da3m0n s3c

UPDATE [l] : shortly after finishing this post, I had decided to do a couple scans of the raw code. The results returned several Shell Trojan variants, and doing some permanent damage to windows systems. Reports available at ] VirusTotal ] and [ Malwr ]. Thanks to both services for the great results. It attempted network connx with the original url, not surprise from a webshell, IMO, only a bit strange that the likely 0wn/Op would keep such a trophy case in the wild like that? I mean really??. I would've expected an http request or few since nce that's who was hosting the assets but the requests were made to connect to "Hostthshellcode and then starts the endless streaming of the v1c's data and a continual stream of fresh code for the mal to swap out. This only confirmed the feeling I had about the src code. Multiple langs being used, illogical syntax and it's all just mixed together... if anyone can answer how this can support the back and forth exec using Perl,...

This anonymous submission came to us a few days ago, only with the knowledge that the this payload tripped and was dropped by an Enterprise level A/V appliance. The 'submitter' got their hands on it and asked us to break it down. For this project, I elicited the help of F1re_W1re , a very good c0d3r as well as a very good brother. we have worked together many times in the past, with nothing but amazing results. When a second set of eyes or decoded iteration is needed, he is my go to. A hat tip to you, Sir. This project was a true collaboration of skillz to which I graciously thank him for his role as primary contributor. For reasons, I assumed the role of  Project Manager (PM), and Lead Consultant . This was solved by both of us doing out part and offering input and direction as needed. Often time it takes another set of eyes to see what's there, (or just not apparent). You will get what I mean later on. Let's get at it!! After acquiring the sample, it was clear th...

Circa late '16, i was studying "PHP" lang (amongst others) and reviewing some case studies from a large infiltration and the widespread takeover of spanning several large scale providers that offered blogs, free pages, social accounts, etc. I'm leaving the names out but will give reference to the friendly name given:  the infamous SEO Attacks . Stegonography is nothing new, I'm not reinventing the wheel here, but after over 3mos. of work last year and countless deep dives...I see this has gotten way out of hand for EVERY side that's using the technology. Just look at the wiki dumps from last week... After you read this and your still not convinced of the scale? Leave a comment, I can take you a bit deeper down the rabbit hole. I'm not a (conspiracy) theorist, I don't post a word unless I can back it up. I'm not a whistleblower, not considered good nor bad. Only da3m0n s3c, and this is FYI . I combed through dozens of writeups, mostly by reputabl...