https://github.com/navytitanium/eitest-tools-scripts-iocs

https://github.com/navytitanium/eitest-tools-scripts-iocs

eitest-c2 ioc iocs malicious-domains malicious-redirects malicious-url

Last synced: about 1 month ago
JSON representation

• Host: GitHub
• URL: https://github.com/navytitanium/eitest-tools-scripts-iocs
• Owner: NavyTitanium
• Created: 2018-01-28T20:52:51.000Z (almost 7 years ago)
• Default Branch: master
• Last Pushed: 2018-04-13T23:22:05.000Z (over 6 years ago)
• Last Synced: 2024-05-18T13:31:21.509Z (7 months ago)
• Topics: eitest-c2, ioc, iocs, malicious-domains, malicious-redirects, malicious-url
• Language: PHP
• Homepage: https://blog.brillantit.com/exposing-eitest-campaign/
• Size: 8.54 MB
• Stars: 5
• Watchers: 2
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# IOCs

Indicators of Compromise (IOCs) updated every 30 minutes related to EITest campaigns. **The domain stat-dns.com used in EITest's DGA algorithm [has been sinkholed](https://www.proofpoint.com/us/threat-insight/post/eitest-sinkholing-oldest-infection-chain). As a result, the EITest campaign now appears to have been shutdown since 2018-03-15.**

# backend-decipher.py

Decodes data transmitted from an infected website via the EITest script to the EITest C2.

# infol_Decrypter.py

Decodes data transmitted by the victims to help.php and download.php.

# injPayloadDecrypter.py

Decodes data transmitted from the EITest C2 to the infected website (the content to be injected in the webpage).

# parsing-EITest_GET-requests.py

Process the GET requests from the EITest sinkhole server and store them in a MySQL database. Takes as input a large log file containing millions of requests, decode and process them using multiple threads.

# Malicious files

Contains differents artefact belonging to EITest.