Sakura Exploit Kit

Some things that have been useful in catching Sakura lately.

Landing – hq5jj.grantsfork12schools.net:88/forum/he.php
PDF – hq5jj.grantsfork12schools.net:88/forum/late_between.php (application/pdf)
JAR – hq5jj.grantsfork12schools.net:88/forum/late_between.php (application/x-java-archive)
EXE – hq5jj.grantsfork12schools.net:88/forum/8632.htm (application/octet-stream) – likey from pdf

Landing

HTTP Request Method = GET
HTTP URI contains /forum/ OR /articles/ OR /page/ OR /pages/ OR /docs/ OR /blog/ OR /wiki/
Regex HTTP URI for :((8|9)[0-9]|443|9090)\/(forum|articles|pages?|docs|blog|wiki)\/[a-z-_]+\.php$

PDF

HTTP Request Method = GET
HTTP URI contains /forum/ OR /articles/ OR /page/ OR /pages/ OR /docs/ OR /blog/ OR /wiki/
Content type = application/pdf
Regex HTTP URI for :((8|9)[0-9]|443|9090)\/(forum|articles|pages?|docs|wiki)\/[a-z_-]+\.php$

JAR

HTTP Request Method = GET
HTTP URI contains /forum/ OR /articles/ OR /page/ OR /docs/ OR /pages/ OR /blog/ OR /wiki/
Content type = application/x-java-archive
Regex HTTP URI for :((8|9)[0-9]|443|9090)\/(forum|articles|pages?|docs|wiki)\/[a-z-_]+\.php$

EXE

HTTP Request Method = GET
HTTP URI contains /forum/ OR /articles/ OR /page/ OR /pages/ OR /docs/ OR /blog/ OR /wiki/
Content type = application/octet-stream
Regex HTTP URI for :((8|9)[0-9]|443|9090)\/(forum|articles|pages?|docs|blog|wiki)\/

See more examples of Sakura Exploit Kit on URLquery.net

Thanks to @Set_Abominae for helping to keep this up to date!

Comments are closed.