白加黑发扬光大名扬海外

显示全部楼层 · 发表于 2012-9-14 12:47:52

本帖最后由 jefffire 于 2012-9-14 12:50 编辑

白加黑终于成名到海外去了坐看各大厂商有何高招

http://labs.alienvault.com/labs/ ... r-of-the-plugx-rat/

Some days ago, TrendMicro published some information about a new version of a RAT called PlugX. From the last few months we have been tracking a group using the PlugX RAT that has been attacking different targets especially in Japan, Taiwan, Korea and against Tibetan organizations and individuals.

In this post we will focus on the intelligence we have extracted from the payloads of the attacks and how we used this information to track the author of the RAT that is very likely to be involved in the attacks as well.

During the past few months we have seen some spearphishing campaigns against Tibetan targets using mainly Microsoft Office Exploits (CVE-2012-0158). Those documents used a very tricky technique; the payload dropped was a benign Nvidia executable (NvSmart.exe), a DLL (NvSmartMax.dll) and a binary file (boot.ldr) This technique was explained by Symantec as well.

http://www.symantec.com/connect/ ... itimate-application

显示全部楼层 · 发表于 2012-9-14 12:50:36

不知白加黑原产地是哪里

显示全部楼层 · 发表于 2012-9-14 12:51:12

Tomin2009 发表于 2012-9-14 12:50
不知白加黑原产地是哪里

我国劳动人民的智慧

显示全部楼层 · 发表于 2012-9-14 12:52:13

白加黑是个可以无限利用的0Day 嘿嘿

显示全部楼层 · 发表于 2012-9-14 12:52:54

想让趋势注意就把病毒带到11区

显示全部楼层 · 发表于 2012-9-14 12:57:05

Tibetan organizations and individuals 是什么东西

显示全部楼层 · 发表于 2012-9-14 12:58:10

derek2005 发表于 2012-9-14 12:52
想让趋势注意就把病毒带到11区

11区？

显示全部楼层 · 发表于 2012-9-14 12:58:57

jefffire 发表于 2012-9-14 12:52
白加黑是个可以无限利用的0Day 嘿嘿

弱弱的问句，何为0Day

显示全部楼层 · 发表于 2012-9-14 12:59:08

天朝创造了它。

显示全部楼层 · 发表于 2012-9-14 13:00:08

attacking different targets especially in Japan, Taiwan, Korea and against Tibetan organizations and individuals.

[讨论] 白加黑发扬光大名扬海外

评分

[讨论] 白加黑发扬光大 名扬海外

评分

[讨论] 白加黑发扬光大名扬海外