[Snakebyte]

Windows NT samples from defon talk today:
https://www.defcon.org/html/defcon-23/d ... quis-Boire

Standard password

[Artilllerie]

Many things in the dll package :

[R136a1]

List of extracted domain names:

Code: Select all

www.divextreme-ar.com
www.crazy-jump.com
www.dive-extreme.com
www.tandemskydive-ar.com
www.groupdive.com
www.skydivelessons.com
www.bungee4you-br.com
www.brazil-crazybungee.com
www.bungeejumping-br.com
www.groupbungee-br.com

www.divextreme-au.com
www.crazyjump-uy.com
www.stuntjumps.com
www.tandemskydive-au.com
www.groupdive-au.com
www.au-skydivelessons.com
www.bungee4you-uy.com
www.uruguay-crazybungee.com
www.bungeejumping-uy.com
www.groupbungee-uy.com

www.circlesofourlives-ir.com
www.clickflowers-hk.com
www.cropcirclestours.com
www.irelancropcircles.com
www.ir-cool.com
www.magnificentcircles.com
www.china-flowershop.com
www.hongkong-bouquets.com
www.beautifuldaisies.com
www.rosesinchina.com

Last block explains why Kaspersky calls this malware "Flowershop". If you hurry up you can set up some sinkholes...

[Snakebyte]

Did Kaspersky do a writeup on this?

[Artilllerie]

Don't find anything about It on "kaspersky.com" domains, It's seem they don't cover a specifical report for this malware yet with Flowershop as name.

[RedFrank]

Nearly no activity on these C2s in the US. Any targeting information?

[R136a1]

No, there is no paper or article by Kaspersky about this threat. I was referring to the signature of the samples.

[dhuss]

Some more domains in the attached sample

Code: Select all

www.holidayapartments4you.com
www.euro-rafting.com
www.holidayapartments-Paris.com
www.paris-holidayapartments.com
www.franceholidayapartments.com
www.apartmentsin-paris.com
www.raftingholiday.com
www.eurorafting-tr.com
www.turkeyextremerafting.com
www.raftingtours-turkey.com