/td><td>Trojan.Win32.VATET.A<\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><tr><td>10c4067908181cebb72202d92ff7a054b19ef3aada939bf76178e35be9506525<\/td><td>Trojan.Win32.VATET.A<\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>19938becb018e3459b49381c7efffabbe44a6450362b769ba85a3f1240b068d0<\/td><td>Trojan.Win32.VATET.A<\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><tr><td>2f149a79f721bb78eb956f70183b531fb6a1b233ceb4a3d6385759a0b0c16fd3<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><tr><td>37e8d3ae4c34441b30098d7711df8ef0bcc12c395f265106b825221744b956bc<\/td><td>Trojan.Win32.VATET.A<\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>382d9bf5da142d44de5fda544de4fffe2915a3ffc67964b993f3c051aa8c2989<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>42f5f1b08c9cee876bafdb6dc4188e8e29d26a07951e1083e08e2a4b0cb6d0ff<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002 (GENERIC:Hit Bad Auto Shield)<\/td><\/tr><tr><td>4421720e0321ac8b3820f8178eb8a5ff684388438b62c85f93df9743a1d9fdb9<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>4fb94877cc150f591e5b61dc5641f33e93e67ae1912c2e122e7ef2a236046f1a<\/td><td>Trojan.Win32.VATET.A<\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>52d3ebe824ad60a939d64e73336e790884e3674b2d22dbe6e3c6b22061124161<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>\u7121<\/td><\/tr><tr><td>57eea67e3eebde707c3fb3473a858e7f895ae12aad37cc664f9c0512c0382e6a<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>Troj.Win32.TRX.XXPE50FFF038<\/td><\/tr><tr><td>6ac07424e5c9b87d76645aa041772ac8af12e30dc670be8adf1cf9f48e32944b<\/td><td>Backdoor.Win32.VATET.CFH<\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>bacc02fd23c4f95da0fbc5c490b1278d327fea0878734ea9a55f108ef9f4312e<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>ea6c3b993d830319b08871945cf2726dd6d8e62e8fed8fc42bcb053c38c78748<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>e5ce1c1b69bd12640c604971be311f9544adb3797df15199bd754d3aefe0a955<\/td><td>Trojan.Win32.VATET.A<\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>ef7e21d874a387f07a9f74f01f2779a280ff06dff3dae0d41906d21e02f9c975<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><tr><td>f0a25444cf58b61ff6cdd86ff1cfa53a51ad426817a33bd0e098f4f0ff286f22<\/td><td><a href=\"http:\/\/www.trendmicro.com\/vinfo\/us\/threat-encyclopedia\/malware\/Trojan.Win32.VATET.SM\">Trojan.Win32.VATET.SM<\/a><\/td><td>BKDR.Win32.TRX.XXPE50FFF038E0002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>\u539f\u6587\u51fa\u8655\uff1a<a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/20\/k\/weaponizing-open-source-software-for-targeted-attacks.html\">Weaponizing Open Source Software for Targeted Attacks<\/a>   \u4f5c\u8005\uff1aAbraham Camba\u3001Bren Matthew Ebriega \u8207 Gilbert Sison<\/p>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u958b\u653e\u539f\u59cb\u78bc\u8edf\u9ad4\u5982\u4f55\u8b8a\u6210\u6728\u99ac\u7a0b\u5f0f\uff1f\u6211\u5011\u53c8\u8a72\u5982\u4f55\u5075\u6e2c\u9019\u985e\u7a0b\u5f0f\uff1f\u8981\u56de\u7b54\u9019\u4e9b\u554f\u984c\uff0c\u8b93\u6211\u5011\u4f86\u770b\u4e00\u4e0b\u6700\u8fd1\u6211\u5011\u91dd\u5c0d\u9019\u985e\u6a94\u6848\u6240 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_wpscppro_dont_share_socialmedia":false,"_wpscppro_custom_social_share_image":0,"_facebook_share_type":"","_twitter_share_type":"","_linkedin_share_type":"","_pinterest_share_type":"","_linkedin_share_type_page":"","_instagram_share_type":"","_medium_share_type":"","_threads_share_type":"","_google_business_share_type":"","_selected_social_profile":[],"_wpsp_enable_custom_social_template":false,"_wpsp_social_scheduling":{"enabled":false,"datetime":null,"platforms":[],"status":"template_only","dateOption":"today","timeOption":"now","customDays":"","customHours":"","customDate":"","customTime":"","schedulingType":"absolute"},"_wpsp_active_default_template":true},"categories":[46,2452],"tags":[2466,4580,1836,2047],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/66488"}],"collection":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=66488"}],"version-history":[{"count":2,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/66488\/revisions"}],"predecessor-version":[{"id":66490,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=\/wp\/v2\/posts\/66488\/revisions\/66490"}],"wp:attachment":[{"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=66488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=66488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.trendmicro.com.tw\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=66488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}