Locked Cobian RAT v1.0.40.7

[J0k3rj0k3r]

This is the hidden content, please

• Sign In
• or
• Sign Up

 

Download [HIDE-THANKS]

This is the hidden content, please

• Sign In
• or
• Sign Up

[/HIDE-THANKS]

Pass

This is the hidden content, please

• Sign In
• or
• Sign Up

[damiano]

this RAT Good

[uzmaniz]

Thanks for share

[karmina]

:rolleyes::rolleyes:parece bueno,lo probare

[Kan3]

It is Backdoored check it >>

 

 

 

The client is connecting to pastebin.com at port 80 to import a file as bytes. Using Wireshark I was able to sniff the HTTP request.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

First request:

This is the hidden content, please

• Sign In
• or
• Sign Up

Second request:

This is the hidden content, please

• Sign In
• or
• Sign Up

 

The first one is junk file, but it's also editable as pastbin.com allow the user to modify his page without changing the URL.

the second request contains encrypted data

 

Before decrypt:

[Y2hlY2tmb3J1cGRhdGUuc3l0ZXMubmV0OjU2MzUxLG1pY3JvY2NpdC5kZG5zLm5ldDo1NjM1MSw=]

 

After decrypt:

[checkforupdate.sytes.net:56351,microccit.ddns.net:56351,]

 

After tracking the hosts, it appears to be an Indonesian hacker was behind all this backdooring. The last IP to establish a valid connection to microccit.ddns.net was 223.255.227.17

 

This method isn't new, let's see a similar code to understand how it's working.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

 

 

 

https://source4hacker.blogspot.ch/20...ackdoored.html

Edited March 21, 2018 by Kan3

[m3tal]

It is Backdoored check it >>

 

 

 

The client is connecting to pastebin.com at port 80 to import a file as bytes. Using Wireshark I was able to sniff the HTTP request.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

First request:

This is the hidden content, please

• Sign In
• or
• Sign Up

Second request:

This is the hidden content, please

• Sign In
• or
• Sign Up

 

The first one is junk file, but it's also editable as pastbin.com allow the user to modify his page without changing the URL.

the second request contains encrypted data

 

Before decrypt:

[Y2hlY2tmb3J1cGRhdGUuc3l0ZXMubmV0OjU2MzUxLG1pY3JvY2NpdC5kZG5zLm5ldDo1NjM1MSw=]

 

After decrypt:

[checkforupdate.sytes.net:56351,microccit.ddns.net:56351,]

 

After tracking the hosts, it appears to be an Indonesian hacker was behind all this backdooring. The last IP to establish a valid connection to microccit.ddns.net was 223.255.227.17

 

This method isn't new, let's see a similar code to understand how it's working.

 

 

This is the hidden content, please

• Sign In
• or
• Sign Up

 

 

 

 

https://source4hacker.blogspot.ch/20...ackdoored.html

 

Yeah, its true there is a backdoored.. but for solution you can just block pastebin.com or by firewall or by host file ;)

[Kan3]

On 3/21/2018 at 4:59 PM, m3tal said:

 

Yeah, its true there is a backdoored.. but for solution you can just block pastebin.com or by firewall or by host file ;)

Or use a Non backdoored  rat  -_-