MsraMiner 被曝光后72小时内的更新
<p>3月16日，我们<a href="__GHOST_URL__/msraminer-qian-fu-yi-jiu-de-wa-kuang-jiang-shi-wang-luo/">文章</a> 中，提到了 MsraMiner，一个潜伏已久的挖矿僵尸网络。</p><p>DNSMon 在过去的72小时内，提示我们该僵尸网络有更新，如下：</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2018/03/dnsmon_alert.png" class="kg-image" alt loading="lazy"></figure><ul><li>样本压缩包文件改名为 <em>ProximityUntilCache32.tlb</em> ，原来叫 <em>MsraReportDataCache32.tlb</em></li><li>矿机程序被重命名为 <em>WUDHostServices.exe</em> ，原来是 <em>TrustedHostServices.exe</em></li><li>样本里的 C2 Domain 被替换为 <code>tsk.tknuv.com</code> / <code>err.tknuv.com</code> / <code>slo.tknuv.com</code> ，原来是 <code>ccc.njaavfxcgk3.club</code> / <code>rer.njaavfxcgk3.club</code> / <code>acs.njaavfxcgk3.club</code></li></ul><p>新的矿池域名和挖矿账号如下，其中，<code>jiovt.com</code> 和 <code>etionz.com</code> 这两个域名都是 2018-03-16 才注册的。</p><pre><code>A:\ -o sim.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o lol.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o tzt.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o tot.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o ziz.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o mue.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o okt.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o pqi.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o kji.jiovt.com:45560 -u letiot@protonmail.com

swx.jiovt.com  
ff.etionz.com  
mm.etionz.com  
dddddd.etionz.com  
cccccc.etionz.com  
rat.etionz.com  
err.etionz.com  
nnn.etionz.com  
</code></pre><p>这些挖矿账号和备用的 C2 域名，是通过对内存数据解密得到的：</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2018/03/dll_mem_cc.png" class="kg-image" alt loading="lazy"></figure><p>新的样本 md5 (VT first-seen: 2018-03-17)：</p><pre><code>a4992890d226f25f1057d71e475a83d8 *ProximityUntilCache32_tlb.zip  
d4ee3ccb9fd8d1a7fd90d2d9d6500300 *ProximityUntilCache32_tlb/crypt  
011d6ce51b7806dca26c300e8d26f9bb *ProximityUntilCache32_tlb/hash  
1e0022c02030f2b4353b583beffbade9 *ProximityUntilCache32_tlb/hash64  
1afb7154e1a57adc72e87e0948573bd0 *ProximityUntilCache32_tlb/spoolsv  
baa824c84e4385056f777759ef37092c *ProximityUntilCache32_tlb/spoolsv64  
3ab6ddea6ebd2404250f5255ff7e23b1 *ProximityUntilCache32_tlb/srv  
c70673f416e3c3ee0b194ff0966e0a86 *ProximityUntilCache32_tlb/srv64  
5b8fe3875e5523bfa356503b5e81ff25 *ProximityUntilCache32_tlb/x64.dll  
8fd6f89f9ec5f303c17243e9bdd2970a *ProximityUntilCache32_tlb/x86.dll```  </code></pre>
3月16日，我们文章 中，提到了 MsraMiner，一个潜伏已久的挖矿僵尸网络。

DNSMon 在过去的72小时内，提示我们该僵尸网络有更新，如下：

 * 样本压缩包文件改名为 ProximityUntilCache32.tlb ，原来叫 MsraReportDataCache32.tlb
 * 矿机程序被重命名为 WUDHostServices.exe ，原来是 TrustedHostServices.exe
 * 样本里的 C2 Domain 被替换为 tsk.tknuv.com / err.tknuv.com / slo.tknuv.com ，原来是 ccc.njaavfxcgk3.club / rer.njaavfxcgk3.club / acs.njaavfxcgk3.club

新的矿池域名和挖矿账号如下，其中，jiovt.com 和 etionz.com 这两个域名都是 2018-03-16 才注册的。

A:\ -o sim.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o lol.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o tzt.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o tot.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o ziz.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o mue.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o okt.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o pqi.jiovt.com:45560 -u letiot@protonmail.com  
A:\ -o kji.jiovt.com:45560 -u letiot@protonmail.com

swx.jiovt.com  
ff.etionz.com  
mm.etionz.com  
dddddd.etionz.com  
cccccc.etionz.com  
rat.etionz.com  
err.etionz.com  
nnn.etionz.com  


这些挖矿账号和备用的 C2 域名，是通过对内存数据解密得到的：

新的样本 md5 (VT first-seen: 2018-03-17)：

a4992890d226f25f1057d71e475a83d8 *ProximityUntilCache32_tlb.zip  
d4ee3ccb9fd8d1a7fd90d2d9d6500300 *ProximityUntilCache32_tlb/crypt  
011d6ce51b7806dca26c300e8d26f9bb *ProximityUntilCache32_tlb/hash  
1e0022c02030f2b4353b583beffbade9 *ProximityUntilCache32_tlb/hash64  
1afb7154e1a57adc72e87e0948573bd0 *ProximityUntilCache32_tlb/spoolsv  
baa824c84e4385056f777759ef37092c *ProximityUntilCache32_tlb/spoolsv64  
3ab6ddea6ebd2404250f5255ff7e23b1 *ProximityUntilCache32_tlb/srv  
c70673f416e3c3ee0b194ff0966e0a86 *ProximityUntilCache32_tlb/srv64  
5b8fe3875e5523bfa356503b5e81ff25 *ProximityUntilCache32_tlb/x64.dll  
8fd6f89f9ec5f303c17243e9bdd2970a *ProximityUntilCache32_tlb/x86.dll```  
{"version":"0.3.1","atoms":[],"cards":[["image",{"src":"__GHOST_URL__/content/images/2018/03/dnsmon_alert.png","alt":"","title":""}],["code",{"code":"A:\\ -o sim.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o lol.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o tzt.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o tot.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o ziz.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o mue.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o okt.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o pqi.jiovt.com:45560 -u letiot@protonmail.com  \nA:\\ -o kji.jiovt.com:45560 -u letiot@protonmail.com\n\nswx.jiovt.com  \nff.etionz.com  \nmm.etionz.com  \ndddddd.etionz.com  \ncccccc.etionz.com  \nrat.etionz.com  \nerr.etionz.com  \nnnn.etionz.com  \n"}],["image",{"src":"__GHOST_URL__/content/images/2018/03/dll_mem_cc.png","alt":"","title":""}],["code",{"code":"a4992890d226f25f1057d71e475a83d8 *ProximityUntilCache32_tlb.zip  \nd4ee3ccb9fd8d1a7fd90d2d9d6500300 *ProximityUntilCache32_tlb/crypt  \n011d6ce51b7806dca26c300e8d26f9bb *ProximityUntilCache32_tlb/hash  \n1e0022c02030f2b4353b583beffbade9 *ProximityUntilCache32_tlb/hash64  \n1afb7154e1a57adc72e87e0948573bd0 *ProximityUntilCache32_tlb/spoolsv  \nbaa824c84e4385056f777759ef37092c *ProximityUntilCache32_tlb/spoolsv64  \n3ab6ddea6ebd2404250f5255ff7e23b1 *ProximityUntilCache32_tlb/srv  \nc70673f416e3c3ee0b194ff0966e0a86 *ProximityUntilCache32_tlb/srv64  \n5b8fe3875e5523bfa356503b5e81ff25 *ProximityUntilCache32_tlb/x64.dll  \n8fd6f89f9ec5f303c17243e9bdd2970a *ProximityUntilCache32_tlb/x86.dll```  "}]],"markups":[["a",["href","__GHOST_URL__/msraminer-qian-fu-yi-jiu-de-wa-kuang-jiang-shi-wang-luo/"]],["em"],["code"]],"sections":[[1,"p",[[0,[],0,"3月16日，我们"],[0,[0],1,"文章"],[0,[],0," 中，提到了 MsraMiner，一个潜伏已久的挖矿僵尸网络。"]]],[1,"p",[[0,[],0,"DNSMon 在过去的72小时内，提示我们该僵尸网络有更新，如下："]]],[10,0],[3,"ul",[[[0,[],0,"样本压缩包文件改名为 "],[0,[1],1,"ProximityUntilCache32.tlb"],[0,[],0," ，原来叫 "],[0,[1],1,"MsraReportDataCache32.tlb"]],[[0,[],0,"矿机程序被重命名为 "],[0,[1],1,"WUDHostServices.exe"],[0,[],0," ，原来是 "],[0,[1],1,"TrustedHostServices.exe"]],[[0,[],0,"样本里的 C2 Domain 被替换为 "],[0,[2],1,"tsk.tknuv.com"],[0,[],0," / "],[0,[2],1,"err.tknuv.com"],[0,[],0," / "],[0,[2],1,"slo.tknuv.com"],[0,[],0," ，原来是 "],[0,[2],1,"ccc.njaavfxcgk3.club"],[0,[],0," / "],[0,[2],1,"rer.njaavfxcgk3.club"],[0,[],0," / "],[0,[2],1,"acs.njaavfxcgk3.club"]]]],[1,"p",[[0,[],0,"新的矿池域名和挖矿账号如下，其中，"],[0,[2],1,"jiovt.com"],[0,[],0," 和 "],[0,[2],1,"etionz.com"],[0,[],0," 这两个域名都是 2018-03-16 才注册的。"]]],[10,1],[1,"p",[[0,[],0,"这些挖矿账号和备用的 C2 域名，是通过对内存数据解密得到的："]]],[10,2],[1,"p",[[0,[],0,"新的样本 md5 (VT first-seen: 2018-03-17)："]]],[10,3]],"ghostVersion":"3.0"}