用DTA照亮DNS威胁分析之路 (4)
<p><strong><strong><em><em>--- 发挥人的能动作用</em></em></strong></strong></p><h2 id="-"><strong>概述</strong></h2><p></p><h2 id="--1">举例</h2><p>未知威胁无告警</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/00.png" class="kg-image" alt loading="lazy"></figure><p>只保留新出现的心跳域名</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/01-2.png" class="kg-image" alt loading="lazy"></figure><p>点击心跳域名列表左上角的威胁情报图</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/02-4.png" class="kg-image" alt loading="lazy"></figure><p>样本无识别</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/06-5.png" class="kg-image" alt loading="lazy"></figure><p>telegram中文版“关联出样本80385</p><!--kg-card-begin: markdown--><table>
<thead>
<tr>
<th>中文版下载地址</th>
<th>域名注册时间</th>
<th>安装压缩包</th>
<th>安装文件名称</th>
<th>安装文件MD5</th>
<th>VT识别</th>
</tr>
</thead>
<tbody>
<tr>
<td>telegram-cn[.]org</td>
<td>2021-06-30 14:30:21</td>
<td>tsetup.zip</td>
<td>Telegram中文版.msi</td>
<td>58f8d9e024de1ad31c6c88e70bba6f58</td>
<td>14/57</td>
</tr>
<tr>
<td>www[.]telegram-zh[.]org</td>
<td>2021-11-24 14:28:25</td>
<td>Telegram Desktop.zip</td>
<td>Telegram Desktop.exe</td>
<td>ed1b74827b64fc8913af19b1b745ad1a</td>
<td>23/64</td>
</tr>
<tr>
<td>borsolo.oss-ap-southeast-1.aliyuncs[.]com</td>
<td>-</td>
<td>telegram.rar</td>
<td>Telegram中文版.msi</td>
<td>54cc6069bc165be77301937286fc6b82</td>
<td>20/59</td>
</tr>
<tr>
<td>www[.]telelgracn[.]com</td>
<td>2021-06-27 07:00:00</td>
<td>setup.zip</td>
<td>Telegram中文版.msi</td>
<td>53fb412a783e10607871fd205492981a</td>
<td>2/58</td>
</tr>
<tr>
<td>www[.]telegldcn[.]com</td>
<td>2021-08-07 07:00:00</td>
<td>setup.zip</td>
<td>Telegram中文版.msi</td>
<td>8038518d5023819708d2282e348ca931</td>
<td>22/59</td>
</tr>
</tbody>
</table>
<!--kg-card-end: markdown--><p>全局关联</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/09.png" class="kg-image" alt loading="lazy"></figure><p>样本相似性：域名结构相似，伪造知名公司</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/08-1.png" class="kg-image" alt loading="lazy"></figure><p>内嵌gh0st变种，C2：www.windowstimeupdate.com:9006</p><figure class="kg-card kg-image-card"><img src="__GHOST_URL__/content/images/2022/02/07-5.png" class="kg-image" alt loading="lazy"></figure><p></p><h2 id="--2"><strong>结语</strong></h2><p>发挥人能动性的环节：中文版telegram；域名相似性，</p><p>未知威胁科普系列完结，后续继续科普其它，比如资产可视化。资产的重要性。</p><p>产品、商务咨询，请联系 <a href="mailto:xuyinghan@360.cn">xuyinghan@360.cn</a></p>
--- 发挥人的能动作用


概述




举例

未知威胁无告警

只保留新出现的心跳域名

点击心跳域名列表左上角的威胁情报图

样本无识别

telegram中文版“关联出样本80385




中文版下载地址
域名注册时间
安装压缩包
安装文件名称
安装文件MD5
VT识别




telegram-cn[.]org
2021-06-30 14:30:21
tsetup.zip
Telegram中文版.msi
58f8d9e024de1ad31c6c88e70bba6f58
14/57


www[.]telegram-zh[.]org
2021-11-24 14:28:25
Telegram Desktop.zip
Telegram Desktop.exe
ed1b74827b64fc8913af19b1b745ad1a
23/64


borsolo.oss-ap-southeast-1.aliyuncs[.]com
-
telegram.rar
Telegram中文版.msi
54cc6069bc165be77301937286fc6b82
20/59


www[.]telelgracn[.]com
2021-06-27 07:00:00
setup.zip
Telegram中文版.msi
53fb412a783e10607871fd205492981a
2/58


www[.]telegldcn[.]com
2021-08-07 07:00:00
setup.zip
Telegram中文版.msi
8038518d5023819708d2282e348ca931
22/59





全局关联

样本相似性：域名结构相似，伪造知名公司

内嵌gh0st变种，C2：www.windowstimeupdate.com:9006




结语

发挥人能动性的环节：中文版telegram；域名相似性，

未知威胁科普系列完结，后续继续科普其它，比如资产可视化。资产的重要性。

产品、商务咨询，请联系 xuyinghan@360.cn
{"version":"0.3.1","atoms":[],"cards":[["image",{"src":"__GHOST_URL__/content/images/2022/02/00.png"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/01-2.png"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/02-4.png"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/06-5.png"}],["markdown",{"markdown":"| 中文版下载地址 | 域名注册时间 | 安装压缩包 | 安装文件名称 | 安装文件MD5 | VT识别 |\n| --- | --- | --- | --- | --- | --- |\n| telegram-cn[.]org | 2021-06-30 14:30:21 | tsetup.zip | Telegram中文版.msi | 58f8d9e024de1ad31c6c88e70bba6f58 | 14/57 |\n| www[.]telegram-zh[.]org | 2021-11-24 14:28:25 | Telegram Desktop.zip | Telegram Desktop.exe | ed1b74827b64fc8913af19b1b745ad1a | 23/64 |\n| borsolo.oss-ap-southeast-1.aliyuncs[.]com | - | telegram.rar | Telegram中文版.msi | 54cc6069bc165be77301937286fc6b82 | 20/59 |\n| www[.]telelgracn[.]com | 2021-06-27 07:00:00 | setup.zip | Telegram中文版.msi | 53fb412a783e10607871fd205492981a | 2/58 |\n| www[.]telegldcn[.]com | 2021-08-07 07:00:00 | setup.zip | Telegram中文版.msi | 8038518d5023819708d2282e348ca931 | 22/59 |"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/09.png"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/08-1.png"}],["image",{"src":"__GHOST_URL__/content/images/2022/02/07-5.png"}]],"markups":[["strong"],["em"],["a",["href","mailto:xuyinghan@360.cn"]]],"sections":[[1,"p",[[0,[0,0,1,1],4,"--- 发挥人的能动作用"]]],[1,"h2",[[0,[0],1,"概述"]]],[1,"p",[]],[1,"h2",[[0,[],0,"举例"]]],[1,"p",[[0,[],0,"未知威胁无告警"]]],[10,0],[1,"p",[[0,[],0,"只保留新出现的心跳域名"]]],[10,1],[1,"p",[[0,[],0,"点击心跳域名列表左上角的威胁情报图"]]],[10,2],[1,"p",[[0,[],0,"样本无识别"]]],[10,3],[1,"p",[[0,[],0,"telegram中文版“关联出样本80385"]]],[10,4],[1,"p",[[0,[],0,"全局关联"]]],[10,5],[1,"p",[[0,[],0,"样本相似性：域名结构相似，伪造知名公司"]]],[10,6],[1,"p",[[0,[],0,"内嵌gh0st变种，C2：www.windowstimeupdate.com:9006"]]],[10,7],[1,"p",[]],[1,"h2",[[0,[0],1,"结语"]]],[1,"p",[[0,[],0,"发挥人能动性的环节：中文版telegram；域名相似性，"]]],[1,"p",[[0,[],0,"未知威胁科普系列完结，后续继续科普其它，比如资产可视化。资产的重要性。"]]],[1,"p",[[0,[],0,"产品、商务咨询，请联系 "],[0,[2],1,"xuyinghan@360.cn"]]]],"ghostVersion":"3.0"}