Skip to main content

Posts

Showing posts from September, 2018

Emotet C2 Network IOC September 2018 Week 1 Campaign

IP Port Country State City 184.191.59.24 United States Texas Padre Island Ntl Seashor 98.5.202.134 United States Washington Bainbridge Island 174.64.65.21 United States Kansas Park 62.75.143.128 Switzerland Geneve 199.119.78.38 443 United States Missouri Springfield 95.141.175.240 443 Netherlands Diemen 130.180.10.18 United States Virginia Virginia Beach 85.100.125.179 443 Germany Nordrhein-westfalen Huerth 118.244.214.210 Korea, Republic Of Seoul 63.141.2.116 8443 United States Virginia Ashburn 157.7.164.23 Thailand 81.151.15.109 8443 Spain Barcelona Barcelona 199.119.78.23 United States Missouri Springfield 216.74.200.97 United States South Carolina Rock Hill 190.86.177.157 7080 Argentina Buenos Aires 85.246.79.84 Spain Madrid Madrid 211.115.111.19 443 Australia New South Wales Sydney 106.187.52.135 China Tianjin 105.184.68.110 8080 Egypt 84.200.106.120 8080 Turkey Istanbul 199.119.78.9 443 United States Missouri Springfield 69.198.17.7 Canada British Colum

Useful Regex for Malware Analysis

Article by  Vishal Thakur This post is a living post - I'll keep adding to it as I come across more useful regexs'. IP address: This should give you all strings that look like IP addresses - will also get you strings that are not valid IP addresses: \b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b This one is longer but should give you valid IP addresses: \b(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.   (25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.   (25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.   (25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\b Grep: This will get you everything 'after' the word 'http' in ALL the lines in a file.  grep -o 'http:.*' > c2i-all