MCPcopy Create free account

hub / github.com/S3N4T0R-0X0/APTs-Adversary-Simulation / functions

Functions191 in github.com/S3N4T0R-0X0/APTs-Adversary-Simulation

⨍ Functions 191◇ Types & classes 13
↓ 55 callersMethodencode
North Koreans APT/Ricochet Chollima/payload.cpp:665
↓ 21 callersFunctionlog
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:194
↓ 19 callersMethoddecode
North Koreans APT/Ricochet Chollima/payload.cpp:707
↓ 16 callersFunctionMultiply
North Koreans APT/Ricochet Chollima/payload.cpp:414
↓ 14 callersFunctionxtime
North Koreans APT/Ricochet Chollima/payload.cpp:388
↓ 11 callersFunctionxor_decrypt_base64_string
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:98
↓ 10 callersFunctionget_json_value
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:266
↓ 10 callersFunctiontrim
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:115
↓ 9 callersFunctionget_json_value
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:332
↓ 9 callersFunctionxor_decrypt
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:92
↓ 8 callersMethodencrypt
North Koreans APT/Ricochet Chollima/payload.cpp:782
↓ 5 callersFunctionAddRoundKey
This function adds the round key to state. The round key is added to the state by an XOR function.
North Koreans APT/Ricochet Chollima/payload.cpp:331
↓ 5 callersFunctionxor_encrypt
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:87
↓ 4 callersFunctionhttp_request
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:261
↓ 4 callersFunctionstring_to_vector
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:98
↓ 4 callersFunctionstring_to_vector
North Koreans APT/Ricochet Chollima/payload.cpp:836
↓ 4 callersFunctionxor_encrypt_decrypt_string
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:87
↓ 3 callersFunctionCipher
Cipher is the main function that encrypts the PlainText.
North Koreans APT/Ricochet Chollima/payload.cpp:506
↓ 3 callersMethoddecrypt
North Koreans APT/Ricochet Chollima/payload.cpp:795
↓ 3 callersFunctionexecute_command
Russian APT/APT28-Adversary-Simulation/payload.cpp:19
↓ 3 callersFunctionget_url
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:122
↓ 3 callersFunctionhttp_request
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:153
↓ 3 callersFunctionsend_data
North Koreans APT/Ricochet Chollima/payload.cpp:808
↓ 3 callersFunctionxor_encrypt
decrypt data using XOR
Russian APT/Energetic-Bear-APT/C2-Server.php:12
↓ 3 callersFunctionxor_encrypt_decrypt
(data, key)
North Koreans APT/Famous Chollima/ReverseTCP_XOR.py:6
↓ 2 callersFunctionAES_ctx_set_iv
North Koreans APT/Ricochet Chollima/payload.cpp:323
↓ 2 callersFunctionDownloadPayload
Russian APT/Ember-Bear-APT/SaintBot.cpp:49
↓ 2 callersFunctionInvCipher
North Koreans APT/Ricochet Chollima/payload.cpp:532
↓ 2 callersFunctionKeyExpansion
This function produces Nb(Nr+1) round keys. The round keys are used in each round to decrypt the states.
North Koreans APT/Ricochet Chollima/payload.cpp:241
↓ 2 callersFunctionXorWithIv
North Koreans APT/Ricochet Chollima/payload.cpp:577
↓ 2 callersFunctionfnv1a_salted
(data, salt, seed_value=0x811C9DC5)
Chinese APT/Wicked Panda/fnv1a_salted.py:1
↓ 2 callersFunctionget_process_list
===== PROCESS LIST FUNCTIONS =====
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:79
↓ 2 callersFunctionparse_headers
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:128
↓ 2 callersFunctionrecv_all
North Koreans APT/Ricochet Chollima/payload.cpp:819
↓ 2 callersFunctionrun_powershell_command
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:374
↓ 2 callersFunctionsend_to_payload
send encrypted output to the payload
Russian APT/Energetic-Bear-APT/C2-Server.php:21
↓ 2 callersFunctionxor_crypt
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:81
↓ 1 callersFunctionAES_CBC_decrypt_buffer
North Koreans APT/Ricochet Chollima/payload.cpp:601
↓ 1 callersFunctionAES_CBC_encrypt_buffer
North Koreans APT/Ricochet Chollima/payload.cpp:586
↓ 1 callersFunctionAES_init_ctx
North Koreans APT/Ricochet Chollima/payload.cpp:313
↓ 1 callersFunctionArchiveFilesWithPassword
Function to archive files with a password (stub)
Chinese APT/Mustang Panda/ToneShellBackdoor.c:91
↓ 1 callersFunctionC2_GetCommand
Russian APT/Venomous-Bear-APT/backdoor.c:81
↓ 1 callersFunctionDisplayTimedDebugMessages
Placeholder for DisplayTimedDebugMessages function
Chinese APT/Mustang Panda/ToneShellBackdoor.c:84
↓ 1 callersFunctionInjectIntoProcess
Russian APT/Ember-Bear-APT/SaintBot.cpp:84
↓ 1 callersFunctionInvMixColumns
MixColumns function mixes the columns of the state matrix. The method used to multiply may be difficult to understand for the inexperienced. Please us
North Koreans APT/Ricochet Chollima/payload.cpp:444
↓ 1 callersFunctionInvShiftRows
North Koreans APT/Ricochet Chollima/payload.cpp:476
↓ 1 callersFunctionInvSubBytes
The SubBytes Function Substitutes the values in the state matrix with values in an S-box.
North Koreans APT/Ricochet Chollima/payload.cpp:464
↓ 1 callersFunctionIsSupportedLocale
Russian APT/Ember-Bear-APT/SaintBot.cpp:22
↓ 1 callersFunctionMalwareMain
Chinese APT/Wicked Panda/DodgeBox.c:30
↓ 1 callersFunctionMixColumns
MixColumns function mixes the columns of the state matrix
North Koreans APT/Ricochet Chollima/payload.cpp:394
↓ 1 callersFunctionProcessCommand
Russian APT/Venomous-Bear-APT/backdoor.c:113
↓ 1 callersFunctionReadConfig
Russian APT/Venomous-Bear-APT/backdoor.c:66
↓ 1 callersFunctionResolveImport
Chinese APT/Wicked Panda/DodgeBox.c:45
↓ 1 callersFunctionSbieDll_Hook
Chinese APT/Wicked Panda/DodgeBox.c:20
↓ 1 callersFunctionSelfDelete
Russian APT/Ember-Bear-APT/SaintBot.cpp:141
↓ 1 callersFunctionServiceLoop
Russian APT/Venomous-Bear-APT/backdoor.c:123
↓ 1 callersFunctionServiceMain
Russian APT/Venomous-Bear-APT/backdoor.c:50
↓ 1 callersFunctionSetupAndEnumWindowProps
Function to set up and enumerate window properties
Chinese APT/Mustang Panda/ToneShellBackdoor.c:23
↓ 1 callersFunctionShiftRows
The ShiftRows() function shifts the rows in the state to the left. Each row is shifted with different offset. Offset = Row number. So the first row is
North Koreans APT/Ricochet Chollima/payload.cpp:360
↓ 1 callersFunctionSubBytes
The SubBytes Function Substitutes the values in the state matrix with values in an S-box.
North Koreans APT/Ricochet Chollima/payload.cpp:345
↓ 1 callersFunctionValidateAndProcessData
Placeholder for ValidateAndProcessData function
Chinese APT/Mustang Panda/ToneShellBackdoor.c:75
↓ 1 callersFunctionapply_jitter
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:599
↓ 1 callersFunctioncalculate_crc32
Russian APT/APT28-Adversary-Simulation/payload.cpp:49
↓ 1 callersFunctioncheckin
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:463
↓ 1 callersFunctionclose_socket
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:231
↓ 1 callersFunctionconnectToServer
Chinese APT/Wicked Panda/MoonWalk.cpp:82
↓ 1 callersFunctionconnect_to_c2
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:209
↓ 1 callersFunctioncopy_to_persistence
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:129
↓ 1 callersFunctioncreatePersistenceWindows
Chinese APT/Wicked Panda/MoonWalk.cpp:61
↓ 1 callersFunctioncreate_persistence_dir
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:120
↓ 1 callersFunctioncreate_scheduled_task
Persistence
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:140
↓ 1 callersFunctiondecode
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:67
↓ 1 callersFunctiondecode
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:63
↓ 1 callersFunctiondecryptAndInjectBackdoor
Function to decrypt and inject the backdoor
North Koreans APT/Labyrinth Chollima/backdoor.c:7
↓ 1 callersFunctiondownload_from_onedrive
Russian APT/APT28-Adversary-Simulation/payload.cpp:60
↓ 1 callersFunctionencode
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:45
↓ 1 callersFunctionencode
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:47
↓ 1 callersFunctionencrypt_access_token
(token, key_length)
Russian APT/Gossamer-Bear-APT/GoogleDrive-C2.py:53
↓ 1 callersFunctionencrypt_access_token
(token)
Russian APT/APT28-Adversary-Simulation/OneDrivec2.py:46
↓ 1 callersFunctionencrypt_access_token
(token)
Russian APT/APT29-Adversary-Simulation/Dropboxc2.py:45
↓ 1 callersFunctionencrypt_access_token
(token, key_length)
Russian APT/Ember-Bear-APT/Discord-C2.py:49
↓ 1 callersFunctionestablish_reverse_shell
(ip, port)
Russian APT/Ember-Bear-APT/Discord-C2.py:67
↓ 1 callersFunctionexecute_command
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:443
↓ 1 callersFunctionexecute_command
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:167
↓ 1 callersFunctionexecute_command
function to execute commands and return the output
Russian APT/APT29-Adversary-Simulation/c2_payload.cpp:25
↓ 1 callersFunctionexecute_command
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:190
↓ 1 callersFunctionexecute_command
North Koreans APT/Ricochet Chollima/payload.cpp:840
↓ 1 callersFunctiongenerate_random_dir
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:102
↓ 1 callersFunctiongenerate_random_key
(length)
Russian APT/Gossamer-Bear-APT/GoogleDrive-C2.py:44
↓ 1 callersFunctiongenerate_random_key
(length)
Russian APT/Ember-Bear-APT/Discord-C2.py:45
↓ 1 callersFunctiongenerate_rsa_keys
Generate RSA keys
Russian APT/Voodoo-Bear-APT/C2-Server.php:12
↓ 1 callersFunctionget_attacker_info
()
Russian APT/Gossamer-Bear-APT/GoogleDrive-C2.py:48
↓ 1 callersFunctionget_attacker_info
()
Russian APT/APT28-Adversary-Simulation/OneDrivec2.py:41
↓ 1 callersFunctionget_json_array
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:284
↓ 1 callersFunctionget_machine_guid
Russian APT/APT28-Adversary-Simulation/payload.cpp:36
↓ 1 callersFunctionget_module_path
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:114
↓ 1 callersFunctionget_tasks
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:549
↓ 1 callersFunctionhas_run_argument
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:169
↓ 1 callersFunctionhijack_dll
()
Russian APT/APT29-Adversary-Simulation/Dropboxc2.py:76
↓ 1 callersFunctioninitialize_winsock
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:199
next →1–100 of 191, ranked by callers