Credentials Leaks on VirusTotal
A few weeks ago, researchers published some information about stolen credentials that were posted on Virustotal[1]. I’m keeping an eye on VT for my customers and searching for data related to them. For example, I looking for their domain name(s) inside files posted on VT. I may confirm what researchers said, there are a lot of passwords leaks shared on VTI but yesterday, there was a peak of files uploaded on this platform.
Here is the list of files I found yesterday and I’m pretty sure that it’s only the visible part of the iceberg!
-rw-r--r--@ 1 xavier rem 18925199 Mar 9 11:32 539K.TR.EMail.Pass.crackerteam.com.by-MeMaTi-22.txt -rw-r--r--@ 1 xavier rem 19723010 Mar 9 11:56 553K_TR_sauwick.txt -rw-r--r--@ 1 xavier rem 3487094 Mar 9 11:56 118k_combo_United_States.txt -rw-r--r--@ 1 xavier rem 17173723 Mar 9 11:58 518K.txt -rw-r--r--@ 1 xavier rem 4989847 Mar 9 11:59 145K-MAIL-ACCESS-VALID-HQ-COMBOLIST-MIX.txt -rw-r--r--@ 1 xavier rem 19757718 Mar 9 12:00 632k.txt -rw-r--r--@ 1 xavier rem 6557939 Mar 9 12:01 200K-NL.txt
It was time to gather some statistics. The total amount of credentials collected yesterday was 2.713.282. Amongst them, 2.163.756 were unique. Here is the top-30 of domain names extract from email addresses:
732702 hotmail.com 281541 aol.com 210844 gmail.com 206774 yahoo.com 67424 live.nl 63512 wanadoo.nl 59580 web.de 58987 hotmail.de 49680 comcast.net 48233 mail.com 45333 gmx.de 37792 mail.ru 26356 wanadoo.fr 26196 yandex.ru 25930 rambler.ru 19759 msn.com 19449 mynet.com 17839 orange.fr 17107 yahoo.ca 14748 aim.com 14596 hotmail.fr 14051 t-online.de 13265 live.de 12756 ymail.com 12748 live.com 10990 windowslive.com 10539 bellsouth.net 10167 arcor.de 9745 hotmail.nl
On the opposite, let's search for interesting domain names like the ones that contain the string ".gov":
86 tmo.gov.tr 85 sgk.gov.tr 60 icisleri.gov.tr 23 iskur.gov.tr 17 gsgm.gov.tr 16 saglik.gov.tr 16 estb.moe.gov.sa 12 rb.moe.gov.sa 12 gumruk.gov.tr 11 milliemlak.gov.tr 9 mkhb.moe.gov.sa 8 mkhg.moe.gov.sa 7 eskisehir-bld.gov.tr 6 schools.bedfordshire.gov.uk 6 sanayi.gov.tr 6 rg.moe.gov.sa 6 mb.moe.gov.sa 6 istanbul.gov.tr 5 egm.gov.tr 5 antalyadefterdarligi.gov.tr 4 tbmm.gov.tr 4 r1.deped.gov.ph 4 ncr2.deped.gov.ph 4 isparta.gov.tr 4 gumushane.gov.tr 4 denizli.gov.tr 4 casur.gov.co 4 balikesirozelidare.gov.tr 4 antalyasm.gov.tr 3 zonguldakdef.gov.tr 3 vks.gov.vn 3 ubak.gov.tr 3 tuik.gov.tr 3 r4a-1.deped.gov.ph 3 jzb.moe.gov.sa 3 ibb.gov.tr 3 estg.moe.gov.sa 3 eskisehirozelidare.gov.tr 3 dtm.gov.tr 3 adalet.gov.tr 3 abgs.gov.tr 2 trabzonnumune.gov.tr 2 tpao.gov.tr 2 thainguyen.gov.vn 2 tedas.gov.tr 2 tcmb.gov.tr 2 tarimnet.gov.tr 2 state.gov 2 sgk.gov 2 sayistay.gov.tr 2 saomanuel.sp.gov.br 2 r7-2.deped.gov.ph 2 petrol.tpao.gov.tr 2 osmaniyeailedanisma.gov.tr 2 nnptnt.daklak.gov.vn 2 nevsehirdefterdarligi.gov.tr 2 nevsehir.gov.tr 2 ncr1.deped.gov.ph 2 mg.moe.gov.sa 2 meteor.gov.tr 2 meteo.gov.mk 2 meb.gov.tr 2 malatya.gov.tr 2 koski.gov.tr 2 kosgeb.gov.tr 2 kirikkaleilozelidare.gov 2 kep.gov.gr 2 kayseridis.gov.tr 2 kayseri-meb.gov.tr 2 karamansm.gov.tr 2 jpd.gov.lv 2 istanbul.mfa.gov.il 2 iski.gov.tr 2 health.wa.gov. 2 hazine.gov.tr 2 halton.gov.uk 2 gsim.gov.tr 2 giresunsaglik.gov.tr 2 giresun.gov.tr 2 fsco.gov.on.ca 2 fbi.gov 2 euas.gov.tr 2 etimaden.gov.tr 2 erzurumozelidare.gov.tr 2 ego.gov.tr 2 edu.madeira.gov.pt 2 doj.ca.gov 2 dmo.gov.tr 2 diyanet.gov.tr 2 denizlidh.gov.tr 2 cdcr.ca.gov 2 byegm.gov.tr 2 bybs.gov.tr 2 bilecikdh.gov.tr 2 banbridge.gov.uk 2 asrb.moe.gov.sa 2 artvinozelidare.gov.tr 2 artvinkhb.gov.tr 2 ardahandh.gov.tr 2 antalya.gov.tr.tr.tr 2 ankaracocuk.gov.tr 2 ankara-bel.gov.tr 2 angkasa.gov.my 2 afyonkarahisar.gov.tr 2 act.gov.au 1 wcb.gov.ns.ca 1 vargemgrandepta.sp.gov.br 1 usarec.gov 1 tunja.gov.co 1 tubitak.gov.tr 1 te.vte.gov.lb 1 southtyneside.gov.uk 1 southsomerset.gov.uk 1 seduc.go.gov.br 1 sec.gov 1 saocarlos.sp.gov.br 1 sanliurfaozelidare.gov.tr 1 sanjuan.gov.ar 1 redencao.pa.gov.br 1 r9.deped.gov.ph 1 r11.deped.gov.ph 1 qsmg.moe.gov.sa 1 ptc.gov.ye 1 psa.gov.ph 1 policiacientifica.sp.gov.br 1 plymouth.gov.uk 1 ouropreto.mg.gov.br 1 mto.gov.on.ca 1 mkek.gov.tr 1 mirempet.gov.ao 1 mgs.gov.on.ca 1 mgm.gov.tr 1 memphistn.gov 1 mbs.gov.on.ca 1 masfamu.gov.ao 1 mail.gov.nl.ca 1 leicester.gov.uk 1 la.gov 1 kirklees.gov.uk 1 kent.gov.uk 1 jzg.moe.gov.sa 1 jus.gov.on.ca 1 jatai.go.gov.br 1 jaguaribe.ce.gov.br 1 inder.gov.co 1 highways.gov.sk.ca 1 gems9.gov.bc.ca 1 gems2.gov.bc.ca 1 finance.gov.sr 1 finance.gov.sk.ca 1 faan.gov.ng 1 etec.sp.gov.br 1 ene.gov.on.ca 1 educacao.sp.gov.br 1 educacao.mt.gov.br 1 educ.somerset.gov.uk 1 edu.lagosstate.gov.ng 1 ebserh.gov.br 1 dolma.gov.np 1 dl.gov.cn 1 dh.gsi.gov.uk 1 dgs.ca.gov 1 dfg.ca.gov 1 defra.gsi.gov.uk 1 curionopolis.pa.gov.br 1 css.gov.on.ca 1 crt01.gov.br 1 cefospe.pe.gov.br 1 cdph.ca.gov 1 cbm.ba.gov.br 1 calepa.ca.gov 1 bury.gov.uk 1 botas.gov.tr 1 aphis.usda.gov 1 angiang.gov.vn
Then, I used the good old tool "pipal" created by DigiNinga to generate some statistics about the passwords' strength. Pipal[2] is an old tool but it's doing a great job. Here are the basic Results
Total entries = 2711303 Total unique entries = 1547231 Top 10 passwords galatasaray = 33943 (1.25%) istanbul = 27191 (1.0%) fenerbahce = 26108 (0.96%) 123456 = 19312 (0.71%) 123456789 = 13660 (0.5%) besiktas = 13614 (0.5%) ankara = 13551 (0.5%) yasemin = 7328 (0.27%) antalya = 6030 (0.22%) trabzon = 5705 (0.21%) Top 10 base words istanbul = 52725 (1.94%) galatasaray = 47861 (1.77%) fenerbahce = 37905 (1.4%) ankara = 32097 (1.18%) besiktas = 23710 (0.87%) trabzon = 14174 (0.52%) antalya = 13206 (0.49%) yasemin = 12977 (0.48%) malatya = 12135 (0.45%) sakarya = 10643 (0.39%) Password length (length ordered) 1 = 452 (0.02%) 2 = 318 (0.01%) 3 = 2890 (0.11%) 4 = 9331 (0.34%) 5 = 23670 (0.87%) 6 = 312288 (11.52%) 7 = 401317 (14.8%) 8 = 849978 (31.35%) 9 = 380064 (14.02%) 10 = 313613 (11.57%) 11 = 173130 (6.39%) 12 = 100220 (3.7%) 13 = 44323 (1.63%) 14 = 31227 (1.15%) 15 = 31763 (1.17%) 16 = 12971 (0.48%) 17 = 5404 (0.2%) 18 = 5632 (0.21%) 19 = 2393 (0.09%) 20 = 2034 (0.08%) 21 = 1007 (0.04%) 22 = 1255 (0.05%) 23 = 852 (0.03%) 24 = 959 (0.04%) 25 = 489 (0.02%) 26 = 310 (0.01%) 27 = 225 (0.01%) 28 = 203 (0.01%) 29 = 177 (0.01%) 30 = 183 (0.01%) 31 = 70 (0.0%) 32 = 1909 (0.07%) 33 = 96 (0.0%) 34 = 42 (0.0%) 35 = 24 (0.0%) 36 = 32 (0.0%) 37 = 18 (0.0%) 38 = 66 (0.0%) 39 = 22 (0.0%) 40 = 264 (0.01%) 41 = 5 (0.0%) 42 = 3 (0.0%) 43 = 4 (0.0%) 44 = 6 (0.0%) 45 = 4 (0.0%) 46 = 1 (0.0%) 47 = 1 (0.0%) 48 = 2 (0.0%) 50 = 15 (0.0%) 51 = 1 (0.0%) 52 = 3 (0.0%) 53 = 5 (0.0%) 54 = 2 (0.0%) 60 = 2 (0.0%) 65 = 4 (0.0%) 68 = 1 (0.0%) 69 = 1 (0.0%) 70 = 1 (0.0%) 80 = 1 (0.0%) 81 = 3 (0.0%) 83 = 1 (0.0%) 85 = 3 (0.0%) 86 = 6 (0.0%) 87 = 1 (0.0%) 89 = 2 (0.0%) 90 = 4 (0.0%) Password length (count ordered) 8 = 849978 (31.35%) 7 = 401317 (14.8%) 9 = 380064 (14.02%) 10 = 313613 (11.57%) 6 = 312288 (11.52%) 11 = 173130 (6.39%) 12 = 100220 (3.7%) 13 = 44323 (1.63%) 15 = 31763 (1.17%) 14 = 31227 (1.15%) 5 = 23670 (0.87%) 16 = 12971 (0.48%) 4 = 9331 (0.34%) 18 = 5632 (0.21%) 17 = 5404 (0.2%) 3 = 2890 (0.11%) 19 = 2393 (0.09%) 20 = 2034 (0.08%) 32 = 1909 (0.07%) 22 = 1255 (0.05%) 21 = 1007 (0.04%) 24 = 959 (0.04%) 23 = 852 (0.03%) 25 = 489 (0.02%) 1 = 452 (0.02%) 2 = 318 (0.01%) 26 = 310 (0.01%) 40 = 264 (0.01%) 27 = 225 (0.01%) 28 = 203 (0.01%) 30 = 183 (0.01%) 29 = 177 (0.01%) 33 = 96 (0.0%) 31 = 70 (0.0%) 38 = 66 (0.0%) 34 = 42 (0.0%) 36 = 32 (0.0%) 35 = 24 (0.0%) 39 = 22 (0.0%) 37 = 18 (0.0%) 50 = 15 (0.0%) 44 = 6 (0.0%) 86 = 6 (0.0%) 41 = 5 (0.0%) 53 = 5 (0.0%) 43 = 4 (0.0%) 45 = 4 (0.0%) 65 = 4 (0.0%) 90 = 4 (0.0%) 42 = 3 (0.0%) 52 = 3 (0.0%) 81 = 3 (0.0%) 85 = 3 (0.0%) 48 = 2 (0.0%) 54 = 2 (0.0%) 60 = 2 (0.0%) 89 = 2 (0.0%) 46 = 1 (0.0%) 47 = 1 (0.0%) 51 = 1 (0.0%) 68 = 1 (0.0%) 69 = 1 (0.0%) 70 = 1 (0.0%) 80 = 1 (0.0%) 83 = 1 (0.0%) 87 = 1 (0.0%) | | | | | | | | || || |||| |||| ||||| ||||| |||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 000000000011111111112222222222333333333344444444445555555555666666666677 012345678901234567890123456789012345678901234567890123456789012345678901 One to six characters = 348949 (12.87%) One to eight characters = 1600244 (59.02%) More than eight characters = 1111059 (40.98%) Only lowercase alpha = 964588 (35.58%) Only uppercase alpha = 15068 (0.56%) Only alpha = 979656 (36.13%) Only numeric = 367723 (13.56%) First capital last symbol = 33154 (1.22%) First capital last number = 149291 (5.51%) Single digit on the end = 199328 (7.35%) Two digits on the end = 363743 (13.42%) Three digits on the end = 158454 (5.84%) Last number 0 = 137616 (5.08%) 1 = 247000 (9.11%) 2 = 133639 (4.93%) 3 = 176774 (6.52%) 4 = 121218 (4.47%) 5 = 114059 (4.21%) 6 = 129914 (4.79%) 7 = 111782 (4.12%) 8 = 105108 (3.88%) 9 = 108479 (4.0%) | | | | | | | | | | |||| | |||||||| | |||||||||| |||||||||| |||||||||| |||||||||| |||||||||| |||||||||| |||||||||| 0123456789 Last digit 1 = 247000 (9.11%) 3 = 176774 (6.52%) 0 = 137616 (5.08%) 2 = 133639 (4.93%) 6 = 129914 (4.79%) 4 = 121218 (4.47%) 5 = 114059 (4.21%) 7 = 111782 (4.12%) 9 = 108479 (4.0%) 8 = 105108 (3.88%) Last 2 digits (Top 10) 23 = 79010 (2.91%) 12 = 40311 (1.49%) 56 = 34572 (1.28%) 11 = 31147 (1.15%) 00 = 30333 (1.12%) 89 = 29147 (1.08%) 01 = 27355 (1.01%) 34 = 26567 (0.98%) 07 = 24614 (0.91%) 10 = 23597 (0.87%) Last 3 digits (Top 10) 123 = 65452 (2.41%) 456 = 27030 (1.0%) 789 = 18101 (0.67%) 234 = 11293 (0.42%) 000 = 10709 (0.39%) 345 = 8833 (0.33%) 321 = 8071 (0.3%) 007 = 6489 (0.24%) 111 = 6127 (0.23%) 907 = 5942 (0.22%) Last 4 digits (Top 10) 3456 = 24279 (0.9%) 6789 = 15731 (0.58%) 1234 = 10306 (0.38%) 2345 = 8016 (0.3%) 1907 = 5648 (0.21%) 1905 = 5373 (0.2%) 1903 = 4359 (0.16%) 4321 = 3835 (0.14%) 1987 = 3833 (0.14%) 2000 = 3696 (0.14%) Last 5 digits (Top 10) 23456 = 24016 (0.89%) 56789 = 15559 (0.57%) 12345 = 7812 (0.29%) 45678 = 3400 (0.13%) 54321 = 3215 (0.12%) 23123 = 2993 (0.11%) 34567 = 2841 (0.1%) 11111 = 2441 (0.09%) 00000 = 2178 (0.08%) 67890 = 2073 (0.08%) Character sets loweralphanum: 1017832 (37.54%) loweralpha: 964588 (35.58%) numeric: 367723 (13.56%) mixedalphanum: 177478 (6.55%) mixedalpha: 38905 (1.43%) mixedalphaspecialnum: 32426 (1.2%) loweralphaspecialnum: 29438 (1.09%) upperalphanum: 28480 (1.05%) loweralphaspecial: 18937 (0.7%) upperalpha: 15068 (0.56%) mixedalphaspecial: 8315 (0.31%) specialnum: 5449 (0.2%) upperalphaspecialnum: 1824 (0.07%) upperalphaspecial: 596 (0.02%) special: 99 (0.0%) Character set ordering allstring: 1018561 (37.57%) stringdigit: 907054 (33.45%) alldigit: 367723 (13.56%) othermask: 160397 (5.92%) digitstring: 101157 (3.73%) stringdigitstring: 80481 (2.97%) digitstringdigit: 36441 (1.34%) stringspecialdigit: 14594 (0.54%) stringspecial: 12641 (0.47%) stringspecialstring: 10952 (0.4%) specialstring: 671 (0.02%) specialstringspecial: 532 (0.02%) allspecial: 99 (0.0%)
These statistics must be read carefully because there is no way to verify their accuracy. Many times, such files are based on very old leaks and probably most of the passwords are not valid anymore (or the account).
[1] https://www.darkreading.com/threat-intelligence/researchers-explore-hacking-virustotal-to-find-stolen-credentials
[2] https://github.com/digininja/pipal
Xavier Mertens (@xme)
Xameco
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key
Reverse-Engineering Malware: Advanced Code Analysis | Singapore | Nov 18th - Nov 22nd 2024 |
Comments
Anonymous
Mar 10th 2022
2 years ago