BushidoUK’s gists

BushidoUK / RedZeiUpdate1H2023.txt

Created July 11, 2023 10:15

RedZei Number 1H 2023

	Number MNO Voice Mail Theme
	+44 24 7522 9208 IP Voice Networks Ltd Unknown (Chinese)
	+44 7404 008579 Lycamobile UK Limited Visa Information
	+44 7424 407427 Lycamobile UK Limited Visa Information
	+44 7405 901628 Lycamobile UK Limited Visa Information
	+44 7496 139575 EE Limited ( TM) Unknown (Chinese)
	+44 7526 013110 Telefonica UK Limited Chinese Embassy
	+44 7526 057134 Telefonica UK Limited Chinese Embassy
	+44 20 8072 0091 TAP GATEWAY LTD Unknown (Chinese)
	+44 7478 993982 Hutchison 3G UK Ltd Unknown (Chinese)

BushidoUK / BYOVA Collection.txt

Created June 17, 2023 17:24

Collection of Vulnerable Legit Applications used for DLL side-loading or search-order hijacking

	Valid signed file by Symantec, Symantec Antivirus Installer
	61d1943f0b702f4c16bb37228ade1d8f0ef4675b480921950d026c82e4a65fde

	Valid signed file by Venta Association, VentaFax MAPI client
	390d75e6c7fc1cf258145dc712c1fac1eb183efccee1b03c058cec1d790e46b1

	Valid signed file by Vivaldi Technologies, Vivaldi.exe
	58e7af5eb1acb5c9bee821d59054c69263aed3dce1b95616255dea7114ad8494

	Valid signed file by Invincea, Inc. Sandboxie

BushidoUK / Malicious Hostnames.txt

Created June 14, 2023 21:19

Malicious Hostnames belonging to Malware Operators, Ransomware Groups, and Advanced Persistence Threats

BushidoUK / RaspberryRobin_C2Domains.yara

Created May 3, 2023 00:51

	import "vt"
	rule RaspberryRobin_C2Domains{
	meta:
	description = "Checks for Files with RaspberryRobin C2 domains"
	author = "Will Thomas (@BushidoToken), Equinix Threat Analysis Center (ETAC)"
	date = "2023-APRIL-14"
	tlp = "CLEAR"
	adversary = "DEV-0856"

	strings:

BushidoUK / Ransomware Victims on Shodan

Created March 27, 2023 23:12

	Loki
	https://www.shodan.io/search?query=%22Loki+Locker%22

	BlackBit
	https://www.shodan.io/search?query=%22Encrypted+by+BlackBit%22

	BlackHunt
	https://www.shodan.io/search?query=%22Your+Network+Infected+with+BlackHunt+Ransomware+Team%22

	Amelia, Proxima

BushidoUK / Royal_Ransomware_hashes_Dec_2022

Created January 2, 2023 17:50

	1.exe \| Netherlands \| First seen : 2022-12-23
	de025f921dd477c127fba971b9f90accfb58b117274ba1afb1aaf2222823b6ac

	qut.dll \| Australia \| First seen : 2022-12-23
	8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648

	gdr.exe \| Argentina \| First seen : 2022-12-21
	bc06587b96b2628480d47579bcc2519a9da2b55aa037a49af4cd03811c534f66

	windows_encryptor.exe \| Hong Kong \| First seen : 2022-12-18

BushidoUK / CN_Scammer_Numbers.txt

Last active May 14, 2024 14:32

Chinese scammers targeting Chinese students in the UK

BushidoUK / Tracking web defacements.txt

Created November 26, 2022 13:35

Using Shodan and URLscan to track web defacements

BushidoUK / Message from CL0P Leaks

Created August 15, 2022 19:31

A UK Water Utility was apparently hit by the CL0P group, this was the message on their .onion Tor site

	Website:
	www.thameswater.co.uk
	Revenue:
	$2 billion

	Thames Water supply much of critical water services to people and companies.
	This company is public and this mean not only they bring water and sewage services to millions of people they also allow many people and company to invest with their stock offering.
	Companies like this have much responsibility and we contact them and tell them that they have very bad holes in their systems. ALL SYSTEMS.

	We spent months in the company system and saw first hand evidence of very bad practice.

BushidoUK / AutoUpdate JS

Created August 9, 2022 09:45

SocGholish JavaScript Fake Browser Update

	1.exe \| Netherlands \| First seen : 2022-12-23
	de025f921dd477c127fba971b9f90accfb58b117274ba1afb1aaf2222823b6ac

	qut.dll \| Australia \| First seen : 2022-12-23
	8e01ecf9d804454f34eeceb0f7793f4884be8868886a646526419fc2e2bbb648

	gdr.exe \| Argentina \| First seen : 2022-12-21
	bc06587b96b2628480d47579bcc2519a9da2b55aa037a49af4cd03811c534f66

	windows_encryptor.exe \| Hong Kong \| First seen : 2022-12-18

BushidoToken BushidoUK