[Waves97]

New two :)
https://www.virustotal.com/file/631a51a ... /analysis/
https://www.virustotal.com/file/32fcdd8 ... /analysis/

[tomatto007]

http://greatis.com/blog/rootkit/crecycl ... 8628dn.htm

[Tigzy]

Thanks!
I'll add the other one

[Quads]

Rogue Killer, doesn't get these, Win 7 is not the recycler folder.

c:\$recycle.bin\S-1-5-18\$a437a1a12864ba5ff69ec86ce7982643\@
c:\$recycle.bin\S-1-5-18\$a437a1a12864ba5ff69ec86ce7982643\n
c:\$recycle.bin\S-1-5-18\$a437a1a12864ba5ff69ec86ce7982643\U\00000004.@
c:\$recycle.bin\S-1-5-18\$a437a1a12864ba5ff69ec86ce7982643\U\000000cb.@
c:\$recycle.bin\S-1-5-18\$a437a1a12864ba5ff69ec86ce7982643\U\80000000.@
c:\$recycle.bin\S-1-5-21-1207855306-3296853362-3562190217-1000\$a437a1a12864ba5ff69ec86ce7982643\@
c:\$recycle.bin\S-1-5-21-1207855306-3296853362-3562190217-1000\$a437a1a12864ba5ff69ec86ce7982643\n

Quads

[Tigzy]

Uh, yes didn't try on Seven... :/
Vista is the same as Seven?

[nullptr]

Vista is the same as Seven?

Yes

[thisisu]

Thanks for updating your tool.

Here is a fresh dropper, low detection 1/42
MD5: 097067998ba0b976f1d7577e2abd6d3b
https://www.virustotal.com/file/d0024c0 ... 346748162/

[Tigzy]

Currently coding an "InCTRL5-like" tool in .NET
tested over ZeroAccess. It shows new / recently modifed files only

Capture.PNG (19.42 KiB) Viewed 656 times

[thisisu]

Fresh "recycler" dropper with fail av results

Detection ratio: 3 / 42
https://www.virustotal.com/file/947f6ba ... /analysis/

Code: Select all

Kaspersky UDS:DangerousObject.Multi.Generic 
PCTools HeurEngine.Skintrim
Symantec Suspicious.Skintrim 

Obtained from : hxxp://94.199.53.203/latest/Flash_Player_v11.3.301_for_Windows.exe

[EP_X0FF]

Fresh "recycler" dropper with fail av results

Detection ratio: 3 / 42
https://www.virustotal.com/file/947f6ba ... /analysis/

Code: Select all

Kaspersky UDS:DangerousObject.Multi.Generic 
PCTools HeurEngine.Skintrim
Symantec Suspicious.Skintrim 

Obtained from : hxxp://94.199.53.203/latest/Flash_Player_v11.3.301_for_Windows.exe

Unpacked in attach + all significant files extracted from CAB.