[thisisu]

XP Defender 2013

Looks like NameChanger / FakeRean season is here :lol:

[Win32:Virut]

Key:

Code: Select all

3425-814615-3990

Is this for the XP Defender 2013 ?

yes, this is for XP Defender 2013 / Win 7 Defender 2013

[Win32:Virut]

One more sample, detected only by AhnLab:
https://www.virustotal.com/file/6aec1a0 ... /analysis/
Attached.

Looks like FakeAV.

EDIT

This is System Progressive Protection. Can you move this post?

[Xylitol]

landing and panel cash

[dumb110]

^^^ Fake IObit scanner...you dont have the exe file??

[rough_spear]

Hi All, :D

SKYPE users targeted by Ransomware.

Web link - hxxp://goo.gl/5q1sx?img=radix.abhijeetsawant


Regards,

rough_spear. ;)

[rough_spear]

Hi, :D

Here is one more Fake AV.

Urls -

hxxp://178.77.103.54:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://188.212.156.180:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://202.169.224.202:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://50.22.136.150:8080/get/faa91cf5e79a76602f094ed38fad5872.exe

Regards,


rough_spear. ;)

[Cody Johnston]

System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

[Buster_BSA]

System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

This sample calls DSEditSecurity function. What is the purpose of that?

[EP_X0FF]

System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

This sample calls DSEditSecurity function. What is the purpose of that?

There is no purpose like any other. This is a part of fake import table.