Skip to content

Instantly share code, notes, and snippets.

http://mootsiestootsieskid.com
additional dl
http://billionaires-indo.com/coba1/1
http://billionaires-indo.com/coba1/2
http://billionaires-indo.com/coba1/3
http://primagamahomeschool.com/wp-includes/1
http://primagamahomeschool.com/wp-includes/2
http://primagamahomeschool.com/wp-includes/3
http://skolanovavesnn.cz/wp-admin/1
@silence-is-best
silence-is-best / Hancitor Dec 13
Created December 13, 2018 15:21
Hancitor Dec 13
http://normamonteldesigns.com
http://fsbams.net
http://fsbams.com
additional dl
http://caiautoinsurance.com/1
http://caiautoinsurance.com/2
http://caiautoinsurance.com/3
http://doctor-t.ru/1
http://doctor-t.ru/2
cryometers.com
additional dl
http://mail.porterranchpetnanny.com/wp-includes/1
http://mail.porterranchpetnanny.com/wp-includes/2
http://mail.porterranchpetnanny.com/wp-includes/3
http://precisionpartners.org/wp-admin/includes/1
http://precisionpartners.org/wp-admin/includes/2
http://precisionpartners.org/wp-admin/includes/3
http://rescuereinvented.org/wp-content/plugins/woocommerce/1
http://gaslab.kr
additional dl
http://culture-developpement.asso.fr/wp-content/plugins/wp-pagenavi/1
http://culture-developpement.asso.fr/wp-content/plugins/wp-pagenavi/2
http://culture-developpement.asso.fr/wp-content/plugins/wp-pagenavi/3
http://digitalmarketingsheffield.co.uk/wp-includes/pomo/1
http://digitalmarketingsheffield.co.uk/wp-includes/pomo/2
http://digitalmarketingsheffield.co.uk/wp-includes/pomo/3
http://ledbazaar.net/wp-admin/1
http://marylandrxcoupon.com
additional doc dl below thanks to @JayTHL
mainerxcoupon.com
indianarxcoupon.com
iowarxcoupon.com
louisianarxcoupon.com
minnesotarxcoupon.com
montanarxcoupon.com
mississippirxcoupon.com
airxllc.com
rule NewDDOSBot_bin
{
meta:
description = "NewDDOSBot"
author = " James_inthe_box"
reference = "https://app.any.run/tasks/209085da-a3b3-4317-923a-90a4a2e82414"
date = "2019/01"
maltype = "Bot"
strings:
http://ddl7.data.hu/get/309105/12392411/RFQ_and_Company_Profile_PDF.cab
http://ddl7.data.hu/get/318254/12392412/Qoutation_for_April_and_Company_Profile_PDF.cab
http://ddl7.data.hu/get/375193/12388695/Our_company_profile_as_requested_and_Purchase_Order_pdf.cab
http://ddl7.data.hu/get/375297/12392504/Inquiry.pdf_and_samples.jpg__ZIP.cab
rule newloader_bin
{
meta:
description = "Unknown loader"
author = "James_inthe_box"
reference = "5a888d05804d06190f7fc408bede9da0423678c8f6eca37ecce83791de4df83d"
date = "2020/4"
maltype = "Poopy"
strings:
alert tcp any any -> any any (msg:"NanoCore RAT CnC"; flow:to_server,established; content:"|40 00 00 00 fe 31 80 44 e7 eb 4a 77|"; depth:12; reference:md5,18fe62a701d08affdd58ade2df0d1fb6; classtype:command-and-control; sid:20166322; rev:1; metadata:created_at 2020_4_23;)