Matt Suiche msuiche
msuiche
/ EternalBlue-SmbHandler.asm
Created
April 23, 2017 09:45
DOUBLEPULSAR - ETERNALBLUE - SmbHandler()
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Thanks to https://zerosum0x0.blogspot.com/2017/04/doublepulsar-initial-smb-backdoor-ring.html#pulsar_step5 for the description | |
| kd> dps srv!SrvTransaction2DispatchTable | |
| 91463530 9148b56f srv!SrvSmbOpen2 | |
| 91463534 91485fe4 srv!SrvSmbFindFirst2 | |
| 91463538 9148606d srv!SrvSmbFindNext2 | |
| 9146353c 91488a89 srv!SrvSmbQueryFsInformation | |
| 91463540 914892f3 srv!SrvSmbSetFsInformation | |
| 91463544 9147ff65 srv!SrvSmbQueryPathInformation | |
| 91463548 91480c74 srv!SrvSmbSetPathInformation |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // Decompiled with JetBrains decompiler | |
| // Type: Installer.Install | |
| // Assembly: Installer, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null | |
| // MVID: 1DF6A781-016A-4A47-9C62-874A888EB357 | |
| // Assembly location: | |
| using \u0004; | |
| using \u0006; | |
| using Microsoft.Win32; | |
| using System; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # http://slatestarcodex.com/2014/11/12/how-to-use-23andme-irresponsibly/ | |
| $indexSNPName = 0 | |
| $indexSNPValue = 3 | |
| $fileName = "genome_Peter_Parker_Full_20170130051759.txt" | |
| Write-Host " --- " | |
| $rs909525 = gci $fileName | Select-String 'rs909525\t' | |
| $rs909525 = $rs909525.Line.Split("`t") | |
| Write-Host "[+]"$rs909525[$indexSNPName] "(Warrior Gene): ("$rs909525[$indexSNPValue]")" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 61110bea272972903985d5d5e452802c DSZOPSDISK/Resources/Df/Uploads/i386-winnt/DoubleFeatureDll.dll.unfinalized | |
| 0d81f9972863c6d8c90100a73b0600ab DSZOPSDISK/Resources/DmGz/Uploads/i386/winnt/ntfltmgr.sys | |
| e14ab6e6ae835792979ff50e647b89c8 DSZOPSDISK/Resources/DSky/Uploads/i386/winnt/tdi6.sys | |
| 997ba8c988340a1c644cf9a5f67e4177 DSZOPSDISK/Resources/Ep/Plugins/Files/DuplicateToken_Implant.dll | |
| 425fb612ba62fc1ecad9fb24d10f9bfa DSZOPSDISK/Resources/Ep/Plugins/Files/EventLogEdit_Implant.dll | |
| c11142caa3013f852ccb698cc6008b51 DSZOPSDISK/Resources/Ep/Plugins/Files/GetAdmin_Implant.dll | |
| bdd2b462e050ef2fa7778526ea4a2a58 DSZOPSDISK/Resources/Ep/Plugins/Files/kill_Implant.dll | |
| 199796e3f413074d5fdef7fe8334eccf DSZOPSDISK/Resources/Ep/Plugins/Files/LSADUMP_Implant.dll | |
| cf5b0d82d39669f584258389f4307b82 DSZOPSDISK/Resources/Ep/Plugins/Files/modifyAudit_Implant.dll | |
| 8187650eb74ccb3f0fb647335fd54d30 DSZOPSDISK/Resources/Ep/Plugins/Files/modifyAuthentication_Implant.dll |
msuiche
/ EquationDrug-IOC-list.txt
Created
January 13, 2017 05:38
List of EquationDrug IOCs #ShadowBrokers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| PS E:\ioc> dir . | Foreach-Object{ | |
| >> $file = $_ | |
| >> $hash = Get-FileHash $file -Algorithm MD5 | |
| >> $fileinfo = Get-Item $file | |
| >> | |
| >> New-Object -TypeName PSObject -Property @{ | |
| >> LastWriteTime = $fileinfo.LastWriteTime | |
| >> Length = $fileinfo.Length | |
| >> Algorithm = $hash.Algorithm | |
| >> MD5 = $hash.Hash |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| dir . | Foreach-Object{ | |
| $file = $_ | |
| $hash = Get-FileHash $file -Algorithm MD5 | |
| $fileinfo = Get-Item $file | |
| New-Object -TypeName PSObject -Property @{ | |
| VersionInfo = $fileinfo.VersionInfo | |
| LastWriteTime = $fileinfo.LastWriteTime | |
| Length = $fileinfo.Length | |
| Algorithm = $hash.Algorithm |
NewerOlder