[forty-six]

GMO w/ RK dropped via Angler.

Code: Select all

bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
runas
ComSpec
\\.\NtSecureSys
SeShutdownPrivilege
kernel32
IsWow64Process
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
*EUDC*
ZwQuerySystemInformation
ntdll.dll
svchost.exe
SystemDefaultEUDCFont
EUDC\%d
ObReferenceObjectByHandle
ZwDuplicateToken
ObOpenObjectByPointer
PsReferencePrimaryToken
PsInitialSystemProcess
ObfReferenceObject
IoGetCurrentProcess
KeDelayExecutionThread
WinExec
GetModuleFileNameA
GetTickCount
GetSystemDirectoryA
CloseHandle
GetLastError
GetCurrentProcess
Sleep
GetExitCodeThread
WaitForSingleObject
CreateThread

[Xylitol]

Code: Select all

granchhunting.com/img/al2602.enc

https://www.virustotal.com/en/file/d415 ... 395848494/

[patriq]

Code: Select all

granchhunting.com/img/al2602.enc

https://www.virustotal.com/en/file/d415 ... 395848494/

more attached

Code: Select all

granchhunting.com/img/net19.exe

https://www.virustotal.com/en/file/0fa1 ... 396009084/

https://malwr.com/analysis/ZWYyNjZlMjY5 ... Q0MTU1NDk/

[bao]

https://www.virustotal.com/ru/file/0fa1 ... 396009084/
https://malwr.com/analysis/MGE2MTdkNGNm ... ZiYmZiYWQ/

[unixfreaxjp]

GMO via this malvertising:

VT: https://www.virustotal.com/en/file/6e3f ... 396076550/
Sample is : (attached)

[Xylitol]

https://www.virustotal.com/en/file/806a ... 396610451/
Zeus Gameover targeting france

[patriq]

11d983b19f9b9aeb500a09eeaf7adeb0

https://malwr.com/analysis/NmU1Mzg5Nzhm ... U1OTBiMzE/

Code: Select all

Sample pulled from:

hxxp://esoftmechanics.com/spengler/beatle
hxxp://floormastersandiego.com/impugning/felsitic

*same file, different name. 

[r3shl4k1sh]

ZeusP2P.

VT Low detection 2/53: https://www.virustotal.com/en/file/597f ... 401371918/

Malwr: https://malwr.com/analysis/NDQzNmRjZTcz ... EzYmM0NTQ/

[EP_X0FF]

Takedown
https://www.europol.europa.eu/content/i ... ransomware
http://www.symantec.com/connect/blogs/i ... me-network

[Xylitol]

http://www.justice.gov/opa/gameover-zeus.html
http://www.abuse.ch/?p=7822