evilsocket

package main

import (
	"encoding/json"
	"fmt"
	"io/ioutil"
	"math/rand"
	"net/http"
	"net/url"
	"strings"

evilsocket

Keybase proof

I hereby claim:

• I am evilsocket on github.
• I am evilsocket (https://keybase.io/evilsocket) on keybase.
• I have a public key ASDQOex7WfTVV8cumbapyzHyv-NXXay_D0-RfJwOH8xKrQo

To claim this, I am signing this object:

evilsocket

Keybase proof

I hereby claim:

• I am evilsocket on github.
• I am evilsocket (https://keybase.io/evilsocket) on keybase.
• I have a public key whose fingerprint is 7F1A D5FA 2A51 87DF DD53 DDA9 1564 D7F3 0393 A456

To claim this, I am signing this object:

evilsocket

/*
 * This tool will decrypt files encrypted by the Magniber ransomware with
 * AES128 ( CBC mode ) algorithm.
 *
 * RE and report by MalwareBytes ( @hasherezade )
 *
 *  https://blog.malwarebytes.com/threat-analysis/2017/10/magniber-ransomware-exclusively-for-south-koreans/
 *
 * Decryptor written by Simone 'evilsocket' Margaritelli
 *  

evilsocket

Verifying that "evilsocket.id" is my Blockstack ID. https://onename.com/evilsocket

evilsocket

class Example < BetterCap::Proxy::UDP::Module
  meta(
    'Name'        => 'Example',
    'Description' => 'Example UDP proxy module.',
    'Version'     => '1.0.0',
    'Author'      => "Simone 'evilsocket' Margaritelli",
    'License'     => 'GPL3'
  )
  
  # Received when the victim is sending data to the upstream server.

evilsocket

# Empty lines or lines starting with # will be ignored.

# redirect *.google.com to the attacker ip address
local .*google\.com

# redirect *.microsoft.com to 10.10.10.10
10.10.10.10 .*microsoft\.com

evilsocket

class Example < BetterCap::Proxy::TCP::Module
  meta(
    'Name'        => 'Example',
    'Description' => 'Example TCP proxy module.',
    'Version'     => '1.0.0',
    'Author'      => "Simone 'evilsocket' Margaritelli",
    'License'     => 'GPL3'
  )
  
  # Received when the victim is sending data to the upstream server.

evilsocket

class HackTitle < BetterCap::Proxy::HTTP::Module
  meta(
    'Name'        => 'HackTitle',
    'Description' => 'Adds a "!!! HACKED !!!" string to every webpage title.',
    'Version'     => '1.0.0',
    'Author'      => "Simone 'evilsocket' Margaritelli",
    'License'     => 'GPL3'
  )
  
  # called before the request is performed

evilsocket

Keybase proof

I hereby claim:

• I am evilsocket on github.
• I am evilsocket (https://keybase.io/evilsocket) on keybase.
• I have a public key whose fingerprint is 7F1A D5FA 2A51 87DF DD53 DDA9 1564 D7F3 0393 A456

To claim this, I am signing this object: