MadoMiner Part 2 - Mask
AlienVault
OCTOBER 29, 2018
CVE-2017-0143, SMB exploit. CVE-2017-0146, SMB exploit. Sogou.exe is the payload that contains the CPUInfo scanner, however, it has been set to scan for IPV6 addresses. In addition, in Sogou.exe, MadoMiner appears to search for IPV6 addresses that are vulnerable to EternalBlue, as well as installs some tasks. dll or x64.dll
40 
Let's personalize your content