new spyeye 1.3 with anti TrusteerRapport module has been released on black market.
any sample?
any sample?
Enjoy :)
Author added "short to long" jumps.
A forum for reverse engineering, OS internals and malware analysis
Attachments
pass: malware
(278.2 KiB) Downloaded 65 times
(278.2 KiB) Downloaded 65 times
Ring0 - the source of inspiration
publisher....: Trusteer Ltd.
copyright....: (c) Trusteer Ltd. All rights reserved.
product......: Rapport
description..: RapportService
original name: RapportService
internal name: RapportService
file version.: 3.5.1007.28
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Give this one a try. ;)
http://owned-nets.blogspot.com/2011/01/ ... osted.html
80.91.191.156/boss/bin/jupdate.exe appears alive and downloadable as well.
copyright....: (c) Trusteer Ltd. All rights reserved.
product......: Rapport
description..: RapportService
original name: RapportService
internal name: RapportService
file version.: 3.5.1007.28
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
Give this one a try. ;)
http://owned-nets.blogspot.com/2011/01/ ... osted.html
80.91.191.156/boss/bin/jupdate.exe appears alive and downloadable as well.
Attachments
(362.13 KiB) Downloaded 57 times
Arrogance led me to my Ignorance
cleansweep.exe
http://www.virustotal.com/file-scan/rep ... 1295884724
mute.exe
http://www.virustotal.com/file-scan/rep ... 1295884902
http://www.virustotal.com/file-scan/rep ... 1295884724
mute.exe
http://www.virustotal.com/file-scan/rep ... 1295884902
Attachments
(321.76 KiB) Downloaded 55 times
Here's the RapportService sample dumped and fixed so that it'll run on VMs.
Pretty lame antiVM, lol
Pretty lame antiVM, lol
Attachments
pass: malware
(348.46 KiB) Downloaded 57 times
(348.46 KiB) Downloaded 57 times
@nullptr, bsod for me
Xylitol wrote:@nullptr, bsod for methat's interesting, what kind of? Page fault?
Ring0 - the source of inspiration
argh i've retested and he did not make it again it work properly, i've not view the seg but my vm was full fcuked when i've reboot after the bsod.. nothing happend just blocked on the win32 loading logo.
EP_X0FF wrote:Enjoy :)yea exactly what i was looking for
Author added "short to long" jumps.
thx
deadly effective against rapport
kmd wrote:deadly effective against rapportAre you sure? Guys from Rapport dev has a different opinion :)
(unless they will silently update their soft in few days/weeks)
Ring0 - the source of inspiration