It's been extremely hard to keep this one under wraps.

[kajer@infosec.exchange]

@Dio9sys @da_667

Did you even download VCL from the warez BBS?!

[da_667@infosec.exchange]

@Dio9sys Quick question- the initial payload string -- were you all seeing that in GET requests? POST requests? Attached to particular exploit attempts? Would love to sig it. I'll have Suricata rules for the C2 tomorrow (We just finished up QA release for today, unfortunately)

[alda@topspicy.social]

@Dio9sys Ah yes. I've seen my share of those. Kudos on the writeup.

[insidertreat@infosec.exchange]

@Dio9sys this is an amazing read! Great work.

[neurovagrant@masto.deoan.org]

@Dio9sys this is such a good post! thanks for writing it.

[fx@chaos.social]

@neurovagrant @Dio9sys "hey that looks like AES-GCM, encrypted with the Key ..." would be very handy.

[dio9sys@haunted.computer]

@da_667 The payload that triggered all this was a POST request. Best guess right now is that it was intended for a machine that had already been exploited and with a malware dropper hiding on the device to wait for the POST request with the hidden payload.

Fun fact that I didn't note in the post: I found the same payload on one of those Chinese websites where they share their firewall logs....and then I checked it again the next day and the file was corrupted lol

[dio9sys@haunted.computer]

@alda everything comes down to someone wanting crypto

[dio9sys@haunted.computer]

@InsiderTreat thanks!

[dio9sys@haunted.computer]

@neurovagrant Thanks! It was fun!

[da_667@infosec.exchange]

@Dio9sys sorry to keep badgering you, and if you're under NDA or just don't want to right now, that's fine, but can you tell me if it was an actually cookie header value?

[swiftyshq@critter.cafe]

@Dio9sys

Dear reader, I cannot describe the joy I have at working with the type of person who can look at a string and go “ah yeah, backwards base64.”

beautiful sentence

[epic_null@infosec.exchange]

@Dio9sys Not finished reading but

The c2c subdomain is an nginx server on ubuntu on a server in japan, per URLScan. I was curious what the top level domain looked like, so I tried www as well. Turns out their www is in a tencent datacenter in singapore. Neat!

Tencent is that company that buys games from indie developers

That seems forboding...

[intaglio_dragon@furry.engineer]

@Dio9sys I'm reminded of the book "The Cuckoo's Egg" by Clifford Stoll, who similarly stumbled upon foreign hacker activity in the computer system at Lawrence Berkley National Laboratory, because of a $0.75 accounting discrepancy in computer usage.

https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)

[dio9sys@haunted.computer]

@Epic_Null
Tencent is a megabrand tho. They are basically the chinese AWS if AWS also had a movies division, blogging platform, and game studio

[dio9sys@haunted.computer]

@Intaglio_Dragon
oh, I should give that one a read

[epic_null@infosec.exchange]

@Dio9sys Okay so this is more "Someone buying file storage and runtime to run this operation" than "tencent is running cryptominers"

[crazypedia@masto.hackers.town]

@Dio9sys I love @greynoise 🤓

[csolisr@hub.azkware.net]

So, Amazon (minus the blog platform)

[mia@void.rehab]

@Dio9sys

No immediately visible MX server. I wonder if they’re actually using an email protocol or if it’s a front end for sending log files.

this doesn't seem right. your query was for mail.deepgtp.net/health, which is a url, not a domain. querying the domain gives proper mailserver data:

$ dig +short deepgtp.net mx
10 mail.deepgtp.net.
$ dig +short mail.deepgtp.net a
43.160.236.90