Black Hat Ethical Hacking
Snake Keylogger Spreads Through Malicious PDFs

Snake Keylogger Spreads Through Malicious PDFsPost Views: 2
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
While most malicious e-mail campaigns use Word documents to hide and spread malware, a recently discovered campaign uses a malicious PDF file and a 22-year-old Office bug to propagate the Snake Keylogger malware, researchers have found.
The campaign—discovered by researchers at HP Wolf Security—aims to dupe victims with an attached PDF file purporting to have information about a remittance payment, according to a blog post published Friday. Instead, it loads the info-stealing malware, using some tricky evasion tactics to avoid detection.

“While Office formats remain popular, this campaign shows how attackers are also using weaponized PDF documents to infect systems,” HP Wolf Security researcher Patrick Schlapfer wrote in the post, which opined in the headline that “PDF Malware Is Not Yet Dead.”

Indeed, attackers using malicious email campaigns have preferred to package malware in Microsoft Office file formats, particularly Word and Excel, for the past decade, Schlapfer said. In the first quarter of 2022 alone, nearly half (45 percent) of malware stopped by HP Wolf Security used Office formats, according to researchers.

“The reasons are clear: users are familiar with these file types, the applications used to open them are ubiquitous, and they are suited to social engineering lures,” he wrote.

Still, while the new campaign does use PDF in the file lure, it later employs Microsoft Word to deliver the ultimate payload—the Snake Keylogger, researchers found. Snake Keylogger is a malware developed using .NET that first appeared in late 2020 and is aimed at stealing sensitive information from a victim’s device, including saved credentials, the victim’s keystrokes, screenshots of the victim’s screen, and clipboard data, according to Fortinet. ‘Unusual’ CampaignThe HPW Wolf Security team noticed a new PDF-based threat campaign on March 23 with an “unusual infection chain,” involving not just a PDF but also “several tricks to evade detection, such as embedding malicious files, loading remotely-hosted exploits and shellcode encryption,” Schlapfer wrote.

Attackers target victims with emails that include a PDF document named “REMMITANCE INVOICE.pdf”—misspelling intended–as attachment. If someone opens the file, Adobe Reader prompts the user to open a .docx file with a rather curious name, researchers found.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png “The attackers sneakily named the Word document “has been verified. However PDF, Jpeg, xlsx, .docx” to make it look as though the file name was part of the Adobe Reader prompt,” according to the post.

The.docx file is stored as an EmbeddedFile object within the PDF, which opens Microsoft Word if clicked on, researchers found. If Protected View is disabled, Word downloads a Rich Text Format (.rtf) file from a web server, which then is run in the context of the open document.

Researchers unzipped the contents of the .rtf—which is an Office Open XML file—finding a URL hidden in the “document.xml.rels” file that is not a legitimate domain found in Office documents, they said. 17-Year-Old Bug ExploitedConnecting to this URL leads to a redirect and then downloads an RTF document called “f_document_shp.doc. This document contained two “not well-formed” OLE objects that revealed shellcode exploiting CVE-2017-11882, which researchers said is an “over four-years-old” remote code execution vulnerability (RCE) [...]

in Equation Editor.

Equation Editor is app installed by default with the Office suite that’s used to insert and edit complex equations as Object Linking and Embedding (OLE) items in Microsoft Word documents.
See Also: Kali Linux 2022.2 released with new tools, terminal tweaks and more
It turns out, however, that the bug that attackers leverage in the campaign is actually one that Microsoft patched more than four years ago–in 2017, to be exact—but actually had existed some 17 years before that, making it 22 years old now.

As the final act of the attack, researchers found shellcode stored in the “OLENativeStream” structure at the end of one of the OLE objects they examined. The code eventually decrypts a ciphertext that turns out to be more shellcode, which is then executed after to lead to an executable called fresh.exe that loads the Snake Keylogger, researchers found. See Also: Recon Tool: Dorks collections list Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: Find hidden and encrypted secrets from any website Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/FTYM512XsAArcFs-90x90.jpg Malicious PyPI package opens backdoors on Windows, Linux, and Macs1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/WordPress_headpic-90x90.jpg Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/3e41-article-210226-vmware-body-text-90x90.jpg April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/iphone-low-power-hacking_068D000001681697-90x90.jpg iPhones Vulnerable to Attack Even When Turned Off6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-90x90.jpg Apple emergency update fixes zero-day used to hack Macs, Watches1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/banner-2022.2-release-90x90.jpg Kali Linux 2022.2 released with new tools, terminal tweaks and more1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Discord-hack-90x90.png Malware Builder Leverages Discord Webhooks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/backdoor-90x90.jpg BPFdoor: Stealthy Linux malware bypasses firewalls for remote access2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-exploit-90x90.jpg Actively Exploited Zero-Day Bug Patched by Microsoft2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/maxresdefault-90x90.jpg UK government blocked four times as many cyber-scams in 20212 weeks ago
The post Snake Keylogger Spreads Through Malicious PDFs first appeared on Black Hat Ethical Hacking.

My Pentest Log -20 — (A Little Tip in Nessus)

Greetings to all from Porte Drungari,Continue reading on Medium »
Read more...

My Pentest Log -20 — (A Little Tip in Nessus)
https://hcibo.medium.com/my-pentest-log-20-a-little-tip-in-nessus-9131eadbfa71?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Greetings to all from Porte Drungari,Continue reading on Medium » (https://hcibo.medium.com/my-pentest-log-20-a-little-tip-in-nessus-9131eadbfa71?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

How I Found a company’s internal S3 Bucket with 41k Files

I found a company’s S3 bucket which was used internally and was not referenced anywhere in GitHub or its domain. This was my first valid…Continue reading on InfoSec Write-ups »
Read more...

How I Found a company’s internal S3 Bucket with 41k Files
https://infosecwriteups.com/how-i-found-a-companys-internal-s3-bucket-with-41k-files-94b453e588b5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I found a company’s S3 bucket which was used internally and was not referenced anywhere in GitHub or its domain. This was my first valid…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-found-a-companys-internal-s3-bucket-with-41k-files-94b453e588b5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Prevention Tips

https://cdn-images-1.medium.com/max/1610/1*XsO4cxlJ45YTLExS3bqqcQ.jpeg
The hacking of social media pages is becoming alarming these days. Imagine you take years to build followers and one day boom, dem hackam.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Phantun : Transforms UDP Stream Into (Fake) TCP Streams That Can Go Through Layer 3 &Amp

Phantun is a project that obfuscated UDP packets into TCP connections. It aims to achieve maximum performance with minimum processing and encapsulation overhead.

It is commonly used in environments where UDP is blocked/throttled but TCP is allowed through.

Phantun simply converts a stream of UDP packets into obfuscated TCP stream packets. The TCP stack used by Phantun is designed to pass through most L3/L4 stateful/stateless firewalls/NAT devices. It will not be able to pass through L7 proxies. However, the advantage of this approach is that none of the common UDP over TCP performance killer such as retransmissions and flow control will occur. The underlying UDP properties such as out-of-order delivery are fully preserved even if the connection ends up looking like a TCP connection from the perspective of firewalls/NAT devices.

Phantun means Phantom TUN, as it is an obfuscator for UDP traffic that does just enough work to make it pass through stateful firewall/NATs as TCP packets.

Phantun is written in 100% safe Rust. It has been optimized extensively to scale well on multi-core systems and has no issue saturating all available CPU resources on a fast connection. See the Performance section for benchmarking results.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlWNAAXGD0R3siJSz7fCP2qg8vftAwVdsK9kWjpzCvoH_-Gu4KY0GreG3Cj7RXwGcMllZr5lkQaFLWP8QIlztytNtq0lVfAd97rOPShuH1bG8DHKPo8uUFi4DPYJRtOqfMAD-3dvi13zPLHioty-wF8pKYtCpYC9Wq7aefzEWahhcm0r7leJKrzvCd/s600/1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcOpClKihsTt08fw72WaS7t0PEnkeYOe3idYlaAV8hU1nxspwSwMXb7E-hiQWSNsFK2gYoHo6lW2R9CY1g-itA4AXQmgq5m9He8e274vd6dC1vd8IBbUnrn-0Mw1iCoV4SO3qPUGjsXddlUYpnG2b8W0OByweq0l4NdBa4yXjxegPT6Cm50GoyppGF/s1035/2.png UsageFor the example below, it is assumed that Phantun Server listens for incoming Phantun Client connections at port 4567(the --localoption for server), and it forwards UDP packets to UDP server at 127.0.0.1:1234(the --remoteoption for server).

It is also assumed that Phantun Client listens for incoming UDP packets at 127.0.0.1:1234(the --localoption for client) and connects to Phantun Server at 10.0.0.1:4567(the --remoteoption for client).

Phantun creates TUN interface for both the Client and Server. For Client, Phantun assigns itself the IP address 192.168.200.2and fcc8::2by default. For Server, it assigns 192.168.201.2and fcc9::2by default. Therefore, your Kernel must have IPv4/IPv6 forwarding enabled and setup appropriate iptables/nftables rules for NAT between your physical NIC address and Phantun’s Tun interface address.

You may customize the name of Tun interface created by Phantun and the assigned addresses. Please run the executable with -hoptions to see how to change them.

Another way to help understand this network topology (please see the diagram above for an illustration of this topology):

Phantun Client is like a machine with private IP address (192.168.200.2/fcc8::2) behind a router. In order for it to reach the Internet, you will need to SNAT the private IP address before it’s traffic leaves the NIC.

Phantun Server is like a server with private IP address (192.168.201.2/fcc9::2) behind a router. In order to access it from the Internet, you need to DNATit’s listening port on the router and change the destination IP address to where the server is listening for incoming connections.

In those cases, the machine/iptables running Phantun acts as the “router” that allows Phantun to communicate with outside using it’s private IP addresses.

As of Phantun v0.4.1, IPv6 is fully supported for both TCP and UDP [...]

___________________________
@hacking_Attack
@Hacking_Video

sides. To specify an IPv6 address, use the following format: [::1]:1234with the command line options. Resolving AAAA record is also supported. Please run the program with -hto see detailed options on how to control the IPv6 behavior. Enable Kernel IP forwardingEdit /etc/sysctl.conf, add net.ipv4.ip_forward=1and run sudo sysctl -p /etc/sysctl.conf.IPv6 specific config net.ipv6.conf.all.forwarding=1will need to be set as well.

Back to TOC Add required firewall rulesClientClient simply need SNAT enabled on the physical interface to translate Phantun’s address into one that can be used on the physical network. This can be done simply with masquerade.

Note: change eth0to whatever actual physical interface name is

Back to TOC Using nftablestable inet nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
iifname tun0 oif eth0 masquerade
}
}

Note: The above rule uses inetas the table family type, so it is compatible with both IPv4 and IPv6 usage.

Back to TOC Using iptablesiptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE ServerServer needs to DNAT the TCP listening port to Phantun’s TUN interface address.

Note: change eth0to whatever actual physical interface name is and 4567to actual TCP port number used by Phantun server

Back to TOC Using nftablestable inet nat {
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iif eth0 tcp dport 4567 dnat ip to 192.168.201.2
iif eth0 tcp dport 4567 dnat ip6 to fcc9::2
}
} Using iptablesiptables -t nat -A PREROUTING -p tcp -i eth0 –dport 4567 -j DNAT –to-destination 192.168.201.2
ip6tables -t nat -A PREROUTING -p tcp -i eth0 –dport 4567 -j DNAT –to-destination fcc9::2 Run Phantun binaries as non-root (Optional)It is ill-advised to run network facing applications as root user. Phantun can be run fully as non-root user with the cap_net_admincapability.

sudo setcap cap_net_admin=+pe phantun_server
sudo setcap cap_net_admin=+pe phantun_client Start Phantun daemonNote: Run Phantun executable with -hoption to see full detailed options.

Back to TOC ServerNote: 4567is the TCP port Phantun should listen on and must corresponds to the DNAT rule specified above. 127.0.0.1:1234is the UDP Server to connect to for new connections.

RUST_LOG=info /usr/local/bin/phantun_server –local 4567 –remote 127.0.0.1:1234

Or use host name with --remote:

RUST_LOG=info /usr/local/bin/phantun_server –local 4567 –remote example.com:1234

Note: Server by default assigns both IPv4 and IPv6 private address to the Tun interface. If you do not wish to use IPv6, you can simply skip creating the IPv6 DNAT rule above and the presence of IPv6 address on the Tun interface should have no side effect to the server.

Back to TOC ClientNote: 127.0.0.1:1234is the UDP address and port Phantun should listen on. 10.0.0.1:4567is the Phantun Server to connect.

RUST_LOG=info /usr/local/bin/phantun_client –local 127.0.0.1:1234 –remote 10.0.0.1:4567

Or use host name with --remote:

RUST_LOG=info /usr/local/bin/phantun_client –local 127.0.0.1:1234 –remote example.com:4567 MTU overheadPhantun aims to keep tunneling overhead to the minimum. The overhead compared to a plain UDP packet is the following (using IPv4 below as an example):

Standard UDP packet: 20 byte IP header + 8 byte UDP header = 28 bytesObfuscated packet: 20 byte IP header + 20 byte TCP header = 40 bytesNote that Phantun does not add any additional header other than IP and TCP headers in order to pass through stateful packet inspection!

Phantun’s additional overhead: 12 bytes. I other words, when using Ph[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
CobaltBus : Cobalt Strike External C2 Integration With Azure Servicebus, C2 Traffic Via Azure Servicebus

CobaltBus is a Cobalt Strike External C2 Integration With Azure Servicebus, C2 traffic via Azure Servicebus
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDbEZgNT49Ik_NL885CtcocoA5kBYpgfG0sLt1OcTfO51qfVLT096tNV9kpchzvXtnlVuWZ0VEDyCSYxu4ieMeXc8RWqNVSKU4e_XeVW5d07wQX9rrIVJ12OwG-HYOcM9zWI2eDg6aorU0PrzE3y7K8_zag_kV_atjgjQZhtfclW8jiOvZXf4lhC08/s4399/1.png
Setup

* Create an Azure Service Bus
* Create a Shared access policy (Connection string) that can only Send and Listen
* Edit the static connectionString variable in Beacon C# projects to match the “Primary Connection String” value for the Shared access policy created in step 2.
* The same variables need to be updated for the CobaltBus project, but the “Primary Connection String” for the “RootManageSharedAccessKey” Shared access policy must be used. (Needs the “manage” permission)
* Setup Cobalt and start en External C2 listener on port 4444, 127.0.0.1 (can be changed by editing the ExternalC2Port ExternalC2Ip vars in the C# project)

How does it work?

Then CobaltBus DotNetCore binary that integrates with CobaltStrikes ExternalC2, will create a local SqliteDB in order to keep track of multiple beacons. The messages inbound to CobaltBus will be captured and written to the database. The database names “CobaltBus.db” and “CobaltBus-log.db” will be created in the directory CobaltBus.dll is running from. Once a Beacon binary runs, it will push an “INITIALIZE” message to the baseQueueName queue, with a randomly generated BeaconId and Pipename. The CobaltBus handler will then capture this, create and move into the two new queues based on the BeaconId sent, request stager shellcode from the CobaltStrike, and push it back down the new queue as an “INJECT” message. From here, the Beacon project injects the captured shellcode into memory and establishes a connection with the CobaltStrike beacon over the generated pipe name. When a command is issued from CobaltBus, it is pushed down the beacon respective queue and into the beacon pipe name.
Download

___________________________
@hacking_Attack
@Hacking_Video

antun, the usable payload for UDP packet is reduced by 12 bytes. This is the minimum overhead possible when doing such kind of obfuscation. MTU calculation for WireGuardFor people who use Phantun to tunnel WireGuard® UDP packets, here are some guidelines on figuring out the correct MTU to use for your WireGuard interface.

WireGuard MTU = Interface MTU – IPv4 header (20 bytes) – TCP header (20 bytes) – WireGuard overhead (32 bytes)

or

WireGuard MTU = Interface MTU – IPv6 header (40 bytes) – TCP header (20 bytes) – WireGuard overhead (32 bytes)

For example, for a Ethernet interface with 1500 bytes MTU, the WireGuard interface MTU should be set as:

IPv4: 1500 - 20 - 20 - 32 = 1428 bytesIPv6: 1500 - 40 - 20 - 32 = 1408 bytesThe resulted Phantun TCP data packet will be 1500 bytes which does not exceed the interface MTU of 1500. Please note it is strongly recommended to use the same interface MTU for both ends of a WireGuard tunnel, or unexpected packet loss may occur and these issues are generally very hard to troubleshoot. Version compatibilityWhile the TCP stack is fairly stable, the general expectation is that you should run same minor versions of Server/Client of Phantun on both ends to ensure maximum compatibility. PerformancePerformance was tested on 2 AWS t4g.xlargeinstances with 4 vCPUs and 5 Gb/s NIC over LAN. nftableswas used to redirect UDP stream of iperf3to go through the Phantun/udp2raw tunnel between two test instances and MTU has been tuned to avoid fragmentation.

Phantun v0.3.2and udp2raw_arm_asm_aes20200818.0was used. These were the latest release of both projects as of Apr 2022.

Test command: iperf3 -c ModeSend SpeedReceive SpeedOverall CPU UsageDirect (1 stream)3.00 Gbits/sec2.37 Gbits/sec25% (1 core at 100%)Phantun (1 stream)1.30 Gbits/sec1.20 Gbits/sec60% (1 core at 100%, 3 cores at 50%)udp2raw (cipher-mode=none auth-mode=nonedisable-anti-replay) (1 stream)1.30 Gbits/sec715 Mbits/sec40% (1 core at 100%, 1 core at 50%, 2 cores idling)Direct connection (5 streams)5.00 Gbits/sec3.64 Gbits/sec25% (1 core at 100%)Phantun (5 streams)5.00 Gbits/sec2.38 Gbits/sec95% (all cores utilized)udp2raw (cipher-mode=none auth-mode=nonedisable-anti-replay) (5 streams)5.00 Gbits/sec770 Mbits/sec50% (2 cores at 100%) Compariation to udp2rawudp2raw is another popular project by @wangyu- that is very similar to what Phantun can do. In fact I took inspirations of Phantun from udp2raw. The biggest reason for developing Phantun is because of lack of performance when running udp2raw (especially on multi-core systems such as Raspberry Pi). However, the goal is never to be as feature complete as udp2raw and only support the most common use cases. Most notably, UDP over ICMP and UDP over UDP mode are not supported and there is no anti-replay nor encryption support. The benefit of this is much better performance overall and less MTU overhead because lack of additional headers inside the TCP payload.

Here is a quick overview of comparison between those two to help you choose:
Phantunudp2rawUDP over FakeTCP obfuscationhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png UDP over ICMP obfuscationhttps://s.w.org/images/core/emoji/13.1.0/72x72/274c.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png UDP over UDP obfuscationhttps://s.w.org/images/core/emoji/13.1.0/72x72/274c.png https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Multi-threadedhttps://s.w.org/images/core/emoji/13.1.0/72x72/2705.png https://s.w.org/images/core/emoji/13.1.0/72x72/274c.png ThroughputBetterGoodLayer 3 modeTUN interfaceRaw sockets + BPFTunneling MTU overhead12 bytes44 bytesSeprate TCP connections for each UDP connectionClient/ServerServer onl[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Live-Forensicator : Powershell Script To Aid Incidence Response And Live Forensics

Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Forensic Investigators and Incidence responders in carrying out a quick live forensic investigation.

It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for unusual files or activities and points it out to the investigator.

It is paramount to note that this script has no inbuilt intelligence its left for the investigator to analyse the output and decide on a conclusion or decide on carrying out more deeper investigation. Optional DependenciesThis script is written in powershell for use on windows PCs and Servers.

For additional features it depends on external binaries.

It has a supporting file WINPMEM for taking RAM dumps https://github.com/Velocidex/WinPmem

It also depends on Nirsoft’s BrowserHistoryView for exporting browser history http://www.nirsoft.net/utils/browsing_history_view.html

This script is expected to work out of the box.

winpmem_mini_x64_rc2.exe | BrowsingHistoryView64.exe | BrowsingHistoryView86.exe | etl2pcapng64.exe | etl2pcapng86.exe Usagecopy the files to the computer
git clone https://github.com/Johnng007/Live-Forensicator.git
Execution
.\Forensicator.ps1 ExamplesBasic
.\Forensicator.ps1
Check your Version
.\Forensicator.ps1 -Version
Check for Updates
.\Forensicator.ps1 -Update
Decrypt An Encrypted Artifact
.\Forensicator.ps1 -DECRYPT DECRYPT
Extract Event Logs alongside Basic Usage
.\Forensicator.ps1 -EVTX EVTX
Grab weblogs IIS & Apache
.\Forensicator.ps1 -WEBLOGS WEBLOGS
Run Network Tracing & Capture PCAPNG for 120 secounds
.\Forensicator.ps1 -PCAP PCAP
Extract RAM Dump alongside Basic Usage
.\Forensicator.ps1 -RAM RAM
Check for log4j with the JNDILookup.class
.\Forensicator.ps1 -log4j log4j
Encrypt Artifact after collecting it
.\Forensicator.ps1 -ENCRYPTED ENCRYPTED
Yes of course you can do all
.\Forensicator.ps1 -EVTX EVTX -RAM RAM -log4j log4j -PCAP PCAP -WEBLOGS WEBLOGS
For Unattended Mode on Basic Usage
.\Forensicator.ps1 -OPERATOR “Ebuka John” -CASE 01123 -TITLE “Ransomeware Infected Laptop” -LOCATION Nigeria -DEVICE AZUZ
You can use unattended mode for each of the other parameters
.\Forensicator.ps1 -OPERATOR “Ebuka John” -CASE 01123 -TITLE “Ransomeware Infected Laptop” -LOCATION Nigeria -DEVICE AZUZ -EVTX EVTX -RAM RAM -log4j log4j
Check for files that has similar extensions with ransomeware encrypted files (can take some time to complete)
.\Forensicator.ps1 -RANSOMEWARE RANSOMEWARE
You can compress the Forensicator output immidiately after execution Oneliner
.\Forensicator.ps1 ; Start-Sleep -s 15 ; Compress-Archive -Path “$env:computername” -DestinationPath “C:\inetpub\wwwroot\$env:computername.zip” -Force NotesRun the script as an administrator to get value.
The results are outputed in nice looking html files with an index file.
You can find all extracted Artifacts in the script’s working directory.

Forensicator Has the ability to Search through all the folders within a system looking for files with similar extensions as well known Ransomewares, Albeit this search takes long but its helpful if the Alert you recieved is related to a Ransomeware attack, Use the -RANSOMEWARE Parameter to invoke this.

Forensictor now hs the ability to capture network traffic using netsh trace, this is useful when your investigation has to do with asset communicating with known malicious IPs, this way you can parse the pcapng file to wireshark and examine for C&C servers. By Defult i set the capture to take 120secs

Sometimes it may be paramount to maintain the integrity of the Artifacts, where lawyers may argue that it might have been compromised on transit to your lab. Forensicator can now encrypt the Artifact with a unique randome[...]

___________________________
@hacking_Attack
@Hacking_Video