11 Antworten in diesem Thema

[leon]

PlasmaHTTP 1.1 Botnet [Panel + Binary]

 

[spoiler=Weitere Screenshots]

 

 

Das PlasmaHTTP 1.1 Botnet bietet 5 verschiedene Grundfunktionen mit diversen Einstellungsmöglichkeiten.

DDoS

• Slowloris
• UDP
• Arme
• HTTP Post
• HTTP Get
• Condis
• BwFlood
• Stop DDoS

Mining

• CPU
• GPU

Bot

• Download
• Update
• Uninstall
• Update Gate

Botkiller

• Run Bot Killer Module
• Run Hard Bot Killer Module
• Enable Proactive Bot Killer
• Disable Proactive Bot Killer

Misc

• Hosts
• Shell
• Visit Hidden
• Visit Visible
• Torrent Seeder

 

Builder: 

Please Login HERE or Register HERE to see this link!

Panel: 

Please Login HERE or Register HERE to see this link!

 

Scan; 

Please Login HERE or Register HERE to see this link!

Ich würde den Builder nur in der Sandbox ausführen

[bumg2]

3. Tools eintragen
3.1 User ohne Sondergenehmigung dürfen Tools nur in dem Bereich "Public Tools" posten.
3.2 Zu jedem eingetragenen Tool muss ebenfalls ein Virustotal- oder Elementscanner-Check vorliegen.
3.3 Wir übernehmen keine Haftung für mögliche Schäden die durch Tools verursacht werden können.

Please Login HERE or Register HERE to see this link!

[SourceKing]

Download at your own risk... Sure this builder has something nasty hidden inside.

[notfound]

Hey,
 
 

Download at your own risk... Sure this builder has something nasty hidden inside.

That's true.
 
I just analyzed that shit and saw it is infected.
 
 
Uninfected builder:
DL:

Please Login HERE or Register HERE to see this link!

Scan:

Please Login HERE or Register HERE to see this link!

 
INFECTED VIRUS IN INFECTED BUILDER:
DL:

Please Login HERE or Register HERE to see this link!

Password: VORSICHT INFECTED!
It was crypted by "Immortal Crypter". It is a betabot file that connects to 65.55.50.158.
Scan:

Please Login HERE or Register HERE to see this link!

 
 
Greetz
BlackMuffin

[SourceKing]

Admin should remove this. Before someone gets system fucked.  Not understand why hackers try to post infected stuff. Do they think people won't check this lol.

[bumg2]

Hey,
 
 
That's true.
 
I just analyzed that shit and saw it is infected.
 
 
Uninfected builder:
DL:

Please Login HERE or Register HERE to see this link!

Scan:

Please Login HERE or Register HERE to see this link!

 
INFECTED VIRUS IN INFECTED BUILDER:
DL:

Please Login HERE or Register HERE to see this link!

Password: VORSICHT INFECTED!
It was crypted by "Immortal Crypter". It is a betabot file that connects to 65.55.50.158.
Scan:

Please Login HERE or Register HERE to see this link!

 
 
Greetz
BlackMuffin

NetRange: 65.52.0.0 - 65.55.255.255
CIDR: 65.52.0.0/14
NetName: MICROSOFT-1BLK
NetHandle: NET-65-52-0-0-1
Parent: NET65 (NET-65-0-0-0-0)
NetType: Direct Assignment
OriginAS:
Organization: Microsoft Corporation (MSFT)
RegDate: 2001-02-14
Updated: 2013-08-20

[SourceKing]

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          65.55.50.158
+ Target Hostname:    65.55.50.158
+ Target Port:        443
---------------------------------------------------------------------------
+ SSL Info:        Subject:  /C=US/ST=Washington/L=Redmond/O=Microsoft/OU=DSP/CN=www.update.microsoft.com
                   Ciphers:  AES128-SHA256
                   Issuer:   /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Update Secure Server CA 1
+ Start Time:         2015-12-19 13:21:07 (GMT-4)
---------------------------------------------------------------------------
+ Server: Microsoft-IIS/8.5
+ Retrieved x-powered-by header: ASP.NET
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The site uses SSL and the Strict-Transport-Security HTTP header is not defined.
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Cookie ASPSESSIONIDQWBDBDBD created without the httponly flag
+ Root page / redirects to: /windowsupdate/v6/default.aspx
+ Retrieved x-aspnet-version header: 4.0.30319

[leon]

Hey,
 
 
That's true.
 
I just analyzed that shit and saw it is infected.
 
 
Uninfected builder:
DL:

Please Login HERE or Register HERE to see this link!

Scan:

Please Login HERE or Register HERE to see this link!

 
INFECTED VIRUS IN INFECTED BUILDER:
DL:

Please Login HERE or Register HERE to see this link!

Password: VORSICHT INFECTED!
It was crypted by "Immortal Crypter". It is a betabot file that connects to 65.55.50.158.
Scan:

Please Login HERE or Register HERE to see this link!

 
 
Greetz
BlackMuffin

 

Link ist updated, Server an Microsoft gemeldet.

[darknide]

Panel Link geht nicht mehr

[Irhabi]

Weiß wer, ob das Panel irendwelche Löcher hat? Google spuckt auf die schnelle nichts herauß.

Wäre auch super, wenn wer noch das Panel Archiv reuppen könnte.

[im_nobody]

@Irhabi

schick mir nen link zum panel und ich riskier einen flüchtigen blick^^

[Irhabi]

@Irhabi

schick mir nen link zum panel und ich riskier einen flüchtigen blick^^

Würde ich ja, aber das Panel habe ich nicht, deshalb fragte ich ja auch, ob es wer reuppen könnte

Aber danke dennoch