Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- https://twitter.com/ps66uk/status/1058019904627073024
- #lokibot
- found by @ps66uk
- https://app.any.run/tasks/3fad920f-ae45-4d90-96b3-d1d7d4f4d5a1
- interesting in memory strings
- 0x4a0074 (53): https://publicspeaking.co.id/okoye/Panel/five/fre.php
- 0x569450 (106): C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
- x415414 (14): password_value
- 0x415424 (14): username_value
- 0x415434 (10): origin_url
- 0x415448 (68): %s\%s\User Data\Default\Login Data
- 0x415490 (64): %s\%s\User Data\Default\Web Data
- 0x4154d4 (30): %s%s\Login Data
- 0x4154f4 (46): %s%s\Default\Login Data
- 0x415524 (26): Comodo\Dragon
- 0x415540 (44): MapleStudio\ChromePlus
- 0x415570 (26): Google\Chrome
- 0x4155d4 (26): Titan Browser
- 0x4155fc (40): Yandex\YandexBrowser
- 0x415628 (40): Epic Privacy Browser
- 0x415654 (28): CocCoc\Browser
- 0x415684 (30): Comodo\Chromodo
- 0x4156b8 (26): Coowon\Coowon
- 0x4156d4 (30): Mustang Browser
- 0x4156f4 (36): 360Browser\Browser
- 0x41571c (40): CatalinaGroup\Citrio
- 0x415748 (34): Google\Chrome SxS
- 0x41578c (44): \Opera\Opera Next\data
- 0x4157bc (56): \Opera Software\Opera Stable
- 0x4157f8 (102): \Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer
- 0x415860 (104): \Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer
- 0x4158cc (24): vaultcli.dll
- 0x4158e8 (19): VaultEnumerateItems
- 0x4158fc (20): VaultEnumerateVaults
- 0x415920 (12): VaultGetItem
- 0x415930 (14): VaultOpenVault
- 0x415940 (15): VaultCloseVault
- 0x415950 (116): Software\Microsoft\Internet Explorer\IntelliForms\Storage2
- 0x4159f0 (92): Software\Microsoft\Internet Explorer\TypedURLs
- 0x415a58 (84): SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins
- 0x415acc (17): encryptedUsername
- 0x415ae0 (17): encryptedPassword
- 0x415af4 (28): %s\logins.json
- 0x415b14 (22): %s\prefs.js
- 0x415b2c (34): %s\signons.sqlite
- 0x415b50 (22): signons.txt
- 0x415b68 (24): signons2.txt
- 0x415b84 (24): signons3.txt
- 0x415ba0 (62): %s\Mozilla\Firefox\profiles.ini
- 0x415be0 (60): %s\Mozilla\Firefox\Profiles\%s
- 0x415c20 (66): %s\Mozilla\SeaMonkey\profiles.ini
- 0x415c68 (64): %s\Mozilla\SeaMonkey\Profiles\%s
- 0x415cac (58): %s\Flock\Browser\profiles.ini
- 0x415ce8 (56): %s\Flock\Browser\Profiles\%s
- 0x415d24 (54): %s\Thunderbird\profiles.ini
- 0x415d5c (52): %s\Thunderbird\Profiles\%s
- 0x415d94 (48): %s\K-Meleon\profiles.ini
- 0x415dc8 (28): %s\K-Meleon\%s
- 0x415de8 (64): %s\Comodo\IceDragon\profiles.ini
- 0x415e30 (62): %s\Comodo\IceDragon\Profiles\%s
- 0x415e70 (92): %s\NETGATE Technologies\BlackHawk\profiles.ini
- 0x415ed0 (90): %s\NETGATE Technologies\BlackHawk\Profiles\%s
- 0x415f2c (46): %s\Postbox\profiles.ini
- 0x415f5c (44): %s\Postbox\Profiles\%s
- 0x415f90 (74): %s\8pecxstudios\Cyberfox\profiles.ini
- 0x415fe0 (72): %s\8pecxstudios\Cyberfox\Profiles\%s
- 0x416030 (94): %s\Moonchild Productions\Pale Moon\profiles.ini
- 0x416090 (92): %s\Moonchild Productions\Pale Moon\Profiles\%s
- 0x4160f0 (50): %s\FossaMail\profiles.ini
- 0x416124 (48): %s\FossaMail\Profiles\%s
- 0x416158 (150): %s\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}\data
- 0x416234 (22): %s\nss3.dll
- 0x416258 (12): NSS_Shutdown
- 0x416268 (23): PK11_GetInternalKeySlot
- 0x416280 (13): PK11_FreeSlot
- 0x416290 (17): PK11_Authenticate
- 0x4162a4 (15): PK11SDR_Decrypt
- 0x4162b4 (22): PK11_CheckUserPassword
- 0x4162cc (16): SECITEM_FreeItem
- 0x4162e0 (22): sqlite3.dll
- 0x4162f8 (28): mozsqlite3.dll
- 0x41632c (16): sqlite3_finalize
- 0x416340 (12): sqlite3_step
- 0x416350 (13): sqlite3_close
- 0x416360 (19): sqlite3_column_text
- 0x416374 (14): sqlite3_open16
- 0x416384 (18): sqlite3_prepare_v2
- 0x416398 (15): sqlite3_prepare
- 0x4163a8 (28): CurrentVersion
- 0x4163c8 (64): SOFTWARE\Mozilla\Mozilla Firefox
- 0x416414 (20): %s\%s\Main
- 0x41642c (34): Install Directory
- 0x416468 (72): SOFTWARE\Mozilla\Mozilla Thunderbird
- 0x4164b4 (52): SOFTWARE\Mozilla\FossaMail
- 0x4164ec (48): SOFTWARE\Postbox\Postbox
- 0x416520 (44): SOFTWARE\Mozilla\Flock
- 0x416550 (40): SOFTWARE\Flock\Flock
- 0x416588 (28): %ProgramW6432%
- 0x4165a8 (42): %s\NETGATE\Black Hawk
- 0x4165d4 (52): SOFTWARE\Mozilla\Pale Moon
- 0x416610 (140): %s\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}
- 0x4166a0 (34): SOFTWARE\K-Meleon
- 0x4166d8 (72): SOFTWARE\ComodoGroup\IceDragon\Setup
- 0x416738 (64): SOFTWARE\8pecxstudios\Cyberfox86
- 0x41677c (60): SOFTWARE\8pecxstudios\Cyberfox
- 0x4167bc (60): SOFTWARE\mozilla.org\SeaMonkey
- 0x4167fc (38): %s\Mozilla\Profiles
- 0x41682c (52): SOFTWARE\Mozilla\SeaMonkey
- 0x416864 (50): SOFTWARE\Mozilla\Waterfox
- 0x4168b0 (22): firefox.exe
- 0x416a38 (108): Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete
- 0x416aa8 (84): %s\QupZilla\profiles\default\browsedata.db
- 0x416b2c (20): InstallDir
- 0x416b48 (72): SOFTWARE\Apple Computer, Inc.\Safari
- 0x416b98 (88): %s\Apple Computer\Preferences\keychain.plist
- 0x416bf8 (78): %s\Apple Application Support\plutil.exe
- 0x416c54 (54): -convert xml1 -s -o %s "%s"
- 0x416c8c (56): %s\Data\AccCfg\Accounts.tdat
- 0x416cc8 (20): %s\Storage
- 0x416ce0 (24): Account.rec0
- 0x416cfc (30): %s\Foxmail\mail
- 0x416d28 (26): %SYSTEMDRIVE%
- 0x416d58 (24): EmailAddress
- 0x416d74 (20): Technology
- 0x416db0 (20): PopAccount
- 0x416dc8 (22): PopPassword
- 0x416de0 (20): SmtpServer
- 0x416e0c (22): SmtpAccount
- 0x416e24 (24): SmtpPassword
- 0x416e40 (62): Software\IncrediMail\Identities
- 0x416ea4 (20): POP3Server
- 0x416edc (36): SMTP Email Address
- 0x416f04 (22): SMTP Server
- 0x416f1c (28): SMTP User Name
- 0x416f50 (22): POP3 Server
- 0x416f68 (28): POP3 User Name
- 0x416f9c (36): NNTP Email Address
- 0x416fc4 (28): NNTP User Name
- 0x416fe4 (22): NNTP Server
- 0x416ffc (22): IMAP Server
- 0x417014 (28): IMAP User Name
- 0x41705c (30): HTTP Server URL
- 0x41707c (36): HTTPMail User Name
- 0x4170a4 (30): HTTPMail Server
- 0x417100 (28): POP3 Password2
- 0x417120 (28): IMAP Password2
- 0x417140 (28): NNTP Password2
- 0x417160 (36): HTTPMail Password2
- 0x417188 (28): SMTP Password2
- 0x4171a8 (26): POP3 Password
- 0x4171c4 (26): IMAP Password
- 0x4171e0 (26): NNTP Password
- 0x4171fc (26): HTTP Password
- 0x417218 (26): SMTP Password
- 0x417238 (178): Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
- 0x4172f0 (110): Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
- 0x417360 (110): Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
- 0x4173d0 (30): %s\32BitFtp.TMP
- 0x4173f0 (30): %s\32BitFtp.ini
- 0x417410 (54): %s\Estsoft\ALFTP\ESTdb2.dat
- 0x417448 (22): %s\site.xml
- 0x417460 (46): %s\BitKinex\bitkinex.ds
- 0x4174ac (30): LastUsedProfile
- 0x4174cc (56): Software\Bitvise\BvSshClient
- 0x417508 (40): %s\BlazeFtp\site.dat
- 0x417538 (72): Software\FlashPeak\BlazeFtp\Settings
- 0x417584 (24): LastPassword
- 0x4175b4 (22): LastAddress
- 0x417618 (88): Software\NCH Software\ClassicFTP\FTPAccounts
- 0x417694 (24): %s\Cyberduck
- 0x4176b0 (22): user.config
- 0x4176c8 (30): %s\iterate_GmbH
- 0x4176e8 (30): %s\EasyFTP\data
- 0x417730 (26): %s\ExpanDrive
- 0x41774c (26): *favorites.js
- 0x4177a8 (60): Software\Far\Plugins\FTP\Hosts
- 0x4177e8 (62): Software\Far2\Plugins\FTP\Hosts
- 0x417828 (148): %s\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
- 0x4178c0 (52): %s\FileZilla\Filezilla.xml
- 0x4178f8 (52): %s\FileZilla\filezilla.xml
- 0x417930 (60): %s\FileZilla\recentservers.xml
- 0x417970 (56): %s\FileZilla\sitemanager.xml
- 0x4179ac (22): %s\FlashFXP
- 0x4179c4 (20): *Sites.dat
- 0x4179dc (20): *quick.dat
- 0x417a08 (22): FtpUserName
- 0x417a20 (22): FtpPassword
- 0x417a38 (24): _FtpPassword
- 0x417a58 (72): Software\NCH Software\Fling\Accounts
- 0x417aa8 (78): %s\FreshWebmaster\FreshFTP\FtpSites.SMF
- 0x417af8 (46): %s\FTPBox\profiles.conf
- 0x417b28 (64): %s\FTPGetter\Profile\servers.xml
- 0x417b6c (48): %s\FTPGetter\servers.xml
- 0x417ba0 (50): %s\FTPInfo\ServerList.xml
- 0x417bd4 (50): %s\FTPInfo\ServerList.cfg
- 0x417c08 (56): %s\FTP Navigator\Ftplist.txt
- 0x417c44 (40): %s\FTP Now\sites.xml
- 0x417c70 (48): %s\FTPShell\ftpshell.fsi
- 0x417ca8 (64): %s\.config\fullsync\profiles.xml
- 0x417cec (44): %s\DeluxeFTP\sites.xml
- 0x417d20 (66): %s\GoFTP\settings\Connections.txt
- 0x417d98 (36): %s\%s%i\encPwd.jsd
- 0x417dc0 (78): %s\%s%i\data\settings\sshProfiles-j.jsd
- 0x417e10 (78): %s\%s%i\data\settings\ftpProfiles-j.jsd
- 0x417e84 (60): Software\LinasFTP\Site Manager
- 0x417ec4 (52): %s\oZone3D\MyFTP\myftp.ini
- 0x417efc (46): %s\NetDrive\NDSites.ini
- 0x417f2c (46): %s\NetDrive2\drives.dat
- 0x417f60 (64): %s\Fastream NETFile\My FTP Links
- 0x417fa8 (66): %s\NexusFile\userdata\ftpsite.ini
- 0x417fec (48): %s\NexusFile\ftpsite.ini
- 0x418020 (64): %s\INSoftware\NovaFTP\NovaFTP.db
- 0x418068 (90): %s\Notepad++\plugins\config\NppFTP\NppFTP.xml
- 0x4180c8 (78): %s\Odin Secure FTP Expert\QFDefault.QFQ
- 0x418118 (76): %s\Odin Secure FTP Expert\SiteInfo.QFP
- 0x418168 (26): PublicKeyFile
- 0x418184 (24): TerminalType
- 0x4181a0 (20): PortNumber
- 0x4181b8 (64): Software\9bis.com\KiTTY\Sessions
- 0x418200 (70): Software\SimonTatham\PuTTY\Sessions
- 0x418264 (20): lsasrv.dll
- 0x41827c (22): LsaICryptUnprotectData
- 0x4182b0 (48): %s\Microsoft\Credentials
- 0x4182e4 (22): Config Path
- 0x4182fc (50): Software\VanDyke\SecureFX
- 0x418330 (22): %s\Sessions
- 0x418378 (30): %s\SftpNetDrive
- 0x4183a8 (84): %s\Sherrod Computers\sherrod FTP\favorites
- 0x418400 (52): #document.favoriteManager*
- 0x418438 (22): %s\SmartFTP
- 0x418460 (44): %s\Staff-FTP\sites.ini
- 0x418490 (44): %s\Steed\bookmarks.txt
- 0x4184c0 (26): %s\SuperPutty
- 0x418548 (20): {.:CRED:.}
- 0x418594 (24): %s\Syncovery
- 0x4185b0 (26): Syncovery.ini
- 0x4185cc (28): %s\wcx_ftp.ini
- 0x4185ec (44): %s\GHISLER\wcx_ftp.ini
- 0x41861c (20): FtpIniName
- 0x418638 (64): Software\Ghisler\Total Commander
- 0x41867c (42): %s\UltraFXP\sites.xml
- 0x4186a8 (60): %s\WinFtp Client\Favorites.dat
- 0x4186e8 (20): FSProtocol
- 0x418700 (46): Software\Martin Prikryl
- 0x418730 (40): %s\WS_FTP\WS_FTP.INI
- 0x41875c (26): %s\WS_FTP.INI
- 0x418778 (22): %s\Ipswitch
- 0x418790 (20): ws_ftp.ini
- 0x4187a8 (52): %s\NetSarang\Xftp\Sessions
- 0x4187f0 (33): MAC=%02X%02X%02XINSTALL=%08X%08Xk
- 0x418874 (24): %s\%s\%s.exe
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement