#sm.txt

[shot-messenger]

there's something about relating to dogs and having a father who got dogs when you were young, only to get tired of them and let them run away. something about relating to dogs and your mother leaving them too, but blaming your father for abandoning them. giving you white lies about not being able to find them when she gave up too.

something about how i always found myself left in a hot car in the summer and thought it was love. do you think dogs thought it was love too?

[junkratsloverat]

updated cullen, if anybody wants him! 💕

[lbcybersecurity]

StorageCrypt ransomware, a coinminer and more

Lawrence over at Bleeping Computer posted an interesting blog yesterday: StorageCrypt Ransomware Infecting NAS Devices Using SambaCry

In that blog, Lawrence pointed out quite some users had issues with a new ransomware, dubbed StorageCrypt, and possibly spread via a worm.

There is a Windows component and a Linux component. We'll briefly take a look at both, hopefully providing some additional insight and indicators.

Windows artifacts

美女与野兽.exe is the Windows component, and as pointed out by Lawrence, translates loosely to 'Beauty and the Beast'.

This executable is packed with ASPack, and appears to to display worm-like and backdoor behaviour, with the additional 'feature' of spreading itself via removable drives. After unpacking the sample, it reveals some interesting strings:

1.vbpSMSS.EXEhttp://www.freewebs.com/kelly6666/sm.txthttp://www.freewebs.com/kelly6666/lo.txtDBST32NT.LOG.bak.exeV1.8Start Success.logyyyymmddmmssTxt Open ,Repair the application! is running, Repair the application from backup. is running, Repair the application from MySelf. running is running, update the application !Get V Data!Read Tname to memory.icoKill icoExtractIcons...Write to Tname...ip addr addedGetFolderFileDate...Replace all attrib.I m here!-->Insert Error : for .dll.dll  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonShellexplorer.exe UserinitHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunWindows9xPacksHKEY_CLASSES_ROOT\txtfile\shell\open\command NOTEPAD.EXE %1HKEY_HKEY_CLASSES_ROOTHKEY_CURRENT_USERHKEY_LOCAL_MACHINEHKEY_USERSHKEY_PERFORMANCE_DATAHKEY_CURRENT_CONFIGHKEY_DYN_DATAErrorC:\boot_net.datC:\dosnal.exeFind all exe file from Local host*.exeDownload files is accomplish!Run files of download is success![autorun]Download files1 is accomplish!Run files1 of download is success!This program cannot be run in DOS mode.This program must be run under Win32Autorun.infsuccess.txtcmd.exe /C net view command.exe /C net view  to find to Create file.exeopen=.exeGet Local host IP: Rnd IP:DiskC:\dntboot.binip packet too_bigip unload

Whatever was hosted at www.freewebs[.]com, cannot be retrieved as it no longer exists.

In any case, binaries similar as to this one, appear to have been floating the web for quite a while, as can be observed in this analysis result from 2013 by Team Cymru's TotalHash.

I've uploaded the unpacked sample on Hybrid Analysis.

Linux artifacts The Linux component appears to exist out of a Samba vulnerability, dubbed SambaCry, and assigned CVE-2017-7494 from earlier this year.

There are several components, which are listed in the table below.

Filename Hash Purpose kJn8LUAZ.so 6b5b4fce04f36101c04c0c5b3f7935ea Downloads ‘sambacry’ ZbdofxPY.so 053bb22c2cedf5aa5a089bfd2acd31f6 Downloads ‘sambacry’ sambacry ffe17e314f7b1306b8badec03c36ccb4 Fetch other payloads httpd1 a5e8cb2e7b84081f5b1f2867f2d26e81 Miner config minerd32 a016b34ade18626f91d14e46588d6483 Coinminer watchcat32 ac9ad6bc8cd8118eaeb204c2ebf95441 Watchdog

The 'sambacry' binary will, after one of the .so files has downloaded it, download a set of other files from the C2 server, which is 45.76.102[.]45.

These files are to support the coin mining and, alongside installed, is also what appears to be a watchdog, which monitors the miner process. Additionally, it runs the following in a loop:

while true do  

 ps -ef|grep -E "wget|curl"|grep -v $$|grep -v 45.76.102.45|awk '{print $2}'|xargs kill -9 

done

Whoever's behind this campaign is using the email address madhatterss@protonmail[.]com, as defined in the miner configuration:

{         "url" : "stratum+tcp://xmr.pool.minergate.com:45560",         "user" : "madhatterss@protonmail.com",         "pass" : "x",         "algo" : "cryptonight" }

While analysing both Windows and Linux artifacts, I have not observed any ransomware behaviour, so likely the latter is installed manually later on by the attacker.

If you run a Samba server, patch immediately, as this vulnerability has already been reported in April.

Indicators

The post StorageCrypt ransomware, a coinminer and more appeared first on Security Boulevard.

from StorageCrypt ransomware, a coinminer and more

[coldsunglasses]

Hi, this is my new blog and I will post my text post under the tag sm.txt! Enjoy your stay! :D

[shot-messenger]

hey, ppsst, people who owned this book at a kid- how are we doing?

[shot-messenger]

margaret atwood - dearly

[shot-messenger]

forget your zodiac sign- whats the alex dimitrov poem named after ur birth month

[shot-messenger]

AAAAAAAAAAAAAAAAAAAAAAAAAAAA

[shot-messenger]

reasons to keep going [written by a man having a mental breakdown at 5am]:

my cats wouldnt understand what happened to me

my roommate(s) would have to be the people to find me/identify the body

i would open old wounds for them

i would be abandoning them

im on a lease until september (dont do that to them)

i have so many unfinished projects. so much art living in my head

spite every person who probably wishes i was dead

the fact that i am alive to make it to where i am is a miracle within itself: dont squander that

just this once the time sunk fallacy is viable

my brain isnt done cooking yet (debatable point, it might never be fully cooked)

i dont want to become a statistic

i have accomplished so little besides surviving. i have so much i want to do

everything is temporary, even if not for the better things will atleast be different

i will be leaving colorado in september (with or without company)

there is no need to kill myself, time will do it for me. ill die anyways, just wait

my loved ones would blame themsleves

some will never forgive themselves

some will think about it for the rest of their lives (i think this is almost hopeful but i kinda have to be thats the point of this stupid exercise

im only allowed to die if a super nice car hits me going 100 miles an hour

[shot-messenger]

happy disability awareness month!!! my entire friend group dropped me because i took a break because i was burning out and ghosted me!!!

hows ur day going :D

[shot-messenger]

man

me when the insanity

[shot-messenger]

“you’re not alone.”

actually i am, which is part of the problem; we are all alone, trapped in these bodies and our own minds, and whatever company we have in this life is only fleeting and superficial...

all the bright places - jennifer niven

[shot-messenger]

were so good and cool and awesome and doing an awesome job and im not literally the dumbest person on the planet.

dw dw the things i have to say arent stupid and i am worth listening to and to be treated with respect

pat myself on the back, im doing the best can. im doing all i can its okay. literally any opinion anyone could possibly have about me and what im doing is fucking worthless

fuckin- self affirmation pilled- fucking self love maxing because someone has to let me feel secure being unapologetically me

[shot-messenger]

im tired of the chase. of things running from me no matter how badly i want them. i can sit and yearn and nothing will come of it and maybe thats better than something actually happening

maybe i just want things to stop happening altogether but they wont. just to me. everyone will keep moving without me and i will be stuck here

always making one step forward and five steps back

im tired of chasing, im tired of running, i am tired. i am broken and i am the only one around to pick up the pieces. i am the only one who is willing to bleed for me. i have no other choice

[shot-messenger]

very thoughtful recently

[shot-messenger]

how do i keep ending up in the same position over and over and over again