Advertising

SponsoredTweets referral badge

APT Calypso RAT, Flying Dutchman Samples




Attackers exploit Windows SMB vulnerability CVE-2017-0143 or use stolen credentials to gain access, deploy the custom Calypso RAT and use it to upload other tools such as Mimikatz, EternalBlue and EternalRomance. They move laterally and steal data.

Links updated: Jan 19, 2023

Download

             Other malware




Hashes




MD5SHA256SHA1FilenameFile TyeeStage
aa1cf5791a60d56f7ae6da9bb1e7f01ed5afa3bfd423ba060207ad025467feaa56ac53d13616ac8782a7f63c9fc0fdb4bdd8b9115d1ae536d0ea1e62052485e5ad10761fMPSSVC.dllpe dllCalypso RAT Payload
1e765fed294a7ad082169819c95d2c85f6a09372156a8aef96576627a1ed9e57f194b008bb77e32ca29ac89505f933f060dda7ccd9ae00701046923b619a1b9c33c8e2acWscntfy.exepe exeCalypso RAT Dropper
17e05041730dcd0732e5b296db16d757b6c21c26aef75ad709f6c9cfa84bfa15b7ee709588382ce4bc3544a04bceb661f3301405d8ad5b160747241d6b2a8d88bf6292e8pe exeCalypso RAT Dropper
1ed72c14c4aab3b66e830e16ef90b37beebff21def49af4e85c26523af2ad659125a07a09db50ac06bd3746483c89f9ddc0d0a34f107d140d9e47582e17a7fec945403eacoal.exepe exeCalypso RAT Dropper
e24a62d9826869bc4817366800a8805cc407c3dde18c9b56ed24492ca257d77a570616074356b8c7854a080823f7ee1753791c9e7c41931a6becb999fee4eb7daf9b1a11data01.binpe dllCalypso RAT Dropper
c9c39045fa14e94618dd631044053824ab39301d45045172ad41c9a89210fdc6f0d3f9dccb567fd733b0dbffbfcfbcc31cda28bc307c09508dbb1f3495a967bbcc29326epe exeCalypso RAT Dropper
69322703b8ef9d490a20033684c28493e6a3b43acdaa824f3280095b10798ea341839f7d43f0460df8989f13c98fa6e0f203680d97705d99f92fe9797691be6177f5fd41RasCon.dllpe dllCalypso RAT Dropper
85ce60b365edf4beebbdd85cc971e84d5dfdee5dd680948d19ab4d16df534cf10aca5fa0b157c59659d6517fe897c62fd9c14f7b6de8e26ae33e41a72ae8e35bb1af4434pe exeCalypso RAT Dropper
6347e42f49a86aff2dea7c8bf455a52a281583aca23f8fd8745dd88a600cbfc578d819859a13957ec022b86c3c1c99f48b2a81af85590e0e36efc1c05aa4f0600ea21545HIDMgr.dllpe dllCalypso RAT Dropper
cb914fc73c67b325f948dd1bf97f57330031c7b63c1e1cd36d55f585d97e2b21a13a19858d5a1aa5455e5cc64b41e6e937ce4d0a3168e3b2f80b3fae38082e68a454aee0pe exeCalypso RAT Dropper
c84df4b2cd0d3e7729210f15112da7ac4e8351ddaff18f7df6fcc27a3c75598e0c56d3b406818d45effb4e78616092c241a0c5a1aad36f405c8755613c732591e3300f97mscorsvw.dllpe dllCalypso RAT Dropper
5199ef9d086c97732d97eddef56591ec511683c8ee62478c2b45be1f782ce678bbe03c4349a1778651414803010b3ee9d19a786adc09dff84642f2c2e0386193fa2a914bdnscache.dllpe dllFlyingDutchman
06c1d7bf234ce99bb14639c194b3b318a9a82099aa812d0c4025bee2b34f3b34c1d102773e36f1d50648815913dbe03d464ab9e11d371bf24de46c98c295d4afe7e957c1fromResource.exepedllFlyingDutchman
617d588eccd942f243ffa8cb13679d9c0664b09a86ec2df7dfe01a93e184a1fa23df66ea82cab39000944e418ec1f7b21b043fdcb582ed13cbf7dabcef6527762b5be93cpe dllHussar
2807236c2d905a0675878e530ed8b1f8314e438198f8cc2ee393c75f8e9f2ebd2b5133fd6f2b7deb1178f82782fc63302f6fe857632a67e87f4f3631bfa93713ccdf168aAeLookupMgr.dllpe dllCalypso RAT Payload
cce8c8ee42feaed68e9623185c3f7fe438cc404437b936660066b71cc87a28af1995248d6d4c471706eb1dd347129b4b9d2235c911b86bb6ad55d953a2f56ea78c5478e5AppCert.dll.crtCalypso RAT Payload
e1a578a069b1910a25c95e2d9450c710413622ded5d344a5a78de4fea22cfdabdeb4cdccf69e9a1f58f668096c32473836087a5b0809dc3f9dc5a77355a88e99af491a88RasCfgMan.dll.crtCalypso RAT Payload
0d532484193b8b098d7eb14319cefcd3f8043d6bfc3e63d8561f7f74e65cb7ff1731577ecf6c7559795d9de21298f0fc31f4c6dc6ce78b4e0439b30c830dfd5d9a3fc4feRasCfgMan.dllpe dllCalypso RAT Payload
974298eb7e2adfa019cae4d1a927ab070461710e681fd6dc9f1c83b57f94a88cd6df9e6432174cbfdd70dfd24577a0f841bc37679ce3caeecc176d10b4f8259918e25807VirtualUMP.dll.crtCalypso RAT Payload
05f472a9d926f4c8a0a372e1a71939988017923cd8169bf951106f053408b425f1eb310a9421685638ead55bb3823db38d909bd3450ebe0cffd0cb17b91bc28d23ef5083EFSProvider.dll.crtCalypso RAT Payload
d1a1166bec950c75b65fdc7361dcdc63f3f38c097b0cc5337b7d2dbec098bf6d0a3bb4a3e0336e7b1c8af75268a0a49d5731350f68a74fb4762c4ea878ecff635588a825RasCon.dllpe dll 64bits assemblyCalypso RAT Payload
e3e61f30f8a39cd7aa25149d0f8af5efc4dc7519bccc24c53794bf9178e4a4d0823875c34479d01cedbb3e9b10f5c7301b75ea494c3ac171c5177bdcc263b89a3f24f207MPSSVC.dllpe dllCalypso RAT Payload
More info

Learning Binary Ninja For Reverse Engineering And Scripting

 Recently added a new playlist with about 1.5 hours of Binary Ninja Content so far..   

Video 1: I put this out a couple months ago covering use cases and reversing flows as well as some basic scripting.. 


Videos 2+3 in the playlist start getting specifically into scripting for reversing automation.. Enjoy.. 


@Ficti0n on twitter..   


Video 1 UI Workflows and Scripting:



Video 2: Scripting Part1 


Video 3: Scripting Part 2



Related news


  1. Pentest Tools Kali Linux
  2. Hacker Tools Mac
  3. Hacking Tools For Windows
  4. Growth Hacker Tools
  5. Ethical Hacker Tools
  6. Pentest Tools Open Source
  7. Pentest Tools
  8. Hack And Tools
  9. Hacker Tools Software
  10. Top Pentest Tools
  11. Hacking Tools Windows 10
  12. Hack Rom Tools
  13. How To Install Pentest Tools In Ubuntu
  14. Hacking Tools For Windows 7
  15. Best Hacking Tools 2020
  16. Pentest Recon Tools
  17. Hack Tools Mac
  18. Pentest Reporting Tools
  19. Hack Tools
  20. Top Pentest Tools
  21. Android Hack Tools Github
  22. Hack Tools Pc
  23. Game Hacking
  24. Hacker
  25. Hack Tools For Pc
  26. Pentest Tools For Mac
  27. Pentest Tools Find Subdomains
  28. Pentest Recon Tools
  29. Hack Tools
  30. Pentest Tools For Mac
  31. Pentest Tools Bluekeep
  32. Hack Tools For Ubuntu
  33. Hacking Tools For Windows 7
  34. Hacking Tools Online
  35. Pentest Tools For Mac
  36. Hak5 Tools
  37. Android Hack Tools Github
  38. Pentest Tools Apk
  39. Pentest Tools Download
  40. Pentest Tools
  41. Pentest Tools List
  42. Hacking Tools
  43. Hack And Tools
  44. Blackhat Hacker Tools
  45. Wifi Hacker Tools For Windows
  46. Game Hacking
  47. Hack And Tools
  48. Hacking Tools 2019
  49. Hacking Tools For Mac
  50. Pentest Tools For Android
  51. Hacking Tools Mac
  52. Hacking Tools For Windows
  53. What Are Hacking Tools
  54. Hacking Tools For Games
  55. Hack Tool Apk No Root
  56. Pentest Tools Kali Linux
  57. Hacker Tools For Ios
  58. Pentest Tools Website Vulnerability
  59. Hacking Tools Windows
  60. Usb Pentest Tools
  61. Hacker Hardware Tools
  62. Hacker Techniques Tools And Incident Handling
  63. Hacker Tools Linux
  64. Tools 4 Hack
  65. Pentest Tools Download
  66. Hack Apps
  67. Pentest Tools Download
  68. Hacking Tools Software
  69. Pentest Tools Windows
  70. Top Pentest Tools
  71. Hack Tools
  72. Ethical Hacker Tools
  73. Kik Hack Tools
  74. Beginner Hacker Tools
  75. Hacking Tools For Pc
  76. Pentest Recon Tools
  77. Pentest Tools Bluekeep
  78. How To Install Pentest Tools In Ubuntu
  79. Hack App
  80. Hacking Tools For Beginners
  81. Hacker Tool Kit
  82. Best Hacking Tools 2019
  83. Hacker Tools For Ios
  84. Hacking Tools For Games
  85. Hacking Tools For Beginners
  86. Hacking Tools Download
  87. Github Hacking Tools
  88. Hack Tools Download
  89. Hacking Tools
  90. Hacking Tools Github
  91. Pentest Tools Windows
  92. Hacker Security Tools
  93. Hacking Tools For Windows 7
  94. New Hack Tools
  95. Easy Hack Tools
  96. Hackrf Tools
  97. Growth Hacker Tools
  98. Pentest Tools Kali Linux
  99. Ethical Hacker Tools
  100. Hacker Tools Online
  101. Hacking Tools Online
  102. Hacking Tools For Windows Free Download

Linux Stack Protection By Default

Modern gcc compiler (v9.2.0) protects the stack by default and you will notice it because instead of SIGSEGV on stack overflow you will get a SIGABRT, but it also generates coredumps.




In this case the compiler adds the variable local_10. This variable helds a canary value that is checked at the end of the function.
The memset overflows the four bytes stack variable and modifies the canary value.



The 64bits canary 0x5429851ebaf95800 can't be predicted, but in specific situations is not re-generated and can be bruteforced or in other situations can be leaked from memory for example using a format string vulnerability or an arbitrary read wihout overflowing the stack.

If the canary doesn't match, the libc function __stack_chck_fail is called and terminates the prorgam with a SIGABORT which generates a coredump, in the case of archlinux managed by systemd and are stored on "/var/lib/systemd/coredump/"


❯❯❯ ./test 
*** stack smashing detected ***: terminated
fish: './test' terminated by signal SIGABRT (Abort)

❯❯❯ sudo lz4 -d core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000.lz4
[sudo] password for xxxx: 
Decoding file core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 
core.test.1000.c611b : decoded 249856 bytes 

 ❯❯❯ sudo gdb /home/xxxx/test core.test.1000.c611b7caa58a4fa3bcf403e6eac95bb0.1121.1574354610000000 -q 


We specify the binary and the core file as a gdb parameters. We can see only one LWP (light weight process) or linux thread, so in this case is quicker to check. First of all lets see the back trace, because in this case the execution don't terminate in the segfaulted return.




We can see on frame 5 the address were it would had returned to main if it wouldn't aborted.



Happy Idea: we can use this stack canary aborts to detect stack overflows. In Debian with prevous versions it will be exploitable depending on the compilation flags used.
And note that the canary is located as the last variable in the stack so the previous variables can be overwritten without problems.




Related links

  1. Hack Tool Apk
  2. Pentest Tools Online
  3. Hackers Toolbox
  4. Pentest Tools Website
  5. Termux Hacking Tools 2019
  6. Blackhat Hacker Tools
  7. Pentest Tools Tcp Port Scanner
  8. Hacking Tools Hardware
  9. Nsa Hacker Tools
  10. Pentest Tools Website
  11. Kik Hack Tools
  12. Hacking Tools And Software
  13. Termux Hacking Tools 2019
  14. Pentest Tools Tcp Port Scanner
  15. Hacking Tools Windows 10
  16. Hacking Tools Github
  17. Pentest Tools Bluekeep
  18. Hacker Tools Hardware
  19. Beginner Hacker Tools
  20. Pentest Recon Tools
  21. Hacking Apps
  22. Hack Apps
  23. Hacking Tools Online
  24. Hacking Tools For Pc
  25. Black Hat Hacker Tools
  26. Physical Pentest Tools
  27. Nsa Hack Tools
  28. Hacking Tools 2019
  29. Hacking Tools Windows
  30. Hacking Tools 2020
  31. How To Hack
  32. Hacking Tools For Kali Linux
  33. Hacking Tools Github
  34. Hacker Tools Mac
  35. Hacking Apps
  36. Hacker Tools Free
  37. Hacker Tools List
  38. World No 1 Hacker Software
  39. Hackrf Tools
  40. Pentest Tools Nmap
  41. Hacker Tools For Mac
  42. Hack Tools 2019
  43. Hacking Tools Usb
  44. Best Pentesting Tools 2018
  45. Hacking Tools And Software
  46. Hacker Tools For Windows
  47. Pentest Tools Github
  48. Hacker Tools Mac
  49. Hacking Tools Mac
  50. Underground Hacker Sites
  51. Hack Tools For Pc
  52. How To Make Hacking Tools
  53. Hacking Tools For Games
  54. Hacking Tools Software
  55. Hacking Tools For Pc
  56. Hacker Security Tools
  57. Top Pentest Tools
  58. Pentest Tools
  59. Pentest Tools
  60. Hack Website Online Tool
  61. Pentest Tools Online
  62. Free Pentest Tools For Windows
  63. Github Hacking Tools
  64. Hacking Tools For Mac
  65. Tools Used For Hacking
  66. Pentest Tools For Windows
  67. Pentest Recon Tools
  68. Pentest Tools Online
  69. Hacker Tools
  70. Hacker Hardware Tools
  71. Hack Tools For Mac
  72. Hacker Tools For Windows
  73. Hack Tools Download
  74. Hack Tools Download
  75. Hack Tools Download
  76. Hacking Tools For Windows Free Download
  77. Hacking Tools Kit
  78. Hacker
  79. Hacking Tools For Kali Linux
  80. Pentest Tools Online
  81. Hack Tools For Mac
  82. Hacker Tools Free Download
  83. Hack Tools For Ubuntu
  84. What Are Hacking Tools
  85. Underground Hacker Sites
  86. Hacker Search Tools
  87. Hacking Tools For Kali Linux
  88. Hacking Tools
  89. Hacking Tools For Kali Linux
  90. Best Pentesting Tools 2018
  91. Pentest Recon Tools
  92. Hacker Tools Linux
  93. Hacking Tools Windows 10
  94. Hacking Tools Pc
  95. Hacker Tools Linux
  96. Hacker Tools Apk
  97. Hacking Tools For Kali Linux
  98. Best Hacking Tools 2019
  99. Best Hacking Tools 2019
  100. Hacking Tools Mac
  101. Pentest Tools For Android
  102. Hackrf Tools
  103. Hacking Tools Pc
  104. Pentest Tools Kali Linux
  105. Hacker Tool Kit
  106. Top Pentest Tools
  107. Hak5 Tools
  108. Pentest Tools Open Source
  109. Hacking Tools For Kali Linux
  110. Hacker Tools
  111. Hacker Security Tools
  112. Hacking Tools Name
  113. Pentest Tools Find Subdomains
  114. Hack Tools Github
  115. Hacking Tools For Games
  116. What Is Hacking Tools
  117. Hack Tool Apk
  118. Hacking Tools Name
  119. Bluetooth Hacking Tools Kali
  120. Hacking Tools Free Download
  121. Hacker Tools Free Download
  122. Hackrf Tools
  123. Hacker Tools Free
  124. Pentest Box Tools Download
  125. Pentest Reporting Tools
  126. Pentest Tools For Android
  127. Pentest Tools Bluekeep
  128. Hacker Tools For Pc
  129. Hacker Tools List
  130. Hacking Tools Name
  131. Hacker Tools For Ios
  132. Hack Rom Tools

Aircrack-ng: The Next Generation Of Aircrack


"Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, as well as the all-new PTW attack, thus making the attack much faster compared to other WEP cracking tools. In fact, Aircrack-ng is a set of tools for auditing wireless networks." read more...

Website: http://www.aircrack-ng.org

Related links
  1. Top Pentest Tools
  2. Hacker Tools For Mac
  3. Hacking Tools For Pc
  4. Hacking Tools For Windows Free Download
  5. Nsa Hack Tools Download
  6. New Hacker Tools
  7. Pentest Reporting Tools
  8. Hack Tool Apk No Root
  9. Pentest Tools Apk
  10. Hacking Tools Kit
  11. Hack Tools 2019
  12. Usb Pentest Tools
  13. Hackrf Tools
  14. Hacking Tools For Beginners
  15. Hack Tools Download
  16. Hack Tools
  17. Pentest Tools Website
  18. Pentest Tools Subdomain
  19. Hack Tools
  20. Pentest Tools Subdomain
  21. Pentest Tools Open Source
  22. Hack And Tools
  23. Usb Pentest Tools
  24. Hacker Hardware Tools
  25. Kik Hack Tools
  26. Hack Tools Mac
  27. Hacker Tools Linux
  28. Hacker Tools For Ios
  29. Pentest Recon Tools
  30. New Hacker Tools
  31. Hak5 Tools
  32. Hacker Tool Kit
  33. Hack Tool Apk No Root
  34. Growth Hacker Tools
  35. Pentest Tools Free
  36. Beginner Hacker Tools
  37. Hack Tools Online
  38. Pentest Tools Nmap
  39. Hack Tools Download
  40. New Hacker Tools
  41. How To Hack
  42. Nsa Hack Tools
  43. Pentest Tools Alternative
  44. Best Pentesting Tools 2018
  45. Best Hacking Tools 2020
  46. Usb Pentest Tools
  47. Hacking Tools Free Download
  48. How To Make Hacking Tools
  49. Hacker Hardware Tools
  50. Hacking Tools For Windows 7
  51. Hacker Tools Apk Download
  52. Pentest Tools Apk
  53. Pentest Tools
  54. Hack And Tools
  55. Pentest Tools For Ubuntu
  56. Growth Hacker Tools
  57. Hack Tools Pc
  58. Hacking Tools Free Download
  59. What Are Hacking Tools
  60. Hack Apps
  61. Bluetooth Hacking Tools Kali
  62. Hack Tools 2019
  63. Pentest Tools Website
  64. Hacker Tools
  65. Hacker Tools For Ios

Subscribe to: Posts (Atom)

Freelancer