002Zer0Tw0

## emotet.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              2 stars
            
          
                ker2x
                / emotet.md
            
            
              Last active
              January 29, 2022 14:03
            
              
                Reverse engineering emotet, bit by bit
              
          
    (extracted from main diary)
2021/11/10 : Exploring emotet


SHA256 : 878d5137e0c9a072c83c596b4e80f2aa52a8580ef214e5ba0d59daa5036a92f8
Probably the scariest trojan of the current days. Let's explore it. I using ghidra again.
According to ghidra, the only import is KERNEL32.DLL::WTSGetActiveConsoleSessionId
I wonder what it can possibly be with so little and i'll have to find out.
The obvious step for now is to find out how it load other functions to be able to do anything.


## termux_mxrig.md

      
              1 file
            
          
              9 forks
            
          
              149 comments
            
          
              56 stars
            
          
                2niuhe
                / termux_mxrig.md
            
            
              Last active
              March 30, 2024 12:45
            
              
                install XMRig on termux 
              
          
    Monero XMR mining via termux ;ubuntu

install ubuntu in termux
command;
(ubuntu is optional)

pkg install update && upgrade
apt install git
apt install wget
apt install proot

  
## inspector_malloc.gdb
define -mem-heap-dump-chunk
  printf "%#016x: ", $mem_addr
  printf "%016lu %016lu   %#02x ", ((long *)$mem_addr)[0], ((long *)$mem_addr)[1] & ~3, ((long*)$mem_addr)[1] & 3
  printf "%016x %016x\n", ((long *)$mem_addr)[2], ((long *)$mem_addr)[3]
  set $mem_addr = $mem_addr + ((long *)$mem_addr)[1] & ~3
end
document -mem-heap-dump-chunk
!!! FOR INTERNAL USE ONLY - DO NOT CALL !!!
end

## socket.c
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

#include <netinet/tcp.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
	define -mem-heap-dump-chunk
	printf "%#016x: ", $mem_addr
	printf "%016lu %016lu %#02x ", ((long )$mem_addr)[0], ((long )$mem_addr)[1] & ~3, ((long*)$mem_addr)[1] & 3
	printf "%016x %016x\n", ((long )$mem_addr)[2], ((long )$mem_addr)[3]
	set $mem_addr = $mem_addr + ((long *)$mem_addr)[1] & ~3
	end
	document -mem-heap-dump-chunk
	!!! FOR INTERNAL USE ONLY - DO NOT CALL !!!
	end
	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include <unistd.h>
	#include <fcntl.h>

	#include <netinet/tcp.h>
	#include <sys/socket.h>
	#include <sys/types.h>
	#include <netinet/in.h>