legal contact
 

05 - Automatic crawling pastebin for "nice" things using YARA + Splunk

yara=aws_api

# Read AWS access key from env. variables or configuration file. Best practice is NOT # to embed credentials in code. access_key = "AKIAILOQYR57QT5TYWJA" secret_key = "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"

'access_key' => 'AKIAJF6WVJVTGZMC5ANQ', 'secret_key' => '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', 'region' => 'eu-west-1' }

yara=email_list

Saudi Goverment Offical Ambassadors Personal Database Leaked by Touseef Jaskani Officals leaks Get Official leak on Www.Dleets.com name passport bir_date sex s_cell email sup_email منير حميد احمد الحمادي Muneer Hamid Ahmed Al-Hammadi 0003326851 15/6/1979 m 0597156808 eng.muneer2008@gmail.com ghulam@ksu.edu.sa شاجع على احمد غالب shagae ali ahmed ghaleb 0004602950 2-5-1985 m 0590073931 shaga_111@yahoo.com جامعة الملك سعود - سكن الطلاب تعز - اليمن حسين سالم علي الحريبي Hussein Salem Ali AL-Huraibi 002286644 13/11/1984 m 0538254705 husseinalhuraibi7014@gmail.com ابرق الرغامة - جدة شبوة - بيحان حلمي محمد محمد صلاح Helmi Mohammed Mohammed Salah 0003921534 30/11/1992 m 0533899304 432106929@student.ksu.edu.sa جامعة الملك سعود السكن الجامعي حضرموت -المكلا فهد عبد القادر عبد الله الهتار fahd abdulqader abdallah alhetar 002814670 01/01/1977 m 0591465281 fahd077@yahoo.com الرياض - جامعة الملك سعود إب - الظهار إبراهيم محمد محمد محرم Ebrahim Mohammed mohammed moharrm 003386386 01/01/1985 m 0548046695 moharrm85@yahoo.com جامعة الملك سعود صنعاء - مديرية السبعين - شارع بينون توفيق عبدة صالح عوض Taufiq Abdh Saleh 00804321 5/9/1972 m 00966506065323 abo_nor1@hotmail.com جامعة الملك فهد الدمام المنطقة الشرقية الحديدة - الحي التجاري بشائر عبدالله حسن حسين bashayr abdullah hassan hussain 01 29/7/1991 f 0544402724 GHROO00OOR.ONTHA@HOTMAIL.COM جدة مشاعل محمد عبدالرحمن العمودي mashael mohammed abdulrahman al amoudi 00347960 مضافه 1/ 7 /1415 هـــ f 0553517277__ 05608 trke99@hotmail.com مكه المكرمه __ العزيزيه الجنوبيه لايوجد محمد محمد قائد محمد Mohammad Mohammad Qaid Mohammad 002500623 30/05/1982 m 0595793575 abuaymenmh@gmail.com malsalhy@gmail.com السكن الجامعي - جامعة الملك سعود المسراخ-تعز سعاد حمود عوضه Souad Hammoud odah 01340458 1974l f 0507771722 dakd@lkf.ckj عبدالله صالح محمد الجفري Abdullah Saleh Mohammed Algefri 01353823 1414/02/26 m 0590526875 abood4my@hotmail.com الدمام حي النخيل ريناد سالم علي الكاف renad salem ali alkaf 01333255 25/8/1993 f 0562783833 - المنز renad.k@live.com جده - حي الزهراء - شارع حلمي كتبي عمر سعيد علي باسالم omar saeed ali basalem 01632842 1995/01/26م m 0532337121 kil1ler@windowslive.com الطايف حي العقيق شارع ا--> https://pastebin.com/api_scrape_item.php?i=jSVmH4v0 <--

yara=email_list

pigman2011@hotmail.co.uk|aids1234 benbrownbjb@live.co.uk|bened1ct little_princess_2001@hotmail.co.uk|bighead7 bendiggory@hotmail.co.uk|lornas123 lou.easton@hotmail.co.uk|speedo500 njb1g10@soton.ac.uk|cloud999 kyle@jupiterkiss.co.uk|pokemon123 bartlett99@tiscali.co.uk|isaacisaac parade10break@yahoo.co.uk|Simply123 christophermholmes@yahoo.co.uk|shutupstupid alextapley123@live.co.uk|Live_life1 jamiefelllows@hotmail.co.uk|sheffwed ismailolanrewaju81@yahoo.co.uk|olanrewaju zm123v@hotmail.co.uk|provocator1 greensamuel@hotmail.co.uk|npcosm12 annaleigh@live.co.uk|bunnyblanket paulmottram@blueyonder.co.uk|batman123 zak.corderoy22@hotmail.co.uk|aprilia125 adnana@redmoor.leics.sch.uk|amaterasu mexmasterchief@hotmail.co.uk|anonymus s.j.pendleton@hotmail.co.uk|codliver1 narx.strawberry@googlemail.co.uk|runescape matthewbarnard14@yahoo.co.uk|riotstarter intrinsic@tiscali.co.uk|mattstef master54@hotmail.co.uk|fungames r4ih44n123@hotmail.co.uk|barcelona123 jasongoulden92@live.co.uk|09321039 stormin177@yahoo.co.uk|hayabusa racheltullett@hotmail.co.uk|B4ILEYB00 mkinlock@hotmail.co.uk|smokebeats cool@yahoo.co.uk|ironhide13 calebprice@hotmail.co.uk|calebhell jools15@hotmail.co.uk|screw805 adam.ellaway@live.co.uk|minimonster99 tzmpaul@hotmail.co.uk|toggle11 rath@hotmail.co.uk|cockface anglevi2000@yahoo.co.uk|89773432 mordwyn@hotmail.co.uk|cambria1 salbert4cert@hotmail.co.uk|brolly100 buddy218uk@yahoo.co.uk|eh8phg2q

To search the pastbin continously for interesting facts get yousrself the sources of Pastehunter from GitHUB.

git clone https://github.com/kevthehermit/PasteHunter.git

Get you a pastbin pro account and create your API key


https://pastebin.com/api

And whitelist the IP you are about to scrape pastebin from and note the scrape URL for the later config.

https://pastebin.com/doc_scraping_api

Configure settings.json accordingly

/opt/PasteHunter/settings.json


{
"inputs": {
"pastebin":{
"enabled": true,
"module": "inputs.pastebin",
"api_scrape": "https://scrape.pastebin.com/api_scraping.php",
"api_raw": "https://scrape.pastebin.com/api_scrape_item.php?i=[removed for privatcy]", ← This is where you need the scrape URL from above section
"paste_limit": 200,
"store_all": false
},
"dumpz": {
"enabled": true,
"module": "inputs.dumpz",
"api_scrape": "https://dumpz.org/api/recent",
"api_raw": "https://dumpz.org/api/dump",
"paste_limit": 200,
"store_all": false
},
"gists": {
"enabled": true,
"module": "inputs.gists",
"api_token": "([removed for privatcy])",
"api_limit": 100,
"store_all": false,
"user_blacklist": [],
"file_blacklist": ["grahamcofborg-eval-package-list"]
}
},
"outputs": {
"elastic_output": {
"enabled": false,
"module": "outputs.elastic_output",
"classname": "ElasticOutput",
"elastic_index": "paste-test",
"elastic_host": "192.168.1.22",
"elastic_port": 9200,
"elastic_user": "elastic",
"elastic_pass": "changeme",
"elastic_ssl": false,
"weekly_index": true
},
"json_output": {
"enabled": true,
"module": "outputs.json_output",
"classname": "JsonOutput",
"output_path": "logs/json/",
"store_raw": true,
"encode_raw": true
},
"csv_output": {
"enabled": false,
"module": "outputs.csv_output",
"classname": "CSVOutput",
"output_path": "logs/csv/"
},
"syslog_output": {
"enabled": false,
"module": "outputs.syslog_output",
"classname": "SyslogOutput",
"host": "10.1.1.21",
"port": 514
},
"smtp_output": {
"enabled": false,
"module": "outputs.smtp_output",
"classname": "SMTPOutput",
"smtp_host": "smtp.server.com",
"smtp_port": 25,
"smtp_security": "starttls",
"smtp_user": "[removed for privatcy]",
"smtp_pass": "[removed for privatcy]",
"recipients" : {
"recipient_1": {
"address": "emailaddress that gets the alerts",
"rule_list": ["custom_keywords"],
"mandatory_rule_list": []
},
"recipient_2": {
"address": "emailaddress that gets the alerts",
"rule_list": [],
"mandatory_rule_list": ["keyword1", "keyword2"]
}
}
}
},
"yara": {
"rule_path": "YaraRules",
"blacklist": true,
"test_rules": false
},
"general": {
"run_frequency": 120,
"logging_level": 20
},
"post_process": {
"post_email": {
"enabled": true,
"module": "postprocess.post_email",
"rule_list": ["email_list"]
},
"post_b64": {
"enabled": true,
"module": "postprocess.post_b64",
"rule_list": ["b64_exe", "b64_rar", "b64_zip", "b64_gzip"],
"cuckoo": {
"enabled": false,
"api_host": "127.0.0.1",
"api_port": 8080
},
"viper": {
"enabled": false,
"api_host": "127.0.0.1",
"api_port": 8080
}
}
}
}

Create your own yara rules that will match the realy interesting stuff 

/opt/PasteHunter/YaraRules/customer_watch.yar

/*
This rule will look for ducky / bunny code
*/

rule watch_[removed for privatcy]{
meta:
author = "Marcus Pauli"
info = "Part of PasteHunter"
reference = "none"

strings:
$a1 = "[removed for privatcy]" nocase
$a2 = "[removed for privatcy]" nocase
$a3 = "[removed for privatcy]" nocase
$a4 = "[removed for privatcy]" nocase
$a5 = "[removed for privatcy]" nocase
$a6 = "[removed for privatcy]" nocase
$a7 = "leak" nocase
$a8 = "password" nocase
$a9 = "[removed for privatcy]" nocase
$a10 = "[removed for privatcy]" nocase
$a11 = "[removed for privatcy]" nocase
$a12 = "[removed for privatcy]" nocase
$a13 = "[removed for privatcy]" nocase
condition:
3 of them
}

rule watch_pauli
{
meta:
author = "Marcus Pauli"
info = "Part of PasteHunter"
reference = "none"

strings:
$a1 = "mpauli.de" nocase
$a2 = "[removed for privatcy]" nocase
$a3 = "paul-sec.com" nocase
$a4 = "[removed for privatcy]" nocase
$a5 = "[removed for privatcy]" nocase
$a6 = "[removed for privatcy]" nocase
$a7 = "[removed for privatcy]" nocase
$a8 = "marcus.pauli" nocase
condition:
1 of them
}

Have Splunk monitor the according output from PasteHunter

Create Splunk sourcetype pastebin