杂谈
今天的分享分为两部分
- 恶意IP/域名情报
- 你关心的趣事
恶意IP/域名情报
![图片[1]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807013303541.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
你关心的趣事
每日可供学习参考的钓鱼🎣样本
样本名称 | MD5 | 分析报告 |
---|---|---|
三峡集团2022高温补贴.exe | 7757c460b8083378a6b4871b562b2e59 | https://s.threatbook.com/report/file/76f95c0b4b877fd35f167643a510753b6b0c82d6a1af2763c55034ad6d97fb41 |
涉疫轨迹检查表.xls 2.exe | 2d2e2831ae6351fbee7810bfc0d10955 | https://s.threatbook.com/report/file/ffeb7d694c82c2dfa5344d082b61386561202ccde69fc11257916b0da515c922 |
薪酬调整计划通知.rar | d5b2a91db72ad6cc0d5495b6452f6bf4 | https://s.threatbook.com/report/file/8ad012accbebae2332327e3e601c0411943cf361438e9a092cfcabcf71cb22c7 |
Microsoft.Office.PolicyTips.exe | 4e1aae01098239a474edb7134a3e5094 | https://s.threatbook.com/report/file/79deafbe41fe822c424dfcb0aee9108ed90224ccf1fc546a4f617aaab900153e |
debug.dll | 4c67339be7257db855a8beefd7167c3f | https://s.threatbook.com/report/file/3e95f8ad1ddef83c97dc72b00a7735f16089f9f4179e8352848e66ebde0852c4 |
师傅,有没有新的表情包可以用来水群?
![图片[2]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807015233966.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
hvv的时间15天,正好是两周😂
![图片[3]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807020239438.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
还有最后2天了😊
![图片[4]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025913795.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
微信溯源取证相关资料?
之前我们有详细分享过相关的文章
这次分享一个更简单粗暴的
下载之后打开CMD
![图片[5]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022056931.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
将SharpWxDump.exe
拖入CMD中,发现可以显示
- 微信进程ID
- 微信版本号
- 微信昵称
- 微信号
- 微信绑定的手机号
- 微信绑定邮箱(部分版本可能没有)
![图片[6]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022144308.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
还有热心网友反馈,可以将其用于cobaltstrike中
![图片[7]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022348167.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
通过远程执行脚本,可以获取到被控机器的相关资料
![图片[8]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807022502115.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
这里需要强调的是微信版本的一些区别
- 版本 < 3.7.0.30 只运行不登录能获取个人信息,登录后可以获取数据库密钥
- 版本 > 3.7.0.30 只运行不登录不能获取个人信息,登录后都能获取
如何通过开源情报查询“戏精”佩洛西的资产?
最近人民日报分享了下面的视频《起底“戏精”佩洛西》
很多朋友都比较关心佩洛西的资产情况,我们之前给大家介绍过OSINT框架
其中关于公开财产可以通过下面的网址进行搜索
![图片[9]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807024005183-1024x789.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
![图片[10]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025134278.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
点击右侧Assets(财产)
![图片[11]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025330841-1024x587.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
这里可以看到从2008年到2018年的全部资产表格,可以按需修改年份查看对应每一年的财产详情
![图片[12]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025416880.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
下面是最近的2018年财产情况,由于我不是经济学专业的,这里就不献丑了,感兴趣的可以自行分析
Organization | Industry | Minimum Value | Maximum Value | Lobbies? | Contributed? |
---|---|---|---|---|---|
Apple Inc | Electronics Mfg/Eqp | $5,250,002 | $25,500,000 | YES | YES |
Visa Inc | Finance/Credit | $5,000,001 | $25,000,000 | YES | YES |
Thirteen Hundred One Sansome LLC | Real Estate | $5,000,001 | $25,000,000 | ||
Russell Ranch LLC | Real Estate | $5,000,001 | $25,000,000 | ||
Nine Forty Five Battery LLC | Real Estate | $5,000,001 | $25,000,000 | ||
Auberge du Soleil Ltd | Lodging/Tourism | $5,000,001 | $25,000,000 | ||
45 Belden Place – Four Story Commercial Building | $5,000,001 | $25,000,000 | |||
25 Point Lobos – Commercial Property | $5,000,001 | $25,000,000 | |||
11 Zinfandel Lane – Home & Vineyard | $5,000,001 | $25,000,000 | |||
Walt Disney Co | TV/Movies/Music | $1,000,001 | $5,000,000 | YES | YES |
Salesforce.com | Internet | $1,000,001 | $5,000,000 | YES | YES |
Piatti Restaurant Co | Food & Beverage | $1,000,001 | $5,000,000 | ||
Forty-Five Belden Corp | Securities/Invest | $1,000,001 | $5,000,000 | ||
Facebook Inc | Internet | $550,002 | $1,100,000 | YES | YES |
Comcast Corp | Telecom Svcs | $500,001 | $1,000,000 | YES | YES |
City Car Services | Misc Transport | $500,001 | $1,000,000 | ||
Borel Real Estate | Real Estate | $500,001 | $1,000,000 | ||
Amazon.com | Internet | $500,001 | $1,000,000 | YES | YES |
Union Bank of California Money Market | Cash/Money Market/Savings/Checking | $250,001 | $500,000 | ||
Stoneridge Group | $250,001 | $500,000 | |||
Square Inc | Electronics Mfg/Eqp | $250,001 | $500,000 | YES | |
Sierra Vista Baseline Investors LP | Real Estate | $250,001 | $500,000 | ||
Mosher Partners LP | Real Estate | $250,001 | $500,000 | ||
Morningstar Inc | Publishing | $250,001 | $500,000 | ||
Interactive Brokers | Securities/Invest | $250,001 | $500,000 | ||
EDI Assoc | Lodging/Tourism | $250,001 | $500,000 | ||
AT&T Inc | Telephone Utilities | $250,001 | $500,000 | YES | YES |
Financial Leasing Services | Finance/Credit | $100,001 | $250,000 | ||
Dropbox Inc | Internet | $100,001 | $250,000 | YES | |
Nautilus Leasing Services | Trucking | $50,001 | $100,000 | ||
City National Bank – Checking Account | Cash/Money Market/Savings/Checking | $50,001 | $100,000 | ||
Wells Fargo Bank/Checking | Commercial Banks | $15,001 | $50,000 | ||
Trivium LLC | Electronics Mfg/Eqp | $15,001 | $50,000 | ||
Odyssey LLC | Securities/Invest | $15,001 | $50,000 | ||
Matthews International Mutual Fund | Mutual Fund | $15,001 | $50,000 | ||
Global Ambassador Concierge | Business Services | $15,001 | $50,000 | ||
Congressional Credit Union – Checking Account [BA] | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
City National Securities | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
Aristotle LLC | Business Services | $15,001 | $50,000 | ||
Bank of America/Checking | Commercial Banks | $1,003 | $17,000 | ||
Qualcomm Inc | Electronics Mfg/Eqp | $1,001 | $15,000 | YES | YES |
Clean Energy Fuels Corp | Misc Energy | $1,001 | $15,000 | YES | |
BF Enterprises | Lawyers/Law Firms | $1,001 | $15,000 | ||
Union Bank of California/Pelosi Trust | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
Union Bank of California/Checking | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
Tripath Technology | Electronics Mfg/Eqp | $1 | $1,000 | ||
SunEdison Inc | Misc Energy | $1 | $1,000 | ||
Mojo Networks | $0 | $0 |
你还可以将其导出成csv格式,方便使用excel进一步分析
![图片[13]-2022护网日记第十三天-FancyPig's blog](https://static.iculture.cc/wp-content/uploads/2022/08/20220807025818402-1024x231.png?x-oss-process=image/auto-orient,1/format,webp/watermark,image_cHVibGljL2xvZ28ucG5nP3gtb3NzLXByb2Nlc3M9aW1hZ2UvcmVzaXplLFBfMTA,x_10,y_10)
© 版权声明
THE END
- 最新
- 最热
只看作者