milkream

[milkream @milkr3am]

@netresec Oh I see, thanks for the clarification :)

[milkream @milkr3am]

@netresec Another issue for me, also with Emotet, but for spam. I tried run: "polarproxy -v -p 10465,25,465 -p 10587,25,587" but no SMTP(s) packets are caught and decrypted by PolarProxy although there are spams running.

[milkream @milkr3am]

@netresec Thank you @netresec for the response. I'll try it that way but I'm afraid it won't be suitable because Emotet has multiple C2 IP(s) and we don't know which one will work.

[m4n0w4r @kienbigmummy]

@_VinCSS_ has successfully detected and prevented a phishing attack campaign to distribute malware to customer that was protected by us. Here is my detail analysis about #Trickbot, one of the most dangerous malware!!!
[Eng]https://t.co/ISj9b3j5OO
[Vie]https://t.co/6F2v3DP2GB

[milkream @milkr3am]

CobaltStrike watermark ID: "1580103814" or "0x5e2e7886" in hex

[milkream @milkr3am]

#Qakbot #Qbot #CobaltStrike C2(s):
45.138.172[.]91
23.108.57[.]245
204.16.247[.]35
204.16.247[.]224
23.108.57[.]31

Port: 8080 or 443
URI to download beacons: /strap/j-devmin.js

[milkream @milkr3am]

Corresponding Domains:
45.138.172.91 -> classworldint[.]com
23.108.57.245 -> knotsecuritybusiness[.]com
204.16.247.35 -> madesecuritybusiness[.]com
204.16.247.224 -> entirelysecuritybusiness[.]com
23.108.57.31 -> ticksecuritybusiness[.]com

[milkream @milkr3am]

Bot goes qak qak ... 👌

[m4n0w4r @kienbigmummy]

#Qakbot #Qbot My journey to analyze how QakBot infects after launched by malicious Excel document, the techniques used to make the analysis difficult, and how to extract the C2 list. #VinCSS #MalwareAnalysis @erikpistelli @hasherezade
Check it out: https://t.co/o2CZIlZ6DV

[milkream @milkr3am]

@shik_auto @jpcert That is my mistake:
https://t.co/YOS55qXC8j

[milkream @milkr3am]

This is exact date information of #Emotet uninstallation. It’s 25 April 2021 12:00 local time. Sorry for the mistake in my previous tweet 🙂.

[milkream @milkr3am]

@valentinor78 I think it is approximately 90 days (or 3 months) from the date they had taken down botnet C2 servers.

[milkream @milkr3am]

All Emotet epochs now are delivering the payload (https://t.co/Tv21VmJm4s) which has the code to remove Emotet on 25 March 2021 12:00. I believe that #Emotet #Killed

[milkream @milkr3am]

@craiu @hatr I guess they want to take advantage of Emotet's working flow to uninstall it properly. E.g: in case there is a flaw in the code, they still can deploy another one via Emotet's update protocol.

[milkream @milkr3am]

@craiu For some reasons, maybe there are some victims who did not receive the latest version of Emotet.

[milkream @milkr3am]

@craiu If you guys here are (were) playing with Emotet, then we known that Emotet gangs just started their update cycle for their arsenals early this year (modules, email templates using password in images ...) but after that they has been taken down.

[milkream @milkr3am]

This is exact date information of #Emotet uninstallation. It’s 25 April 2021 12:00 local time. Sorry for the mistake in my previous tweet 🙂.

[ThreatDown @Threat_Down]

We are checking on the #Emotet 'cleanup binary'.

It seems the actual date to trigger the uninstall routine is April 25.

More details to come.

/cc @campuscodi @LawrenceAbrams

https://t.co/OwM2trJdBu
https://t.co/UpQjxZhMwY

[milkream @milkr3am]

@psyklopz24 Oh yes, thanks for pointing out my fault 😅

[milkream @milkr3am]

And Emotet bot is controlled to connect to these servers only:

80.158.3[.]161:443
80.158.51[.]209:8080
80.158.35[.]51:80
80.158.63[.]78:443
80.158.53[.]167:80
80.158.62[.]194:443
80.158.59[.]174:8080
80.158.43[.]136:80