[Aleksandra]

Necurs x64 driver: https://www.virustotal.com/ru/file/aa6a ... 395612964/

[Xylitol]

exe: https://www.virustotal.com/en/file/6819 ... 400251423/ > 5/53
x64 sys: https://www.virustotal.com/en/file/b47a ... 400253021/ > 9/52

[Win32:Virut]

3 drivers

[hx1997]

http://pferrie.host22.com/papers/necurs1.pdf

[Blaze]

Droppers + driver attached.

Exe:
a5923e1efd90be7542c779184f4a7843
f681b38447a16e4d6c9ae4837bfb407b

Sys:
fb7a765c02c06123958c20512c1b8e6a

[thisisu]

Credits to Malekal_morte for providing dropper on his website.

.sys + .exe/dropper attached

syshost.exe -- dabea808bb91f02e158cdbcbf3e8a790 -- https://www.virustotal.com/en/file/2b64 ... 401773988/
79051d41d365f350.sys -- ca82853fd71df06831edf7ffede4b1d5 -- https://www.virustotal.com/en/file/b94e ... 401773274/

[forty-six]

More Necurs:

Code: Select all

bcdedit.exe -set TESTSIGNING ON
%s\drivers\%s.sys
runas
ComSpec
\\.\NtSecureSys

[rkhunter]

MSRT + Necurs :)

http://blogs.technet.com/b/mmpc/archive ... ecurs.aspx

[achn30]

I have some thing here: virustotal.com/en/file/c8b6ae219c944f4a6362b22dad1a3cf25a31ca2dbe5ec96d645c031ad7332bf0/analysis/1406668147/
but actually i stuck in unpacking ... lot of anti-debugging tricks ://

[EP_X0FF]

It is Necurs downloader.