ProIntegritate

#Trickbot #IOCs
Source: https://blog.angadiworldtech.com/generalo/uptime.php

24551812877dbf813d57b3ac0cdb8ad1
4e71930a812a2b5650e7e08eb2b10b34
5a67a45742e13bbb8d03b52ec2b07275
8ea57fb696fde17f2a6360728ad924a9
9f1163b96f329b7607dc7d51f1adab68
a3de6c880d642c4b6f5c4df497d99fa2
d02f63798c1b2f7fe5858cda472fd09d

ProIntegritate

2020-08-25: Some #Trickbot hashes.

Not all of them though, Ivan get annoyed when you scrape his PHP downloaders.
Source: https://yektairon.com/brands/goodmanstory.php

006eb0704a4fb613b2a5c96e40dcfb4e
00f7dacbca2671c4d9c368affc369f19
022ff5f2033d291b388c1cc42b583e10
05b7dc52cd38b8a6fb03368571799e4f
05ed7eb8f3dc67605a3314be0d07815e

ProIntegritate

Dridex IOCs 2020-09-07 IOCS.

Payload hashes:

150f42ff16bd2ae9895532a7be6284a1
2f3e7c9fb52e413577370c1cd1c4befa
5b4de46aee52cf976a7f5b417f58c04c
698e51bc1e2a4642c0ac6ee6eac9791e
6e6533fa01c0c32dac8c1cab8dc73dbc
740eee666d4306312e619a38914b8755

ProIntegritate

        Dim sOutput As String = ""
        Dim inaug As DateTime = Convert.ToDateTime("2021-01-20T17:00:00.000Z") ' Timestamp in ISO8601 format.
        Dim ttb As System.TimeSpan
        
        ttb = inaug - Convert.ToDateTime(Now.ToString)
        sOutput = "Seconds: " & ttb.TotalSeconds & vbCrLf                     ' Total seconds left
        sOutput = sOutput & "Time left: " & ttb.ToString & " Local" & vbCrLf  ' Time in Local zone

        ttb = inaug - Convert.ToDateTime(Date.UtcNow.ToString) 
        sOutput = sOutput & "Time left: " & ttb.ToString & " UTC" & vbCrLf    ' Time in UTC zone

ProIntegritate

powershell -c "Set-ExecutionPolicy bypass"
powershell -f %1
powershell -c "Set-ExecutionPolicy Restricted"

ProIntegritate

Current (2021-07-05) IP Infra of Revil, taken from active domain list.
- Seems like a number of them are using the same boxes to host domains (see top).
- 5 of them pointed to localhost (removed)

Count	Adress

     39	142.93.110.250
     32	47.75.130.171
     18	192.0.78.13
     18	192.0.78.12

ProIntegritate

@echo off
echo Run as admin.
netsh advfirewall firewall delete rule name="Audacity-in"
netsh advfirewall firewall delete rule name="Audacity-out"
pause
echo Run your update now, then press any key to reactivate the firewall.
pause
netsh advfirewall firewall add rule name="Audacity-in" dir=in program="audacity.exe" action="block" enable="yes")
netsh advfirewall firewall add rule name="Audacity-out" dir=out program="audacity.exe" action="block" enable="yes")
echo Done.

ProIntegritate

# Source: https://github.com/AmnestyTech/investigations/blob/master/2021-07-18_nso/domains.txt
2021-07-19, ?, 14-tracking.com
2021-07-19, ?, 1minto-start.com
2021-07-19, ?, 2far1v4lv8.get1tn0w.free247downloads.com
2021-07-19, ?, 301-redirecting.com
2021-07-19, ?, 365redirect.co
2021-07-19, ?, 3driving.com
2021-07-19, ?, 456h612i458g.com
2021-07-19, ?, 4n3d9ca2st.php78mp9v.opposedarrangement.net
2021-07-19, ?, 7style.org

ProIntegritate

Exploring WMI objects with Powershell:

For this example on how to explore WMI classes, i've used Win32_ShadowCopy
as an example. Some classes, like Win32_ShadowCopy, REQUIRES administrator
privileges to work.

	Search for classes names *shadow*
		powershell -c "Get-CimClass -ClassName *shadow*"

	See if a class has Methods and Properties:

ProIntegritate

Specific object cleanup:

	Object.Dispose() ' Does not exist for all objects though.
	Object = Nothing ' This _will_ exist for all objects.

The periodically run:

	GC.Collect() ' Init Garbage collector

If you use performance counters (System.Diagnostic.*), you may want to clean them up too as you free things up: