#tom cobalt header

[hiloedits]

— cobalt family headers

like or reblog if you use/save.

© hiloedits on twitter.

[dcusrclicta]

𝕿𝖍𝖊 𝖂𝖍𝖔𝖑𝖊 𝕲𝖆𝖓𝖌 𝕴𝖘 𝕳𝖊𝖗𝖊! || 𝕸𝖚𝖘𝖊 𝕷𝖎𝖘𝖙

Muses Statuses 

Primary muses will get frequent starter calls & attention almost equal to the actual main muses. If you send a meme & don’t specify who it’s for & Brittnay or Severus don’t want it it will be answered by a muse of this status. They will also answer memes specifically for them.

Secondary muses’ll get starter calls every now & then. They will answer memes sent specifically for them.

Request Only muses are only played if another player wants them. They will very very rarely get starter calls. They will answer memes sent specifically for them.

Every single muse on this blog painstakingly organised by fandom. All canon & fanon divergent because I wanted to save them. Information in parenthesis means they have a Harry Potter AU verse.

Blog Headers (Main Muses)

Name: Severus Tobias Snape Year: Cute. House: Slytherin Blood Status: Befouler Antichrist Eye colour: Cobalt Age: Old enough to say no. Birthdate: 1/9 Height: 6′7 Patronus: Horned Viper

Description: I still hate my job. I still hate people. I’m just immortal now. Please leave my office & don’t touch anything on your way out.

Status: Main

Fandom: Harry Potter

Name: Brittnay Mathews Year: College Junior (House: Slytherin) Blood Status: Human (Pureblood) Eye colour: Blue Age: 21 Birthdate:  6/15 Height: 5′5 (Patronus: Pitbull)

Description: Cross me & I’ll hurt you, bitch. Otherwise I’m Brittnay Matthews your new best friend. People think I’m full of myself but in reality they’re just angry I’m better than them. I used to go to Overland Park high school. I’m glad I don’t anymore.

Status: Main

Fandom: Youtube {x}

Harry Potter

Name: Lilith “Lily” Sophie Evans Year: Graduated/Verse Dependant House: Slytherin Blood Status: Demon/Witch Eye colour: Green/Blue/ Sometimes they go crimson. Age: Doesn’t matter. I won’t die. Birthdate: 1/30 Height: 5’3 Patronus: Bold of you to assume I have one Description: My sister was right. I’m a freak. Even my parents saw something… Wrong in me when I was younger. They tried to pretend I was fine. ”Just a few odd occurrences here & there.” Until an older boy who couldn’t keep his hands to himself suddenly found that a hand could very easily be turned inside out. In the long run it was a good result. They found quite a bit of child pornography in his little hovel of a bedroom. My parents knew I did it but couldn’t quite figure out how until the Hogwarts letter came. They were both horrified & relieved. But to make a long story short. Once I met Severus Snape & we put our interest in the Dark Arts together… I got WORSE. & it felt good. I became addicted to the draw of dark magic, occult magic in particular & now Tom Riddle wants me to tell him what I said to Lucifer to get this new body. I might tell him if he begs in the right tone.

Status: Primary

Name: Thomas Marvolo Riddle Year: Graduated House: Slytherin Blood Status: Demon Fledging Eye colour: Blue Age: Rude. Birthdate: 12/31 Height: 6′4 Patronus: Hmmm, my little secret. Description: Join my cult. Satanism is actually very beneficial if you’re respectful. No. You don’t have to slit your wrist to join… Please. Stop slitting your wrists to join.

Status: Primary

Name: Scorpio Felix Sepelio Tobias Exodus Snape Blood Status: Vampire Eye colour: One is jade one is cobalt and they swap sides frequently Age: 91 Died at 36 and it’s been a while. You do the math, mate. Birthdate: 11/10 Height: 5’3

Description: Surprise bitches. I bet you all thought I was dead…In a matter of speaking that’s still accurate. The greasy little snot did indeed best me when I was human. I respect that victory &even though I miss them.. My children don’t need me. I wasn’t good to them when they did. I doubt they’re aware I came back and I’ll keep it that way for all our sakes. There’s no point in asking me how exactly I returned to life. I don’t know and I don’t particularly care. Maybe Hell just can’t handle me yet.

Status: Primary

Name: Eileen Tabitha Prince Snape Year: Graduated House: Slytherin Blood Status: Pureblood Poltergeist Eye colour: Black Age: Well. I died at 35 so let’s go with that Birthdate: 12/18 Height: 6’11  (Used to be 6'6 but I had this weird growth spurt two days before I died.) Patronus: Didn’t have one apparently

Description: … I really don’t have anything to say to you. I died, I decided I wanted to come back. Er. Awkwardly enough the old castle I was haunting is now inhabited by my son and his family. They’re all really bloody loud. No wonder the rest of the ghosts make so much noise back. And no. I have not introduced myself to any of them. I mean. Sometimes I talk to ‘em but I’ve never gotten an answer. Plus unlike most of the floating assholes here I’d much rather keep to myself, thank you.

Status: Secondary

A Song Of Ice & Fire

Name: Rhaegar Daeron Targaryen (Year: Graduated/Verse Dependant) (House: Slytherin) Blood Status: ??? Eye colour: Violet Age: 34 Nameday: All I remember was being born in the high summer Height: 7’1 (Patronus: Hungarian Horntail) 

Description: I’m believed to be dead. Walking about when one is believed to be dead is actually quite boring no matter how much it may benefit the Realm. I do admit I made. Many mistakes however in my defence not all prophecies are interpreted in a straight forward manner. I did better than any of you would have in the situation so save your criticism for until you watch a man identical to you get his chest caved in by a war hammer.

Status: Primary

Name: Prince Joffrey Baelor Targareyen (Year: Fourth) (House: Slytherin) Blood Status: Human (Pureblood) Eye colour: Green Age: 13 Nameday: Ask Mother. Height: 6′1 (Patronus: None) Description: I am hungry. You all bore me. I am going home. Please stop asking me why my Father faked his death. I am never going to tell you. Ask me again & I’ll tell my grandfather you were planning another rebellion. Then I’ll roast my chicken over the results. If you say something insulting about my mother in front of me… Even my grandfather won’t be able tostomach looking at what remains of you.

Status: Primary

Name: Queen Rhealla Targareyen (Year: Graduated) (House: Slytherin) Blood Status: Human(?) (Pureblood) Eye colour: Violet Age: 49 (Yes, I know I don’t look it) Nameday: Sometime in the High Summer Height: 5′4 (Patronus: Chameleon) Description: My obedience is owed to my King. My loyalty will always be to my children no matter what destruction it will bring. I will never fail my children again.

Status: Primary

Name: King Aerys Targaryen Second of His Name King of the Andals & the First Men Lord of the Seven Kingdoms & Protector of the Realm (Year: Graduated) (House: Slytherin) Blood Status: Human Mine is the blood of Old Valyria (Pureblood) Eye colour: Violet Age: Hm. Nameday: High summer. Height: 6′8 (Patronus: Gila Monster) Description: Burn them all.

Status: Request Only

Name: Viserys Targareyen (Year: Seventh) (House: Slytherin) Blood Status: Human (Pureblood) Eye colour: Violet Age: 17 Nameday: It escapes me. Height: 6′3 (Patronus: Crocodile Monitor) Description: I MUST remember that I am the blood of dragons. I must be strong. I must not forget myself. I must remember who I truly am inside. I must drink from the cup handed to me.I MUST.

Status: Secondary

Name: Daenerys Visenya Targaryen (Year: Fifth) (House: Slytherin) Blood Status: ??? (Pureblood) Eye colour: Violet Age: 15 Nameday: During a violent storm Height: 4′9 (Patronus: Blue-tongued Skink) Description: My family’s way is fire & blood… But my heart sings a softer song… & I don’t know which way is right.

Status: Secondary

Name: Danny Flint Blood Status: Shade Eye colour: Grey Age: Old Nameday: ? Height: 5′4 Description: Being dead was less droll. {x}

Status: Request Only

Name: Robyn Black Robin Blood Status: Poltergeist Eye colour: Hazel Age: Hm Nameday: Some far off winter Height: 6′5 Description:  “The Gods above all knew his crimes The lord read off his lists The Gods above all knew his crimes The men’s hands balled to fists His legs they kicked, they jerked, then slowed The crowd not once did cheer His legs they slowed, then finally stopped The crowd not once did jeer” {x}

Status: Secondary

Name: Ser Jaime Lannister (Year: Graduated) (House: Hufflepuff) Blood Status: Shade (Pureblood) Eye colour: Green Age: I’m dead. Sorry. Nameday: Does it matter? Height: 5′6 (Patronus: Munchkin Cat) Description: I stayed loyal to the Targaryens & they won. But I died when Robert Baratheon caved in Rhaegar’s chest… At least I got to watch him die for it.

Status: Primary

Name: Lancel Lannister (Year: Graduated) (House: Hufflepuff) Blood Status: Human (Pureblood) Eye colour: Green Age: 17 Nameday: Eh Height: 6′1 (Patronus: Devon Rex Kitten) 

Description: … I wish I was one of the smallfolk to be honest. Or the youngest.

Status: Primary

Name: Joanna Lannister (Year: Graduated) (House: Gryffindor) Blood Status: Human (Pureblood) Eye colour: Green Age: 47 Nameday: I remember it was cloudy? Height: 5′6 (Patronus: Centaur) Description: Rhaella says I’m too kind. So be it. I’ve seen enough harm to others, sometimes at the hands of those I love the very most & I will NOT add to that bloodshed.

Status: Secondary

Medici The Magnificent

Name: Jacopo de’Pazzi (Year: Graduated) (House: Slytherin) Blood Status: Tatzelwurm (Cursed Werewolf/Pureblood) Eye colour: Green Age: 596 54 Birthdate: 4/30 None of your business Height: 5′10 (Patronus: Canis)

Description: ... Perish all of you.

Status: Primary

Name: Francesco de’Pazzi (Year: Graduated) (House: Slytherin) Blood Status: Demon (Pureblood) Eye colour: Hazel Age: 575 Birthdate: 1/28 Height: 6′1 (Patronus: Maned Wolf)

Description: From now on. I ask the questions & find my own answers to them.

Status: Request Only

Name: Giuliano de’ Medici (Year: Graduated) (House: Gryffindor) Blood Status: Spectral Fae (Pureblood) Eye colour: Blue Age: 566 Birthdate: 3/25 Height: 5′10 (Patronus: Yorkshire Terrier) Description: I am the brother who lacks purpose. I’ll gladly drink to that.

Status: Request Only

Die Hard

Name: Karl Vreski (Year: Graduated) (House: Slytherin) Blood Status: Human (Pureblood) Eye colour: Blue Age: 19 (Typically) Birthdate: 10/25 Height: 6′1 (Patronus: Jackal)

Description: I’m Karl. Lacrosse. Tacos. Boxing. American football. Whatever activity that involves either Hans Gruber or hitting something? I like it. Tony’s alright. Good brother at least. Not at all annoying like the normal younger sibling M.O. Far nicer than me. I’ll likely end up being a lawyer same as my father. Boring but Hans and I are already working at the damn firm so it’s an easy job. I’m sure Hans’ll come up with a more fun idea. He always does.

Status: Primary

Name: Tony Vreski (House: Hufflepuff) (Year: Seventh) Blood Status: Poltergeist (Pureblood) Eye colour: Blue Age: 17 (Typically) Birthdate: 9/3 Height: 5′10 (Patronus: Rooster)

Description: I’m Tony… I uh. I play some football. Real football not American. I’m Karl’s younger brother and… To be honest Hans scares me a little bit even if we’re all like brothers… Uh more often than not I just go along with their crazy plans because. Well because my brother says it’ll be fun. And. It usually is. Even if some of it’s a little illegal.

Status: Request Only 

Stephen King

Name: Beverly Marsh Blood Status: Human Eye colour: Green Age: 14 Birthdate: 8/26 Height: 5′3

Description: I’m Bev. Looked into that stupid clown’s deadlights & lived. I’ll be a loser to the end & I’m honestly real proud of that. Losers have no where to go but up, after all.

Status: Primary

Name: Richmond Richie Wentworth Tozier Blood Status: Human Eye colour: Caribbean Green Age: 14 Birthdate: 8/10 Height: 5′10 Description: I’m only afraid of werewolves & girls with eyes that are hard to not get lost in.

Status: Secondary

Twilight

Name: Jacob Black (Year: Seventh) (House: Gryffindor) Blood Status: Shapeshifter (Half Veela/Werewolf) Eye colour: Brown Age: 18 Birthdate: 7/30 Height: 6′5 (Patronus: Australian Cattle Dog ) Description: Hi, I’m Jacob & I’m not having any fun anymore.

Status: Primary

Name: Jasper Hale (Year: Graduated) (House: Slytherin) Blood Status: Dark Fae (Vampire/Pureblood) Eye colour: Crimson (Blue) Age: Like 70ish? Birthdate: ?? Height: 6′1 (Patronus: Maine Coon) Description: I’m so glad I moved out of that stupid house.

Status: Secondary

Name: Rosalie Hale (Year: Graduated) (House: Slytherin) Blood Status: Dark Fae (Vampire/Veela) Eye colour: Crimson (Blue) Age: ? Birthdate: ? Height: 5′9 (Patronus: Cougar) Description: What those two said. Also yes. I stole the kid. Renessme would’ve been a horrible name.

Status: Secondary

Name: Claire Hale (Year: Fourth) (House: Slytherin) Blood Status: Dark Fae (Half Vampire/Halfblood) Eye colour: Brown Age: 15 Birthdate: ? Height: 5′5 (Patronus: Cymric) Description: I’m glad my mom stole me. My real parents sound shitty & Renessme is a fucking dumb ass name. Jacob & I? Not dating, what the fuck he’s like my brother. &Ilikegirls.

Status: Primary

Disney

Name: Ursula Trident Blood Status: Sea Witch Eye colour: Green Age: It escapes me Height: Depends on whether I have the tentacles or not. Description: I’m only here to help these poor, unfortunate souls out here all alone in the world.

Status: Request Only

Name: Yzma Chimbo Blood Status: Witch Eye colour: Hazel Age: If my plans go well it won’t be relevant Birthdate: No. Height: 5′9 Description: I will burn brighter than the sun. & take it entirely for myself.

Status: Request Only

Name: Gaston  LeGume Blood Status: Human Eye colour: Blue Age: 21 Birthdate: … Height: 6′5 Description: I just wish to stop fighting this war. I want to go home.

Status: Secondary

Name: Sidney Phillips Blood Status: Human Eye colour: Grey Age: 18 Birthdate: 8/15 Height: 6′1 Description: Yea, every else thinks I’m crazy too. Leave me alone.

Status: Secondary

Name: Gothel Altergott Blood Status: Unseelie/Human Eye colour: Green Age: 26 Birthdate: eh Height: 5′6 Description: I fear the ravages of time far more than I should.

Status: Secondary

Name: Lina Grimhilde Blood Status: Witch Eye colour: Blue Age: 48 Birthdate: Eat this apple & I’ll tell you Height: 6′1

Description: Don’t waste your time. I’m just as vain & unattainable as I appear.

Status: Request Only

Name: Henry Harry Jameson Hook (Year: Slytherin) (House: Seventh) Blood Status: Half-demon/Sorcerer Eye colour: Blue Age: 17 Birthdate: 10/23 Height: 6′2 (Patronus: Savannah cat) Description: All it takes is one wrong look & I’ll EVISCERATE ya… Taken by Uma daughter of Ursula. Ya want me? Ya have ta ask her permission & pray she likes ya & is in a SHARIN’ mood. Jamie Hook is me mum an’ she taugh’ me all I know about bein’ scary. Me da??? ‘Eard e’s a dumbass. Dunno who it is but me mum never lies.

Status: Primary

Name: Carlos De Vil (Year: Sixth) (House: Slytherin) Blood Status: Half-demon/ Sorcerer Eye colour: Blue Age: 16 Birthdate: 3/20 Height: 5′7 (Patronus: Red Fox) Description: Hi, I’m Carlos & life is pain, only valid things in this world are only science & Evie Grimhilde, bye. Gemini De Vil is my midget brother who I love. Devil De Vil is my crazy ass dad. My mom is dead, thanks for asking.

Status: Primary

Youtube

Name: “Andrew” Antisepticeye McLoughlin Blood Status: Computer Virus Entity/Demon Eye colour: Lime Green Age: 29 (Existing for 3) Birthdate: 10/10 Height: N/A Description: It’s better if ya dun run. It’ll just drag et out. Plus sometimes ya lot chip my knife on one of yer stupid bones. & I dun really li’e runnin much ta be honest.

Status: Primary

Name: Chase Brody Blood Status: Human Eye colour: Blue Age: 29 Birthdate: 4/11 Height: 5′10 Description: Hey bros! I’m Chase! Uh, some of ya already know tha! Anti brought me here! He said it’d be fun an’ I trus’ ‘im! I swear ‘e’s actually always been kinda nice ta me! Besides the ‘ole threatenin’ the kids thin’ but we’re frien’s now! He says he’ll teach me how ta shoot a real gun someday!

Status: Request Only

Family Guy

Name: Brian Griffin Blood Status: Dog(?) Eye colour: Green Age: ??? Birthdate: ??? Height: 6′4 Description: I used to be an alcoholic dog. Now I’m an alcoholic. Not much to say after something like that happens. I’m really confused to be frank. Maybe now I can actually get someone to take me seriously & publish my book.

Status: Request Only

Adventure Time

Name: Griffin “Finn” Merterns Blood Status: Human(?) Eye colour: Blue Age: 19 Birthdate: 3/14 Height: 6′3 Description: Hey bros! I’m Finn, a radical kid that makes it his business to help people out and kick monster tail! Mostly when I’m not doin’ that I’m chillin’ it up with my bro Jake in the tree house so as long as you’re not some wacko monster that wants to eat up my face you can swing by and we can fire up BMO or something.

Status: Secondary

Name: Marceline Abadeer Blood Status: Vampire Demon Eye colour: Green Age: 1003, Approximately Birthdate: Unknown Height: 5′9 (Various) Description: Marceline the Vampire Queen, dude. Sure you’ve heard of me before so I wouldn’t be surprised to see you shaking in your boots right about now. Been traveling and terrorising the Land of Ooo for a while now though it’s nothing too irreversible. Mostly I’m just "a radical dame that likes to play games" as a very special someone once said about me.

Status: Secondary

Invader Zim

Name: Zim Wagner  (Year: Graduated) (House: Slytherin) Blood Status: Irken (Muggleborn) Eye colour: Crimson (Grey) Age: 23 Earth Years, now Birthday: 11/6 Height: 5′11 (Patronus: None)

Description: I’ve found a much better cloaking device but I’m STILL banished… I suppose I’ve defected at this point but my plans aren’t doing much better, even with Gaz’s… “Assistance.”

Status: Primary

Name: Gazlene “Gaz” Membrane (Year: Graduated) (House: Slytherin) Blood Status: Unknown (Pureblood) Eye colour: Blue, Green, Amber, Violent depends on the lighting & my mood Age: 22 Birthday: 7/13 Height: 5′4 (Patronus: None) Description: One day Zim will actually be worthy of the name Invader. Until then I guess I can enjoy watching the flames from his inventions exploding smolder.

Status: Secondary

Ten: Murder Island

Name: Nathan Clarke (Year: I died in seventh) (House: Slytherin) Blood Status: (Verse dependent) Poltergeist (Half-blood) Eye colour: Blue Age: 17 Birthdate: 8/13 Height: 6′2 (Patronus: Some squiggly thing I dunno)

Description: Hi I’m Nathan & I wanna die… Haha gottem!

Status: Secondary

Mythology

Name: Loki Freyjason (Year: Graduated) (House: Slytherin) Blood Status: God of Mischief & Chaos Eye colour: Green Age: Don’t be rude. Birthdate: Mind your business Height: 6′0 (Patronus: Corn snake) Description: I am Loki of Asgard. & I’m so fucking tired of all the gards. Note: Loki has mixed slight MCU influences where I feel like along with whatever asinine original headcanons I come up with.

Status: Primary

The Boy

Name: Brahms Hillshire (Year: Sixth) (House: Slytherin) Blood Status: Half-demon Eye colour: Green Age: 16 Birthdate: Don’t care Height: 5′11 (Patronus: None) Description: I’m a child serial killer. I want to play around in your innards. & blood. I want to play around in your blood too.

Status: Primary

Five Night’s At Freddy’s

Name: William Afton (Year: Graduated) (House: Slytherin) Blood Status: Unknown (Pureblood) Eye colour: Green Age: 41 Birthday: 7/10 Height: 6′3 (Patronus: None) Description: I will put him back together. No matter the cost. No matter to how deep the depths I’ll have to sink to turn out to be.

Status: Secondary

Suicide Notes

Name: Sadie O’Connell Blood Status: ??? Eye colour: Blue Age: 19 Birthdate: I don’t actually remember Height: 5′6 Description: I tried to kill myself over a boy who didn’t love me back. Someone brought me back & now here I am, I guess. 

Status: Primary

[terabitweb]

Original Post from FireEye Author: Michael Bailey

FireEye has observed the certificate most recently being served on the following IPs (Table 4):

IP

Hostname

Last Seen

104.193.252.151:443

vds2.system-host[.]net

2019-04-26T14:49:12

185.180.196.35:443

customer.clientshostname[.]com

2019-04-24T07:44:30

213.227.155.8:443

  2019-04-24T04:33:52

94.156.133.69:443

  2018-11-15T10:27:07

185.174.172.241:443

vds9992.hyperhost[.]name

2019-04-27T13:24:36

109.230.199.227:443

  2019-04-27T13:24:36

Table 4: Recent Test Company certificate use

While these IPs have not been observed in any CARBANAK activity, this may be an indication of a common developer or a shared toolkit used for testing various malware. Several of these IPs have been observed hosting Cobalt Strike BEACON payloads and METERPRETER listeners. Virtual Private Server (VPS) IPs may change hands frequently and additional malicious activity hosted on these IPs, even in close time proximity, may not be associated with the same users.

I also parsed an unprotected private key from the source code dump. Figure 4 and Table 5 show the private key parameters at a glance and in detail, respectively.

Figure 4: Parsed 512-bit private key

Field

Value

bType

7

bVersion

2

aiKeyAlg

0xA400 (CALG_RSA_KEYX) – RSA public key exchange algorithm

Magic

RSA2

Bitlen

512

PubExp

65537

Modulus

0B CA 8A 13 FD 91 E4 72 80 F9 5F EE 38 BC 2E ED

20 5D 54 03 02 AE D6 90 4B 6A 6F AE 7E 06 3E 8C

EA A8 15 46 9F 3E 14 20 86 43 6F 87 BF AE 47 C8

57 F5 1F D0 B7 27 42 0E D1 51 37 65 16 E4 93 CB

P

8B 01 8F 7D 1D A2 34 AE CA B6 22 EE 41 4A B9 2C

E0 05 FA D0 35 B2 BF 9C E6 7C 6E 65 AC AE 17 EA

Q

81 69 AB 3D D7 01 55 7A F8 EE 3C A2 78 A5 1E B1

9A 3B 83 EC 2F F1 F7 13 D8 1A B3 DE DF 24 A1 DE

Dp

B5 C7 AE 0F 46 E9 02 FB 4E A2 A5 36 7F 2E ED A4

9E 2B 0E 57 F3 DB 11 66 13 5E 01 94 13 34 10 CB

Dq

81 AC 0D 20 14 E9 5C BF 4B 08 54 D3 74 C4 57 EA

C3 9D 66 C9 2E 0A 19 EA C1 A3 78 30 44 52 B2 9F

Iq

C2 D2 55 32 5E 7D 66 4C 8B 7F 02 82 0B 35 45 18

24 76 09 2B 56 71 C6 63 C4 C5 87 AD ED 51 DA 2ª

D

01 6A F3 FA 6A F7 34 83 75 C6 94 EB 77 F1 C7 BB

7C 68 28 70 4D FB 6A 67 03 AE E2 D8 8B E9 E8 E0

2A 0F FB 39 13 BD 1B 46 6A D9 98 EA A6 3E 63 A8

2F A3 BD B3 E5 D6 85 98 4D 1C 06 2A AD 76 07 49

Table 5: Private key parameters

I found a value named PUBLIC_KEY defined in a configuration header, with comments indicating it was for debugging purposes. The parsed values are shown in Table 6.

Field

Value

bType

6

bVersion

2

aiKeyAlg

0xA400 (CALG_RSA_KEYX) – RSA public key exchange algorithm

Magic

RSA1

Bitlen

512

PubExp

65537

Modulus

0B CA 8A 13 FD 91 E4 72 80 F9 5F EE 38 BC 2E ED

20 5D 54 03 02 AE D6 90 4B 6A 6F AE 7E 06 3E 8C

EA A8 15 46 9F 3E 14 20 86 43 6F 87 BF AE 47 C8

57 F5 1F D0 B7 27 42 0E D1 51 37 65 16 E4 93 CB

Table 6: Key parameters for PUBLIC_KEY defined in configuration header

Network Based Indicators

The source code and binaries contained multiple Network-Based Indicators (NBIs) having significant overlap with CARBANAK backdoor activity and FIN7 operations previously observed and documented by FireEye. Table 7 shows these indicators along with the associated FireEye public documentation. This includes the status of each NBI as it was encountered (active in source code, commented out, or compiled into a binary). Domain names are de-fanged to prevent accidental resolution or interaction by browsers, chat clients, etc.

NBI

Status

Threat Group Association

comixed[.]org

Commented out

Earlier CARBANAK activity

194.146.180[.]40

Commented out

Earlier CARBANAK activity

aaaabbbbccccc[.]org

Active

  stats10-google[.]com

Commented out

FIN7

192.168.0[.]100:700

Active

  80.84.49[.]50:443

Commented out

  52.11.125[.]44:443

Commented out

  85.25.84[.]223

Commented out

  qwqreererwere[.]com

Active

  akamai-technologies[.]org

Commented out

Earlier CARBANAK activity

192.168.0[.]100:700

Active

  37.1.212[.]100:700

Commented out

  188.138.98[.]105:710

Commented out

Earlier CARBANAK activity

hhklhlkhkjhjkjk[.]org

Compiled

  192.168.0[.]100:700

Compiled

  aaa.stage.4463714.news.meteonovosti[.]info

Compiled

DNS infrastructure overlap with later FIN7 associated POWERSOURCE activity

193.203.48[.]23:800

Active

Earlier CARBANAK activity

Table 7: NBIs and prevously observed activity

Four of these TCP endpoints (80.84.49[.]50:443, 52.11.125[.]44:443, 85.25.84[.]223, and 37.1.212[.]100:700) were new to me, although some have been documented elsewhere.

Conclusion

Our analysis of this source code dump confirmed it was CARBANAK and turned up a few new and interesting data points. We were able to notify vendors about disclosures that specifically targeted their security suites. The previously documented NBIs, Windows API function resolution, backdoor command hash values, usage of Windows cabinet file APIs, and other artifacts associated with CARBANAK all match, and as they say, if the shoe fits, wear it. Interestingly though, the project itself isn’t called CARBANAK or even Anunak as the information security community has come to call it based on the string artifacts found within the malware. The authors mainly refer to the malware as “bot” in the Visual Studio project, filenames, source code comments, output binaries, user interfaces, and manuals.

The breadth and depth of this analysis was a departure from the usual requests we receive on the FLARE team. The journey included learning some Russian, searching through a hundred thousand of lines of code for new information, and analyzing a few dozen binaries. In the end, I’m thankful I had the opportunity to take this request.

In the next post, Tom Bennett takes the reins to provide a retrospective on his and Barry Vengerik’s previous analysis in light of the source code. Part Four of CARBANAK Week is available as well.

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Michael Bailey CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis Original Post from FireEye Author: Michael Bailey FireEye has observed the certificate most recently being served on the following IPs (Table 4):