One ZoomEye Query Cleans BazarLoader C2s

“HTTP/1.1 404 Not found” +”Server: nginx” +”Content-Type: text/html; charset=UTF-8" +”Connection: close Date” -”Content-Length” -”<head>” -”Cache-Control”

(ssl:”System,CN” ssl:”Amadey Org,CN” ssl:”O=Global Security,OU=IT Department,CN=example.com” ssl:”NZT,CN” ssl:”O=Lero,OU=Lero” ssl:”Security,OU=Krot” ssl:”O=Shioban,OU=Shioban”) +”HTTP/1.1 404 Not found” +”Server: nginx” +”Content-Type: text/html; charset=UTF-8" -ssl:”OU=System” -ssl:digicert -”Content-Length” -”Connection: keep-alive”

https://www.zoomeye.org/searchResult?q=(ssl%3A%22System%2CCN%22%20ssl%3A%22Amadey%20Org%2CCN%22%20ssl%3A%22O%3DGlobal%20Security%2COU%3DIT%20Department%2CCN%3Dexample.com%22%20ssl%3A%22NZT%2CCN%22%20ssl%3A%22O%3DLero%2COU%3DLero%22%20ssl%3A%22Security%2COU%3DKrot%22%20ssl%3A%22O%3DShioban%2COU%3DShioban%22)%20%2B%22HTTP%2F1.1%20%20404%20Not%20found%22%20%2B%22Server%3A%20nginx%22%20%2B%22Content-Type%3A%20text%2Fhtml%3B%20charset%3DUTF-8%22%20-ssl%3A%22OU%3DSystem%22%20-ssl%3Adigicert%20-%22Content-Length%22%20-%22Connection%3A%20keep-alive%22

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store