A forum for reverse engineering, OS internals and malware analysis 

Malware/MSIL-BA

Forum for analysis and discussion about malware.

Re: Malware/MSIL-BA

 #4811  by markusg
 Sat Jan 29, 2011 4:03 pm
Windows 7 ultimate+Keygen.exe
http://www.virustotal.com/file-scan/rep ... 1296305901
Nero9Keymaker.exe
http://www.virustotal.com/file-scan/rep ... 1296306971
Microsoft Windows 7 Ultimate Validator + Activation.exe
http://www.virustotal.com/file-scan/rep ... 1296307304
keygen.exe
http://www.virustotal.com/file-scan/rep ... 1296313498
Office2010Crack.exe
http://www.virustotal.com/file-scan/rep ... 1296315979
Attachments
(3.12 MiB) Downloaded 45 times

Re: Malware/MSIL-BA

 #4822  by EP_X0FF
 Sun Jan 30, 2011 8:09 am
Microsoft Windows 7 Ultimate Validator + Activation.exe
http://www.virustotal.com/file-scan/rep ... 1296307304
Activator joined with CyberGate v1.04.0 RAT.
Windows 7 ultimate+Keygen.exe
http://www.virustotal.com/file-scan/rep ... 1296305901
Another spy rat.

CCleaner.exe

https://www.virustotal.com/file-scan/re ... 1296308973

Same as above, spy rat (Trojan Inject + PWS).
Nero9Keymaker.exe
http://www.virustotal.com/file-scan/rep ... 1296306971
PWS Spatet
Office2010Crack.exe
http://www.virustotal.com/file-scan/rep ... 1296315979
PWS Spatet
keygen.exe
http://www.virustotal.com/file-scan/rep ... 1296313498
Joined with Backdoor Blackshades NET.

Music from last one attached
Attachments
(8.04 KiB) Downloaded 42 times

Re: Malware/MSIL-BA

 #5277  by EP_X0FF
 Thu Mar 03, 2011 5:36 am
markusg wrote:http://www.virustotal.com/file-scan/rep ... 1299008527
Trojan Info Stealer.
markusg wrote:hSwitch.exe
http://www.virustotal.com/file-scan/rep ... 1299009072
Dotnet container with harmless hSwitch application and trojan - primitive Delphi coded keylogger (captured data stored in text file dclogs.sys) running from IEXPLORE address space.

Autoruns through
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

as x:\documents and settings\user\application data\nvidia\svchost.exe
markusg wrote:WINDEF~1.EXE
http://www.virustotal.com/file-scan/rep ... 1299066603
Blackshades.NET
 Return to “Malware”