Skip to main content

Posts

Showing posts from December, 2018

Malienist C2i Feed now on OTX

Malienist Emotet weekly feed is now available on the OTX platform by AlienVault. You can integrate it with your SIEM solution. Here's the link to the first pulse - https://otx.alienvault.com/pulse/5c1c2c5ce8b7580bde6ade7f Subscribe the feed at OTX by joining the group  EMOTET C2I

SMA: Sharpshooter Payload

Article by  Vishal Thakur This is a SMA of the payload used in the SharpShooter campaign. The sample shows code-reuse from the Lazarus malware family but full attribution is hard to determine at this time. The focus of this article is on the networking C2i. Following is the complete URI for the first connection: 000007FEFA6ABA48 | 4C 8B DC                  | mov r11,rsp                              | 000007FEFA6ABA4B | 53                        | push rbx                                 | 000007FEFA6ABA4C | 55                        | push rbp                                 | 000007FEFA6ABA4D | 56                        | push rsi                                 | 000007FEFA6ABA4E | 57                        | push rdi                                  | 000007FEFA6ABA4F | 41 54                     | push r12                                 | 000007FEFA6ABA51 | 41 55                     | push r13                                 | 000007FEFA6ABA5

Emotet C2 Network IOC December 2018 Week 2 Campaign

Article by  Vishal Thakur OTX Feed: https://otx.alienvault.com/pulse/5c1c2c5ce8b7580bde6ade7f/ Ip Address Country Region City Status 109.104.79.48 United Kingdom Valid 109.128.252.1 Belgium Wallonia Ohey Valid 130.209.248.118 United Kingdom Glasgow City Glasgow Valid 130.209.248.130 United Kingdom Glasgow City Glasgow Valid 130.209.253.231 United Kingdom Glasgow City Glasgow Valid 133.242.208.183 Japan Valid 138.68.139.199 United Kingdom London, City of London Valid 144.76.117.247 Germany Bayern Gunzenhausen Valid 152.169.22.153 Argentina Santa Fe Rosario Valid 159.65.76.245 United States California Santa Clara Valid 165.227.213.173 United States New Jersey Clifton Valid 173.212.221.251 Germany Valid 178.141.80.155 Russia Kirov Lomovskaya Valid 179.52.155.151 Dominican Republic Distrito Nacional Santa Domingo Valid 181.51.214.5 Colombia Bogota D.C. Bogotá Valid 181.57.97.83 Colombia Antioquia MedellĂ­n Valid 181.60.57.250 Colombia Valid 185.86.148.222 Swe