LinuxとWindowsを狙うマルウエアWellMess(2018-06-28) | JPCERTコーディネーションセンター（JPCERT/CC）
マルウエアの中にはマルチプラットフォームで動作することを意図して作成されたものが存在し、その際に使用されるプログラミング言語として代表的なものがJavaです。たとえば、以前分析センターだよりで紹介したAdwindはJavaで作成されたマルウエアで、Windows以外のOSでも動作します。ご存知の通り、Java以外にもマルチプラットフォームで動作することを想定したプログラミング言語は存在し、Golangもその１つです。Javaで作成されたマルウエアに比べると少ないですが、Golangで作成されたものも確認されています。たとえば、Linuxに感染するマルウエアとして有名なMiraiもコントローラーにはGolangが使用されています。 今回は、JPCERT/CC で確認したマルウエアWellMessについて紹介します。WellMessは、Golangで作成され、クロスコンパイルによってLinux
Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets
Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets This post is also available in: 日本語 (Japanese) Summary Palo Alto Networks Unit 42 used the AutoFocus threat intelligence service to identify a series of phishing attacks against Japanese organizations. Using AutoFocus to quickly search and correlate artifacts across the collective set of WildFire and other Palo Alto
CIRCL » TR-24 Analysis - Destory RAT family
Overview CIRCL analyzed a malware sample which was only sporadically detected by just a handful antivirus engines, based on heuristic detection. CIRCL analyzed the entire command structure of the malware and was able to attribute this specific malware to the Destory RAT family. The malware is a feature-rich Remote Access Tool. The malware is used by a specific group of attackers specialized in ind
Evasive Tactics: Terminator RAT | FireEye Blog
FireEye Labs has been tracking a variety of advanced persistent threat (APT) actors that have been slightly changing their tools, techniques, and procedures (TTPs) in order to evade network defenses. Earlier, we documented changes to Aumlib, the malware used in the attack against the New York Times, and Taidoor, a malware family that is being used in ongoing cyber-espionage campaigns particularly
Endpoint Protection - Symantec Enterprise
Contributor: Lionel Payet Political news has always been one of the top topics used in targeted attacks. Last week we came across unique malicious emails targeting high-profile companies in Europe and Asia (in sectors such as finance, mining, telecom, and government). The payload is an updated version of a Java remote access tool (RAT) detected as Backdoor.Opsiness, also known as Frutas RAT. Figur
PR Distribution Services | Notified
Notified IR Solutions Tell your investment story with world-class IR solutions
Poison Ivy trojan spreading across Skype - Webroot Blog
Poison Ivy trojan spreading across Skype by Blog Staff | May 15, 2012 | Industry Intel, Threat Lab Reading Time: ~ 2 min. Last night, a friend of mine surprisingly messaged me at 6:33 AM on Skype, with a message pointing to what appeared to be a photo site with the message “hahahahaha foto” and a link to hxxp://random_subdomain.photalbum.org What was particularly interesting is that he created a g
Home - Broadcom Community - Discussion Forums, Technical Docs, Ideas and Blogs
VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.. View Community Sessions VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.. View Community Sessions VMware Explore Community Tracks - Videos View Live Streams and On Demand Videos from this year's Community sessions.
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
アクセンチュア | 日本 | Let There Be Change
Research, News, and Perspectives
ウイルス作成ソフト流通の脅威 - ライブドアニュース
http://www.fireeye.com/blog/technical/malware-research/2013/08/njw0rm-brother-from-the-same-mother.html
Android Malware Eavesdrops on Users, Uses Google+ as Disguise
Endpoint Protection - Symantec Enterprise
Spyware. HackingTeam
Android Malware Eavesdrops on Users, Uses Google+ as Disguise
GitHub - kcreyts/plugxdecoder: Decodes PlugX traffic and encrypted/compressed artifacts
opensc.ws
Windows Mediaの脆弱性（MS12-004）を悪用する攻撃の検知状況 - Tokyo SOC Report
Android Malware Eavesdrops on Users, Uses Google+ as Disguise