2022护网日记第十三天
作者：FancyPig | 发布时间： | 更新时间：
杂谈
今天的分享分为两部分
- 恶意IP/域名情报
- 你关心的趣事
恶意IP/域名情报
你关心的趣事
每日可供学习参考的钓鱼🎣样本
| 样本名称 | MD5 | 分析报告 |
|---|---|---|
| 三峡集团2022高温补贴.exe | 7757c460b8083378a6b4871b562b2e59 | https://s.threatbook.com/report/file/76f95c0b4b877fd35f167643a510753b6b0c82d6a1af2763c55034ad6d97fb41 |
| 涉疫轨迹检查表.xls 2.exe | 2d2e2831ae6351fbee7810bfc0d10955 | https://s.threatbook.com/report/file/ffeb7d694c82c2dfa5344d082b61386561202ccde69fc11257916b0da515c922 |
| 薪酬调整计划通知.rar | d5b2a91db72ad6cc0d5495b6452f6bf4 | https://s.threatbook.com/report/file/8ad012accbebae2332327e3e601c0411943cf361438e9a092cfcabcf71cb22c7 |
| Microsoft.Office.PolicyTips.exe | 4e1aae01098239a474edb7134a3e5094 | https://s.threatbook.com/report/file/79deafbe41fe822c424dfcb0aee9108ed90224ccf1fc546a4f617aaab900153e |
| debug.dll | 4c67339be7257db855a8beefd7167c3f | https://s.threatbook.com/report/file/3e95f8ad1ddef83c97dc72b00a7735f16089f9f4179e8352848e66ebde0852c4 |
师傅，有没有新的表情包可以用来水群？
hvv的时间15天，正好是两周😂
还有最后2天了😊
微信溯源取证相关资料？
之前我们有详细分享过相关的文章
data-postsbox="{"id":15969,"title":"给你一台电脑，你能提取微信的信息吗？","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/05/20220516092713172.jpg","cover_video":"","views":9282,"comment_count":18,"category":"knowledge","is_forum_post":false}">{"id":15969,"title":"给你一台电脑，你能提取微信的信息吗？","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/05/20220516092713172.jpg","cover_video":"","views":9282,"comment_count":18,"category":"knowledge","is_forum_post":false}
data-postsbox="{"id":19286,"title":"微信聊天记录取证工具","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/07/20220704082301397.png","cover_video":"","views":14873,"comment_count":23,"category":"knowledge","is_forum_post":false}">{"id":19286,"title":"微信聊天记录取证工具","author":"FancyPig","author_id":1,"cover_image":"https://static.pigsec.cn/wp-content/uploads/2022/07/20220704082301397.png","cover_video":"","views":14873,"comment_count":23,"category":"knowledge","is_forum_post":false}
这次分享一个更简单粗暴的
下载之后打开CMD
将SharpWxDump.exe拖入CMD中，发现可以显示
- 微信进程ID
- 微信版本号
- 微信昵称
- 微信号
- 微信绑定的手机号
- 微信绑定邮箱（部分版本可能没有）
还有热心网友反馈，可以将其用于cobaltstrike中
data-postsbox="{"id":3521,"title":"【网友分享】Cobalt Strike——安装与使用教程","author":"蒸蚌～","author_id":5337,"cover_image":"","cover_video":"","views":5614,"comment_count":4,"category":"vip","is_forum_post":false}">{"id":3521,"title":"【网友分享】Cobalt Strike——安装与使用教程","author":"蒸蚌～","author_id":5337,"cover_image":"","cover_video":"","views":5614,"comment_count":4,"category":"vip","is_forum_post":false}
通过远程执行脚本，可以获取到被控机器的相关资料
这里需要强调的是微信版本的一些区别
- 版本 < 3.7.0.30 只运行不登录能获取个人信息，登录后可以获取数据库密钥
- 版本 > 3.7.0.30 只运行不登录不能获取个人信息，登录后都能获取
如何通过开源情报查询“戏精”佩洛西的资产？
最近人民日报分享了下面的视频《起底“戏精”佩洛西》
很多朋友都比较关心佩洛西的资产情况，我们之前给大家介绍过OSINT框架
其中关于公开财产可以通过下面的网址进行搜索
点击右侧Assets（财产）
这里可以看到从2008年到2018年的全部资产表格，可以按需修改年份查看对应每一年的财产详情
下面是最近的2018年财产情况，由于我不是经济学专业的，这里就不献丑了，感兴趣的可以自行分析
| Organization | Industry | Minimum Value | Maximum Value | Lobbies? | Contributed? |
|---|---|---|---|---|---|
| Apple Inc | Electronics Mfg/Eqp | $5,250,002 | $25,500,000 | YES | YES |
| Visa Inc | Finance/Credit | $5,000,001 | $25,000,000 | YES | YES |
| Thirteen Hundred One Sansome LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Russell Ranch LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Nine Forty Five Battery LLC | Real Estate | $5,000,001 | $25,000,000 | ||
| Auberge du Soleil Ltd | Lodging/Tourism | $5,000,001 | $25,000,000 | ||
| 45 Belden Place - Four Story Commercial Building | $5,000,001 | $25,000,000 | |||
| 25 Point Lobos - Commercial Property | $5,000,001 | $25,000,000 | |||
| 11 Zinfandel Lane - Home & Vineyard | $5,000,001 | $25,000,000 | |||
| Walt Disney Co | TV/Movies/Music | $1,000,001 | $5,000,000 | YES | YES |
| Salesforce.com | Internet | $1,000,001 | $5,000,000 | YES | YES |
| Piatti Restaurant Co | Food & Beverage | $1,000,001 | $5,000,000 | ||
| Forty-Five Belden Corp | Securities/Invest | $1,000,001 | $5,000,000 | ||
| Facebook Inc | Internet | $550,002 | $1,100,000 | YES | YES |
| Comcast Corp | Telecom Svcs | $500,001 | $1,000,000 | YES | YES |
| City Car Services | Misc Transport | $500,001 | $1,000,000 | ||
| Borel Real Estate | Real Estate | $500,001 | $1,000,000 | ||
| Amazon.com | Internet | $500,001 | $1,000,000 | YES | YES |
| Union Bank of California Money Market | Cash/Money Market/Savings/Checking | $250,001 | $500,000 | ||
| Stoneridge Group | $250,001 | $500,000 | |||
| Square Inc | Electronics Mfg/Eqp | $250,001 | $500,000 | YES | |
| Sierra Vista Baseline Investors LP | Real Estate | $250,001 | $500,000 | ||
| Mosher Partners LP | Real Estate | $250,001 | $500,000 | ||
| Morningstar Inc | Publishing | $250,001 | $500,000 | ||
| Interactive Brokers | Securities/Invest | $250,001 | $500,000 | ||
| EDI Assoc | Lodging/Tourism | $250,001 | $500,000 | ||
| AT&T Inc | Telephone Utilities | $250,001 | $500,000 | YES | YES |
| Financial Leasing Services | Finance/Credit | $100,001 | $250,000 | ||
| Dropbox Inc | Internet | $100,001 | $250,000 | YES | |
| Nautilus Leasing Services | Trucking | $50,001 | $100,000 | ||
| City National Bank - Checking Account | Cash/Money Market/Savings/Checking | $50,001 | $100,000 | ||
| Wells Fargo Bank/Checking | Commercial Banks | $15,001 | $50,000 | ||
| Trivium LLC | Electronics Mfg/Eqp | $15,001 | $50,000 | ||
| Odyssey LLC | Securities/Invest | $15,001 | $50,000 | ||
| Matthews International Mutual Fund | Mutual Fund | $15,001 | $50,000 | ||
| Global Ambassador Concierge | Business Services | $15,001 | $50,000 | ||
| Congressional Credit Union - Checking Account [BA] | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
| City National Securities | Cash/Money Market/Savings/Checking | $15,001 | $50,000 | ||
| Aristotle LLC | Business Services | $15,001 | $50,000 | ||
| Bank of America/Checking | Commercial Banks | $1,003 | $17,000 | ||
| Qualcomm Inc | Electronics Mfg/Eqp | $1,001 | $15,000 | YES | YES |
| Clean Energy Fuels Corp | Misc Energy | $1,001 | $15,000 | YES | |
| BF Enterprises | Lawyers/Law Firms | $1,001 | $15,000 | ||
| Union Bank of California/Pelosi Trust | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
| Union Bank of California/Checking | Cash/Money Market/Savings/Checking | $1 | $1,000 | ||
| Tripath Technology | Electronics Mfg/Eqp | $1 | $1,000 | ||
| SunEdison Inc | Misc Energy | $1 | $1,000 | ||
| Mojo Networks | $0 | $0 |
你还可以将其导出成csv格式，方便使用excel进一步分析
标签：report