𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
LightNews LightNews
banner
netresec.infosec.exchange.ap.brid.gy
𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲
@netresec.infosec.exchange.ap.brid.gy
8 followers 2 following 58 posts
Experts in Network Forensics and Network Security Monitoring. Creators of #NetworkMiner, #CapLoader, #PolarProxy and #RawCap.

#PCAP or it didn't happen!

🌉 bridged from ⁂ https://infosec.exchange/@netresec, follow @ap.brid.gy to interact
Posts Replies Media Videos
netresec.infosec.exchange.ap.brid.gy
The technical detail in this PureRAT analysis by Heejae Hwang (황희재) is fantastic! The analyzed #purerat sample looks very similar to the one James Northey recently blogged about for @huntress. It even uses the same C2 server 157.66.26.209:56001.
Decompiled .NET code for PureRAT showing C2 server 157.66.26.209 0x0000DAC1 = TCP port 56001 0x0000DAC2 = TCP port 56002 0x0000DAC3 = TCP port 56003
October 16, 2025 at 9:44 AM
netresec.infosec.exchange.ap.brid.gy
Here are the decoded/decompressed HTTP/2 headers from Nezha. It's using gRPC, or more specifically the (grpc-go)[https://github.com/grpc/grpc-go] library.
HTTP/2 headers extracted from PCAP with NetworkMiner. :method :method POST 1554 192.168.100.10 [DESKTOP-JGLLJLD] :scheme :scheme http 1554 192.168.100.10 [DESKTOP-JGLLJLD] :path :path /proto.NezhaService/ReportSystemInfo2 1554 192.168.100.10 [DESKTOP-JGLLJLD] :authority :authority c.mid.al:80 1554 192.168.100.10 [DESKTOP-JGLLJLD] content-type content-type application/grpc 1554 192.168.100.10 [DESKTOP-JGLLJLD] user-agent user-agent grpc-go/1.72.2 1554 192.168.100.10 [DESKTOP-JGLLJLD] te te trailers 1554 192.168.100.10 [DESKTOP-JGLLJLD] grpc-timeout grpc-timeout 4033579u 1554 192.168.100.10 [DESKTOP-JGLLJLD] client_uuid client_uuid f6e7314f-5c7e-f2cb-5be7-68b95a0cf7c3 1554 192.168.100.10 [DESKTOP-JGLLJLD] client_secret client_secret GuH9TipzAZxzcnUpgYFfh0kwNSOyU8am 1554 192.168.100.10 [DESKTOP-JGLLJLD] :status :status 200 1558 172.245.52.169 [c.mid.al] content-type content-type application/grpc 1558 172.245.52.169 [c.mid.al] trailer trailer Grpc-Status,Grpc-Message,Grpc-Status-Details-Bin 1558 172.245.52.169 [c.mid.al] grpc-status grpc-status 0 1560 172.245.52.169 [c.mid.al]
October 9, 2025 at 9:31 AM
netresec.infosec.exchange.ap.brid.gy
The use of TLS is pretty much mandatory for HTTP/2, yet this #nezha backoor POSTS HTTP/2 data over TCP port 80 without encryption!
🔥 172.245.52[.]169:80
🔥 c.mid[.]al:80
https://tria.ge/251009-j26bgacj7s
https://app.any.run/tasks/952bf595-caf6-4445-b302-513295214e76
CapLoader transcript of unencrypted HTTP/2 traffic from Nehza PRI * HTTP/2.0 SM ......... ....................?.....@............ ...................... ...........?......??E?b?.?????.????+.KY?N?HIi?T?.A?"??E?E??_?.u?b &=LMedz??????`+?%?@.te?M?5.?.@?????MIOj.?h.????@?%.-I??M'?????Z?f??V?D?f?+?8?o?0.WH?@?%.-I?.%?O??n7???p???J?W7<2?.?4?????? ..?..........? .Microsoft Windows 10 Pro..22H2.1AMD Ryzen 5 3500 6-Core Processor 6 Physical Core ????.(?????.0????.:.x86_64H????.R.1.13.0Z.Microsoft Basic Display Adapter
October 9, 2025 at 8:48 AM
netresec.infosec.exchange.ap.brid.gy
NetworkMiner actually extracts the whole X.509 certificate from the PCAP on ANY-RUN
X.509 certificate with thumbprint 50f990235d7492431f57953cec14a478fb662c8d extracted from ANY.RUN PCAP file with NetworkMiner 3.0
August 27, 2025 at 7:48 AM
netresec.infosec.exchange.ap.brid.gy
Google’s report on #unc6384 lists this certificate as being used in C2 comms by Sogu (#plugx variant):
eca96bd74fb6b22848751e254b6dc9b8e2721f96

Here’s an @anyrun_app execution, of AdobePlugins.​exe on May 19, which runs CANONSTAGER as well as SOGU.​SEC […]

[Original post on infosec.exchange]
PCAP file from https://app.any.run/tasks/ce2745eb-edac-4e62-b5a9-5d9515b88bc4 loaded in NetworkMiner 3.0 showing parameters extracted from frame 2775.
August 27, 2025 at 7:36 AM
netresec.infosec.exchange.ap.brid.gy
Google’s report on #unc6384 lists this certificate as being used in C2 comms by Sogu (#plugx variant):
eca96bd74fb6b22848751e254b6dc9b8e2721f96

Here’s a sandbox execution, of AdobePlugins.​exe on May 19, which runs CANONSTAGER as well as SOGU.​SEC […]

[Original post on infosec.exchange]
PCAP file from https://app.any.run/tasks/ce2745eb-edac-4e62-b5a9-5d9515b88bc4 loaded in NetworkMiner 3.0 showing parameters extracted from frame 2775.
August 27, 2025 at 7:34 AM
netresec.infosec.exchange.ap.brid.gy
UPDATE: Turns out the whole /wp-admin/js/ directory on Västkupan's website allows directory listing. Among the files in that directory is "New PO 102456688.exe", which drops #purelogs.
🔥 MD5: b2647b263c14226c62fe743dbff5c70a
🔥 C2: 147.124.219.201:65535
https://netresec.com/?b=257eead
Directory listing on vastkupan.com with New PO 102456688.exe
July 30, 2025 at 10:02 PM
netresec.infosec.exchange.ap.brid.gy
Do #purelogs Stealer and #purecrypter use the same C2 protocol, or is there some way to tell the C2 protocols apart?
C2 servers:
🔥 45.141.233.100:7708
🔥 144.172.91.74:7709
🔥 62.60.235.100:9100
🔥 65.108.24.103:62050
🔥 91.92.120.102:62050
🔥 192.30.240.242:62520
Transcript of PureLogs (or PureCrypter) C2 traffic to 65.108.24.103:62050
July 21, 2025 at 5:17 PM
netresec.infosec.exchange.ap.brid.gy
Qlwxqgsag.dat is a DLL with reversed content.
curl -s https://www.vastkupan.com/wp-admin/js/Qlwxqgsag.dat | xxd | tail 00352760: 0035 2000 0030 010b 210e 00e0 0000 0000 .5 ..0..!....... 00352770: 0000 0000 686e dba3 0003 014c 0000 4550 ....hn.....L..EP 00352780: 0000 0000 0000 0024 0a0d 0d2e 6564 6f6d .......$....edom 00352790: 2053 4f44 206e 6920 6e75 7220 6562 2074 SOD ni nur eb t 003527a0: 6f6e 6e61 6320 6d61 7267 6f72 7020 7369 onnac margorp si 003527b0: 6854 21cd 4c01 b821 cd09 b400 0eba 1f0e hT!.L..!........ 003527c0: 0000 0080 0000 0000 0000 0000 0000 0000 ................ 003527d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 003527e0: 0000 0000 0000 0040 0000 0000 0000 00b8 .......@........ 003527f0: 0000 ffff 0000 0004 0000 0003 0090 5a4d ..............ZM
July 16, 2025 at 8:05 PM
netresec.infosec.exchange.ap.brid.gy
Cxqyoub.dat is decrypted by XOR-ing with "414".
curl -s https://www.vastkupan.com/wp-admin/js/Cxqyoub.dat | xxd | head 00000000: 796b a434 3234 3431 3034 3134 cbce 3434 yk.424410414..44 00000010: 8934 3431 3434 3134 7431 3434 3134 3431 .4414414t1441441 00000020: 3434 3134 3431 3434 3134 3431 3434 3134 4414414414414414 00000030: 3431 3434 3134 3431 3434 3134 b431 3434 414414414414.144 00000040: 3f2b 8e3f 3480 38f9 1589 3578 fc15 6059 ?+.?4.8...5x..`Y 00000050: 5d47 1144 465e 5346 5059 1452 555a 5f5b ]G.DF^SFPY.RUZ_[ 00000060: 4011 5651 1146 415f 145d 5f14 707e 6714 @.VQ.FA_.]_.p~g. 00000070: 5c5b 5054 1a39 3c3e 1031 3434 3134 3431 \[PT.9<>.1441441 00000080: 6471 3134 7830 3734 60a1 4059 3434 3134 dq14x074`.@Y4414 00000090: 3431 3434 d134 3a10 3f35 0134 3419 0134 4144.4:.?5.44..4
July 16, 2025 at 8:05 PM
netresec.infosec.exchange.ap.brid.gy
Why does CloudFlare insist on forwarding abuse reports to hosting providers and website owners? This makes no sense if the website operators and possibly also hosting providers are the criminals you're trying to stop!
Because Cloudflare does not have the ability to remove content from a website, it is our practice to forward abuse complaints to entities like the hosting provider and/or website owner to follow up. Please specify: Who should be notified? Please select at least one.Note: The hosting provider may have their own policies for how they notify the website owner of a complaint. Please forward my report to the website hosting provider. Include my name and contact information with the report to the website hosting provider. Please forward my report to the website owner. Include my name and contact information with the report to the website owner.
June 25, 2025 at 9:10 AM
netresec.infosec.exchange.ap.brid.gy
Researchers uncover how the Facebook app used localhost STUN communication with the browser to track visited websites in Covert Web-to-App Tracking via Localhost on Android. This trick works even if the user browses in incognito mode and uses a VPN.

> The […]

[Original post on infosec.exchange]
Wireshark with localhost STUN traffic
June 11, 2025 at 6:45 AM
netresec.infosec.exchange.ap.brid.gy
Thank you CISA, NCSC, @bsi et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting!
#threathunting #threatintel
Many organizations may not need to allow outgoing traffic to hosting and API mocking services, which are frequently used by GRU unit 26165. Organizations should consider alerting on or blocking the following services, with exceptions allowlisted for legitimate activity [D3-DNSDL]. *.000[.]pe *.1cooldns[.]com *.42web[.]io *.4cloud[.]click *.accesscan[.]org *.bumbleshrimp[.]com *.camdvr[.]org *.casacam[.]net *.ddnsfree[.]com *.ddnsgeek[.]com *.ddnsguru[.]com *.dynuddns[.]com *.dynuddns[.]net *.free[.]nf *.freeddns[.]org *.frge[.]io *.glize[.]com *.great-site[.]net *.infinityfreeapp[.]com *.kesug[.]com *.loseyourip[.]com *.lovestoblog[.]com *.mockbin[.]io *.mockbin[.]org *.mocky[.]io *.mybiolink[.]io *.mysynology[.]net *.mywire[.]org *.ngrok[.]io *.ooguy[.]com *.pipedream[.]net *.rf[.]gd *.urlbae[.]com *.webhook[.]site *.webhookapp[.]com *.webredirect[.]org *.wuaze[.]com Heuristic detections for web requests to new subdomains, including of the above providers, may uncover malicious phishing activity [D3-DNRA]. Logging the requests for each sub-domain requested by users on a network, such as in DNS or firewall logs, may enable system administrators to identify new targeting and victims
May 22, 2025 at 4:56 PM
netresec.infosec.exchange.ap.brid.gy
DoJ, Dutch National Police and FBI have dismantled a botnet that was used to run Anyproxy and 5socks proxy networks.
https://www.theregister.com/2025/05/10/router_botnet_crashed/
OPERATION MOONLANDER
May 12, 2025 at 6:19 AM
netresec.infosec.exchange.ap.brid.gy
@andreasdotorg That CVE GitHub backup looks shady. Do you trust the "GulfOfAmerica" GitHub account who created this mitre-cve-database repo?
GulfOfAmerica GitHub account
April 16, 2025 at 12:18 PM
netresec.infosec.exchange.ap.brid.gy
StealC v2 and Aurotun Stealer seem to be interconnected. They are sometimes deployed as part of the same infection chain and share C2 infrastructure. Like in this malware run:
https://tria.ge/250411-f3d2tszyhy/behavioral1
👾 StealC v2: 62.60.226.114:80
👾 […]

[Original post on infosec.exchange]
StealC v2 and Aurotun Stealer traffic to 62.60.226.114 in PCAP file from tria.ge
April 16, 2025 at 8:16 AM
netresec.infosec.exchange.ap.brid.gy
C2 servers of newly discovered Aurotun Stealer:
👾 45.227.252.199:7712
👾 46.4.119.125:7712
👾 62.60.226.101:40101
👾 62.60.226.101:40105
👾 62.60.226.114:40101
👾 146.190.108.105:7712
👾 155.138.150.12:7712
👾 198.251.84.107:7712
#aurotunstealer #threatintel
Aurotun Stealer C2 traffic loaded into CapLoader. CapLoader currently classifies the traffic as "LimeRAT" because it doesn't yet have a protocol model for Aurotun Stealer. This misclassification implies that those two C2 protocols share similar traits.
April 16, 2025 at 7:36 AM