[unixfreaxjp]

The malware was spotted as payload in HFS watering hole <PIC>

Code: Select all

CNC: kugo.f3322.net (58.128.228.168)port 51012 

Origin is PRC/China. Many analysis evasion like: packed,check mouse,aiming specific OS,antivirus process detection, etc.
Drops two files:

Code: Select all

\Common Files\ppt\symet.exe (self-copy)
\C:\2370.vbs

The vbs is for self deletion executed by malware via wscript <PIC>
The initial communication (beacon) is like this <PIC>
Sample: https://www.virustotal.com/en/file/675f ... /analysis/
Maybe more analysis in windowsOS must be perfomed, reference is poor, it's hard to recognize it as Bulta actually but it's the closest description that I an match for the sample. Will ask Ben to improve this repo.
Need help. @EP_X0FF @Xylit0l

[benkow_]

There is a weak FTP at ftp//58.128.228.168
Proof
all files backuped in attachment

401hk.exe - https://www.virustotal.com/fr/file/eec0 ... 451500569/
s.exe - https://www.virustotal.com/file/eec0b66 ... 451500569/
syn.exe - https://www.virustotal.com/fr/file/c67b ... 452298427/

[lasvegas]

[quote="benkow_"]There is a weak FTP at ftp//58.128.228.168
Proof

It's really weak:-)