黑基网 首页 IT教程 信息安全 查看内容

尼日利亚黑客发起的BEC攻击

2018-2-4 21:04| 投稿: xiaotiger |来自: 互联网

摘要: 亚信安全发布的2018年安全威胁预测中曾提及,本年度,商业电子邮件攻击(BEC)事件会持续增长,并最终导致全球超过90亿美元的损失。BEC攻击主要依赖于社会工程学,向特定目标发送钓鱼邮件,达到攻击目的。 近日,我 ...

亚信安全发布的2018年安全威胁预测中曾提及,本年度,商业电子邮件攻击(BEC)事件会持续增长,并最终导致全球超过90亿美元的损失。BEC攻击主要依赖于社会工程学,向特定目标发送钓鱼邮件,达到攻击目的。

近日,我们发现了一些携带LokiPWS stealer载荷的BEC攻击,攻击者IP大多来自于尼日利亚。此次攻击中,黑客选取邮件作为攻击向量,同时伪造发件人地址,起到欺骗的目的。

【发动BEC攻击的电子邮件】

该邮件附件MTS-509EASH4.rar解压缩后,我们可以看到其是一个可执行程序,文件名是MTS-509EASH4.exe

【邮件附件是可执行的exe文件】

该文件属性如下图所示,从图中我们可以看到,该恶意程序有详细的文件信息,目的是欺骗用户信任该程序。

Virustotal上的检测情况

MTS-509EASH4.exe 恶意程序分析

该文件是用VB编写的

该程序在运行后会主动获取以下浏览器的隐私信息

%APPDATA%\Mozilla\Firefox\profiles.ini

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\key3.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\cert8.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\SIGNONS3.TXT

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons2.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\SIGNONS.TXT

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.sqlite

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\secmod.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons3.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\logins.json

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.sqlite-wal

其会链接到以下地址 www.{blocked}.cf

我们发现该C&C站点仍然活跃

在该网站目录下,我们发现了Loki PWS 的C&C panel

关于Loki这款盗号木马的C&C控制端代码,网上已经有泄漏,详细信息请参考链接:https://github.com/runvirus/LokiPWS

其中,fre.php正是木马客户端连接C&C的入口

下图是C&C panel的主界面,PvqDq929BSx_A_D_M1n_a.php 这个文件是Loki PWS 的典型特征。

【C&Cpanel的主界面】

Bot客户端的信息

通过控制台可以向Bot下发指令

Loki盗取的密码

木马客户端的一些统计信息

有意思的是最新的变种还有盗取比特币账户的功能

根据对被入侵主机的日志分析发现黑客的IP位于尼日利亚

此前,安全公司 Check Point曾经公布过关于尼日利亚黑客针对能源,矿产等基础设施行业的网络攻击行动。

BEC攻击主要依赖于社会工程学,我们可以从以下几方面着手,预防BEC攻击:

1、企业可以通过员工培训来减少BEC带来的损失;

2、可以采取多重验证手段,如电话验证等,抵抗BEC攻击;

3、使用Web网关可以有效监测社会工程学诈骗和伪造行为。

参考资料:

https://www.sans.org/reading-room/whitepapers/malicious/loki-bot-information-stealer-keylogger-more-37850

https://blog.checkpoint.com/2017/08/15/get-rich-die-trying-case-study-real-identity-behind-wave-cyberattacks-energy-mining-infrastructure-companies/

https://www.bleepingcomputer.com/news/security/lone-nigerian-hacker-behind-attempted-hacks-at-4-000-organizations/

*本文作者:亚信安全,转载请注明来自FreeBuf.COM

小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!

本文出自:http://www.sohu.com/a/220209869_354899

免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

发表评论

最新评论

引用 游客 2018-3-19 03:12
Can I simply say what a reduction to find somebody who really is aware of what theyre speaking about on the internet. You definitely know the best way to convey an issue to light and make it important. Extra folks must read this and understand this facet of the story. I cant imagine youre not more in style because you undoubtedly have the gift.
yeezy boost 350 v2 http://qrurl.it/r/1ikn4
引用 游客 2018-3-18 00:29
It抯 onerous to seek out knowledgeable individuals on this subject, but you sound like you understand what you抮e talking about! Thanks
yeezy boost 350 http://chilp.it/d9a2d6d
引用 游客 2018-3-17 08:44
I have to convey my appreciation for your kindness for persons who require help on this concern. Your very own dedication to passing the solution across had become certainly insightful and has always enabled men and women much like me to get to their dreams. The interesting guide can mean much to me and far more to my fellow workers. Best wishes; from everyone of us.
Adidas NMD PK Runner men shoe gray http://www.adidas-nmds.us.com/adidas-nmd-pk-runner-men-shoe-gray-p-35.html
引用 游客 2018-3-16 19:43
Your home is valueble for me. Thanks!?
yeezy shoes http://gul.ly/f50oc
引用 游客 2018-3-15 11:29
Your home is valueble for me. Thanks!?
yeezy boost http://ix.sk/toXF8
引用 游客 2018-3-14 03:01
Thank you a lot for providing individuals with an extraordinarily memorable opportunity to discover important secrets from this site. It is always so amazing and as well , packed with amusement for me personally and my office peers to search the blog at the very least thrice per week to read the latest items you have got. And lastly, I am also certainly astounded for the extraordinary information you give. Certain 3 tips on this page are ultimately the most efficient I have had.
nike polo http: ...
引用 游客 2018-3-12 18:16
Hiya! I just wish to give a huge thumbs up for the nice info you may have here on this post. I shall be coming again to your blog for more soon.
adidas yeezy http://www.yeezys.us.org
引用 游客 2018-3-11 16:48
I enjoy you because of your own labor on this website. Betty loves ** time for investigation and it's ** to grasp why. I learn all of the powerful mode you present invaluable things by means of this web blog and in addition strongly encourage contribution from visitors on the concern while our girl is in fact being taught so much. Take advantage of the rest of the new year. You are doing a terrific job.
Adidas NMD XR1 Rose red http://www.adidas-nmds.us.com/adidas-nmd-xr1-rose-red-p-521. ...
引用 游客 2018-3-11 11:19
A powerful share, I just given this onto a colleague who was doing somewhat analysis on this. And he in fact bought me breakfast because I found it for him.. smile. So let me reword that: Thnx for the deal with! But yeah Thnkx for spending the time to debate this, I feel strongly about it and love reading more on this topic. If possible, as you turn into experience, would you mind updating your blog with extra particulars? It is extremely useful for me. Large thumb up for this blog post!
ultra  ...
引用 游客 2018-3-9 08:40
I抦 impressed, I have to say. Really hardly ever do I encounter a blog that抯 both educative and entertaining, and let me inform you, you may have hit the nail on the head. Your idea is outstanding; the problem is one thing that not enough persons are speaking intelligently about. I am very comfortable that I stumbled across this in my search for one thing relating to this.
adidas nmd r1 http://qrurl.it/r/1iknh
引用 游客 2018-3-8 09:16
There are some fascinating closing dates on this article but I don抰 know if I see all of them heart to heart. There is some validity however I will take hold opinion till I look into it further. Good article , thanks and we want extra! Added to FeedBurner as nicely
yeezy boost http://catb.in/EpHr
引用 游客 2018-3-7 08:34
I enjoy you because of your entire hard work on this site. My niece takes pleasure in conducting investigation and it's ** to grasp why. My spouse and i notice all of the lively ways you deliver both useful and interesting secrets via your web blog and in addition invigorate participation from other individuals about this topic so our favorite daughter has always been starting to learn a lot. Enjoy the rest of the year. You're carrying out a fabulous job.
chrome hearts online http://www.chr ...
引用 游客 2018-3-7 08:26
I found your blog website on google and test a few of your early posts. Continue to keep up the very good operate. I simply further up your RSS feed to my MSN Information Reader. Seeking ahead to studying more from you in a while!?
yeezy boost 350 v2 http://bit.ly/2sT510O
引用 游客 2018-3-7 06:06
I actually wanted to develop a brief message to appreciate you for these lovely tips and tricks you are placing on this site. My long internet search has finally been recognized with sensible suggestions to go over with my co-workers. I would assume that most of us readers actually are truly endowed to live in a useful site with so many perfect individuals with valuable techniques. I feel extremely privileged to have seen your webpage and look forward to plenty of more entertaining times reading ...
引用 游客 2018-3-5 20:21
Your house is valueble for me. Thanks!?
calvin klein outlet http://www.calvinkleinoutlet.us.com
引用 游客 2018-3-5 04:10
I happen to be commenting to make you know of the really good experience my wife's princess obtained studying the blog. She mastered many pieces, which included how it is like to possess an amazing teaching style to have many more without hassle have an understanding of selected tricky things. You undoubtedly exceeded her desires. Many thanks for coming up with such effective, safe, revealing and in addition cool thoughts on that topic to Kate.
yeezys http://cbi.as/8exql
引用 游客 2018-3-4 13:28
Aw, this was a really nice post. In thought I would like to put in writing like this moreover ?taking time and precise effort to make a very good article?but what can I say?I procrastinate alot and under no circumstances seem to get something done.
air jordan shoes http://www.michaeljordanshoes.us.com
引用 游客 2018-3-3 10:08
Your house is valueble for me. Thanks!?
christian louboutin shoes http://www.christian-louboutin.eu.com
引用 游客 2018-3-3 05:39
Thanks so much for providing individuals with an exceptionally pleasant possiblity to read from this site. It really is so pleasurable and as well , full of a great time for me personally and my office peers to visit your website at the very least three times weekly to read through the fresh tips you have. And of course, we are certainly contented with all the dazzling suggestions you give. Certain 2 tips in this post are ultimately the most suitable we've ever had.
adidas ultra boost 3.0 http: ...
引用 游客 2018-3-2 08:54
An fascinating discussion is price comment. I think that it is best to write more on this subject, it may not be a taboo topic but usually individuals are not sufficient to talk on such topics. To the next. Cheers
cartier bracelet http://www.cartierbracelet.us

查看全部评论(53)


新出炉

返回顶部