ʵ²â£¡918²©ÌìÌÃÌì«‘EDR±Õ»·ÍµÏ®¡°º£Á«»¨¡±Ñù±¾

Ðû²¼Ê±¼ä 2025-11-12

½üÆÚ£¬ £¬£¬¸ß¼¶Ò»Á¬ÐÔÍþв£¨APT£©×éÖ¯¡°º£Á«»¨¡±£¨OceanLotus£©ÔÙ¶È»îÔ¾¡£¡£¡£¡£ÆäͶ·ÅµÄÐÂÐÍÑù±¾½ÓÄɸ߶ÈÒþ²ØµÄ¹¥»÷ÊÖ·¨£¬ £¬£¬¶ÔÎÒ¹ú²¿·ÖÖØµãÄ¿µÄʵÑ鶨ÏòÉøÍ¸£¬ £¬£¬¶ÔÆóÒµºÍ»ú¹¹µÄÊý¾ÝÇå¾²×é³ÉÑÏÖØÍþв¡£¡£¡£¡£


¸ÃÑù±¾Ö÷Òª½ÓÄÉÒÔÏÂËÄÀàÊÖÒÕÊֶΣº


Ò»ÊÇÒþ²Ø»¯Ö²È룺ÀÄÓÃÕýµ±MSTÁ÷³Ì£¬ £¬£¬¹æ±ÜͨÀýÇå¾²¼ì²â£»£»£»£»

¶þÊdz¤ÆÚ»¯×¤Áô£ºÍ¨¹ý×¢²á±í×ÔÆô¶¯ÏîʵÏÖϵͳºã¾Ã¿ØÖÆ£»£»£»£»

ÈýÊÇÄڴ滯ִÐУº½ÓÄÉÄ£¿£¿£¿éïοյÈÊÖÒÕ£¬ £¬£¬¶Ô¿¹ÐÂÎÅ̬ÆÊÎö£»£»£»£»

ËÄÊÇÄ£¿£¿£¿é»¯Í¨Ñ¶£ºÒÀÀµ¼ÓÃÜÐÄÌø°üÓëC&CЧÀÍÆ÷ͨѶ£¬ £¬£¬ÊµÏÖÔ¶³Ì²Ù¿Ø¡£¡£¡£¡£


ÃæÁÙ´ËÀà×éÖ¯ÐÔÇ¿¡¢ÊÖ¶ÎÒþ²ØµÄAPT¹¥»÷£¬ £¬£¬ÊµÏÖ´ÓÈëÇÖ¸ÐÖªµ½ÐÐΪ×è¶ÏµÄÈ«Á´Â··À»¤£¬ £¬£¬ÒѳÉΪÖÕ¶ËÇå¾²µÄ½¹µãÌôÕ½¡£¡£¡£¡£


±¾ÎÄ»ùÓÚ918²©ÌìÌÃÌì«‘EDR¶Ô¡°º£Á«»¨¡±×îÐÂÑù±¾µÄʵ²âÀú³Ì£¬ £¬£¬ÏÈÈÝÔõÑùÒÀÍÐÆä¡°Î´ÖªÍþв¸ÐÖª¡¢Á¢Ìå·À»¤ÍøÂç¡¢¿ìËÙÓ¦¼±ÏìÓ¦¡¢Ç鱨Çý¶¯½ø»¯¡±µÈÄÜÁ¦£¬ £¬£¬ÓÐÓÃÓ¦¶Ô´ËÀà¸ß¼¶Íþв¡£¡£¡£¡£


ϵͳ¸Ä¶¯ÊµÊ±¸ÐÖª


¡°º£Á«»¨¡±¹¥»÷ÕßÔËÐÐÕýµ±µÄWindowsPCHealthCheckSetup.msi×°Öðü£¬ £¬£¬¸Ã×°Öðü»áÔÚ%LOCALAPPDATA%Öн¨ÉèÃûΪPCHealthCheckµÄÎļþ¼Ð£¬ £¬£¬½«×°ÖðüÖеÄÕýµ±³ÌÐòPCHealthCheck.exe¸´ÖÆÖÁ´Ë¡£¡£¡£¡£¶ø¹¥»÷ÕßÔÚÏÂÁîºó°ë²¿·Ö¸½¼ÓµÄmstÎļþ»á±»ÆÊÎö£¬ £¬£¬ÊͷŶñÒâÄ£¿£¿£¿étbs.dllµ½PCHealthCheck.exeËùÔÚÎļþ¼Ð£¬ £¬£¬Í¬Ê±Ìí¼ÓÃûΪPCHealthCheckµÄ×ÔÆô¶¯Ï £¬£¬²¢½«ÆäÖ¸ÏòPCHealthCheck.exeÎļþ¡£¡£¡£¡£»£»£»£»ùÓڴ˲Ù×÷£¬ £¬£¬¿ÉʵÏÖÕýµ±µÄPCHealthCheck.exe¿ª»ú×ÔÆô¶¯£¬ £¬£¬×Ô¶¯¼ÓÔØ¶ñÒâµÄtbs.dllÓë¹¥»÷Õß¾ÙÐÐͨѶ£¬ £¬£¬¿ØÖÆÊܺ¦Õß»úе¡£¡£¡£¡£


ͼƬ1.png

ͼ1½¨ÉèÕýµ±³ÌÐòºÍ¶ñÒâDLLÄ£¿£¿£¿é


ͼƬ2.png

ͼ2Ìí¼ÓÀֳɵÄ×¢²á±í×ÔÆô¶¯Ïî


Ìì«‘EDRʵʱ¼à¿Ø×¢²á±í×ÔÆô¶¯Ïî¡¢×ÔÆô¶¯Îļþ¼Ð¡¢ÍýÏëʹÃüµÈϵͳҪº¦Î»Öñ任£¬ £¬£¬È·±£¶Ô¸Ä¶¯ÐÐΪµÄʵʱÏìÓ¦¡£¡£¡£¡£


Èçͼ3¡¢Í¼4Ëùʾ£¬ £¬£¬Àú³ÌIDΪ2536µÄmsiexec.exeÀú³Ì½«PCHealthCheck.exeÌí¼ÓΪע²á±í×ÔÆô¶¯Ï £¬£¬´¥·¢ÁËÌì«‘EDRϵͳ¸Ä¶¯·À»¤¹¦Ð§µÄ×ÔÆô¶¯ÏîÔöÌí¸æ¾¯£¬ £¬£¬ÊµÊ±²¶»ñÆä³¤ÆÚ»¯×¤ÁôÍýÏ룬 £¬£¬´Ó¹¥»÷Á´µÚÒ»²½×èÖ¹ÆäÉìÕÅ¡£¡£¡£¡£


ͼƬ3.png

ͼ3Ìì«‘EDR±¬·¢×ÔÆô¶¯ÏîÔöÌí¸æ¾¯


ͼƬ4.png

ͼ4Ìì«‘EDR×ÔÆô¶¯ÏîÔöÌí¸æ¾¯ÏêÇé


¶ñÒâÐÐΪÖÇÄÜʶ±ðÓë×è¶Ï


¡°º£Á«»¨¡±¹¥»÷ÕßÔÚʹÓÃmsiexec×°ÖÃPCHealthCheckʱ£¬ £¬£¬»áÖ¸¶¨ÌØÊâµÄmstÎļþÖ´ÐÐÌØÊâ²Ù×÷£ºÊͷŶñÒâÄ£¿£¿£¿étbs.dllµ½PCHealthCheck.exeËùÔÚÎļþ¼Ð£¬ £¬£¬Ìí¼ÓÃûΪPCHealthCheckµÄ×ÔÆô¶¯Ï £¬£¬²¢½«ÆäÖ¸ÏòPCHealthCheck.exeÎļþ¡£¡£¡£¡£


ͼƬ5.png

ͼ5MsiExec.exeÆÊÎömstÎļþºóµÄдÎļþ¡¢×¢²á±í²Ù×÷


Ìì«‘EDRÒÀÍÐÄÚÖÃÐÐΪÒýÇæ£¬ £¬£¬¿ÉÒÔ¶ÔÀú³ÌµÄÎļþÐÐΪ¡¢×¢²á±íÏîÐÐΪ¡¢Àú³ÌÐÐΪµÈ¾ÙÐÐ×ÛºÏÆÀ¹À£¬ £¬£¬Ò»µ©×ÛºÏÆÀ¹ÀµÖ´ïÃô¸ÐÐÐΪ¹æÔòãÐÖµ£¬ £¬£¬ÔòÅжϸÃÖ´ÐÐÎļþΪ¶ñÒâÎļþ¡£¡£¡£¡£


Èçͼ6¡¢Í¼7Ëùʾ£¬ £¬£¬¡°º£Á«»¨¡±¹¥»÷ÕßÔÚʹÓÃmsiexec×°ÖÃPCHealthCheckʱ£¬ £¬£¬Ö¸¶¨ÌØÊâµÄmstÎļþÖ´ÐÐÁËÌØÊâ²Ù×÷¡£¡£¡£¡£Ìì«‘EDR¾Í¿ÉÒÔ»ùÓÚÎļþÐÐΪ¡¢×¢²á±íÐÐΪÆÊÎöÅжϸÃÀú³ÌΪAPT32¶ñÒâÀú³Ì£¬ £¬£¬±¬·¢ÏìÓ¦µÄµ¯´°¸æ¾¯£¬ £¬£¬ÔÚÒªº¦Á´Â·ÉÏ×Ô¶¯×èµ²Àú³Ì£¬ £¬£¬ÊµÏÖ¡°ÐÐΪ¼¶¡±Ïûɱ¡£¡£¡£¡£


ͼƬ6.png

ͼ6Ìì«‘EDRÐÐΪÒýÇæ¸æ¾¯


ͼƬ7.png

ͼ7Ìì«‘EDRÐÐΪÒýÇæ¸æ¾¯µÄ¾ÙÖ¤ÐÅÏ¢


ÍøÂçÐÐΪÖÜÈ«ÁôºÛÓë¼ì²â


¡°º£Á«»¨¡±Ñù±¾ÓëC&CЧÀÍÆ÷½¨Éè»ùÓÚHTTPЭÒéµÄÍøÂçÅþÁ¬£¬ £¬£¬Ã¿¸ô30Ãë·¢ËÍÒ»´ÎÐÄÌø°ü£¬ £¬£¬ÊµÑé´ÓC&CЧÀÍÆ÷»ñÈ¡Ö÷»úÐÅÏ¢¡¢Ã¶¾ÙÀú³Ì¡¢ÎļþÉÏ´«ÏÂÔØÒÔ¼°ÏÂÁîÖ´ÐеȶñÒâ¿ØÖÆÖ¸Áî¡£¡£¡£¡£


ͼƬ8.png

ͼ8¡°º£Á«»¨¡±Ñù±¾·¢ËͼÓÃÜÄÚÈÝ


Ìì«‘EDR¿ÉÒÔÍêÕû¼Í¼ÖÕ¶ËËùÓÐÍâÁªÍ¨Ñ¶ÐÐΪ£¬ £¬£¬°üÀ¨Í¨Ñ¶IP¡¢¶Ë¿Ú¡¢Ð­ÒéµÈÒªº¦ÐÅÏ¢£¬ £¬£¬ÖÜÈ«ÁýÕÖÍøÂçÐÐΪ¹ì¼£¡£¡£¡£¡£


Èçͼ9¡¢Í¼10Ëùʾ£¬ £¬£¬Ìì«‘EDR¼à¿Øµ½ÖÕ¶ËÉÏ¡°º£Á«»¨¡±ÑùÄÚÇ鹨Àú³Ìpchealthcheck.exeÌᳫÁËTCPÍøÂçÅþÁ¬139.162.62.239:8001£¬ £¬£¬ÎªºóÐøÍþвËÝÔ´Óë¹ØÁªÆÊÎöÌṩÁËÓÐÓÃÊý¾ÝÖ§³Ö¡£¡£¡£¡£


ͼƬ9.png

ͼ9Ìì«‘EDR¼à²â¡°º£Á«»¨¡±Ñù±¾ÍøÂçÅþÁ¬ÈÕÖ¾


ͼƬ10.png

ͼ10Ìì«‘EDR¼à²â¡°º£Á«»¨¡±Ñù±¾ÍøÂçÅþÁ¬ÈÕÖ¾ÏêÇé


³ýÁ˶ÔÍøÂçÐÅÏ¢µÄ¼Í¼£¬ £¬£¬Ìì«‘EDRÓë918²©ÌìÌÃVenusEyeÍþвÇ鱨¿âÉî¶ÈÁª¶¯£¬ £¬£¬Í¨¹ýÈÚºÏÍâµØ¼ì²âÊý¾ÝÓëÔÆ¶ËÍþвÇ鱨£¬ £¬£¬¹¹½¨¶¯Ì¬¸üеķÀ»¤»úÖÆ£¬ £¬£¬Ò»Á¬¼ì²â²¢µÖÓù¡°º£Á«»¨¡±APT¼°Æä±äÖÖ¹¥»÷£¬ £¬£¬ÊµÏÖÇ徲Σº¦µÄÔç·¢Ã÷¡¢¿ìÏìÓ¦¡£¡£¡£¡£


ͼƬ11.png

ͼ11Ìì«‘EDRÍâµØÇ鱨ÖС°º£Á«»¨¡±Ïà¹ØÍþвÇ鱨ÐÅÏ¢


ͼƬ12.png

ͼ12Ìì«‘EDRÍâµØÇ鱨ÖС°º£Á«»¨¡±Ïà¹ØÍþвÇ鱨ÐÅÏ¢ÏêÇé


Ôڸ߼¶ÍþвһÁ¬ÑݽøµÄÅä¾°Ï£¬ £¬£¬ÖÕ¶Ë·À»¤µÄÒªº¦ÔÚÓÚ½¨ÉèÒ»Á¬ÓÐÓõĶԿ¹ÄÜÁ¦¡£¡£¡£¡£918²©ÌìÌÃÌì«‘EDRͨ¹ý¡°¼ì²â¡ª·À»¤¡ªÏìÓ¦¡ªµü´ú¡±±Õ»·Ç徲ϵͳ£¬ £¬£¬¹¹½¨Ò»¸öÄܹ»×ÔÎÒÓÅ»¯¡¢¶¯Ì¬µ÷½âµÄÖÕ¶Ë·ÀÓù»úÖÆ£¬ £¬£¬ÎªÖÖÖÖÖÕ¶ËÓ¦¶Ô¸ß¼¶ÍþвÌṩ¿É¿¿ÆÁÕÏ¡£¡£¡£¡£