,
5 tweets,
4 min read
Read on Twitter
Mal devs themselves introduce some of the funniest & hi-fi (although short lived) detection opportunities. Amongst several applicable HTTP methodologies, we see "Content-Type:application/octect-stream." Don't manually type out your HPTP headers for your C2 protocolols. #dailypcap 
This network traffic comes from newish backdoor ExileRAT (compiled 2019-01-30T07:05:47Z) 606e943b93a2a450c971291e394745a6 that was hanging (with a multitude of other evil) on recently #opendir "http://27.126.188[.]212" There are ties to a humongous cluster of probs CN espionage.
The attackers from IP 27.126.188[.]212 are rollin' deep with kit. get_robin.py (1) looks to be some derivative of github.com/bhdresh python toolkit and also does some logging of connections. Sc.dat (2) is HTML that does JS get and creates a scheduled task for the exe.
This #dailypcap is brought to you in part by our friends at @TalosSecurity including, but not limited to: @SecurityBeard @r00tbsd and @jaesonschultz See
Don't forget to go PDB #threathunting for some of the applicable development paths.
D:\proj\proj.vs2015\scout\Release\scout.pdb
D:\proj\proj.vs2010\scoutdll\Release\scoutdll.pdb
D:\NetAccer\Release\NetAccer.pdb
#dailypdb
D:\proj\proj.vs2015\scout\Release\scout.pdb
D:\proj\proj.vs2010\scoutdll\Release\scoutdll.pdb
D:\NetAccer\Release\NetAccer.pdb
#dailypdb
