駭客組織8220鎖定Oracle WebLogic伺服器已知漏洞而來，透過PowerShell指令碼散布挖礦軟體
支付動態 · 2024-07-03
資安業者趨勢科技針對中國駭客組織8220最新一波的攻擊行動提出警告，特別的是，這些駭客採用分階段載入與執行酬載的攻擊手法，並對於有效酬載進行混淆處理，使得防守方要察覺攻擊意圖變得更加困難
接著，載入工具在特定檔案路徑建立名為cvtres.exe的處理程序，並將下一階段的有效酬載以處理程序注入的手法，載入記憶體並啟動新的處理程序，執行名為PureCrypter的惡意程式載入工具。
這個惡意程式載入工具連線至C2伺服器，並將受害電腦進行註冊，從而下載包含XMRig在內的最終有效酬載。
研究人員指出，PureCrypter不僅能隱藏自身，並配置在系統啟動或使用者登入電腦的時候自動執行，並能建立隱藏排程執行PowerShell命令，從而將特定檔案列為防毒軟體Microsoft Defender的白名單。值得一提的是，為了防範研究人員逆向工程，駭客對於所有的有效酬載，皆透過.NET程式碼保護軟體.NET Reactor進行處理。
Popular articles
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
GAT Expo Puerto Rico Will Pulse with the New Era of Gaming in the Caribbean
Marketing
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
Super PAC Raises $48 Million: Sports Betting Forces Ramp Up Political Push
Regulation
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
SBC Summit Canada to Make Player Safety a Key Pillar of 2026 Agenda
Marketing
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
HUIDU Invites You to Booth T70 at iGB L!VE 2026 — Let’s Ignite London This July!
HUIDU Focus
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
GGC Awards 2026 Shines in Colombo: Honoring Leaders and Innovators in the iGaming Industry
HUIDU Focus
