Latest accomplishment
Malware Researcher | Developer | @Cryptolaemus1 | @Proofpoint. Will happily talk about malware with anyone.
| https://twitter.com/Myrtus0x0 | |
| Github | https://github.com/myrtus0x0 |
| Team | https://infosec.exchange/web/@cryptolaemus |
Myrtus
- 823 Followers
- 153 Following
- 104 Posts
I'll give someone a whole dollar if they know what malware this is protocol is from
I created a visualization of how #emotet C2s are laid out for the E4 #botnet. Historically the entire set has been broken up into 3 clusters. One for the loader (the actual malware sample), the generic modules (the stealers and the system info modules), and finally the spam modules. The top left is the generic module cluster, the right is the loader and bottom left is spam. (Green nodes are the module IDs and red are the actual C2). There still seems to be 3 clusters but there are some minor differences⌠one of the stealer modules seems to still have localhost in it from testing, and before, a module in the cluster would connect to all the IPs in the cluster. This doesnât seems to be the case anymore. They look a bit âpatchyâ. So it seems like things were deployed a bit hastily if I were to guess? Maybe something forced their hand to deploy their botnet at this time?