Alfonso Maria Tesauro alfonsotesauro

(extracted from main diary)

2021/11/10 : Exploring emotet

SHA256 : 878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
Probably the scariest trojan of the current days. Let's explore it. I using ghidra again.
According to ghidra, the only import is KERNEL32.DLL::WTSGetActiveConsoleSessionId
I wonder what it can possibly be with so little and i'll have to find out.
The obvious step for now is to find out how it load other functions to be able to do anything.

$ git clone https://git.samba.org/samba.git
$ brew install jansson
$ brew install readline && brew link --force readline
$ cpan # then w/in cpan install Parse::Yapp module (might be 'install Term::Parse::Yapp')
$ brew intsall libarchive
$ export LDFLAGS="-L/usr/local/opt/libarchive/lib"
$ export CPPFLAGS="-I/usr/local/opt/libarchive/include"
$ ./configure --prefix=/opt/samba --without-ad-dc --without-acl-support

Setting up iOS Universal Links

	//: A UIKit based Playground for presenting user interface

	import UIKit
	import PlaygroundSupport

	final class SampleCollectionReusableView: UICollectionReusableView {
	private let titleLabel = UILabel()

	override init(frame: CGRect) {
	super.init(frame: frame)

	class DraggableClipView: NSClipView
	{
	private var clickPoint: NSPoint!
	private var originalOrigin: NSPoint!

	override func mouseDown(event: NSEvent) {
	clickPoint = event.locationInWindow
	originalOrigin = bounds.origin
	}

	;
	; Netatalk 3.x configuration file
	;

	[Global]
	; Global server settings
	log file = /var/log/afpd.log
	;log level = default:debug afpdaemon:debug
	uam list = uams_dhx.so uams_dhx2.so

	//get distance between two geo coordinates in kilometers
	function distanceInKilometers(lat1, lon1, lat2, lon2) {
	var rlat1 = Math.PI * lat1/180
	var rlat2 = Math.PI * lat2/180
	var rlon1 = Math.PI * lon1/180
	var rlon2 = Math.PI * lon2/180
	var theta = lon1-lon2
	var rtheta = Math.PI * theta/180
	var dist = Math.sin(rlat1) * Math.sin(rlat2) + Math.cos(rlat1) * Math.cos(rlat2) * Math.cos(rtheta);
	dist = Math.acos(dist)

	// Super simple key logger that uses a CGEventTap to log
	// the unicode strings for each key down event
	// Doesn't handle special keys (enter, backspace, etc.)

	#include <stdio.h>
	#import <Carbon/Carbon.h>
	#import <ApplicationServices/ApplicationServices.h>

	CGEventRef loggerCallback(CGEventTapProxy proxy, CGEventType type, CGEventRef event, void* context)
	{

	# xcode-build-bump.sh
	# @desc Auto-increment the build number every time the project is run.
	# @usage
	# 1. Select: your Target in Xcode
	# 2. Select: Build Phases Tab
	# 3. Select: Add Build Phase -> Add Run Script
	# 4. Paste code below in to new "Run Script" section
	# 5. Drag the "Run Script" below "Link Binaries With Libraries"
	# 6. Insure that your starting build number is set to a whole integer and not a float (e.g. 1, not 1.0)

	// Force to show a titlebar icon
	[window setRepresentedURL:[NSURL URLWithString:@"WindowTitle"]];
	// Set our custom icon
	[[window standardWindowButton:NSWindowDocumentIconButton] setImage:[NSImage imageNamed:@"imagename"]];

	...

	// Implement window delegate method to prevent to popup document (which do not exist) path menu when cmd+clicked
	- (BOOL)window:(NSWindow )window shouldPopUpDocumentPathMenu:(NSMenu )menu
	{

Alfonso Maria Tesauro alfonsotesauro

2021/11/10 : Exploring emotet

Setting up iOS Universal Links

Table of Contents