杂谈
今天的分享分为两部分
- 恶意IP/域名情报
- 你关心的趣事
恶意IP/域名情报
![图片[1]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807013303541.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
你关心的趣事
每日可供学习参考的钓鱼🎣样本
| 样本名称 | MD5 | 分析报告 |
|---|---|---|
| 三峡集团2022高温补贴.exe | 7757c460b8083378a6b4871b562b2e59 | https://s.threatbook.com/report/file/76f95c0b4b877fd35f167643a510753b6b0c82d6a1af2763c55034ad6d97fb41 |
| 涉疫轨迹检查表.xls 2.exe | 2d2e2831ae6351fbee7810bfc0d10955 | https://s.threatbook.com/report/file/ffeb7d694c82c2dfa5344d082b61386561202ccde69fc11257916b0da515c922 |
| 薪酬调整计划通知.rar | d5b2a91db72ad6cc0d5495b6452f6bf4 | https://s.threatbook.com/report/file/8ad012accbebae2332327e3e601c0411943cf361438e9a092cfcabcf71cb22c7 |
| Microsoft.Office.PolicyTips.exe | 4e1aae01098239a474edb7134a3e5094 | https://s.threatbook.com/report/file/79deafbe41fe822c424dfcb0aee9108ed90224ccf1fc546a4f617aaab900153e |
| debug.dll | 4c67339be7257db855a8beefd7167c3f | https://s.threatbook.com/report/file/3e95f8ad1ddef83c97dc72b00a7735f16089f9f4179e8352848e66ebde0852c4 |
师傅，有没有新的表情包可以用来水群？
![图片[2]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807015233966.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
hvv的时间15天，正好是两周😂
![图片[3]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807020239438.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
还有最后2天了😊
![图片[4]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025913795.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
微信溯源取证相关资料？
之前我们有详细分享过相关的文章
4个月前
2个月前这次分享一个更简单粗暴的
下载之后打开CMD
![图片[5]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022056931.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
将SharpWxDump.exe拖入CMD中，发现可以显示
- 微信进程ID
- 微信版本号
- 微信昵称
- 微信号
- 微信绑定的手机号
- 微信绑定邮箱（部分版本可能没有）
![图片[6]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022144308.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
还有热心网友反馈，可以将其用于cobaltstrike中
![图片[7]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022348167.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
通过远程执行脚本，可以获取到被控机器的相关资料
![图片[8]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022502115.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
这里需要强调的是微信版本的一些区别
- 版本 < 3.7.0.30 只运行不登录能获取个人信息，登录后可以获取数据库密钥
- 版本 > 3.7.0.30 只运行不登录不能获取个人信息，登录后都能获取
如何通过开源情报查询“戏精”佩洛西的资产？
最近人民日报分享了下面的视频《起底“戏精”佩洛西》
很多朋友都比较关心佩洛西的资产情况，我们之前给大家介绍过OSINT框架
其中关于公开财产可以通过下面的网址进行搜索
![图片[9]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807024005183-1024x789.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
![图片[10]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025134278.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
点击右侧Assets（财产）
![图片[11]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025330841-1024x587.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
这里可以看到从2008年到2018年的全部资产表格，可以按需修改年份查看对应每一年的财产详情
![图片[12]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025416880.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
下面是最近的2018年财产情况，由于我不是经济学专业的，这里就不献丑了，感兴趣的可以自行分析
| Organization | Industry | Minimum Value | Maximum Value | Lobbies? | Contributed? |
|---|---|---|---|---|---|
| Apple Inc | Electronics Mfg/Eqp | $5,250,002 | $25,500,000 | YES | YES |
| Visa Inc | Finance/Credit | $5,000,001 | $25,000,000 | YES | YES |
| Thirteen Hundred One Sansome LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Russell Ranch LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Nine Forty Five Battery LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Auberge du Soleil Ltd | Lodging/Tourism | $5,000,001 | $25,000,000 | ||
| 45 Belden Place – Four Story Commercial Building | $5,000,001 | $25,000,000 | |||
| 25 Point Lobos – Commercial Property | $5,000,001 | $25,000,000 | |||
| 11 Zinfandel Lane – Home & Vineyard | $5,000,001 | $25,000,000 | |||
| Walt Disney Co | TV/Movies/Music | $1,000,001 | $5,000,000 | YES | YES |
| Salesforce.com | Internet | $1,000,001 | $5,000,000 | YES | YES |
| Piatti Restaurant Co | Food & Beverage | $1,000,001 | $5,000,000 | ||
| Forty-Five Belden Corp | Securities/Invest | $1,000,001 | $5,000,000 | ||
| Facebook Inc | Internet | $550,002 | $1,100,000 | YES | YES |
| Comcast Corp | Telecom Svcs | $500,001 | $1,000,000 | YES | YES |
| City Car Services | Misc Transport | $500,001 | $1,000,000 | ||
| Borel Real Estate | Real Estate | $500,001 | $1,000,000 | ||
| Amazon.com | Internet | $500,001 | $1,000,000 | YES | YES |
| Union Bank of California Money Market | Cash/Money Market/Savings/Checking | $250,001 | $500,000 | ||
| Stoneridge Group | $250,001 | $500,000 | |||
| Square Inc | Electronics Mfg/Eqp | $250,001 | $500,000 | YES | |
| Sierra Vista Baseline Investors LP | Real Estate | $250,001 | $500,000 | ||
| Mosher Partners LP | Real Estate | $250,001 | $500,000 | ||
| Morningstar Inc | Publishing | $250,001 | $500,000 | ||
| Interactive Brokers | Securities/Invest | $250,001 | $500,000 | ||
| EDI Assoc | Lodging/Tourism | $250,001 | $500,000 | ||
| AT&T Inc | Telephone Utilities | $250,001 | $500,000 | YES | YES |
| Financial Leasing Services | Finance/Credit | $100,001 | $250,000 | ||
| Dropbox Inc | Internet | $100,001 | $250,000 | YES | |
| Nautilus Leasing Services | Trucking | $50,001 | $100,000 | ||
| City National Bank – Checking Account | Cash/Money Market/Savings/Checking | $50,001 | $100,000 | ||
| Wells Fargo Bank/Checking | Commercial Banks | $15,001 | $50,000 | ||
| Trivium LLC | Electronics Mfg/Eqp | $15,001 | $50,000 | ||
| Odyssey LLC | Securities/Invest | $15,001 | $50,000 | ||
| Matthews International Mutual Fund | Mutual Fund | $15,001 | $50,000 | ||
| Global Ambassador Concierge | Business Services | $15,001 | $50,000 | ||
| Congressional Credit Union – Checking Account [BA] | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
| City National Securities | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
| Aristotle LLC | Business Services | $15,001 | $50,000 | ||
| Bank of America/Checking | Commercial Banks | $1,003 | $17,000 | ||
| Qualcomm Inc | Electronics Mfg/Eqp | $1,001 | $15,000 | YES | YES |
| Clean Energy Fuels Corp | Misc Energy | $1,001 | $15,000 | YES | |
| BF Enterprises | Lawyers/Law Firms | $1,001 | $15,000 | ||
| Union Bank of California/Pelosi Trust | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
| Union Bank of California/Checking | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
| Tripath Technology | Electronics Mfg/Eqp | $1 | $1,000 | ||
| SunEdison Inc | Misc Energy | $1 | $1,000 | ||
| Mojo Networks | $0 | $0 |
你还可以将其导出成csv格式，方便使用excel进一步分析
![图片[13]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025818402-1024x231.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
© 版权声明
THE END
- 最新
- 最热
只看作者