[PX5]

I wanna run marks original harnig loader in another live enviroment to see if the UA is ver64 or ver63, usually follows the decrypted strings for the UA, may be why not much was seen.

[PX5]

Marks loader is a bit different than the other I ran, links look about the same but the UA is definitly different, they seem to know I have eSobi installed on this desktop.

EDIT: Desktop is running like death sucking on a lifesaver factory. :lol:

Definitly got some different critters in that load.

accrowd.com/timuo/cptrlg.php?adv=adv523
accrowd.com/timuo/hyfaitavt.php?adv=adv523
accrowd.com/timuo/izgowq.php?adv=adv523
accrowd.com/timuo/iztbjhowu.php?adv=adv523
accrowd.com/timuo/kbwdyfeyta.php?adv=adv523
accrowd.com/timuo/mmaucwe.php?adv=adv523
accrowd.com/timuo/ocwrykrz.php?id=269171479&p=0
accrowd.com/timuo/qhlkrzhf.php?adv=adv523
accrowd.com/timuo/sjnlgn.php?adv=adv523
accrowd.com/timuo/tyfnhc.php?adv=adv523
accrowd.com/timuo/ultamgbih.php?adv=adv523
accrowd.com/timuo/xavdxsz.php?adv=adv523
accrowd.com/timuo/xbvqxsa.php?adv=adv523
accrowd.com/timuo/zptfzubjhp.php?adv=adv523&code1=HNJJ&code2=1171&id=269171479&p=0&b=1

bccorps.com/timuo/hyfaitavt.php?adv=adv523
bccorps.com/timuo/tyfnhc.php?adv=adv523
bccorps.com/timuo/xavdxsz.php?adv=adv523
bccorps.com/timuo/xbvqxsa.php?adv=adv523

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; eSobiSubscriber 2.0.4.16)ver64


Same friends as before it appears, I cant reach the url with the rar either which is Rusty himself. :cry:

204.45.118.202/23/aok
204.45.118.202/23/exc
204.45.118.202/23/iok
204.45.118.202/23/lok
204.45.118.202/23/run
204.45.121.42/jwyydjnmbne.rar

lolz@FakeAV

[EP_X0FF]

Malware package identical to those I uploaded before.

It also includes Trojan:Win32/Rimecud, Backdoor Darkness, another Harnig and a few Win32 Autorunner droppers. Poor user of PC who get this package installed.

[markusg]

there is new multible dropper. the only new file is
citistep.info/pnk5/spa12.exe
http://www.virustotal.com/file-scan/rep ... 1293708249

the rest is:

citistep.info/pnk5/am1msgr.exe
citistep.info/pnk5/c2csr.exe
citistep.info/pnk5/i4xcoms.exe
citistep.info/pnk5/ispcd.exe
dropper:
dlsvc32.exe
http://www.virustotal.com/file-scan/rep ... 1293708492

[EP_X0FF]

spa12.exe is TDL4

[main]
version=0.03
aid=30020
sid=0
rnd=1383384898
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://9669b6b96b.com/;hxxps://86b6b96b.com/;hxxps://lkaturl11.com/;hxxps://kangojjm1.com/;hxxps://lkaturl71.com/
wsrv=hxxp://gnorenyawr.com/;hxxp://runderwayr.com/;hxxp://jikdoout0.com/hxxp://swltch0o.com/;hxxp://rammjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.15

[markusg]

dropper
compb.exe
http://www.virustotal.com/file-scan/rep ... 1294401448
files i got are attached
xtrips.info:88/api/w5ptis.exe
xtrips.info:88/bz2/admn.exe
xtrips.info:88/bz2/crlss.exe