黑基网 首页 学院 信息安全 查看内容

尼日利亚黑客发起的BEC攻击

2018-2-4 21:04| 投稿: xiaotiger |来自: 互联网

摘要: 亚信安全发布的2018年安全威胁预测中曾提及,本年度,商业电子邮件攻击(BEC)事件会持续增长,并最终导致全球超过90亿美元的损失。BEC攻击主要依赖于社会工程学,向特定目标发送钓鱼邮件,达到攻击目的。 近日,我 ...

亚信安全发布的2018年安全威胁预测中曾提及,本年度,商业电子邮件攻击(BEC)事件会持续增长,并最终导致全球超过90亿美元的损失。BEC攻击主要依赖于社会工程学,向特定目标发送钓鱼邮件,达到攻击目的。

近日,我们发现了一些携带LokiPWS stealer载荷的BEC攻击,攻击者IP大多来自于尼日利亚。此次攻击中,黑客选取邮件作为攻击向量,同时伪造发件人地址,起到欺骗的目的。

【发动BEC攻击的电子邮件】

该邮件附件MTS-509EASH4.rar解压缩后,我们可以看到其是一个可执行程序,文件名是MTS-509EASH4.exe

【邮件附件是可执行的exe文件】

该文件属性如下图所示,从图中我们可以看到,该恶意程序有详细的文件信息,目的是欺骗用户信任该程序。

Virustotal上的检测情况

MTS-509EASH4.exe 恶意程序分析

该文件是用VB编写的

该程序在运行后会主动获取以下浏览器的隐私信息

%APPDATA%\Mozilla\Firefox\profiles.ini

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\key3.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\cert8.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\SIGNONS3.TXT

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons2.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\SIGNONS.TXT

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.sqlite

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\secmod.db

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons3.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.txt

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\logins.json

%APPDATA%\Mozilla\Firefox\Profiles\wdfh4559.default\signons.sqlite-wal

其会链接到以下地址 www.{blocked}.cf

我们发现该C&C站点仍然活跃

在该网站目录下,我们发现了Loki PWS 的C&C panel

关于Loki这款盗号木马的C&C控制端代码,网上已经有泄漏,详细信息请参考链接:https://github.com/runvirus/LokiPWS

其中,fre.php正是木马客户端连接C&C的入口

下图是C&C panel的主界面,PvqDq929BSx_A_D_M1n_a.php 这个文件是Loki PWS 的典型特征。

【C&Cpanel的主界面】

Bot客户端的信息

通过控制台可以向Bot下发指令

Loki盗取的密码

木马客户端的一些统计信息

有意思的是最新的变种还有盗取比特币账户的功能

根据对被入侵主机的日志分析发现黑客的IP位于尼日利亚

此前,安全公司 Check Point曾经公布过关于尼日利亚黑客针对能源,矿产等基础设施行业的网络攻击行动。

BEC攻击主要依赖于社会工程学,我们可以从以下几方面着手,预防BEC攻击:

1、企业可以通过员工培训来减少BEC带来的损失;

2、可以采取多重验证手段,如电话验证等,抵抗BEC攻击;

3、使用Web网关可以有效监测社会工程学诈骗和伪造行为。

参考资料:

https://www.sans.org/reading-room/whitepapers/malicious/loki-bot-information-stealer-keylogger-more-37850

https://blog.checkpoint.com/2017/08/15/get-rich-die-trying-case-study-real-identity-behind-wave-cyberattacks-energy-mining-infrastructure-companies/

https://www.bleepingcomputer.com/news/security/lone-nigerian-hacker-behind-attempted-hacks-at-4-000-organizations/

*本文作者:亚信安全,转载请注明来自FreeBuf.COM

小编推荐:欲学习电脑技术、系统维护、网络管理、编程开发和安全攻防等高端IT技术,请 点击这里 注册黑基账号,公开课频道价值万元IT培训教程免费学,让您少走弯路、事半功倍,好工作升职加薪!

本文出自:http://www.sohu.com/a/220209869_354899

免责声明:本文由投稿者转载自互联网,版权归原作者所有,文中所述不代表本站观点,若有侵权或转载等不当之处请联系我们处理,让我们一起为维护良好的互联网秩序而努力!联系方式见网站首页右下角。


鲜花

握手

雷人

路过

鸡蛋

相关阅读

发表评论

最新评论

引用 游客 2018-2-24 09:57
There are some interesting time limits in this article however I don抰 know if I see all of them middle to heart. There may be some validity but I will take hold opinion until I look into it further. Good article , thanks and we wish more! Added to FeedBurner as effectively
under armour curry 3 http://www.curry3.in.net
引用 游客 2018-2-23 08:02
I抦 impressed, I must say. Actually rarely do I encounter a weblog that抯 each educative and entertaining, and let me let you know, you have hit the nail on the head. Your thought is excellent; the issue is one thing that not sufficient individuals are speaking intelligently about. I'm very comfortable that I stumbled throughout this in my seek for one thing regarding this.
nike huarache http://www.nike-huarache.com
引用 游客 2018-2-23 05:06
I simply wished to thank you so much once more. I'm not certain the things I could possibly have accomplished without the type of tactics shown by you on this situation. It actually was a real challenging case for me, but noticing the expert technique you dealt with it made me to weep for joy. Extremely grateful for the guidance and even wish you recognize what an amazing job your are undertaking instructing some other people thru your blog. I'm certain you have never encountered all of us.
ult ...
引用 游客 2018-2-22 06:38
Oh my goodness! a tremendous article dude. Thanks Nevertheless I am experiencing issue with ur rss . Don抰 know why Unable to subscribe to it. Is there anybody getting equivalent rss problem? Anybody who is aware of kindly respond. Thnkx
cheap jordans http://www.authenticjordanscheap.us.com
引用 游客 2018-2-21 07:42
I intended to draft you that little bit of observation to finally thank you very much the moment again for all the pleasing knowledge you have shared at this time. It is  pretty generous with people like you in giving easily exactly what many people could possibly have offered as an ebook to help with ** some bucks on their own, and in particular considering the fact that you could possibly have done it if you ever desired. The creative ideas as well served to become a fantastic way to reali ...
引用 游客 2018-2-21 05:08
you could have an excellent blog here! would you prefer to make some invite posts on my weblog?
nmd uk http://www.adidasnmd.uk
引用 游客 2018-2-20 05:22
This site is mostly a stroll-by for all the information you wanted about this and didn抰 know who to ask. Glimpse here, and also you抣l undoubtedly uncover it.
timberland boots http://www.outlettimberland.us.org
引用 游客 2018-2-19 15:07
I happen to be commenting to make you know of the cool experience my cousin's child experienced using your web page. She discovered a wide variety of things, which include what it's like to possess a marvelous giving mindset to have other folks with no trouble gain knowledge of some specialized things. You really exceeded people's expected results. I appreciate you for offering these useful, healthy, revealing and in addition cool tips about that topic to Julie.
yeezy boost http://lovebyt.es/bo ...
引用 游客 2018-2-19 05:17
WONDERFUL Post.thanks for share..more wait .. ?
lebron 14 shoes http://www.lebron14.us.com
引用 游客 2018-2-18 05:32
Can I just say what a aid to search out someone who really is aware of what theyre speaking about on the internet. You undoubtedly know tips on how to convey an issue to gentle and make it important. More people have to learn this and understand this side of the story. I cant imagine youre no more fashionable because you positively have the gift.
air force 1 http://www.nikeairforce1.us.com
引用 游客 2018-2-18 01:49
My wife and i felt quite happy that Emmanuel managed to deal with his preliminary research through the ideas he was given from your own site. It's not at all simplistic just to be freely giving instructions that other people may have been ** money from. And we also take into account we now have you to thank for that. Most of the explanations you have made, the ** site menu, the relationships your site give support to create - it is mostly overwhelming, and it's really leading our son in  ...
引用 游客 2018-2-17 07:31
A powerful share, I just given this onto a colleague who was doing somewhat analysis on this. And he the truth is purchased me breakfast as a result of I found it for him.. smile. So let me reword that: Thnx for the treat! However yeah Thnkx for spending the time to discuss this, I feel strongly about it and love reading more on this topic. If potential, as you develop into experience, would you mind updating your weblog with more particulars? It's highly useful for me. Huge thumb up for this we ...
引用 游客 2018-2-16 12:39
I just wanted to develop a ** message in order to say thanks to you for these splendid information you are giving out at this website. My considerable internet research has finally been recognized with extremely good points to talk about with my family. I would suppose that many of us visitors actually are undeniably blessed to be in a good place with so many outstanding individuals with useful guidelines. I feel really grateful to have used the website and look forward to some more pleasura ...
引用 游客 2018-2-16 10:50
Oh my goodness! an amazing article dude. Thank you However I'm experiencing difficulty with ur rss . Don抰 know why Unable to subscribe to it. Is there anybody getting an identical rss drawback? Anyone who is aware of kindly respond. Thnkx
kobe sneakers http://www.kobesneakers.com
引用 游客 2018-2-16 01:52
Aw, this was a really nice post. In thought I would like to put in writing like this moreover ?taking time and precise effort to make a very good article?however what can I say?I procrastinate alot and not at all seem to get one thing done.
Adidas NMD XR1 Ostrich Color and Black http://www.adidas-nmds.us.com/adidas-nmd-xr1-ostrich-color-and-black-p-519.html
引用 游客 2018-2-15 15:39
There are actually a variety of details like that to take into consideration. That could be a nice point to carry up. I offer the thoughts above as general inspiration however clearly there are questions like the one you bring up where the most important factor might be working in honest good faith. I don?t know if finest practices have emerged around things like that, but I am certain that your job is clearly recognized as a fair game. Both girls and boys feel the impact of just a moment抯 plea ...
引用 游客 2018-2-15 04:31
I must point out my respect for your generosity supporting persons that really need assistance with this important niche. Your special commitment to passing the solution all around had become amazingly practical and has in most cases enabled many people like me to get to their endeavors. Your own helpful tutorial means a lot a person like me and extremely more to my office workers. With thanks; from everyone of us.
yeezy boost 350 http://tropaadet.dk/yzyv2
引用 游客 2018-2-14 20:19
I抎 have to verify with you here. Which isn't something I usually do! I enjoy reading a publish that can make individuals think. Additionally, thanks for permitting me to remark!
cartier bracelet http://www.cartierbracelet.us
引用 游客 2018-2-14 00:46
An attention-grabbing dialogue is price comment. I believe that you need to write extra on this topic, it may not be a taboo subject but usually individuals are not enough to speak on such topics. To the next. Cheers
michael kors outlet online http://www.michaelkors-outletsonline.us.com
引用 游客 2018-2-13 17:44
I enjoy you because of all your effort on this web page. Ellie really loves setting aside time for investigation and it is easy to see why. Almost all learn all of the lively form you make important tips and tricks on your web site and as well invigorate response from the others on this subject and our ** princess is in fact starting to learn a lot. Enjoy the remaining portion of the year. You are conducting a fabulous job.
yeezy boost http://ix.sk/toXF8

查看全部评论(26)


新出炉

返回顶部