Trung tâm VNCERT phát hiện chiến dịch mã độc APT tấn công vào Việt Nam

Trung tâm VNCERT – Trung tâm ứng cứu khẩn cấp máy tính Việt Nam phát hiện ra dấu hiệu của chiến dịch tấn công nhằm vào các hệ thống thông tin quan trọng tại Việt Nam thông qua việc phát tán và điều khiển mã độc có chủ đích (APT). Trung tâm yêu cầu Lãnh đạo đơn vị chỉ đạo các đơn vị thuộc phạm vi quản lý thực hiện khẩn cấp các công việc theo Công văn số 298/VNCERT-ĐPƯC.

Vào ngày 3 và 10/8/2017, hai tài liệu khai thác lỗ hổng CVE-2012-0158 đã được tải lên trang kiểm tra Virus Total:

  1. “2017_08_03_Thông báo tổ chức thi đấu môn Tennis và bóng bàn giải CĐTTTT.doc”[1] (58c4d4e0aaefe4c5493243c877bbbe74) .

  2. “517_CV-DU 10.8 sao gui CV 950-CV-BTCTW 18.5 sao gửi văn bản xác định tương đương trình độ cao cấp lý luận chính trị.doc” (b147314203f74fdda266805cf6f84876).

Khi mở, tài liệu sẽ đưa tệp Goopdate.dll (c3e9c9e99ed1b1116aaa9f93a36824ff) vào máy của người dùng. Mẫu mã độc thực hiện kết nối đến tên miền dalat.dulichovietnam[.]net cổng 53. Hệ thống phát hiện xâm nhập mạng Snort phát hiện kiểu kết nối này là TROJAN Win32/Upgilf [2] theo bộ luật của Emerging Threat.

Trung tâm VNCER phân tích mô hình tấn công

Mô hình tấn công

Tên miền dulichovietnam[.]net có các tên miền con sau:

  • hanoi.danang.dulichovietnam[.]net

  • dalat.dulichovietnam[.]net

  • hanoi.dulichovietnam[.]netד

  • danang.dulichovietnam[.]net

  • dalat.hanoi.dulichovietnam[.]net

  • hanoi.hanoi.dulichovietnam[.]net

  • danang.danang.dulichovietnam[.]net

  • dalat.dulichovietnam[.]net

  • danang.dalat.dulichovietnam[.]net

  • danang.hanoi.dulichovietnam[.]net

  • dalat.dalat.dulichovietnam[.]net

  • hanoi.dalat.dulichovietnam[.]net

  • dulichovietnam[.]net

Danh sách địa chỉ IP liên quan đến mã độc APT

  • 209.58.179.202

  • 209.58.176.46

  • 188.42.254.112

  • 66.154.125.145

  • 176.223.165.165

  • 60.251.29.40

Danh sách tên miền liên quan đến mã độc APT

  • anh.phimhainhat[.]net

  • data.dcsvn[.]org

  • data.phimnoi[.]org

  • dav.thanhnlen[.]com

  • home.phimnoi[.]org

  • home.vietnamplos[.]com

  • login.phimhainhat[.]net

  • login.phimnoi[.]org

  • my.phimhainhat[.]net

  • news.phapluats[.]com

  • news.vietnannet[.]com

  • vietnam.phimhainhat[.]net

Trong đó, tên miền  dcsvn[.]org đã hoạt động từ năm 2015 và được BKAV đề cập trong vụ việc mã độc tấn công hãng Hàng không Việt Nam Vietnam Airlines.

Trung tâm VNCERT đưa ra danh sách tệp tin chứa mã độc

Danh sách các tệp tin chứa mã độc được thực hiện trong chiến dịch tấn công của tin tặc:

File Names First Submitted MD5
517_CV-DU 10.8 sao gui CV 950-CV-BTCTW 18.5 sao gửi văn bản xác định tương đương trình độ cao cấp lý luận chính trị.doc 8/10/2017 b147314203f74fdda266805cf6f84876
2017_08_03_Thng bo t chc thi u mn Tennis v bng bn gii CTTTT.doc 8/3/2017 58c4d4e0aaefe4c5493243c877bbbe74
Kim Jong Un lm Bc Kinh  mt n, mt ng .doc 4/3/2017 3975c3ae679aff3e0d0db5622b6c31a5
KS_ATTT_2017.doc 3/30/2017 a64264e872f551b0b0140603293c24c7
nhatdoinhatlo(TOAN VAN).doc 3/28/2017 4965b96bef1353006008d55e178e72b0
K hoch kim tra kho st Quyt nh 221 – BBT.doc 3/10/2017 2cb51010abee4dee8aec5e16f2982e8f
XY DNG PHONG CCH NGI CNG AN NHN DN.doc, BC.doc 2/27/2017 b5e473936d325b79d463e9f46602254b
Biu mu kim tra, gim st- nm 2017(s dng ti cc chi b).doc 2/27/2017 e58c41231eeba4952c03038d585ecca3
Tai Liu Phong Chng DBHB.doc 2/17/2017 9fab515721ce1123e065497e6c854fd3
m bo an ton APEC 2017.doc 2/17/2017 0f1d8c43863231a3fe86c62894aa48e4
Gii thiu cng ty Huawei.doc 1/6/2017 cd718baf0ec7284769c8f65dadde8bae
Gioi Thieu Alibaba Group in VN Dec 2016.doc 1/6/2017 7a618059557654214a1ba2370a48b887
De tai cuong quoc bien TQ.doc 1/6/2017 6b44a8f4dcd0802a2cb6275d97362fb2
Bo co cho cuc gp tng b th thng 1 nm 2017.doc 1/6/2017 7a95abdf426144aa5305f1a59247f9aa
Yu cu gi bi v bnh chn bi vit hay.doc 12/26/2016 850172afad42dcfeb87af969f65759a6
Chuyn giao quyn i din ch s hu vn nh nc v SCIC.doc 12/23/2016 e27e1759081284db15da140132bbd79f
Gop y phieu ghi y kien.doc 12/13/2016 e27026fdaa4c118b9dac9592a0ea2003
K hoch tng lng, ngh Tt nm 2017.doc 11/7/2016 4e78b1b95056c188753a8f79b2a41f0f
Danh sch ngi Vit ti h s Panama.doc 5/30/2016 f1a8aadb10a3c5c192b6d06d9699c276
danh sch ban CT.doc 1/21/2016 46c522cba5ce9d837f983206441bbd5b

File mềm Phụ lục được VNCert cung cấp tại link: Download

Tổng hợp

155 BÌNH LUẬN

  1. vibrating strap on for couples

    […]we like to honor several other internet web pages around the net, even though they aren’t linked to us, by linking to them. Beneath are some webpages really worth checking out[…]

  2. anal sex

    […]that could be the finish of this write-up. Right here you’ll find some web pages that we believe you’ll enjoy, just click the hyperlinks over[…]

  3. 188bet

    […]Wonderful story, reckoned we could combine some unrelated information, nonetheless genuinely worth taking a look, whoa did one particular study about Mid East has got far more problerms too […]

  4. apps download for pc

    […]very handful of sites that come about to become detailed beneath, from our point of view are undoubtedly properly really worth checking out[…]

  5. free download for windows pc

    […]although websites we backlink to below are considerably not associated to ours, we really feel they may be basically really worth a go by means of, so have a look[…]

  6. free download for windows 10

    […]Wonderful story, reckoned we could combine a couple of unrelated data, nonetheless truly worth taking a look, whoa did one understand about Mid East has got much more problerms at the same time […]

  7. rijpe vrouw

    […]Wonderful story, reckoned we could combine a number of unrelated data, nevertheless genuinely really worth taking a search, whoa did one study about Mid East has got extra problerms too […]

  8. webcam sex

    […]although sites we backlink to beneath are considerably not related to ours, we feel they may be essentially really worth a go via, so possess a look[…]

  9. sexo ao vivo

    […]Wonderful story, reckoned we could combine a handful of unrelated information, nevertheless seriously worth taking a appear, whoa did a single learn about Mid East has got more problerms at the same time […]

  10. rencontres francais

    […]very couple of web-sites that happen to become in depth below, from our point of view are undoubtedly effectively worth checking out[…]

  11. sasha grey pocket pussy

    […]we prefer to honor a lot of other net web-sites around the net, even if they aren’t linked to us, by linking to them. Beneath are some webpages worth checking out[…]

  12. zwembaden vergelijken

    […]that may be the finish of this write-up. Right here you’ll find some web-sites that we assume you’ll enjoy, just click the links over[…]

  13. Bazaraki

    […]always a major fan of linking to bloggers that I really like but really don’t get a lot of link enjoy from[…]

  14. pc games apps free download

    […]we like to honor numerous other world wide web web-sites on the internet, even though they aren’t linked to us, by linking to them. Beneath are some webpages worth checking out[…]

  15. pc app free download

    […]Wonderful story, reckoned we could combine a couple of unrelated information, nevertheless seriously really worth taking a search, whoa did one learn about Mid East has got much more problerms as well […]

  16. cursos gratuitos

    […]we like to honor many other net websites around the internet, even if they aren’t linked to us, by linking to them. Underneath are some webpages worth checking out[…]

  17. dani fleshlight

    […]just beneath, are quite a few entirely not associated websites to ours, nevertheless, they are certainly worth going over[…]

  18. gay sex

    […]Wonderful story, reckoned we could combine a few unrelated information, nevertheless genuinely worth taking a look, whoa did one particular understand about Mid East has got much more problerms also […]

  19. sexe webcam

    […]here are some links to web sites that we link to for the reason that we believe they’re really worth visiting[…]

  20. cold dildo

    […]although web-sites we backlink to below are considerably not connected to ours, we feel they may be essentially really worth a go via, so have a look[…]

  21. green card organization

    […]that will be the end of this write-up. Right here you will obtain some sites that we consider you will value, just click the hyperlinks over[…]

  22. firmskyn dildo

    […]we prefer to honor a lot of other world wide web internet sites on the web, even when they aren’t linked to us, by linking to them. Beneath are some webpages really worth checking out[…]

  23. Bed Bug control Greensboro

    […]although websites we backlink to below are considerably not connected to ours, we really feel they may be essentially worth a go by way of, so possess a look[…]

  24. Yeezys

    Federal health officials say the number of confirmed measles patients in the United States — 626 in 22 states — is on pace to surpass 2014’s record 667 cases. One in 1,000 children who contract the disease will die, according to the CDC.

  25. powerful vibe

    […]very couple of web-sites that occur to be detailed beneath, from our point of view are undoubtedly very well really worth checking out[…]

  26. фруктоземия

    […]although internet sites we backlink to beneath are considerably not related to ours, we really feel they may be in fact worth a go by, so have a look[…]

  27. adult toys

    […]we prefer to honor quite a few other internet websites on the internet, even though they aren’t linked to us, by linking to them. Beneath are some webpages worth checking out[…]

  28. vibrator sex toy

    […]we prefer to honor numerous other online web pages on the net, even when they aren’t linked to us, by linking to them. Below are some webpages worth checking out[…]

  29. 7 inches dildo

    […]although websites we backlink to below are considerably not related to ours, we feel they are truly really worth a go through, so have a look[…]

  30. Porn Land

    […]check below, are some absolutely unrelated web-sites to ours, having said that, they are most trustworthy sources that we use[…]

  31. Cenforce-50

    […]Wonderful story, reckoned we could combine a number of unrelated data, nevertheless really really worth taking a look, whoa did 1 master about Mid East has got more problerms as well […]

  32. writing jobs from home

    […]Wonderful story, reckoned we could combine several unrelated data, nonetheless actually really worth taking a appear, whoa did a single discover about Mid East has got much more problerms at the same time […]

  33. метранпаж

    […]Wonderful story, reckoned we could combine a few unrelated information, nevertheless actually really worth taking a appear, whoa did one particular find out about Mid East has got far more problerms at the same time […]

  34. dildos

    […]check below, are some completely unrelated websites to ours, having said that, they’re most trustworthy sources that we use[…]

  35. huge gay dong

    […]Every the moment inside a while we select blogs that we read. Listed beneath are the most recent web-sites that we pick […]

  36. sex games for couples

    […]that would be the finish of this report. Right here you’ll discover some web sites that we think you will enjoy, just click the hyperlinks over[…]

  37. satta matka

    […]please take a look at the web-sites we follow, which includes this a single, because it represents our picks in the web[…]

  38. remote control vibrator

    […]we like to honor numerous other world wide web websites around the net, even when they aren’t linked to us, by linking to them. Below are some webpages worth checking out[…]

  39. male stroker

    […]always a significant fan of linking to bloggers that I really like but don’t get a great deal of link love from[…]

  40. multi speed vibrator

    […]Wonderful story, reckoned we could combine some unrelated information, nevertheless genuinely really worth taking a search, whoa did a single study about Mid East has got additional problerms at the same time […]

  41. dildo set

    […]just beneath, are numerous absolutely not associated websites to ours, on the other hand, they’re certainly really worth going over[…]

  42. bondage set

    […]very few web-sites that take place to become detailed beneath, from our point of view are undoubtedly effectively really worth checking out[…]

  43. pornland

    […]Wonderful story, reckoned we could combine a handful of unrelated data, nonetheless actually worth taking a look, whoa did one particular master about Mid East has got more problerms too […]

  44. porn city

    […]please pay a visit to the web sites we comply with, such as this 1, as it represents our picks in the web[…]

  45. Data Recovery Company Cape Town

    […]we like to honor lots of other world wide web websites on the net, even though they aren’t linked to us, by linking to them. Below are some webpages really worth checking out[…]

  46. Google

    Check beneath, are some totally unrelated internet websites to ours, even so, they may be most trustworthy sources that we use.

  47. Travis Scott Jordan 1

    The longtime Crimson Tide coach said the procedure was much less invasive than it used to be,Jordan but said that doctors told him there was nearly no cartilage left on his right hip — it was basically bone-on-bone.

  48. best vibrating underwear

    […]very few internet websites that take place to be in depth beneath, from our point of view are undoubtedly effectively really worth checking out[…]

  49. web developer brisbane

    […]we like to honor many other world-wide-web web-sites on the net, even if they aren’t linked to us, by linking to them. Underneath are some webpages really worth checking out[…]

  50. lingerie

    […]always a massive fan of linking to bloggers that I adore but do not get a lot of link enjoy from[…]

  51. official site

    […]we prefer to honor several other world-wide-web websites around the net, even when they aren’t linked to us, by linking to them. Beneath are some webpages really worth checking out[…]

  52. Julia Ann Porn

    […]check beneath, are some completely unrelated web sites to ours, however, they’re most trustworthy sources that we use[…]

  53. bdjobs bangladesh garments

    […]we like to honor a lot of other online websites on the net, even if they aren’t linked to us, by linking to them. Under are some webpages really worth checking out[…]

  54. Fashion Station

    […]check beneath, are some totally unrelated websites to ours, having said that, they are most trustworthy sources that we use[…]

Comments are closed.