[rkhunter]

6 items only.

Sinowal.

2 items...but strange BH EK...don't really understand why Sinowal was here with reveton and other stuff...(1 of both items confirmed as Sinowal by Rkhunter)

9c80e4bd9ba11083d3c97b8c61e8be32 -> Reveton

[AaLl86]

Hi All!
After I was studing March 2012 Sinowal dropper, and starting to write an analysis of old sample, my physical machine auto-updated rootkit driver.
I had isolated it, but I haven't still start analyzing the new update.
I post here May2012 sample, unfortunally I haven't got the dropper but I included in this package a small utility I wrote to help KernelMode.info users in installation process.
See "readme.txt" for all info.

Hope this can be useful,
Andrea

ps. My english is bad

[Alex454]

Nello All.
no new samples ?

[Kafeine]

Can't tell you for sure it's sinowal, but based on where i found it am pretty confident it is. (36 items)

[Alex454]

many thanks, i think, it's sinowal loaders.
But, seems, greputrais.info is blocked :(

[Kafeine]

One fresh sample.
Hope you'll get better luck with this one Alex454

[rkhunter]

One fresh sample.

Seems wave of Sinowal distribution down...
Kafeine, are you confirm? :)

[Kafeine]

I still have one. BH Ip shared in private...they are reading us (aren't you guys ? gg for the fast adaptation...)

7 items attached. (didn't check but as usual base on where and how it look like should be Sinowal).

[rkhunter]

I still have one. BH Ip shared in private...they are reading us (aren't you guys ? gg for the fast adaptation...)

Sinowal.

[rkhunter]

I'm really interesting in count of bots. If anyone of AV-companies will sinkhole botnet, will be great :)