IRC reddit / irc ---------------------------------------------------------------------- hedinc · 2016-02-08 12:40 Is there a server/channel that deals with infosec? Like ip's, domains and similar information? ---------------------------------------------------------------------- svn · 2016-02-08 21:05 IPs of what? ---------------------------------------------------------------------- [deleted] · 2016-02-08 22:08 [removed] ---------------------------------------------------------------------- Japex · 2016-02-09 05:49 irc.arabs.ps #arab ---------------------------------------------------------------------- DefunctKernel · 2016-02-12 20:25 This is very vague. Do you just want a general infosec channel? ---------------------------------------------------------------------- [deleted] · 2016-02-14 16:33 [deleted] ---------------------------------------------------------------------- hedinc · 2016-02-14 16:34 Thanks man, I'll check it out...let you know if it's along the lines of what I was seeking ---------------------------------------------------------------------- hedinc · 2016-02-14 16:35 Sorry for the delay- life and all...I was actually looking for w that goes a bit deeper than say, r/security. Researchers showing off their work, intelligence information, etc. That a bit more specific? ---------------------------------------------------------------------- hedinc · 2016-02-14 17:14 IP's domains, MD5's of potential malicious activity...most sites share similar information anyway so I'm wondering if IRC has any information that might be unique or provide added insight ---------------------------------------------------------------------- FreshPrinceOfNowhere · 2016-02-24 03:24 > IP's domains, MD5's of potential malicious activity Humor me. In your own words, can you explain what are IPs, domains and MD5s of potential malicious activity? ---------------------------------------------------------------------- hedinc · 2016-02-24 04:30 We'll use this as an example. Since some of this work has been performed via sandboxed analysis, we'll take this and start here. Audio-23-02-2016.exe SHA256 HASH - d2224c01a55c725bcf831f230cd21e61fa9cc5c38810541eb5299f369e0d06ae Submitted on February 23rd 2016 21:37:50 (CST) to environment group Windows 7 32 bit Threat Score: 100/100 - Pretty much confirmed as a malicious file as sample contains signature combinations unique to malicious reports as well as identified as malicious by a large number of Antivirus engines (17/55) as of 45 mins ago- Also refer to: https://www.virustotal.com/en/file/d2224c01a55c725bcf831f230cd21e61fa9 cc5c38810541eb5299f369e0d06ae/analysis/ Found potential URL in binary/memory Pattern match: "http://213.136.74.17/documentos/modulos/" Pattern match: "http://www.csantaclara.com.br/plugins/tmp/index.php" Pattern match: "http://213.136.74.17/documentos/starts/" Pattern match: "http://213.136.74.17/documentos/complementos/" Pattern match: "http://177.70.97.88/work/motog6/index.php" Network Related - Found potential IP address in binary/memory - Uses a User Agent typical for browsers, although no browser was launched - Contacts server - GETs files from a webserver HTTP Header Information Endpoint Method/Response URL/Code 213.136.74.17:80 GET /documentos/modulos/app01 GET /documentos/modulos/app01 HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 213.136.74.17 Connection: Keep-Alive I'm just saying- if you saw any of this information in the form of hashes, IP's or domains sitting on logs on your endpoints, net traffic or AV logs this activity wouldn't warrant a slight bit of looking into? Edit: Don't click any of those links ---------------------------------------------------------------------- FreshPrinceOfNowhere · 2016-02-24 04:57 Ah, so you're looking for hashes of malware and lists of known malicious domains/IPs? You really should have phrased your question better, it lacks context and therefore gave me the impression that it's a question of similar caliber [this](https://www.youtube.com/watch?v=SXmv8quf_xM) :) ---------------------------------------------------------------------- hedinc · 2016-02-24 06:46 Pedantic request to humor you fulfilled: I'm pretty sure you had the slightest idea of what I was getting at, although I probably could have been a bit more thorough in the phrasing of what I was looking for. Albeit, any bloke can look up IOC's on various and well known OSINT websites, but I'm asking for IRC channels that contain more unique information; a real community of people sharing and consuming information alike. I haven't been on IRC in a long time and I wanted to get back into it a bit. So aside from cursory queries and cynical context corrections, whaddya got for me? PS That kid had no idea what he was doing. I took 30 seconds to ask a little question on Reddit that probably just needed to be rephrased. This kid took 4 minutes to completely butcher the concept of tracert and sounded confident as heck doing it ---------------------------------------------------------------------- FreshPrinceOfNowhere · 2016-02-24 08:32 I genuinely thought you may be like that kid, hence the query. Anyways, try [these](http://sneakerhax.com/so-you-want-to-infosec/) and ask around there, I guess. ---------------------------------------------------------------------- hedinc · 2016-02-24 16:27 Nah, I'm nothing like that kid, but at least he's trying. Appreciate the infosec info, I'll be looking into that site and branch out from there. Thanks!