찾아줄게요

SHIT 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 SHIT라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• SHIT 파일은 Locky 암호화 파일 입니다. Locky에서 배포한 파일인 것으로 보입니다. 2017-10-18 21:19:49에 처음으로 보고되었으며 2017-10-18 21:19:49에 마지막으로 보고되었습니다.

• Locky 프로그램을 다운로드하여 SHIT 파일을 열 수 있습니다.

• Locky 암호화 파일

• _[0-9]_HELP_instructions (BMP, HTML, TXT)
  
  _[0-9]-INSTRUCTION (HTML)
  
  _[0-9]_WHAT_is (BMP, HTML)
  
  -INSTRUCTION (BMP, HTML)
  
  _HELP_instructions (BMP, HTML, TXT)
  
  _HOWDO_text (BMP, HTML)
  
  _Locky_recover

• 연관 링크 #1: 첨부된 링크가 없습니다.

• 연관 링크 #2: 첨부된 링크가 없습니다.

• [2021-06-22 01:39:27] @GossiTheDog If anybody wants some funny. shitty malware - hunt on this: https://www.virustotal.com/gui/file/cab6d2df593387a6ee9648ea012b8ae3a8de6e1d39fcd8fd75f249aeadb2281d/summary https://twitter.com/rudjosu/status/1406608544355454987

• [2021-06-08 06:48:45] @ActorExpose oh shit they returned :O https://www.sub7crew.org/ https://twitter.com/ActorExpose/status/1402049926402564101/photo/1

• [2021-02-25 20:48:37] @undel0h tags: #mirai #botnet #iot #ELF #binarys #botnet f0cked. Info: botnet base on: @UN5T48L3 (shit source). C2: 45.76.128.190 (9375/TCP) Bins hosting: http://45.76.128.190/nKorea/PornHub.x86 reported at @abuse_ch with the link: https://urlhaus.abuse.ch/host/45.76.128.190/ https://twitter.com/undel0h/status/1364920232733720579/photo/1

• [2021-02-02 05:15:24] @Arkbird_SOLG That's legitimate software vulnerable to side-loading that used by the #A41APT (what shared TTPs with APT10) and focus Japanese companies. This SSL-VPN abuse as entrypoint of the infrastructure. ref @58_158_177_102 https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf https://twitter.com/KorbenD_Intel/status/1356329453710942210 https://twitter.com/Arkbird_SOLG/status/1356350460123340802/photo/1

• [2020-12-27 10:00:41] @cr4ckerwhite Phish Site! (#phishing #scam) Instagram copyright infringement scam https://otx.alienvault.com/indicator/url/ http://copyrights-infringement-appeals.ml Belongs to a script kiddie named Qenzyist Have more intel if someone's looking for the little shit 3:) urls: copyrights-infringement-appeals.ml lnstagramcomplaints.com

• [2020-11-18 23:08:20] @Ricardo_estep @superjoebob @KasperskyES @kaspersky @duckgame_ Oh Shit.. Here we go again. ???? https://www.virustotal.com/gui/file/f04a4dd86fc702369f2eb5fa3442d30a3fa7b59df21812ba11d12f03196a9b56/detection https://twitter.com/Ricardo_estep/status/1329078996798115842/photo/1

• [2020-10-06 18:56:15] @abel1ma とりあえず目視確認した９ドメイン名を https://www.saferinternet.or.jp/akushitsu_ec_form/ に報告しました……

• [2020-09-13 19:47:03] @GrujaRS #Snatch #Ransomware extension .hbdalna! Ransom note;HOW TO RESTORE YOUR FILES.TXT Contact; [email protected] [email protected] Sample VT https://www.virustotal.com/gui/file/7c138b4db5f2cf643f1933f5d746ae36811cf0bc3325af82b4d0cf268351bac4/detection … https://www.hybrid-analysis.com/sample/7c138b4db5f2cf643f1933f5d746ae36811cf0bc3325af82b4d0cf268351bac4/5f5deeb926e9c86f8e60ce7b … pic.twitter.com/ImHU39A7zv

• [2020-08-17 19:04:48] @3XS0 Today's #phish #bec Like holy shit. if you're going to make half an effort to phish my Org. at least make the OWA page look good.. https://app.any.run/tasks/fcf5656c-e4ad-408f-9e72-b1a6ecc7f8bd … 295588802d60578354b408ce7000d174 pic.twitter.com/x9HZScPDJS

• [2020-08-13 03:39:46] @yungmay0 Today's #phish #bec Like holy shit. if you're going to make half an effort to phish my Org. at least make the OWA page look good.. https://app.any.run/tasks/fcf5656c-e4ad-408f-9e72-b1a6ecc7f8bd … 295588802d60578354b408ce7000d174 pic.twitter.com/ksZcd1mU3X

• [2020-07-29 22:01:08] @reecdeep #recon #Malware script: Notification 07.28.vbs https://app.any.run/tasks/8a320a5d-913a-4db6-91b7-8a49f04afa4d … hxxps://preoccupationology.com/thisshit info uploaded to hxxps://disturbancology.com/info @andpalmier @abuse_ch @Bl4ng3l @sugimu_sec @58_158_177_102 @James_inthe_box @luc4m @executemalware #infosec pic.twitter.com/C2IIU74hQT

• [2020-07-09 15:29:11] @0xrb and here is new path #Scylla #IoT #shit #Malware Payload ????????????????: hxxp://45.14.224.220/Scylla.sh | hxxp://45.14.224.220/ScyllaBinsLMaOGuESsWhatYerNotGettIn3m/Scylla.x86 Currently ???????????????????????? cc: @tolisec pic.twitter.com/98y8GBDu5k

• [2020-06-13 00:37:11] @3xp0rtblog #Malware #Stealer #Clipper #Source #Unpack #Shit #MistStealerClipper What_A_Fucking_Joke_Am_I_Right-Fixed.exe: https://virustotal.com/gui/file/7f3c1251434b970f5c53011bd562310cbc02549a953eb114beff4ee34594bb46/ … https://app.any.run/tasks/f1737ace-2c59-4c76-afd1-f2c02628cd58 … GitHub: https://github.com/3xp0rt/MistStealerClipper … CC: @James_inthe_box https://twitter.com/James_inthe_box/status/1271201231487172608?s= 20 …

• [2020-04-26 13:56:58] @MaraAnn333 python2: a= open('./bad.exe'.'r').read() print a68154:68168 ab.exe >>> b= a.replace('\x61\x00\x62\x00\x2e'. '\x61\x00\x61\x00\x62\x00\x66\x00\x2e') >>> open('./bad2.exe'.'wb').write(b) python3: ????? for shits and giggles: https://www.virustotal.com/gui/file/33e2568e279ee3ad9677f4782172cad1b13ce3b4d7825b3943034f7e01e87301/behavior …

• [2020-04-15 05:39:07] @JayTHL not me. but they are in a shitty area of town so i believe it. https://www.virustotal.com/gui/ip-address/104.148.58.76/relations …

• [2020-04-09 19:10:33] @3xp0rtblog #Stealer #Malware #RocketX #RocketXStealer RocketX.exe: https://www.virustotal.com/gui/file/0e417f23ce4a653c221deaf141e42e32ac99cc6790e6fac68171235e1cf1ca7a/detection … https://analyze.intezer.com/#/analyses/05b0f3a8-3e8b-4613-b751-135293713602 … https://app.any.run/tasks/546fda66-c28b-4c79-b128-06dfa421f5e0 … Tomorrow analysis for this dog shit!

• [2020-03-23 16:30:18] @lilyfivenumbers scratch that. it seems like it's a tiny blank jpg that's mislabeled as a tgz. one av says it's a trojan which would make sense with such weird contents but 1/59 detection is bullshit and not likely a virus https://www.virustotal.com/gui/file/b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599/detection … pic.twitter.com/3mf89GjHFR

• [2020-03-12 06:39:48] @JayTHL fake @Zelle email link to 117ysdj.com/f523p7x8REyXr97qa9u44SWs3MMcIHjG.html solve captcha get .doc https://www.virustotal.com/gui/file/a4b183801d7b9d6deb9c9d0cdb87e2826f098d0e8728b27961750f9e279e0a18/detection … downloads hxxp://secure.zenithglobalplc.com/assets/plugins/bootstrap-wizard/system_x64.exe tracert's to putty's website. shits all over c:\myimages\ pic.twitter.com/Stm2CIfbmV

• [2020-03-11 04:11:32] @wwp96 #LokiBot @hexlax @JAMESWT_MHT /lieshitextile.com 8977887f3e8343dc1294755a961ace27 b6f718a071b16d5c356d240e0bd9ece1 https://app.any.run/tasks/699e801f-7c8c-4e0d-baba-334c706ea6b1 …

• [2020-03-03 04:53:07] @wwp96 #LokiBot @hexlax @JAMESWT_MHT hxxp://lieshitextile.com/chief5/five/fre.php 7f8779b1860db6442493b46ab7c93bfb ec7588298279c9b80e9d7e4875ccd302 https://app.any.run/tasks/44a26550-9c41-436d-ae88-6c3762ae414e …

• [2020-03-02 21:56:09] @MiningSev0 @BitpingApp https://www.virustotal.com/gui/file/de1ac4864a4a106dfe3393fbc181e2b0cedec7fdb230e9eff63d42d9664eb68d/detection … ? I never was a real fan of #ShitcoinSV anyway - I wanted to take a look what you where building here - but this seems to me like some kind of a bad joke.. A #Trojan in your windows file? https://bitping.com/node

• [2020-02-28 07:50:25] @thisisnari_tv man you really out here trying to trojan people with that poor ass payload. Didn't even spoof the extension or the .ico nice try shitter. https://www.virustotal.com/gui/file/9c0fb33c097f4fbf2fee4ccc80c3bcc68c7c906ed7a80425befa1b5befc51104/detection …

• [2020-02-20 02:00:23] @JAMESWT_MHT PAGAMENTO GENNAIO found by @JayTHL drop #netwire https://app.any.run/tasks/1029f8af-17c3-4a58-8a22-3154ec7d09b5 … -> holyshit1234.duckdns.org 192.169.69.25 @malwrhunterteam @VirITeXplorer @guelfoweb

• [2020-01-24 01:30:23] @wwp96 #pony #fareit #opendir hxxp://tavim.org/includes/salah/gate.php hxxp://tavim.org/includes/salah/shit.exe (404) 4595eb8d5fd0a17e10c1791e8103bb02 0ad0e335b22a43a5abb5a152a4baa5b4 https://app.any.run/tasks/0a893925-e7f5-4b38-b4e8-9fb42fe5f2a2 … pic.twitter.com/DQNZOjncQp

• [2020-01-17 17:42:05] @catnap707 CitrixHoneypot コインマイナーの埋め込み？ hxxp://185.178.45.221/ci3.sh https://www.virustotal.com/gui/url/d5382a17ee109c5705a08096ab6bdb90d4c8226b822cb26c6483656aa8095a89/detection … #ハニーポット観察 #Shitrix pic.twitter.com/Q0qnrExxbU

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터