https://github.com/navytitanium/eitest-trigger
Trigger content injection on demand from the EITest C2
https://github.com/navytitanium/eitest-trigger
eitest-c2 malware-research tracking
Last synced: 7 months ago
JSON representation
Trigger content injection on demand from the EITest C2
- Host: GitHub
- URL: https://github.com/navytitanium/eitest-trigger
- Owner: NavyTitanium
- Created: 2018-01-07T03:14:12.000Z (over 8 years ago)
- Default Branch: master
- Last Pushed: 2019-10-09T19:23:23.000Z (over 6 years ago)
- Last Synced: 2025-03-01T00:59:44.049Z (over 1 year ago)
- Topics: eitest-c2, malware-research, tracking
- Language: PHP
- Homepage: https://blog.brillantit.com/exposing-eitest-campaign/
- Size: 104 KB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# EITest-trigger
**The domain stat-dns.com used in EITest's DGA algorithm [has been sinkholed](https://www.proofpoint.com/us/threat-insight/post/eitest-sinkholing-oldest-infection-chain). As a result, the EITest campaign has now been shutdown since 2018-03-15.**
Trigger content injection on demand from the EITest C2.
This PHP script is based on the original malicious script, but deobfuscated and highly modified. It will fake a client browsing a website and ask for content injection to the EITest malware C2.
Can be used to track malicious campaigns with the bash script provided. See [the latest version here](https://github.com/NavyTitanium/EITest-trigger/tree/master/automated)
## Usage
```
[root@localhost]# php eitest.php "User Agent string"
```
## Output
Faking Chrome browser:
```
[root@localhost]# php eitest.php "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36"
injected:
if (!!window.chrome && .....<output omitted>.....setTimeout(dy0,1000);}
```
Faking IE browser:
```
[root@localhost]# php eitest.php "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
injected:
function GetWindowHeight(){.....<output omitted>.....;initPu();
```