A forum for reverse engineering, OS internals and malware analysis 

Backdoor Blackshades NET

Forum for analysis and discussion about malware.

Re: Malware/VB (Autorunners, PWS)

 #5449  by EP_X0FF
 Sat Mar 12, 2011 3:44 pm
markusg wrote:Patch.exe
http://www.virustotal.com/file-scan/rep ... 1299937869
Blackshades NET joined with Roboform7 patcher, according to forum rules attach has been removed.
Extracted bot attached, posts moved.
Attachments
pass: malware
(388.23 KiB) Downloaded 56 times

Re: Malware/Not classified

 #5451  by nullptr
 Sun Mar 13, 2011 4:21 am
markusg wrote:pg_ctl1.exe
http://www.virustotal.com/file-scan/rep ... 1299947982
This is Blackshades NET - C:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
Runs as %USERPROFILE%\Application Data\Msnupdate8799.exe
bss_server
usrReverseRelay
usrRelay
tmrLiveLogger
tmrIntervalUpdate
_extentx
_extenty
tmrGrabber
sckFormGrab
bss_server.usrRelay
tmrFocus
tmrAlarms
picThumb
picThumbSize
tmrDoWork
tmrPersistant
tmrWebHide
tmrInfoTO
sckInfo
bss_server.Socket
tmrAudio
sckServer
tmrCrazy
picWC
tmrAlive
tmrScreenshot
tmrDOS
tmrInaktivitet
picScreenshot
tmrSprid
tmrSpara
tmrAnslut
sckTransfer
modFuctions
modOS
modSpread
modAPI
modSS
modSocketMaster
CSocketMaster
socket
frmSck
usrRelay
modIInet
modICallBack
WinInetAsync
modPWs
modLaunchWeb
cCDECL
cFFPD
modRegistry
cSubCls
iSubCls
modSniff
modSqueezer
modAudio
frmHijack
modHijack
frmChat
modInfect
modTorrentSeed
modInjPE
modCrypt
cImage
modScreencap
mWinsock
modBtKiller
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
{00020404-0000-0000-C000-000000000046}
tmrDoWork
tCE
AIJ
BtmrIntervalUpdate
tmrDOS
tmrInfoTO
tmrAlarms
tmrSprid
sckServer
picThumbSize
tmrInaktivitet
picThumb
tmrPersistant
picScreenshot
tmrScreenshot
tmrAlive
tmrLiveLogger
K6sckInfo
tmrAudio
tmrCrazy
tmrAnslut
tmrSpara
Form
tmrFocus
tmrWebHide
MTheBrowser
C_Mutex
Delay
iSubCls_Antes
iSubCls_Despues
GetBrowserName2
PATH_WINLOGON
TheBrowser_BeforeNavigate2
TheBrowser_OnQuit
BROWSER_FB_DocumentComplete
BROWSER_FB_OnQuit
FACEBOOK_START
+ lots more
Uses WH_KEYBOARD_LL and WH_MESSAGE hooks to log data to a DAT file in same directory as executable.
Connected to hxxp://smellyass.zapto.org
 Return to “Malware”