[forty-six]

Upatre was the one checking for CPU numbers and not Dyre, and I understand it was a feature of the packer and not the malware itself.

I think the total number of Upatre and Dyre samples you have reversed is 0.

[EP_X0FF]

Upatre was the one checking for CPU numbers and not Dyre, and I understand it was a feature of the packer and not the malware itself.

Have you ever opened this malware in anything before doing this post?



Lame shit like whole this malware. This check will defeat VirtualPC and lame security experts running VM with 1 CPU in 2015.

[EP_X0FF]

https://www.youtube.com/watch?v=hKkmQ3tGJa0

is GetSystemPowerStatus used to test for sandbox/vm?

I do believe it is a part/sort of antiemulation, just like empty WriteConsoleW before.

[EP_X0FF]

Dyzap with UACME on board (Fubuki).

https://www.virustotal.com/en/file/9947 ... 434601594/

[Xylitol]

More Dyre with Fubuki.
https://www.virustotal.com/en/file/f4fd ... 434746250/
https://www.virustotal.com/en/file/3643 ... 434710822/
https://www.virustotal.com/en/file/86e5 ... 434711299/
https://www.virustotal.com/en/file/60d5 ... 434711225/
https://www.virustotal.com/en/file/37cb ... 434746168/

[sysopfb]

Here's another with Fubuki, came from Upatre

[Xylitol]

+3 Fubuki
https://www.virustotal.com/en/file/2c35 ... 435662044/
https://www.virustotal.com/en/file/8429 ... 435662070/
https://www.virustotal.com/en/file/fd4e ... 435662330/

DYRE trojan targets Spain ~ http://securityblog.s21sec.com/2015/07/ ... spain.html

[gritland]

someone has the fresh builds of dyre?

[EP_X0FF]

Here is some modification from August.

7afb5ac0aaec4198d8cd1acf04865bf32a81c651c0210fc2c18b3b1766c1e3fd (+unpacked vt result)
https://www.virustotal.com/en/file/7afb ... 442845678/
https://www.virustotal.com/en/file/40b8 ... 442845503/

[stimark]

Does anyone has access to a fresh build?