[sugipula]

Nope.
I found many plugins in the wild as well :)
does anyone know where can I get more spyeye samples?

[Gunnerofarsenal]

Nope.
I found many plugins in the wild as well :)
does anyone know where can I get more spyeye samples?

https://spyeyetracker.abuse.ch/monitor.php
http://www.malwaredomainlist.com/mdl.php

[sugipula]

and http://support.clean-mx.de/clean-mx/viruses.php

I know about these websites.

I m wondering if there's any others that have SPYEYE samples.
I dont want random samples , i need specific , spyeye , so I can analyze

[EP_X0FF]

and http://support.clean-mx.de/clean-mx/viruses.php

I know about these websites.

I m wondering if there's any others that have SPYEYE samples.
I dont want random samples , i need specific , spyeye , so I can analyze

This thread overall contains about 100+ spyeye samples of almost all available versions.

[sugipula]

true , but most of them are dead.
the gates , the collectors.
I m looking for fresh ones.

[Blaze]

SpyEye Changes Phone Numbers to Hijack Out of Band SMS Security

>> http://www.trusteer.com/blog/spyeye-cha ... s-security

[markusg]

B6232F3AE78.exe
MD5   : 29534e8af5c7f8af8418133d2c6d76a1
https://www.virustotal.com/file-scan/re ... 1317919895

[Xylitol]

B6232F3AE78.exe
MD5   : 29534e8af5c7f8af8418133d2c6d76a1
https://www.virustotal.com/file-scan/re ... 1317919895

SpyEye v1.3.48 who call this gate: https://spyeyetracker.abuse.ch/monitor. ... rg23ma.com

--

Also for those who are curious of this one: http://www.kernelmode.info/forum/viewto ... =260#p8918
815 bots online, and most of them are from Argentina



Only 7GB free on 500GB and server is slow as fuck.
No professional people.

[sugipula]

markusg wrote:B6232F3AE78.exe
MD5 : 29534e8af5c7f8af8418133d2c6d76a1
https://www.virustotal.com/file-scan/re ... 1317919895


SpyEye v1.3.48 who call this gate: https://spyeyetracker.abuse.ch/monitor. ... rg23ma.com

It's a big one.

[EP_X0FF]

Decrypted config from last sample attached.

Pass: 6CB5879FB91A3B0175742B5FEC117205

Plugins: ccgrabber, customconnector, emailgrabber, ffcertgrabber, ftpgrabber.

C:\Data\Documents\My Projects\CC\CardNet\Progs\Client\SpyEye\plugins\emailgrabber\source\Release\emailgrabber.pdb

Gates:

hxxp://wearsdu4enfarg23ma.com/g/logisz22.php;200
hxxp://wearsdu4enfarg2ser.com/g/logfak3422.php;200
hxxp://wearsdu4enfarg27asd.com/g/rase54f.php;200
hxxp://wearsdu4enfarg28ka.com/g/Has56gg.php;200