2022护网日记第六天

杂谈

今天的分享分为三部分

• 恶意IP/域名情报
• 一些厂商漏洞汇总
• 你关心的趣事

恶意IP/域名情报

一些厂商漏洞汇总

你关心的趣事

POC, sir?

听说有近源攻击翻车的？

是的，朋友圈里有热心网友分享的，大型社工翻车现场

听说红队有被劝退的?

此条已确认，据说是在演戏过程中出现了“脱裤”的恶意行为。（名词解释：“脱裤”，亦称拖库，数据库被黑客整个拖下来。）

钓鱼🎣文件有可供学习参考的吗？

https://www.virscan.org/report/13b1858a636e30998144cb7bb15b9179618ee611e53e1cea5f29029f50ff2149	csrss.exe	伪造系统进程	样本链接（下载有风险，请注意）
https://www.virscan.org/report/7e777d28447f0723e4b257c52456861f125d07a54358cd63b905fcc12490da81	null.sys	sys
https://www.virscan.org/report/ca1acf6236dfaa4b835523a8ccd9a51d886c2d96d7299d476d567fed54962902	钓鱼后门.zip	字面意思
https://www.virscan.org/report/8618d9c59852da1380dce47b5eadd7a38823b2f2597905f75e18ca560a380be3	Lanucher.exe	14KB exe
https://www.virscan.org/report/3719e5b2aa76c1c299e5a612dea371dd8df8ecc014e4591b138aa49b717c30e0	正版验证.exe	EXE 钓鱼
https://www.virscan.org/report/d3724bfb1ae58237d3a464d640be5e14615d8ee08a87229e340e5822da11b64e	凤凰.exe	EXE
https://www.virscan.org/report/6e547d61d31adf07128c39f0ad4b71a3bda60e1273890838214f021d756ec288	ta.exe	EXE多检出	https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
https://www.virscan.org/report/16ac871fa50f204cc96a2f55e8942786d21cdb98188f0869aa67a3d7c67567da	7714‮gpj..Scr	EXE伪装图片
https://www.virscan.org/report/9297c83eb84e2f123a5eca72212807b082f3c99357f0191617e7775daf33b71b	西瓜视频下载.exe	EXE多检出
https://www.virscan.org/report/42ff32fedd64a59278db988b8b702ff3252f7c2b747baaba6668aba386fb3760	photo.exe	EXE 多检出 钓鱼	http://vguarder.91i.net/SETUPX.EXE
https://www.virscan.org/report/b35313d3d6451f184351a7f50d75644f12f3f6e209444641aaa2cc8a24831e72	Fw_ 邮件系统备案紧急通知！.eml	EML 钓鱼	http://205.185.127.88/aq.php
http://cafine.co
http://cafine.com.cn/aq.php
https://www.virscan.org/report/5514cdb8557a93573fc0130601f664e773e73bdc2a5c110e0a03f5f4b24f442e	SharkHW.zip	HW
https://www.virscan.org/report/db7b9dbaeaefb36890a1f301a540b569da21b14dff4e29faabf4ee7c740acdf5	server.exe	EXE 多检出
https://www.virscan.org/report/e9f44654eb0205717e25f544c7cc72aa01475e871b8ece8c729add2a1cfb3d78	VPN登录控件.exe	EXE VPN
https://www.virscan.org/report/af9b4985abb0ad0be7603651e9244a61d9ab4e18b579fd673838da01ca37b92e	beaconx64.exe	CobaltStrike EXE
https://www.virscan.org/report/d45c25126922b244691cc2b3eb12599d672af5d4bcf7905a5777b8876fe4a5fb	网桥转发	exe 多检出 安全厂商API	https://api.sec.yunsee.cn/api/owner/getVulner

会点鼠标的猴子🐒？

参考下面的梗