찾아줄게요

TRI 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 TRI라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• TRI 파일은 TRIOS 파일 입니다. TA Instuments에서 배포한 파일인 것으로 보입니다. 2020-08-27 20:14:22에 처음으로 보고되었으며 2020-08-27 20:14:22에 마지막으로 보고되었습니다.

• TRIOS Software 프로그램을 다운로드하여 TRI 파일을 열 수 있습니다.

• TRIOS는 TA Instruments의 최첨단 소프트웨어 패키지로, 계측기 제어, 데이터 수집, 데이터 분석 등에 최첨단 기술을 사용합니다. 직관적인 사용자 인터페이스를 사용하면 실험을 단순하고 효과적으로 프로그래밍할 수 있으며, 실험 처리와 데이터 보기 및 분석 사이를 쉽게 이동할 수 있습니다. TRIOS 소프트웨어는 완전히 새로운 실험 경험을 제공합니다.

• 시그니처 정보가 없습니다.

• 연관 링크 #1: https://www.tainstruments.com/support/software-downloads-support/downloads/

• 연관 링크 #2: 첨부된 링크가 없습니다.

• [2021-07-07 04:57:24] @dms1899 @MBThreatIntel https://tria.ge/210706-96ygcxwemj

• [2021-07-07 04:06:55] @MBThreatIntel Cobalt Strike Payload: 5de6ec9265f79a31a9845c8a504d28f0 Download URL: http://45.153.241.113/download/pload.exe

• [2021-07-07 00:55:04] @malware_traffic 2021-07-06 (Tuesday) - #BazarLoader (#BazaLoader) from "Stolen Image Evidence" zip archive led to #CobaltStrike - Encoded binary for Cobalt Strike at: hxxp://46.17.98.191/OuqC8rXGwlN5saz48clBNekGjhs8Kjmf - List of IOCs available at: https://github.com/brad-duncan/IOCs/blob/main/2021-07-06-BazarLoader-with-Cobalt-Strike-IOCs.txt https://twitter.com/malware_traffic/status/1412470165179092992/photo/1

• [2021-07-06 23:07:37] @cpardue09 #ln -s :malware_traffic: 2021-07-06 (Tuesday) - #Hancitor (#Chanitor/#MAN1/#Moskalvzapoe/#TA511) active again today with #FickerStealer and #CobaltStrike as follow-up malware. Example of downloaded Word doc: - https://bazaar.abuse.ch/sample/b55284924181f69bf59527ac2b7a5397c35652c799c037a3e94d492d412f8c9c/ Example of dropped… https://twitter.com/malware_traffic/status/1412440042157576196/photo/1

• [2021-07-06 22:55:22] @malware_traffic 2021-07-06 (Tuesday) - #Hancitor (#Chanitor/#MAN1/#Moskalvzapoe/#TA511) active again today with #FickerStealer and #CobaltStrike as follow-up malware. Example of downloaded Word doc: - https://bazaar.abuse.ch/sample/b55284924181f69bf59527ac2b7a5397c35652c799c037a3e94d492d412f8c9c/ Example of dropped DLL: - https://bazaar.abuse.ch/sample/e1e0bfa5cabf7dc46f251327c46c1e371e67262ebb103ab242189e64bf6aa1d4/ https://twitter.com/malware_traffic/status/1412440042157576196/photo/1

• [2021-07-06 22:49:07] @James_inthe_box #cobaltstrike hosted at: http://23.227.203.229/download/klinch.exe c2: http://94.198.40.11:80/visit.js https://twitter.com/James_inthe_box/status/1412438469494804482/photo/1

• [2021-07-06 22:01:01] @bogdanangh Another #FluBot sample. What is interesting about this one is that the payload name doesn't respect the "assets/{dir}/{8 char string}.{ext}" naming convention. It uses "assets/{dir}/{10 char string}.{ext}". @alberto__segura @ThreatFabric @malwrhunterteam https://www.virustotal.com/gui/file/eddfe1cba210143962db5a6c526a8d880731743043dbe842b8a18d25863e1935/details

• [2021-07-06 15:04:13] @58_158_177_102 #cutwail start to spread #maldoc #ursnif ? Subject : Sollecito di pagamento MD5 : 40253c4885c52237755e64dc8ca6e423 payload/C2: checking.. sample : https://www.virustotal.com/gui/file/00946462797de8e5636676060439d06adb4878ab1472db5c16972b2074a0400f/detection https://app.any.run/tasks/c9e4af38-78b5-40db-846b-c767401d77f9 https://tria.ge/210706-nlemx52pc6

• [2021-07-06 13:58:56] @0xrb #CobaltStrike #C2 IP/Domain 42.193.186.7 103.86.44.196 121.196.106.136 43.228.126.114 121.199.0.233 18.183.54.253 149.28.248.129 43.226.74.228 101.37.14.144 p5z2c7j9.hostrycdn.com nollipap.tk

• [2021-07-06 13:05:44] @alberto__segura New #Flubot 4.7 sample. Same countries affected. but it is stopped using seed by country. it now selects a DGA seed randomly. The old code is still used to block numbers phone numbers. https://www.virustotal.com/gui/file/fe52bed001f28a4b218bcd0ad31b92fb59022778cf68a1445cf3e8c612a5e04c/detection cc @malwrhunterteam @danlopgom @pr3wtd @JosepAlbors https://twitter.com/alberto__segura/status/1412291656301400064/photo/1

• [2021-07-06 03:07:06] @cpardue09 #ln -s :malware_traffic: 2021-07-05 (Monday) - #RigEK sends #Redline infostealer malware. Sample of the Redline EXE available at: - https://bazaar.abuse.ch/sample/04ebbf20cfd58785ad616b81244c6901e8ed57c9c2c1c10c4bf454c035f69aa2/ - https://tria.ge/210705-9sdgvvfjwa - https://capesandbox.com/analysis/169772/ - https://app.any.run/tasks/2bbf3517-2d0b-438d-b23a-776d43f24c78 - … https://twitter.com/malware_traffic/status/1412128664721014785/photo/1

• [2021-07-06 02:18:04] @malware_traffic 2021-07-05 (Monday) - #RigEK sends #Redline infostealer malware. Sample of the Redline EXE available at: - https://bazaar.abuse.ch/sample/04ebbf20cfd58785ad616b81244c6901e8ed57c9c2c1c10c4bf454c035f69aa2/ - https://tria.ge/210705-9sdgvvfjwa - https://capesandbox.com/analysis/169772/ - https://app.any.run/tasks/2bbf3517-2d0b-438d-b23a-776d43f24c78 - https://hybrid-analysis.com/sample/04ebbf20cfd58785ad616b81244c6901e8ed57c9c2c1c10c4bf454c035f69aa2 https://twitter.com/malware_traffic/status/1412128664721014785/photo/1

• [2021-07-06 02:09:34] @ps66uk #formbook f481660f51f90b3c528056c8728c9b63c7c2ff6a447f1bc384a6c51a2482aec3 C2: ://www.newrichwealth.com/9tsc/ https://capesandbox.com/analysis/169773/ https://tria.ge/210705-dj3csbqbfe

• [2021-07-05 13:57:29] @0xrb Here's some recent #CobaltStrike #C2 IP 146.56.250.76 14.1.98.5 8.129.227.26 1.116.30.69 81.71.65.171 170.130.55.49 45.63.53.3 120.78.197.8 192.144.225.94 139.159.155.211 110.42.97.22 95.179.176.48 82.156.208.207 123.57.190.31 47.102.216.38

• [2021-07-04 23:27:53] @MergicMagaki Testing Cybermelon's fake server .exe to boost strive's load times: https://git.yeet.st/cybermelon/gg-struggle Virustotal link: https://www.virustotal.com/gui/file/2ba520bdb16846371504e3d7cf354bbb869146bd9948dc24a9ff8d87578b4f1e/detection No malware. I live in Lyon. France. First loading: 2m32s Second loading: 19s As you can tell. it works but it's not useful for everyone (1/?)

• [2021-07-04 04:14:31] @DmitriyMelikov The docm file downloads an executable file( Md5 810BA7D14F1454A01F8D75C4FFC8F797) that looks for other files and upload them to a remote server. > ( hxxp : // 64. 188. 13. 46 /oiasjdoaijsdoiasjd/ ) https://www.virustotal.com/gui/file/5d3220db34868fc98137b7dfb3a6ee47db386f145b534fb4a13ef5e0b5df9268/relations https://www.virustotal.com/gui/file/a20970aa236aa60d74841e7af53990c5da526f406c83fd1bedb011290517d9b0/detection @InQuest #Malware #maldoc https://twitter.com/DmitriyMelikov/status/1411433194386345986/photo/1

• [2021-07-03 21:52:38] @dark0pcodes #kasaya REvil entrypoint (despues de desempaquetar). Interesante string "DTrump4Ever". https://www.virustotal.com/gui/file/9b11711efed24b3c6723521a7d7eb4a52e4914db7420e278aa36e727459d59dd/detection https://twitter.com/dark0pcodes/status/1411337089237536768/photo/1

• [2021-07-03 04:14:33] @nubesque If it matters. 7/2/2021 9:10 GMT detections for #kaseya binaries https://www.virustotal.com/gui/file/d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e/detection and https://www.virustotal.com/gui/file/8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd/detection CrowdStrike: yes PaloAlto: yes SentinelOne: no BlackBerry/(Cylance): yes elastic (Endgame): yes MSFT: yes Mcafee: yes Sophos: yes Symantec: yes Webroot: yes

• [2021-07-02 20:58:43] @JAMESWT_MHT @malwrhunterteam @VK_Intel @bryceabdo Mentioned #CobaltStrike sample https://bazaar.abuse.ch/sample/080ee6c068e95db7a776793e167fb4bb9ad0efcb424a400ed3efe697400fc73a/

• [2021-07-02 19:54:51] @pollo290987 #redline x86_x64_setup.exe 372d8aa0361c2ccd16dc4a368a39b6a3 C2: /176.111.174.254:56328 /flestriche.xyz:80

• [2021-07-02 18:14:23] @JAMESWT_MHT @malwrhunterteam @VK_Intel @bryceabdo Mentioned #CobaltStrike sample https://bazaar.abuse.ch/sample/e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da/

• [2021-07-02 17:39:58] @yvesago #phishing @BRED_BP s://sites.google.com/view/login-bred-banquepopulaire-fr VIA s://cotterillindustries.com.au/doc/1?= p ping @malwrhunterteam @Spam404 @PhishStats https://twitter.com/yvesago/status/1410911117879226372/photo/1

• [2021-07-02 17:22:03] @Certego_Intel #Malware #CobaltStrike #Blocklist Domain: advansys.com.ar VirusTotal: https://www.virustotal.com/gui/domain/advansys.com.ar #CyberSecurity #ThreatIntel (bot generated)

• [2021-07-02 05:44:23] @executemalware I received about 50 #hancitor emails today. As usual. I got #ficker stealer and #cobaltstrike follow-up payloads. Here are the IOCs: https://pastebin.com/Ung73BHW

• [2021-07-02 05:44:23] @NinjaOperator Look what I found https://www.virustotal.com/gui/file/142cc6b6ea21a0cedb8f9a665fcc7aee2dacc1aa674494e61831b0b17da0c477/content/strings A REGEORG web shell sample

• [2021-07-02 05:41:37] @malware_traffic hxxp://23.19.227.147/afjfhfdhfdhjfggh returned Powershell script for #CobaltStrike. Sample submitted to: - https://bazaar.abuse.ch/sample/a60b5b60f28039314631f9546b27d9a185e7866c78476cb45a357ca25b75f2c5/ - https://app.any.run/tasks/ed2624b2-5313-4c41-98a3-d751e4200a68 - https://capesandbox.com/submit/status/169246/ - https://tria.ge/210701-jpbsxbksza

• [2021-07-02 04:32:40] @malware_traffic 2021-07-01 (Thursday) - #CobaltStrike from a #Trickbot gtag zev1 infection using securityupdateav.com on 23.19.227.147 - hxxp://23.19.227.147/afjfhfdhfdhjfggh returns script with base64 text used to generate #CobaltStrike binary - can pull it up in a browser as we speak! https://twitter.com/malware_traffic/status/1410712988135342090/photo/1

• [2021-07-02 00:07:39] @cpardue09 #ln -s :malware_traffic: 2021-07-01 (Thursday) - #Hancitor (#MAN1/#Moskalvzapoe/#TA511) infection with #CobaltStrike and #FickerStealer - Sample Word doc: https://bazaar.abuse.ch/sample/6de957c6676bdc847586662208a81e09971fbe1257a7557348d67621e63a8e5f/ - Sample DLL: https://bazaar.abuse.ch/sample/3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630/ https://twitter.com/malware_traffic/status/1410634474812018697/photo/1

• [2021-07-01 23:20:41] @malware_traffic 2021-07-01 (Thursday) - #Hancitor (#MAN1/#Moskalvzapoe/#TA511) infection with #CobaltStrike and #FickerStealer - Sample Word doc: https://bazaar.abuse.ch/sample/6de957c6676bdc847586662208a81e09971fbe1257a7557348d67621e63a8e5f/ - Sample DLL: https://bazaar.abuse.ch/sample/3246d6ec68556a22b9e5e978ef263472363502122317209fb61cbd884e5db630/ https://twitter.com/malware_traffic/status/1410634474812018697/photo/1

• [2021-07-01 23:07:14] @0xCARNAGE Hancitor niberius.dll - MD5: a31bb62f579e89279a9ebb0115d2e04b C2: hXXp://raeonoran.com/8/forum.php Retrieves: hXXp://rar1tet.ru/7sdf43fs.exe - MD5: 270c3859591599642bd15167765246e3 Talks to: pospvisis.com AppAny video failed. https://app.any.run/tasks/8295ebb9-f5f3-4e01-8e22-cb1274c079be

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터