[rkhunter]

http://blog.webroot.com/2012/03/29/spam ... crimeware/
https://twitter.com/#!/msftmmpc/status/ ... 3912094720

[thisisu]

Is this Fareit?
MD5: eb3ef30274d4c79a70262596525c31be

Code: Select all

G Data	Trojan.ZBot.HUJ (Engine A)
DrWeb	 Trojan.PWS.Siggen.35074
Ikarus	Trojan.Crypt!IK

https://www.virustotal.com/file/264fc19 ... /analysis/

[rkhunter]

Is this Fareit?
MD5: eb3ef30274d4c79a70262596525c31be

Yep.

[dumb110]

http://www3.malekal.com/malwares/index. ... 6da4490289
anybody??

also does anybody have the new files for the police themed and UKASH ransom??

[Win32:Virut]

http://www3.malekal.com/malwares/index. ... 6da4490289
anybody??

[Xylitol]

From bh 108.178.59.25/a.php?e=5&f=0e44a
Just got interested into this threat
exploits -> payloads -> zeusV3 -> pwd stealer and/or rogue/fake soft
https://www.virustotal.com/file/bfd5046 ... 342385814/
https://www.virustotal.com/file/a1b36aa ... 342385371/
Microsoft don't detect it :mrgreen:

Code: Select all

hxxp://sam-latrilogie.com:8080/pony/gate.php
hxxp://loceanic.fr:8080/pony/gate.php
hxxp://viveroparadiso.com.ar/NSyf.exe
hxxp://uppalneurohospital.com/x7nx.exe
hxxp://greatroastcoffee.com/w1HjW1.exe

gate.php <- If gate/pony so Blackhole and the rest
.exe files -> zeus & cie.

Pony C&C:

Code: Select all

hxxp://80.248.208.162:8080/pony/admin.php (sam-latrilogie.com)
hxxp://194.146.227.48:8080/pony/admin.php (loceanic.fr)
hxxp://176.31.255.41:81/pony/admin.php (etsiunjour.fr)

Abuse already sent to OVH but no reaction.
Look's like they use pony to get accounts/credentials and use them for bh/pony/etc or to host pe on compromised machines

Also have a look here, kafeine have do an awesome work:
http://malware.dontneedcoffee.com/2012/ ... ny-17.html

[Xylitol]

Just got my virtual machine infected with blackhole at 80.248.208.162:8080/view.php
Pony c&c: akamaifilms.com:81/pony/admin.php
• dns: 1 ›› ip: 69.175.8.106 - adresse: AKAMAIFILMS.COM
https://www.virustotal.com/file/c1399c5 ... 342765865/

[Xylitol]

https://www.virustotal.com/file/167e561 ... 345115834/

[resercher]

TModule_CuteFTP
TModule_FlashFXP
TModule_FileZilla
TModule_FTPCommander
TModule_BProofFTP
TModule_SmartFTP
TModule_TurboFTP
TModule_FFFTP
TModule_CoreFTP
...

These strings are from PWS:Win32/LdPinch family

[kloent]

https://www.virustotal.com/file/6c5c151 ... 355224213/
SHA1: 99285fb02077d1b794fa2bfc71d8137ad19c47e7
MD5: 736fd0887eabaffcfefbf7dfa47cac0a