MCPcopy Create free account

hub / github.com/S3N4T0R-0X0/APTs-Adversary-Simulation / functions

Functions191 in github.com/S3N4T0R-0X0/APTs-Adversary-Simulation

⨍ Functions 191◇ Types & classes 13
↓ 1 callersFunctioninject_into_explorer
===== PROCESS INJECTION =====
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:352
↓ 1 callersFunctionmain
()
Russian APT/Gossamer-Bear-APT/GoogleDrive-C2.py:61
↓ 1 callersFunctionmain
()
Russian APT/APT28-Adversary-Simulation/OneDrivec2.py:56
↓ 1 callersFunctionmain
()
Russian APT/Ember-Bear-APT/Discord-C2.py:126
↓ 1 callersFunctionmain_loop
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:616
↓ 1 callersFunctionmain_loop
Russian APT/APT28-Adversary-Simulation/payload.cpp:72
↓ 1 callersFunctionmain_malware
Russian APT/Venomous-Bear-APT/backdoor.c:45
↓ 1 callersFunctionperform_anti_analysis_checks
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:266
↓ 1 callersFunctionreceive_data
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:241
↓ 1 callersFunctionreceive_from_payload
encrypted commands from the payload
Russian APT/Energetic-Bear-APT/C2-Server.php:27
↓ 1 callersFunctionreceive_from_payload
Encrypted commands from the payload
Russian APT/Voodoo-Bear-APT/C2-Server.php:44
↓ 1 callersFunctionrecv_data
North Koreans APT/Ricochet Chollima/payload.cpp:830
↓ 1 callersFunctionreverseShell
Chinese APT/Wicked Panda/MoonWalk.cpp:28
↓ 1 callersFunctionreverse_tcp
()
North Koreans APT/Famous Chollima/ReverseTCP_XOR.py:18
↓ 1 callersFunctionrsa_decrypt
Decrypt data using RSA
Russian APT/Voodoo-Bear-APT/C2-Server.php:32
↓ 1 callersFunctionrsa_encrypt
Encrypt data using RSA
Russian APT/Voodoo-Bear-APT/C2-Server.php:26
↓ 1 callersFunctionrun
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:350
↓ 1 callersFunctionrun_cmd_command
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:315
↓ 1 callersFunctionsend_data
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:236
↓ 1 callersFunctionsend_to_dropbox
function to send data to Dropbox using Dropbox API
Russian APT/APT29-Adversary-Simulation/c2_payload.cpp:42
↓ 1 callersFunctionsend_to_payload
Send encrypted output to the payload
Russian APT/Voodoo-Bear-APT/C2-Server.php:38
↓ 1 callersFunctionsetupWinsock
Chinese APT/Wicked Panda/MoonWalk.cpp:74
↓ 1 callersFunctionsetup_persistence
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:163
↓ 1 callersFunctionsetup_registry_persistence
===== REGISTRY PERSISTENCE =====
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:299
↓ 1 callersFunctionstart_c2_server
()
Russian APT/Venomous-Bear-APT/Backdoor-C2.py:3
↓ 1 callersFunctionstart_discord_bot
(token, channel_id)
Russian APT/Ember-Bear-APT/Discord-C2.py:90
↓ 1 callersFunctionstart_display
()
Russian APT/Ember-Bear-APT/Discord-C2.py:80
↓ 1 callersFunctionstart_ngrok
(port)
Russian APT/Ember-Bear-APT/Discord-C2.py:57
↓ 1 callersFunctionsubmit_output
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:576
↓ 1 callersFunctionupload_to_onedrive
Russian APT/APT28-Adversary-Simulation/payload.cpp:66
↓ 1 callersFunctionxorEncrypt
XOR encryption
Russian APT/Energetic-Bear-APT/payload.cpp:14
↓ 1 callersFunctionxor_decrypt_base64
(data, key)
North Koreans APT/Famous Chollima/ReverseTCP_XOR.py:10
MethodAESCipherTCP
North Koreans APT/Ricochet Chollima/payload.cpp:774
FunctionAES_CTR_xcrypt_buffer
Symmetrical operation: same function for encrypting as for decrypting. Note any IV/nonce should never be reused with the same key */
North Koreans APT/Ricochet Chollima/payload.cpp:620
FunctionAES_ECB_decrypt
North Koreans APT/Ricochet Chollima/payload.cpp:567
FunctionAES_ECB_encrypt
North Koreans APT/Ricochet Chollima/payload.cpp:561
FunctionAES_init_ctx_iv
North Koreans APT/Ricochet Chollima/payload.cpp:318
MethodDecryptPayload
(byte[] encryptedPayload)
Russian APT/APT28-Adversary-Simulation/Stager.cs:33
FunctionDllMain
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:51
FunctionDllMain
DllMain function for the malicious DLL
Russian APT/APT29-Adversary-Simulation/c2_payload.cpp:75
MethodExecuteBase64Script
()
North Koreans APT/Stardust Chollima/Fake-Global-Processing-Center.cs:165
MethodExecutePayload
(byte[] payload)
Russian APT/APT28-Adversary-Simulation/Stager.cs:48
FunctionExportedFunction
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:47
FunctionHandlerProc
Russian APT/Venomous-Bear-APT/backdoor.c:41
MethodInitializeComponent
()
North Koreans APT/Stardust Chollima/Fake-Global-Processing-Center.cs:21
MethodMain
(string[] args)
Russian APT/APT28-Adversary-Simulation/DLLDownloader.cs:10
MethodMain
(string[] args)
Russian APT/APT28-Adversary-Simulation/Stager.cs:12
MethodMain
()
North Koreans APT/Stardust Chollima/Fake-Global-Processing-Center.cs:154
MethodMainForm
()
North Koreans APT/Stardust Chollima/Fake-Global-Processing-Center.cs:16
MethodMainForm_Load
(object sender, EventArgs e)
North Koreans APT/Stardust Chollima/Fake-Global-Processing-Center.cs:145
FunctionWinMain
Iranian APT/Static Kitten/ Actual_Payload_HTTP_XOR.cpp:648
Functioncheck_analysis_registry
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:163
Functioncheck_cpu_count
===== ANTI-ANALYSIS FUNCTIONS =====
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:118
Functioncheck_debugger
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:216
Functioncheck_ram_size
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:195
Functioncheck_uptime
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:229
Functioncheck_username
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:247
Functioncheck_virtual_machine
()
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:137
Methodexploit
Russian APT/Energetic-Bear-APT/EnergeticBear_exploit.rb:78
Functionfnv1a_salted
FNV-1a with salt in C
Chinese APT/Wicked Panda/DodgeBox.c:54
Methodget_target
(request)
Russian APT/Energetic-Bear-APT/EnergeticBear_exploit.rb:86
Methodinitialize
(info={})
Russian APT/Energetic-Bear-APT/EnergeticBear_exploit.rb:15
Methodis_base64
North Koreans APT/Ricochet Chollima/payload.cpp:660
Functionlogoff_monitor_thread
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:123
Functionmain
===== MAIN FUNCTION =====
Iranian APT/Static Kitten/RustyWater/reddit/src/main.rs:435
Functionmain
Russian APT/Venomous-Bear-APT/backdoor.c:151
Functionmain
Russian APT/Energetic-Bear-APT/payload.cpp:22
Functionmain
()
Russian APT/Gossamer-Bear-APT/payload.rs:7
Functionmain
Russian APT/APT28-Adversary-Simulation/payload.cpp:131
Functionmain
Russian APT/APT29-Adversary-Simulation/c2_payload.cpp:115
Functionmain
Russian APT/Ember-Bear-APT/SaintBot.cpp:155
Functionmain
North Koreans APT/Labyrinth Chollima/backdoor.c:23
Functionmain
North Koreans APT/Silent Chollima/GOVERSHELL.cpp:447
Functionmain
North Koreans APT/Ricochet Chollima/payload.cpp:925
Functionmain
Main entry point
Chinese APT/Mustang Panda/ToneShellBackdoor.c:99
Functionmain
Chinese APT/Wicked Panda/DodgeBox.c:67
Functionmain
Chinese APT/Wicked Panda/MoonWalk.cpp:101
Methodmain
(String[] args)
Russian APT/Energetic-Bear-APT/CopyDLL.java:6
Functionon_ready
()
Russian APT/Ember-Bear-APT/Discord-C2.py:95
Methodon_request_uri
(cli, request)
Russian APT/Energetic-Bear-APT/EnergeticBear_exploit.rb:97
Methodpad
North Koreans APT/Ricochet Chollima/payload.cpp:759
Functionprimary_thread
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:88
Functionrsa_decrypt
(data, private_key)
Russian APT/Voodoo-Bear-APT/testing payload.py:23
Functionrsa_encrypt
(data, public_key)
Russian APT/Voodoo-Bear-APT/testing payload.py:18
Functionscreen
(ctx)
Russian APT/Ember-Bear-APT/Discord-C2.py:112
Functionsend_to_dropbox
function to send data to Dropbox using Dropbox API
North Koreans APT/Ricochet Chollima/payload.cpp:112
Functionshell
(ctx, *, command)
Russian APT/Ember-Bear-APT/Discord-C2.py:101
Functionsplit
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:181
Functiontask_completion_monitor_thread
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:152
Functiontask_monitor_thread
Russian APT/Voodoo-Bear-APT/kapeka_backdoor.cpp:132
Methodunpad
North Koreans APT/Ricochet Chollima/payload.cpp:766
← previous101–191 of 191, ranked by callers