[EP_X0FF]

Cridex, payload of BH EK.

Detection ratio: 2 / 46

AhnLab-V3 Downloader/Win32.Andromeda
Kingsoft Win32.Heur.KVMF58.hy.(kcloud)

SHA256: 4c05465801f7da23ddc8d6220fdd1734e9207f08db4d4d6e08ebf92b396366ca
SHA1: 39095cd787ea3815df6e0cf00ef89ce4dc8478ae
MD5: 2b04bea28ebaf806f20582ecc9b54af0

https://www.virustotal.com/en/file/4c05 ... 364833020/

[patriq]

maybe this is old/unwanted info..

more details on the previous sample

Code: Select all

http://anubis.iseclab.org/?action=result&task_id=1ef9d0eda5b4d0c843121c82fea60b045

sample makes an http post:
(bad request)

Code: Select all

http://37.59.36.93:8080/FPOJJAAAA/0duD1BAA/xnp1u/

ISPConfig panel

Code: Select all

https://37.59.36.93:8080/

37.59.36.93
Country: FR

[unixfreaxjp]

Funny. Can't see new Cridex in anywhere..
Good news indeed, but can't help to wonder why?

Any idea why? @EP_X0FF

[EP_X0FF]

Previously it was distributed mostly (if not only) from BH EK's along with Sirefef. What is the most prevalent bot distributed today from BH EK?

[forty-six]

BEK. /closest/ 100KB = dropped 165KB = update. Pulled down ZA as well. Looks like code update. Standard pass.

[EP_X0FF]

Any idea why? @EP_X0FF

From the above post (decrypted Cridex.L sample)

img1.png (13.39 KiB) Viewed 713 times

It is alive and under active development.

[unixfreaxjp]

Previously it was distributed mostly (if not only) from BH EK's along with Sirefef. What is the most prevalent bot distributed today from BH EK?

Fareit, Zbot(Gameover), ZeroAccess, and recently they start to use Medfos in their malvertisement,
PoC of Medfos exists (yes is rare): http://malwaremustdie.blogspot.com/2013 ... -plan.html
Sometimes found Cutwails among those too.

From the above post (decrypted Cridex.L sample)
It is alive and under active development.

Copy that. Thank's for your confirmation + to @forty-six for the sample. On it.

Rgds!

[blub.txt]

https://www.virustotal.com/de/file/2ef8 ... /analysis/

http://anubis.iseclab.org/?action=resul ... 6dfbd91aee

[markusg]

hi its only needed to put infected links in code taks, links to vt you can post without.

[forty-six]

Unpacked blub's sample and re-attached.

hxtp://renataltd[.]ru
hxtp://montierco[].ru
hxtp://pianiykrolik[.]ru
hxtp://masterupdate[.]ru
hxtp://updatecheck[.]co[.]ua