[dumb110]

Thank for the analysis EP_XOFF :)

I got those samples from USB by sharing it with my friend who is infected currently,today I will be probably going to cleanse his machine off,I will post here if I find anything interesting.

I checked the detection of desktop.ini file with virustotal and to my suprise Emsisoft didnt detect it but avast did ;)

Thanks again!

[rough_spear]

Hi,

Gamarue dropper.

md5 - f3763d17f0a2b9a64acdceccaf4321d5

Regards,

rough_spear. ;)

[rough_spear]

Hi,

one more gamarue sample.

MD5 - ADA72F13FA24346C5B6704EAF8285079

VT - https://www.virustotal.com/en/file/817f ... /analysis/

Regards,

rough_spear.

[TwinHeadedEagle]

Another dropper :)

MD5 - e4f4ae24234743e3cf9b8483a06ad2bd

VT Link: https://www.virustotal.com/en/file/cc14 ... /analysis/

[SomeUnusedName]

And another researcher fell for its fake backdoor: http://joe4security.blogspot.ch/2013/08 ... wrong.html

[p4r4n0id]

And another researcher fell for its fake backdoor: http://joe4security.blogspot.ch/2013/08 ... wrong.html

sample attached

[dumb110]

Behaves just like the sample I posted previously.

[Win32:Virut]

https://www.virustotal.com/en/file/6c74 ... 380029338/

[forty-six]

https://www.virustotal.com/en/file/7bb5 ... /analysis/

[marauder]

- andromeda with default key [d40e75961383124949436f37f45a8cb6] used to drop so called "vbclip" - malware that changes bank account in clipboard ;]
https://www.virustotal.com/pl/file/e812 ... /analysis/
CNC has been utilized two days ago.