daedalus

/*
* (un)comment correct payload first (x86 or x64)!
* 
* $ gcc cowroot.c -o cowroot -pthread
* $ ./cowroot
* DirtyCow root privilege escalation
* Backing up /usr/bin/passwd.. to /tmp/bak
* Size of binary: 57048
* Racing, this may take a while..
* /usr/bin/passwd overwritten

daedalus

# KEEP YOUR PRIVATE KEYS SAFE !
# Anyone who can read this file can spend your bitcoin.
#
# Format:
#   <Base58 encoded private key>[<whitespace>[<key createdAt>]]
#
#   The Base58 encoded private keys are the same format as
#   produced by the Satoshi client/ sipa dumpprivkey utility.
#
#   Key createdAt is in UTC format as specified by ISO 8601

daedalus

#petya #petrWrap

Win32/Diskcoder.Petya.C
Ransomware attack.

Got new info? Email at isox@vulners.com

*********** KILLSWITCH // PARTIAL? GOT PROOF - EMAIL!
Looks like if you block C:\Windows\perfc.dat from writing/executing - stops #Petya. Is used for rundll32 import.
https://twitter.com/HackingDave/status/879779361364357121

daedalus

"""Demonstrates how to construct and send raw Ethernet packets on the
network.

You probably need root privs to be able to bind to the network interface,
e.g.:

    $ sudo python sendeth.py
"""

from socket import *

daedalus

import socket 
from struct import *


s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)

while True:
	pack = s.recvfrom(20000)
	
	#Get the single element from the tuple

daedalus

#!/usr/bin/env python
import binascii
import socket
import time
import sys
import argparse
 
BUFFER_SIZE = 1024
VERSION = binascii.unhexlify("f9beb4d976657273696f6e00000000006600000023c22f307e110100000000000000000040dbc75800000000000000000000000000000000000000000000ffffad61bfae208d000000000000000000000000000000000000ffff0000000000002747310f6a3c90b9102f5361746f7368693a302e31332e312fbff9060000")
GET_XTHIN = binascii.unhexlify("f9beb4d96765745f787468696e00000050000000738a98c80200000000000000000000000000000000000000000000000000000000000000000000002200000000000000000000000000000000000000000000000000000000000000000000120000000000000001")

daedalus

#    Copyright 2014 Chris Cohen
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

daedalus

"""
Minimal character-level Vanilla RNN model. Written by Andrej Karpathy (@karpathy)
BSD License
"""
import numpy as np

# data I/O
data = open('input.txt', 'r').read() # should be simple plain text file
chars = list(set(data))
data_size, vocab_size = len(data), len(chars)

daedalus

#!/usr/bin/env python
"""A simple Bloom Filter implementation
Calculating optimal filter size: 
            Where:
            m is: self.bitcount (how many bits in self.filter)
            n is: the number of expected values added to self.filter
            k is: the number of hashes being produced
            (1 - math.exp(-float(k * n) / m)) ** k 
http://en.wikipedia.org/wiki/Bloom_filter
"""

daedalus

import sys
import struct
from binascii import unhexlify, crc32
import urllib2

transaction = str(sys.argv[1])
data = urllib2.urlopen("https://blockchain.info/tx/"+transaction+"?show_adv=true")
dataout = b''
atoutput = False