A forum for reverse engineering, OS internals and malware analysis 

Rogue Antimalware (FakeAV, 2011 year)

Forum for analysis and discussion about malware.
 Topic locked

Re: Rogue antimalware (FakeAV, FakeAlert)

 #6169  by Xylitol
 Tue May 03, 2011 9:25 am
WindowsRecovery / CleanThis (?) / AntiVirus AntiSpyware 2011

Image

http://www.virustotal.com/file-scan/rep ... 1304414164
http://www.virustotal.com/file-scan/rep ... 1304414215

edit: CleanThis (not tested but i guess)
http://www.virustotal.com/file-scan/rep ... 1304404783

edit: AntiVirus AntiSpyware 2011
Image
http://www.virustotal.com/file-scan/rep ... 1304427147
Attachments
See archive comment for password
(4.45 MiB) Downloaded 65 times
See archive comment for password
(1.22 MiB) Downloaded 60 times
See archive comment for password
(876.01 KiB) Downloaded 61 times
Last edited by Xylitol on Tue May 03, 2011 1:04 pm, edited 4 times in total.

Fake scanner pages

 #6170  by ngyikp
 Tue May 03, 2011 11:38 am
You need to spoof the referer in order for most of it to work, if you don't, you either get a fake 404 or redirected to google.com

hxxp://mercadorpersa.com.br/KkxO7pT/
hxxp://www.mypuppylicious.com/xpWSXzT/
hxxp://www.digc.com.mx/zr-guggenheim-museum-wiki/
hxxp://gereedschapwinkelplein.nl/mx-prince-charles-age/
hxxp://www.baraniak.eu/lp-news-channel-9/
hxxp://hailhousecall.com/oqsdd.php?id=fantasy%20baseball%202011%20rankings
hxxp://casaa.net/pnhbd.php?off=jane%20austen%20bio
hxxp://beaconofhopeministry.org/sbxct.php?do=who%20won%20the%20oscars%20in%202011
hxxp://healthylifestylecontest.com/sxhfp.php?on=bocelli%20concert
hxxp://wingsofgoldmc.com/xzjbs.php?t=beads%20of%20courage%20pepsi
hxxp://www.perryogden.com/yjtpx.php?sell=comed%20chicago
hxxp://houseofjoy.info/ugueh.php?go=strangers%20no%20more%20karen%20goodman
hxxp://jimcraigmyle.com/icqdt.php?m=gamespyid.com
hxxp://formmail.zwebsolutions.com/appearance/dish/page.php?k=operation-flashpoint-red-river-ign
hxxp://scaner-ccinf.tk/
hxxp://64.120.250.131

Re: Rogue antimalware (FakeAV, FakeAlert)

 #6191  by Xylitol
 Wed May 04, 2011 11:56 am
AntiVirus Antispyware 2011 / CleanThis / MS Removal Tool
All repack, low detection.

Image
.: AntiVirus Antispyware 2011
VT: 1/42 >> 2.4%
https://www.virustotal.com/file-scan/re ... 1304508668

Image
.: CleanThis
VT: 3/41 >> 7.3%
http://www.virustotal.com/file-scan/rep ... 1304510960

Image
.: MS Removal Tool
VT: 4/41 >> 9.8%
https://www.virustotal.com/file-scan/re ... 1304509604
Attachments
see archive comment for password
(627.76 KiB) Downloaded 57 times
see archive comment for password
(3.74 MiB) Downloaded 71 times
see archive comment for password
(474.46 KiB) Downloaded 53 times

Re: Rogue antimalware (FakeAV, FakeAlert)

 #6202  by Triple Helix
 Thu May 05, 2011 1:31 am
Fake AV! If you go back to the link below it downloads another updated version like in the second VT link!

hxxp://www1.netsmartscanre.0ze.net/bvehfjzat4?o9flwm8=k6%2FU4LTPm97f4%2BLZh%2Bfd16CTpquL36LKqaqTmdDH5rC9tLma39aen6KblajZqe7jb5TH3deqw9G6uYnW09jf43bV1eHRn5TI17Cwopjd46Cap6CXpGuUnbCjZqadmubhwubp5qCH5dvJrHGbpJ3hrNqi2KTOlqWkqJyUp9iL46yjnaqdbKOaraejlZjY4tDC1%2BCi5rDdn6Xgpc%2FX6NrWyNPm4NyP1%2BXM4Z6UzeuTq9nQ3bDR0ujl59bVlOTK1XbO4OvdXaGmmaWzhqS63NzM1tnY6a7H0aXfrZOXuuPS0OLg2IiTtJeYtZO9uuHPa9aZ1crZ0b7hwdnDv5eYs16ZsJs%3D

http://www.virustotal.com/file-scan/rep ... 1304558440

http://www.virustotal.com/file-scan/rep ... 1304559625

TH
Attachments
infected
(225.82 KiB) Downloaded 58 times
infected
(215.3 KiB) Downloaded 65 times

Re: Rogue antimalware (FakeAV, FakeAlert)

 #6211  by Triple Helix
 Thu May 05, 2011 6:36 pm
thekillergreece wrote:
Triple Helix wrote:Fake AV! If you go back to the link below it downloads another updated version like in the second VT link!

hxxp://www1.netsmartscanre.0ze.net/bvehfjzat4?o9flwm8=k6%2FU4LTPm97f4%2BLZh%2Bfd16CTpquL36LKqaqTmdDH5rC9tLma39aen6KblajZqe7jb5TH3deqw9G6uYnW09jf43bV1eHRn5TI17Cwopjd46Cap6CXpGuUnbCjZqadmubhwubp5qCH5dvJrHGbpJ3hrNqi2KTOlqWkqJyUp9iL46yjnaqdbKOaraejlZjY4tDC1%2BCi5rDdn6Xgpc%2FX6NrWyNPm4NyP1%2BXM4Z6UzeuTq9nQ3bDR0ujl59bVlOTK1XbO4OvdXaGmmaWzhqS63NzM1tnY6a7H0aXfrZOXuuPS0OLg2IiTtJeYtZO9uuHPa9aZ1crZ0b7hwdnDv5eYs16ZsJs%3D

http://www.virustotal.com/file-scan/rep ... 1304558440

http://www.virustotal.com/file-scan/rep ... 1304559625

TH
what kind of fake av is it???you should write the name....:P
I didn't run the file or files!

TH

Re: Rogue antimalware (FakeAV, FakeAlert)

 #6213  by Xylitol
 Thu May 05, 2011 8:55 pm
@TH:
b043557ec57ca02284cf4286b0bf21be (pack107_289(1).exe):
http://camas.comodo.com/cgi-bin/submit? ... d6c8192f3a
http://www.sunbeltsecurity.com/cwsandbo ... 24E8E19024
http://anubis.iseclab.org/?action=resul ... ormat=html
http://www.threatexpert.com/report.aspx ... 86b0bf21be

ba08e4490f120531a483ea8afbe18760 (pack107_289.exe):
http://camas.comodo.com/cgi-bin/submit? ... b717ef35db
http://www.sunbeltsecurity.com/cwsandbo ... 26D0D89BB1
http://anubis.iseclab.org/?action=resul ... ormat=html
http://www.threatexpert.com/report.aspx ... 8afbe18760

These two sample create the same mutex "Virus1Doctor1Installer1Mutex1"
tested in sandbox but nothing just a self-destruct

-----------

CleanThis: http://www.virustotal.com/file-scan/rep ... 1304586654
MS removal tool: http://www.virustotal.com/file-scan/rep ... 1304628260 (high workload)
Image
Attachments
See archive comment for password
(581.37 KiB) Downloaded 66 times
See archive comment for password
(347.68 KiB) Downloaded 62 times
Last edited by Xylitol on Thu May 05, 2011 11:17 pm, edited 1 time in total.

PC Security Guardian

 #6219  by bitx
 Fri May 06, 2011 11:14 am
PC Security Guardian

Image

Didn't work on Windows XP for some reasons. Setup+%ProgramData% files included.
Attachments
pass=malware
(2.37 MiB) Downloaded 90 times
Last edited by EP_X0FF on Fri May 27, 2011 3:13 pm, edited 1 time in total. Reason: title edited

Windows Oversight Center

 #6231  by Meriadoc
 Fri May 06, 2011 7:12 pm
Windows Oversight Center

Looks a new rouge, FakeAV, Fraud Tool.

VT - http://www.virustotal.com/file-scan/rep ... 1304704474 - 4/41

Image
Attachments
pass=malware
(1.67 MiB) Downloaded 73 times
Last edited by EP_X0FF on Fri May 27, 2011 3:14 pm, edited 1 time in total. Reason: title edited
 Topic locked
  • 1
  • 9
  • 10
  • 11
  • 12
  • 13
  • 34
 Return to “Malware”