THE HITCHHIKER’S GUIDE TO THREAT RESEARCH.

THE HITCHHIKER’S GUIDE TO THREAT RESEARCH

O LRIG DealersChoice GoZebrocy MECHAFLOUNDER SILLY NAMES
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. O LRIG How do we make up these stupid names How do we group activity What is the secret sauce Everyone seems to have their own sets of techniques If you have a another awesome way please share GoZebrocy DealersChoice MECHAFLOUNDER

DATA TYPES Infrastructure Binary Tactics &%/(#//&
%(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Infrastructure Binary Tactics

WE’RE UNDER ATTACK! From: realperson@fakecompany.com
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. From: To: Subject: Important Attachment: A Legitimate Doc.doc Doc has a macro in it Filetype: Macro MS Word Document Filename: A Legitimate Doc.doc Hash: d7130e426... C2 Domain: therealapt.com IP Resolution:

INDICATORS Domains IPs Hashes threalapt.com 10.1.1.5 d7130e426...
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Put it somewhere

01 04 05 02 06 03 INFRASTRUCTURE The Basics Part 1
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. The Basics Part 1 Reusing certificates is great 01 DOMAINS 04 SSL CERT One of two most basic indicators commonly used Adversaries also like to use encryption The Basics Part 2 I’m in the cloud! 02 IP ADDRESS 05 SERVICES The other most basic indicator commonly used Infrastructure is rarely ever self hosted Who are you? What’s the worst that could happen? 03 WHOIS 06 CONTENT Can be incredibly valuable data to extend investigations Seriously, what’s the worst that could happen?

INFRASTRUCTURE Tools to mention Passivetotal Farsight Hyas
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Tools to mention Passivetotal Farsight Hyas is a godaddy parking IP is a DNS sinkhole operated by CERT-PL

INDICATORS Domains IPs Hashes threalapt.com 10.1.1.5 d7130e426...
therealbad.com thebadbad.com ns1.therealapt.com otherbad.net oldbad.com olbad2.com &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

INFRASTRUCTURE &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#&
%%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

INDICATORS Domains IPs Hashes DNS WHOIS threalapt.com 10.1.1.5
d7130e426... ns1.baddns.com therealbad.com Leroy Jenkins thebadbad.com ns1.therealapt.com otherbad.net oldbad.com olbad2.com unicornpanda.net someoldevil.org reallygoogle.com totallylegitimate.org newsevilstuff.io notevilatall.net &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. General discussion of threat landscape themes. There is no easy answer on what is currently on the threat landscape. The simple answer is “lots of evil”, but that’s not particularly interesting.

INFRASTRUCTURE Tools to mention Google dorking Censys &%/(#//&
%(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Tools to mention Google dorking Censys

INDICATORS Domains IPs Hashes DNS WHOIS SSL Cert Content threalapt.com
mayberelated.com d7130e426... ns1.baddns.com 62e1045a... therealbad.com evildomain.net Leroy Jenkins thebadbad.com looksrelated.org ns1.therealapt.com iswearitsfine.com otherbad.net oldbad.com olbad2.com unicornpanda.net someoldevil.org reallygoogle.com totallylegitimate.org newsevilstuff.io notevilatall.net &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

01 04 05 02 06 03 BINARY Words are great Too legit to quit
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Words are great Too legit to quit 01 STRINGS 04 SIGNER Strings are often times reused between samples or variants Digital signatures are abused for evasion, but reused You look the same We’ll do it live! 02 ATTRIBUTES 05 BEHAVIOR Samples from the same adversary may share similar file attributes Additional data points from dynamic analysis Copy paste FTW You talkin’ to me? 03 CODE 06 NETWORK Code is literally copy and pasted over time Capturing network traffic allows correlation back to infrastructure

BINARY Tools to mention VirusTotal Hybrid AutoFocus Yara &%/(#//&
%(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Tools to mention VirusTotal Hybrid AutoFocus Yara

INDICATORS Domains IPs Hashes DNS WHOIS SSL Cert Content Strings
Filenames Author Digital Cert threalapt.com mayberelated.com d7130e426... ns1.baddns.com 62e1045a... obj\Release\Inner.pdb zzz.dot Joohn 089e therealbad.com evildomain.net eb723dbf9... Leroy Jenkins thebadbad.com looksrelated.org b9f3af84a... ns1.therealapt.com iswearitsfine.com 77ff otherbad.net 34bdb5b36... oldbad.com 56afe olbad2.com bb5e81ac9... unicornpanda.net 8cc5f1f87... someoldevil.org reallygoogle.com totallylegitimate.org newsevilstuff.io notevilatall.net &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

BINARY powershell, created
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. powershell, created C:\Windows\system32\findstr.exe” Office365DCOMCheck powershell, Write AppData\Local\Temp\ Office365DCOMCheck.vbs

Filenames Author Digital Cert threalapt.com mayberelated.com d7130e426... ns1.baddns.com 62e1045a... obj\Release\Inner.pdb zzz.dot Joohn 089e therealbad.com evildomain.net eb723dbf9... Leroy Jenkins temp.dot Jiim thebadbad.com looksrelated.org b9f3af84a... ns1.therealapt.com iswearitsfine.com 77ff otherbad.net 34bdb5b36... oldbad.com 56afe olbad2.com bb5e81ac9... unicornpanda.net 8cc5f1f87... someoldevil.org 70284fa1e... reallygoogle.com 5f001f338... totallylegitimate.org newsevilstuff.io notevilatall.net &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Host Behaviors powershell, created C:\Windows\system32\findstr.exe” Office365DCOMCheck powershell, Write AppData\Local\Temp\ Office365DCOMCheck.vbs

BINARY &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#&
%%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

Filenames Author Digital Cert threalapt.com mayberelated.com d7130e426... ns1.baddns.com 62e1045a... obj\Release\Inner.pdb zzz.dot Joohn 089e therealbad.com evildomain.net eb723dbf9... Leroy Jenkins temp.dot Jiim thebadbad.com looksrelated.org b9f3af84a... ns1.therealapt.com iswearitsfine.com 77ff otherbad.net superevil.com 34bdb5b36... oldbad.com badstuff.net 56afe olbad2.com bb5e81ac9... unicornpanda.net 8cc5f1f87... someoldevil.org 70284fa1e... reallygoogle.com 5f001f338... totallylegitimate.org c7563f228... newsevilstuff.io bc... notevilatall.net &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. Host Behaviors powershell, created C:\Windows\system32\findstr.exe” Office365DCOMCheck powershell, Write AppData\Local\Temp\ Office365DCOMCheck.vbs Network Behaviors GET /beacon/to/badguys User Agent: Chrome Mozilla Internet Explorer 42.0 YmVnaW4=

01 03 02 04 TACTICAL It isn’t magic Why are you doing this to me
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. It isn’t magic Why are you doing this to me 01 INGRESS 03 MOTIVATION Recognize the difference between targeted and non-targeted attacks Identify the initial attack or infection vector Feel the flow So cloudy 02 EXECUTION 04 SUPPORT Adversaries commonly use unsanctioned third party services Collate indicators together to understand attack flow

TACTICAL dEVilDonKeY powershell, Write AppData\Local\Temp\
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. dEVilDonKeY Enumerating tactics, then attaching indicators Should try to express this in standardized format like ATT&CK If trying to relate with other groups activities needs multiple data points powershell, Write AppData\Local\Temp\ Office365DCOMCheck.vbs

WHAT’S NEXT? &%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#&
%%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*.

WHAT’S NEXT? A Wild DevilDonkey Appears! By Bryan Lee
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. A Wild DevilDonkey Appears! By Bryan Lee On March , I discovered this really evil clustering of activity which I named DevilDonkey. They have been found heavily targeting the basket-weaving industry in Antarctica. In the course of my investigation I was able to uncover their extensive infrastructure as well as a much larger extended campaign impacting other basket-weaving organizations around the world. ... IOCs threalapt[.]com therealbad[.]com thebadbad[.]com …

REPORT WRITING TIPS TELL A STORY USE VISUALS BE ACCURATE
&%/(#//& %(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. TELL A STORY USE VISUALS BE ACCURATE No one enjoys reading overly technical documents. Why is this research interesting? Why is it relevant? What is the impact? Huge word counts mostly just feed our own egos. Visuals are an excellent way to communicate concepts quickly and effectively All research must be evidence backed. Be careful in making broad statements or assumptions

THANK YOU QUESTIONS? COMMENTS? @obiwanblee &%/(#//&
%(%##%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%#& %%%%%%%%%%%%%%%%%%%%# #%%%%%& %%%%%%%%%%%%%%%%%%%%%% %%%%%( #%%%%%%%%%%%%%%%%%%%%%%%%%%%& %%%%%%%# (%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%# @%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%# *##%%##/ &%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%* #%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%# &#%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%, %%%%%%%%%%%%%%%% && &#%%%%%%%%## %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%# %%%%%%* %%%%%# #%%%%%%%%%%%%%%%/ %%%%%%%####%%%%%%% %%%%%%%%%%%%%%%%, (%%%%% %%%%%( #%%%%%%%%%%%%%%% %%%%%# &%%%%%( #%%%%%%%%%%%%%%% #%#####% #%%%%%# %%%%%%# %%%%%%%%%%%%%%%%# (%%%%%%%%%%%%%%%%& @#%%%%%%%%%%%%%. %%%%%%%%%%%%%%%%# #%%%%%%%%%%%%%# #%%%%%%%%%%%%%%%%# %%%%%%%%%%%%%%%%% #%%%%%% #%%%%%%%%%%# #%%%%%%%%%%%%%%% #%%%%%# #%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%% (%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%% *%%%%%%%&&&##%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%%%, #%%%%%# %#%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%# #%%%%%%%%%%# #%%%%%%%%%%%%%%# *%%%%%%%%%%%# #%%%%%%%%%%# %%%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%%%& %%%%%%%%%%%%%# #%%%%%%%%%%%%%# %%%%%%%%%%%% #%%%%%%%%%%% /%%%%%%%%%%%%%% %%%%%%%%%%%%%%& #%%%%%%%%%%%%%%%%# /%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%/ ,%%%%%%%%%%%%% @%%%%%%%%%%%%%%& %%%%%%%%%%%%% #%%%%%%%%%%% %%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%#% (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& (%%%%%%%%%%% %%%%%%%%%%% ,%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%% (%%%%%%%%%%% %%%%%%%%%%% @%%%%%%%%%%%%%%%# (%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%# %#%%%%%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%& #%%%%%% %%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%% #%%%%%%%%#%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%% #%%%%# #%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# &%%%%% #%%%%( %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%% &%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%# %%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# *%%%%%%%%# %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% /%%%%%%%%%%%%%%%# %%%%%%%%%%% @%%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%%%%%%%& %%%%%%%%%%% %%%%%%%%%%%%%%%% %%%%%%%%%%% %%%%%%%%%%% #%%%%%%%%%%%%%%%# %%%%%%%%%%% (%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% /%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% .%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% *%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% #%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% ,(%############################# //////////////////////////////*//% /////////////////////////////////////( /////////////////////////////////////////% ///////////////////////////////////////////( /////////////////////////////////////////////* ///////////////////////////////////////////////( ///////////////////////////////////////////////// /////////// (*//////////////////// /////////// /////////////////% /////////// (//////////////// /////////// ////////////////# /////////// ///////////////// /////////// *///////////////( /////////// ////////////////* /////////// ////////////////& /////////// //////////////// /////////// %& //////////////// /////////// &//////////*& *//////////////// /////////// #//////////////// ///////////////// /////////// ////// //////# ////////////////( /////////// (////////*///////// ////////////////( /////////// ////// (///// //////////////// /////////// //////% /////* //////////////// /////////// //////% &//////( ////////////////% /////////// /////////////* ////////////////% /////////// /////////////////( ////////////////% /////////// //////////// ///////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// //////////////// /////////// //////////// /////////////// //////////// /////////////% ///////////// /////////// %//////////// ////////////// /////////////*& %/////////////////% (//////////// (//////////////// ////////////// (//////////// ,//////////// //////////// %///////////// ///////////* (/////////// /////////////// ///////////* (/////////// ////////////// ///////////* #////////////* %//////////////// ///////////* %////////////////( %//////////////// ///////////* %//////. /////// #//////////////// ///////////* *///// /////( ////////////////. ///////////* *///// //////( ///////////////// ///////////* (/////# /////// ////////////////( ///////////* ///////%&%%//////// //////////////// ///////////////( ////////////////, //////////////// *///// ////// (.**, #//////////////// ////////////////// (////////////* %//////////////// ////// /////// %///////////////* //////% %///// ///////////////// /////// /////// ///////////////// ///////////////* //////////////// ////////*///////// ////////////////( /////////* (//////////////// #//////////////// #///////////////* *//////////////// ////////////////* ////////////////( &//////////////// //////////////// (*//////*( @(///////////////// (//////////////// (///////////////##(/////////////////////, ///////////////////////////////////////// /////// /////////////////////////// ////// %///////////////////// /////// ///////////////////////, //////% %//////////////////// ///////*((/////////////////// ///////////////////*/*. THANK YOU QUESTIONS? COMMENTS? @obiwanblee

THE HITCHHIKER’S GUIDE TO THREAT RESEARCH.

Similar presentations

Presentation on theme: "THE HITCHHIKER’S GUIDE TO THREAT RESEARCH."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

THE HITCHHIKER’S GUIDE TO THREAT RESEARCH.

Similar presentations

Presentation on theme: "THE HITCHHIKER’S GUIDE TO THREAT RESEARCH."— Presentation transcript:

Similar presentations

About project

Feedback