¿ËÈÕ£¬£¬£¬£¬¹ú¼ÒÅÌËã»ú²¡¶¾Ó¦¼±´¦Öóͷ£ÖÐÐĺÍÅÌËã»ú²¡¶¾·ÀÖÎÊÖÒÕ¹ú¼Ò¹¤³ÌʵÑéÊÒÒÀÍйú¼ÒÅÌËã»ú²¡¶¾ÆÊÎöƽ̨¼à²â·¢Ã÷ľÂí²¡¶¾×îбäÖÖ¡ª¡ª¡°Òøºü¡±¡£¡£¡£¡£¡£´ó×Úαװ³É¡°µç×Ó·¢Æ±¿ª¾ßÀֳɡ±µÄ´¹ÂÚÓʼþÕýÔÚÁ÷ͨ£¬£¬£¬£¬ÓʼþÖС°µã»÷ÏÂÔØ´Ë·¢Æ±¡±µÄÁ´½Ó£¬£¬£¬£¬ÊµÔòΪÒøºü²¡¶¾ÏÂÔصصã¡£¡£¡£¡£¡£

ͼƬȪԴ£º¹ú¼ÒÅÌËã»ú²¡¶¾Ó¦¼±´¦Öóͷ£ÖÐÐĹٷ½Î¢²©

ijµ¥Î»ÒÑ·ºÆðÓû§µã»÷ºóÖն˱»¿ØÖƵÄÇéÐΣ¬£¬£¬£¬¾³ÍâÊÆÁ¦Õýͨ¹ý´ËÀàÊֶζԺ£ÄÚ¶à¸öÐÐÒµµÄÖն˾ÙÐÐÕë¶ÔÐÔÉø͸¡£¡£¡£¡£¡£Ò»µ©ÖÐÕУ¬£¬£¬£¬Óû§²»µ«Ð¡ÎÒ˽¼ÒÊý¾ÝÃæÁÙй¶Σº¦£¬£¬£¬£¬Ð¡ÎÒ˽¼ÒÕË»§×ʽðÇå¾²Ò²½«Êܵ½ÑÏÖØÍþв¡£¡£¡£¡£¡£

ÂÄÀúÖ¤£¬£¬£¬£¬×¯ÏÐÓÎÏ·ÏÂÒ»´ú·À»ðǽ¡¢EDR¡¢×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢APTÇå¾²¼à²âϵͳ¾ù¿É׼ȷ¼ì²â²¢²éɱ¸Ã²¡¶¾£¬£¬£¬£¬ÌṩÖÜÈ«µÄÇå¾²±£»£»£»£»£»¤£¬£¬£¬£¬ÓÐÓÃ×èÖ¹¸ÃÊÂÎñÉìÕÅ¡£¡£¡£¡£¡£

²¡¶¾ÑùÌìÖ°Îö

ׯÏÐÓÎÏ·ÚÐÌýʵÑéÊÒÒÑ»ñÈ¡¸ÃÒøºü²¡¶¾Ñù±¾£¬£¬£¬£¬²¢¾ÙÐÐÊÖÒÕÆÊÎö£¬£¬£¬£¬Æä¹¥»÷°ì·¨ÈçÏ£º

ÓÃÕì¿ÇÈí¼þ¼ì²â£¬£¬£¬£¬ÎÞ¿Ç

¼ì²âÊý×ÖÊðÃû£¬£¬£¬£¬ÌáÐÑÎÞЧ

³ÌÐòÔËÐк󣬣¬£¬£¬½âѹshellcode

½«²¡¶¾´úÂëÖü´æ³ÉÎļþ£¬£¬£¬£¬ÐÞ¸´ºó£¬£¬£¬£¬ÓÃÕì¿ÇÈí¼þ¼ì²â£¬£¬£¬£¬ÅжÏÎÞ¿Ç

´ÓpdbÐÅÏ¢À´¿´ÓÐÀú³Ì±£»£»£»£»£»¤¹¦Ð§

»ñÈ¡Ä¿½ñÖ÷»úÀú³ÌÁбí£¬£¬£¬£¬²éÕÒÊÇ·ñ±£´æÒÔÏÂÃû³ÆµÄÀú³Ì

ÅжÏÊÇ·ñÖÎÀíԱȨÏÞÔËÐÐ

½¨É軥³â£¬£¬£¬£¬×èÖ¹Öظ´ÔËÐÐ

·­¿ªÖ¸¶¨Ð§ÀÍ

»ñÈ¡Àú³ÌÁîÅƺ󣬣¬£¬£¬ÊµÑéÌáȨ

×¼±¸ÊÂÇéÍê±Ïºó£¬£¬£¬£¬×îÏÈÈëÇÖÀú³Ì

ÉêÇëÄÚ´æ¿Õ¼ä£¬£¬£¬£¬Ð´ÈëÊý¾Ý

»ñȡʱ¼ä£¬£¬£¬£¬ÌìÉúËæ»úÊý

ÈôÊÇvssЧÀÍ×¢Èëʧ°Ü£¬£¬£¬£¬ÊµÑé×¢ÈëÆäËûÖ¸¶¨Àú³Ì

½âÃܺڿÍIP

¼ÓÔØÎļþÃûºÍЧÀÍÃû

¼ì²âÖ¸¶¨Àú³ÌÊÇ·ñ±£´æ£¬£¬£¬£¬ÈôÊDZ£´æµ÷½âfwpÉèÖÃ

fwp¹ýÂËÉèÖÃ

¼ÓÔØÎļþÃû²ÎÊý£¬£¬£¬£¬ÌìÉúÎļþ£¬£¬£¬£¬¸ÃÎļþΪÇý¶¯Îļþ£¬£¬£¬£¬ÓÃÀ´¶Ô¿¹É±¶¾Èí¼þ

½¨ÉèЧÀͲ¢Æô¶¯

»ñÈ¡Ö¸¶¨Àú³ÌÐÅÏ¢

ŲÓÃÊͷŵÄÇý¶¯Îļþ£¬£¬£¬£¬¶Ô֮ǰ»ñÈ¡µÄÀú³Ì´¦Öóͷ£

н¨Ö¸¶¨Îļþ

ŲÓÃcom½Ó¿Ú£¬£¬£¬£¬ÉèÖÃÍýÏëʹÃü£¬£¬£¬£¬½«ÉÏÃæÌìÉúµÄÎļþ£¬£¬£¬£¬ÉèÖÿª»ú×ÔÆô¶¯

ÉèÖóÌÐò×ÔÏú»Ù£¬£¬£¬£¬½«Ô´Îļþɾ³ý

¶ÔÖ¸¶¨Àú³ÌÉæ¼°µÄЧÀÍɾ³ý

Òøºü²¡¶¾Ê×ÏÈͨ¹ýαװ³Éϵͳ½¹µãÀú³Ì£¨Èçsvchost.exe¡¢winlogon.exe£©×¢Èë¶ñÒâ´úÂ룬£¬£¬£¬ÆÆËðϵͳÎȹÌÔËÐУ»£»£»£»£»½ø¶øͨ¹ý×¢²á×ÔÆô¶¯Ð§Àͺͽ¨ÉèÒþ²ØͨѶͨµÀ£¨ÈçRPC£©ÊµÏÖ³¤ÆÚ»¯×¤Áô£¬£¬£¬£¬ºã¾ÃDZÔÚÓÚ×°±¸ÖУ»£»£»£»£»ÔÚÊÍ·ÅÇý¶¯Îļþ¶Ô¿¹Çå¾²Èí¼þ²¢ÌáȨ»ñÈ¡ÖÎÀíԱȨÏ޺󣬣¬£¬£¬·Å×ÝÇÔÈ¡Óû§Òþ˽¼°Ö÷ÒªÃô¸ÐÊý¾Ý£»£»£»£»£»×îÖÕ£¬£¬£¬£¬²¡¶¾»áÓëºÚ¿Í¿ØÖÆЧÀÍÆ÷½¨ÉèÅþÁ¬Íê³ÉÊý¾ÝÍâй£¬£¬£¬£¬²¢×Ô¶¯É¾³ýÔ´ÎļþÏú»ÙÈëÇÖºÛ¼£¡£¡£¡£¡£¡£

ÕâÖÖÒþ²ØµÄÈëÇÖÊÖ·¨²»µ«ÈÃÓû§ÄÑÒÔ²ì¾õÒì³££¬£¬£¬£¬»¹ÎªºóÐø¹¥»÷ÂñÏÂÒþ»¼£¬£¬£¬£¬¶Ô×°±¸ÓëÊý¾ÝÇå¾²×é³ÉϵͳÐÔµÄÑÏÖØÍþв¡£¡£¡£¡£¡£

ÔÚ´Ë£¬£¬£¬£¬Ð¡ÌìÒ²ÌáÐѸ÷ÈË£¬£¬£¬£¬´øÃÜÂëµÄ¼ÓÃÜѹËõ°ü²¢²»´ú±íÄÚÈÝÇå¾²£¬£¬£¬£¬´Ë´Î¹¥»÷ÕßΪѹËõ°üÉèÖÃÏàʶѹÃÜÂ룬£¬£¬£¬²¢ÔÚ´¹ÂÚÐÅÏ¢Öмû¸æÃÜÂ룬£¬£¬£¬ÒÔ´ËÌÓ¹ýÁ˲¿·ÖÇå¾²Èí¼þµÄ¼ì²â£¬£¬£¬£¬Ê¹Æä¾ßÓиüÇ¿µÄÈö²¥ÄÜÁ¦¡£¡£¡£¡£¡£

±¾´Î¹¥»÷ÕßʹÓõĴ¹ÂÚÐÅÏ¢ÈÔÈ»ÒÔαÔì¹Ù·½Í¨ÖªÎªÖ÷£¬£¬£¬£¬¸÷ÈËҪʱ¿Ì¼á³ÖСÐÄÐÔÓëÌá·ÀÒâʶ£¬£¬£¬£¬Ñø³É¸üÐÂɱ¶¾Èí¼þµÄÏ°¹ß£¬£¬£¬£¬ÊµÊ±½ÓÄÉ·À»¤²½·¥£¬£¬£¬£¬½÷·ÀÖÖÖÖµçÐÅÍøÂçÕ©Æ­Ô˶¯¡£¡£¡£¡£¡£

Ò»Ñùƽ³££¬£¬£¬£¬Èç·¢Ã÷µçÄÔ²Ù×÷ϵͳµÄÇå¾²¹¦Ð§ºÍ·À²¡¶¾Èí¼þÔÚ·Ç×ÔÖ÷²Ù×÷µÄÇéÐÎϱ»Òì³£¹Ø±Õ£¬£¬£¬£¬¾ÍÒªÒýÆðСÐÄ£¬£¬£¬£¬Á¬Ã¦ÇжÏÍøÂ磬£¬£¬£¬¶ÔÖ÷ÒªÊý¾Ý¾ÙÐб¸·ÝǨáãºóÔÝͣʹÓøÃ×°±¸£¬£¬£¬£¬´ýרҵְԱ¼ì²â¡¢ÅŲéÈ·ÈÏÇå¾²ºó£¬£¬£¬£¬ÔÙÖØÐÂͶÈëʹÓᣡ£¡£¡£¡£

ׯÏÐÓÎÏ·²úÆ··ÀÓùÉèÖÃÖ¸ÄÏ

ׯÏÐÓÎÏ·ÏÂÒ»´ú·À»ðǽϵͳ·ÀÓùÉèÖÃ

1¡¢Í¨¹ý»á¼û¿ØÖÆÕ½ÂÔ»òºÚÃûµ¥½ûÓá°13.230.98.233¡±µÈºÚ¿ÍIPµØµã¼°RPCЭÒ飬£¬£¬£¬×è¶ÏÒøºü²¡¶¾Í¨Ñ¶ÅþÁ¬½¨É裻£»£»£»£»

2¡¢Éý¼¶µ½×îв¡¶¾ÌØÕ÷¿â£¬£¬£¬£¬ÉèÖò¡¶¾·À»¤Õ½ÂÔ£¬£¬£¬£¬¼ì²â²¢×è¶ÏÒøºü²¡¶¾£¬£¬£¬£¬¼Í¼Ïà¹ØÈÕÖ¾£»£»£»£»£»

3¡¢ÉèÖÃÓʼþ¹ýÂ˹¦Ð§£¬£¬£¬£¬½«ÒÑ·ºÆðµÄÒøºü²¡¶¾ÓʼþÄÚÈݼÓÈëºÚÃûµ¥¾ÙÐйýÂË£»£»£»£»£»

4¡¢ÆôÓÃÍþвÇ鱨¹¦Ð§£¬£¬£¬£¬ÊµÊ±×èµ²ÓëÒøºü²¡¶¾Ïà¹ØµÄ×îÐÂIP»òÓòÃûµÈ£¬£¬£¬£¬¼ÓËÙ×赲ЧÂÊ£»£»£»£»£»

5¡¢¿ªÆôÁª¶¯¹¦Ð§£¬£¬£¬£¬»ñȡׯÏÐÓÎÏ·EDR¡¢½©Ê¬ÍøÂçľÂíºÍÈä³æ¼à²âÓë´¦Öóͷ£µÈ²úÆ·¼ì²âЧ¹û£¬£¬£¬£¬ÊµÊ±×è¶ÏÄÚÍøÒÑѬȾÖ÷»úºáÏòÈö²¥£¬£¬£¬£¬¿ØÖÆÍøÂçÈö²¥¹æÄ£¡£¡£¡£¡£¡£

ׯÏÐÓÎÏ·EDRϵͳ·ÀÓùÉèÖÃ

1¡¢ÆôÓÃÓʼþ¼à¿ØÄ£¿£¿é£¬£¬£¬£¬¶ÔÎüÊÕÓʼþµÄ¸½¼þʵÑéɨÃè»úÖÆ£¬£¬£¬£¬¾«×¼×èµ²º¬¡°µç×Ó·¢Æ±¡±Àà´¹ÂÚÁ´½ÓµÄ¶ñÒâÓʼþ£¬£¬£¬£¬´ÓÔ´Í·Çжϲ¡¶¾Èö²¥Á´£»£»£»£»£»

2¡¢¿ªÆôÎļþʵʱ¼à¿Ø¹¦Ð§£¬£¬£¬£¬ÖصãÕë¶Ô¡°.pdf.exe.doc.exe¡±µÈαװÃûÌõġ°µç×Ó·¢Æ±¡±ÀàÎļþ¾ÙÐÐÉî¶ÈɨÃ裬£¬£¬£¬·¢Ã÷Òì³£ÎļþÁ¬Ã¦¸ôÀ룬£¬£¬£¬±ÜÃⲡ¶¾Ö´ÐÐÓëÀ©É¢£»£»£»£»£»

3¡¢¿ªÆôϵͳ¼Ó¹Ì¹¦Ð§£¬£¬£¬£¬¿ÉÓÐÓÃ×èµ²¸ÃÒøºü²¡¶¾¶ÔϵͳҪº¦Î»ÖþÙÐÐÆÆËðºÍ¸Ä¶¯¡£¡£¡£¡£¡£

ׯÏÐÓÎÏ·×Ô˳ӦÇå¾²·ÀÓùϵͳ·ÀÓùÉèÖÃ

1¡¢°²ÅÅ΢¸ôÀëÕ½ÂÔ£¬£¬£¬£¬»ùÓÚЭÒé¡¢¶Ë¿Ú¡¢IPµÈά¶È×è¶ÏÒì³£Á÷Á¿Í¨Ñ¶£¬£¬£¬£¬¹¹½¨ÍøÂç»á¼û¿ØÖÆÆÁÕÏ£¬£¬£¬£¬ÓÐÓÃ×èÖ¹²¡¶¾ÔÚ¾ÖÓòÍøÄڵĺáÏòÀ©É¢Î£º¦£»£»£»£»£»

2¡¢½¨ÉèÖÜÆÚÐÔÎó²îɨÃè»úÖÆ£¬£¬£¬£¬ÁýÕÖϵͳ¡¢Êý¾Ý¿â¡¢ÖÐÐļþµÈ×ʲú£¬£¬£¬£¬ÊµÊ±ÐÞ¸´¿ÉÄܱ»²¡¶¾Ê¹ÓõÄÇå¾²Îó²î£¬£¬£¬£¬ÌáÇ°Ïû³ý¹¥»÷Ã棻£»£»£»£»

3¡¢ÆôÓò¡¶¾ÊµÊ±¼ì²âÒýÇ棬£¬£¬£¬Õë¶ÔÒøºü²¡¶¾ÎÞ¿ÇÌØÕ÷£¬£¬£¬£¬Á¬ÏµÐÐΪÆÊÎöÊÖÒÕ¶Ôδ֪²¡¶¾¾ÙÐÐÖÇÄÜ×èµ²£¬£¬£¬£¬Í¨¹ý¶¯Ì¬ÌØÕ÷ʶ±ðÌáÉý·ÀÓù¾«×¼¶È¡£¡£¡£¡£¡£

ׯÏÐÓÎÏ·APTÇå¾²¼à²âϵͳ¼ì²âÉèÖÃ

1¡¢ÔÚÇå¾²Õ½ÂÔÖпªÆô¶ñÒâÎļþ¼ì²â¹¦Ð§ºó£¬£¬£¬£¬²úƷͨ¹ýÍþвÇ鱨¼ì²â¡¢²¡¶¾¼ì²â¡¢TAI01-¹ÌÍø¶ñÒâ³ÌÐò¼ì²âÖÇ»ÛÒýÇæÓëɳÏä¼ì²âµÈÒ»Ì廯¶àÒýÇæ¼ì²âÄÜÁ¦£¬£¬£¬£¬¾«×¼Ê¶±ðÁ÷Á¿ÖеÄÒøºü²¡¶¾¡£¡£¡£¡£¡£

2¡¢ÔÚÑÐÅд¦Öóͷ£Ä£¿£¿éÖÐÉó²éÒøºü²¡¶¾¼ì²âЧ¹û£¬£¬£¬£¬µã»÷¡¾¶ñÒâÎļþÏêÇé¡¿¿É»ñÈ¡²¡¶¾ÌØÕ÷ÏêÇ鼰ɳÏäÆÊÎö±¨¸æ¡£¡£¡£¡£¡£

ׯÏÐÓÎÏ·²úÆ·»ñÈ¡·½·¨

¡ñ ׯÏÐÓÎÏ·ÏÂÒ»´ú·À»ðǽϵͳÌØÕ÷¿âÏÂÔصص㣺ftp://ftp.topsec.com.cn/

¡ñ ׯÏÐÓÎÏ·EDRµ¥»ú°æÏÂÔصص㣺http://edr.topsec.com

¡ñ ׯÏÐÓÎÏ·×Ô˳ӦÇå¾²·ÀÓùϵͳ¡¢×¯ÏÐÓÎÏ·EDRÆóÒµ°æÊÔÓÿÉͨ¹ýׯÏÐÓÎÏ·¸÷µØ·Ö¹«Ë¾»ñÈ¡£¡£¡£¡£¡£ºhttp://www.topsec.com.cn/contact/

¡ñ ׯÏÐÓÎÏ·APTÇå¾²¼à²âϵͳ¹æÔò¿â»ñÈ¡·½·¨£ºhttps://knowledge.topsec.com.cn/

Ïà¹ØÔĶÁ

1¡¢ÑëÊÓµãÃû£¡GoldPickaxeÐÂÐÍAI²¡¶¾ÈëÇÖ£¬£¬£¬£¬ÄãµÄÁ³»¹Çå¾²Â𣿣¿

2¡¢Money MessageÀÕË÷²¡¶¾Í»ÏÖ£¬£¬£¬£¬×¯ÏÐÓÎÏ·¶à¿î²úÆ·¾ù¿É·ÀÓù£¡

3¡¢LockBit²¡¶¾Ò»Á¬Éý¼¶£¬£¬£¬£¬×¯ÏÐÓÎÏ·¶à¿î²úÆ·¾«×¼³ö»÷£¡

4¡¢MalloxÀÕË÷²¡¶¾À´ÊÆÐÚÐÚ£¬£¬£¬£¬×¯ÏÐÓÎϷѸËÙ°ïÄú·ÀÓù£¡