4 ms·
Oh snap! "The archive also contains the output of ProcMon, Process Monitor, a system monitoring tool distributed by Microsoft and commonly used in forens
by guiambros 12y ago
Oh snap!
"The archive also contains the output of ProcMon,
Process Monitor, a system monitoring tool distributed
by Microsoft and commonly used in forensics and
intrusion analysis.
This file identifies the infected system and provides
a variety of interesting information about the network.
For instance:
USERDNSDOMAIN=BGC.NET
USERDOMAIN=BELGACOM
USERNAME=id051897a
USERPROFILE=C:\Users\id051897a"
Also love the comment at the end:
"Below is a list of hashes for the files The Intercept is making available for download. Given that that it has been over a year since the Belgacom operation was publicly outed, The Intercept considers it likely that the GCHQ/NSA has REPLACED THEIR TOOLKIT AND NO CURRENT OPERATIONS WILL BE AFFECTED by the publication of these samples."
- rasz_pl 12y agooh snap what? This is a file uploaded by BELGACOM admin to VirusTotal database. It is NOT a file NSA published somewhere. Currently we only know this malware was used in belgacom hack, there is still no proof it is nsa code.
- guiambros 12y agoDo you really have any doubt about who's behind this? We can debate about motivations and who their target really was (Belgacom may have been collateral damage), but despite "proof", there's little doubt about who wrote it.
- rasz_pl 12y agoYes, just like FBI assassinating Kennedy because Oh snap cuba! You act like its some sort of proof, like this totalvirus upload came from Langley IP.
- guiambros 12y agoI simply pointed out that the person who uploaded to virustotal certainly didn't realize it also had Belgacom domain name, username, and a list of all the processes running on the machine. > Yes, just like FBI assassinating Kennedy because Oh snap cuba! I have no doubt where this came from, despite not having Gen. Keith Alexander's email in the logs.