Winnti :More than just a game

显示全部楼层 · 发表于 2013-4-11 22:20:12

本帖最后由 360Tencent 于 2013-4-11 22:30 编辑

Who are the attackers? What countries are they from?

Our research revealed that the attackers' used Chinese language in the code of the malware; they used Chinese locale in their Windows servers and they have been using a number of IP addresses in China. There are a number of other indicators, such as nicknames, timezones and more showing that the attackers are located in the People's Republic of China.

调查的时间跨度超过一年，53-80 页曝光了N名姑且称之为“黑客”的ID，包括百度空间，腾讯微博，乌云漏洞平台，红黑联盟，淘宝，myspace，黑客论坛......如果情况全部属实，用三个字评价“太亮了”

F.A.Q

https://www.securelist.com/en/bl ... re_than_just_a_game

Winnti 1.0

https://www.securelist.com/en/an ... _technical_analysis

Detailed Analysis

https://www.securelist.com/en/an ... re_than_just_a_game

https://www.securelist.com/en/bl ... ot_luring_intruders

PDF (共95 页，81-85 为样本MD5 列表）

https://www.securelist.com/en/do ... t-a-game-130410.pdf

显示全部楼层 · 发表于 2013-4-13 16:34:24

多谢消息传递

显示全部楼层 · 发表于 2013-4-13 16:47:03

看不懂……但是很流弊的样纸

显示全部楼层 · 发表于 2013-4-13 16:50:02

wjhstu-VxG 发表于 2013-4-13 16:47
看不懂……但是很流弊的样纸

http://tech.ifeng.com/internet/detail_2013_04/09/24000231_0.shtml

默默表示……我先去下载PDF看看，这个也很牛逼

显示全部楼层 · 发表于 2013-4-14 18:29:12

看了以便好多黑阔被社，躺着中枪

显示全部楼层 · 发表于 2013-4-14 18:54:07

求科普……

显示全部楼层 · 发表于 2013-4-19 18:58:38

同求科普，好高端的样子

显示全部楼层 · 发表于 2013-4-20 13:50:07

本帖最后由 hx1997 于 2013-4-20 14:16 编辑

四个 Winnti 2.0 驱动，卡巴检测为 Rootkit.Win32.Winnti.p 和 Rootkit.Win32.Winnti.q

Thanks to rkhunter.

显示全部楼层 · 发表于 2013-4-20 14:06:08

There are few essays in Chinese probably written by the individual owning wn6805@126.com while studying at Junior High School:
(posted on 2008-09-24): http://www.zww.cn/zuowen/html/25/258151.htm
(posted on 2008-10-05) http://www.zww.cn/zuowen/html/25/263081.htm
(posted on 2009-04-08): http://www.zww.cn/zuowen/html/51/350029.htm

[其他相关] Winnti :More than just a game

评分

本帖子中包含更多资源