Forensic Gamer

Forensics by day, gamer by night.

[Forensic Gamer @GamerForensic]

@HuntShowdown Your likely already aware the the server issues from yesterday are back for US West. Any patching to fix server issues would be great.

[Forensic Gamer @GamerForensic]

@playrust Steam said my update completed yet looks like my client did not, is their manual way to update client to latest patch for the DLC content?

[hasherezade @hasherezade]

[VIDEO] How to make a PE with no sections (using Crinkler): https://t.co/w2s7SWSXel + how to dump it with #PEsieve

[Forensic Gamer @GamerForensic]

@DevinWatson saw an older post on your skin development for Rust, any YouTube vids on how to get started making skins by chance?

[Forensic Gamer @GamerForensic]

@playrust Are servers having issues after patch or just certain ones?

[Forensic Gamer @GamerForensic]

So what is that deal emotet or something??

[David Ledbetter @Ledtech3]

@KorbenD_Intel @SpiderLabs @Trustwave @drole @James_inthe_box @malwrhunterteam @JAMESWT_MHT @Arkbird_SOLG @pmelson Ok I think i've got the bugs worked out

[Forensic Gamer @GamerForensic]

@wilbursecurity @MISPProject @circl_lu Good info, interested in the size of the honeypot as I not seen them deploy an environment which did not look authentic for Ryuk anyhow Trickbot of course.

[Forensic Gamer @GamerForensic]

Is it cached on my computer some where I can retrieve it or my kids are out of luck? Or steps I may follow to retrieve it?

[Forensic Gamer @GamerForensic]

@UltrawRBX Thank you for reply, I didn't notice it on the loading screen. I know when I hit the play button and follow the line it goes to an empty plot.

[Forensic Gamer @GamerForensic]

@pmelson Hey Paul how are you checking if they are broken or work?

[Forensic Gamer @GamerForensic]

@UltrawRBX Thank you for reply, I didn't notice it on the loading screen. I know when I hit the play button and follow the line it goes to an empty plot.

[Forensic Gamer @GamerForensic]

@UltrawRBX Hey friend with the Corona and all, my kids have been playing your Restaurant 2 often, they logged in today and their restaurant was gone any way we can get it back? Feel free direct message me.

[Forensic Gamer @GamerForensic]

@ramen0x3f Alyssa would you mind following me so I can message you and pick your brain?

[Forensic Gamer @GamerForensic]

Unless I botched something, I see it shows the member joined, but I do not see an IP from when they joined.

[Forensic Gamer @GamerForensic]

@ramen0x3f I will take a look and get back to you thanks.

[hasherezade @hasherezade]

If you want to test the latest builds of #PEsieve/#HollowsHunter (built at every commit to master) they can be always downloaded from the build server: https://t.co/DmXOqusb6M

[hasherezade @hasherezade]

I updated the #TrickBot decoder (https://t.co/19v5SexN7L). Now you can extract the config from the settings file

[Forensic Gamer @GamerForensic]

@ramen0x3f I will take a look and get back to you thanks.

[Alyssa (she/her) @ramen0x3f]

@GamerForensic That should be in the cobaltstrike/logs/events.log file I believe.

[Forensic Gamer @GamerForensic]

What do you mean by Trickbot Crypter?

[Vitali Kremez @VK_Intel]

2020-03-12:🆕🔥#Ryuk #Ransomware
🇸🇮[CREA&COM d.o.o.] #DigiCert
#TrickBot Crypter➕Sleep(5) 'Anti-Emu' Loop
do
Sleep(5);
while ( var & 0x200000 );
🔍Ryuk Arg
1⃣Start 'start'
2⃣Wake-Up on LAN & '8 LAN'
3⃣Encrypt 'encrypt'
h/t @malwrhunterteam
MD5:2F3759B5E3F63BC91F25B3129CAAB726

[Forensic Gamer @GamerForensic]

@ramen0x3f I can confirm it did work, thanks. Not a CS user, you seem pretty familiar. Do you know if one of the files logs the IP address of the members that authenticated with the teamserver by chance?