Attachments
(638 KiB) Downloaded 94 times
A forum for reverse engineering, OS internals and malware analysis
Attachments
(281.49 KiB) Downloaded 70 times
Header modification, MSIL Injection warrants a look in vmware xpsp3 :)
Drops Win32.Spyrat http://www.symantec.com/security_respon ... 99&tabid=2
C:\WINDOWS\system32\install (hidden+system)
Registry entry "HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{261B00RD-4480-DW02-A1BH-7DL00FD600NL}\StubPath" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Policies\Explorer\Run\Policies" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_CURRENT_USER\software\microsoft\windows\currentVersion\Policies\Explorer\Run\Policies" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_CURRENT_USER\software\microsoft\windows\currentVersion\Run\HKCU" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\HKLM" created set to <C:\WINDOWS\system32\install\svchost.exe>
injects Process IEXPLORE.EXE
opens backdoor
Drops Win32.Spyrat http://www.symantec.com/security_respon ... 99&tabid=2
C:\WINDOWS\system32\install (hidden+system)
Registry entry "HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\{261B00RD-4480-DW02-A1BH-7DL00FD600NL}\StubPath" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Policies\Explorer\Run\Policies" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_CURRENT_USER\software\microsoft\windows\currentVersion\Policies\Explorer\Run\Policies" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_CURRENT_USER\software\microsoft\windows\currentVersion\Run\HKCU" created set to <C:\WINDOWS\system32\install\svchost.exe>
Registry entry "HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run\HKLM" created set to <C:\WINDOWS\system32\install\svchost.exe>
injects Process IEXPLORE.EXE
opens backdoor
Attachments
pass=malware
(809.45 KiB) Downloaded 76 times
(809.45 KiB) Downloaded 76 times
Who controls the past controls the future
Who controls the present controls the past
Who controls the present controls the past
Creates a directory C:\WINDOWS\system32\Windows (hidden+system)
file : winlogon.exe
opens backdoor
sqlite3.dll http://www.virustotal.com/file-scan/rep ... 1291738997
file : winlogon.exe
opens backdoor
sqlite3.dll http://www.virustotal.com/file-scan/rep ... 1291738997
Who controls the past controls the future
Who controls the present controls the past
Who controls the present controls the past
markusg wrote:http://www.virustotal.com/file-scan/rep ... 1291740511Crypted with NET framework based cryptor.
Trivial stealer + backdoor, and I would say it is very well known trojan.
Executable written on Delphi.
http://www.virustotal.com/file-scan/rep ... 1291803307
From interesting pars of this trash, inside it contains detection of kernel mode based debuggers, such as Syser and SoftIce.
\\.\Syser \\.\SyserDbgMsg \\.\SyserBoot \\.\SICE \\.\NTICEand VirtualBox, Sandboxie detection + a lot of others (if somebody interested all detection code placed at @0040B0F0, see attach from Meriadoc).
VBoxService.exe SbieDll.dllTopic title changed to malware name.
Ring0 - the source of inspiration
markusg wrote:http://www.virustotal.com/file-scan/rep ... 1291725015
Meriadoc wrote:Creates a directory C:\WINDOWS\system32\Windows (hidden+system)Didn't found any new winlogons in system.
file : winlogon.exe
opens backdoor
This trojan starts actual winlogon copy from windows\system32 directory and maps payload code to newly started winlogon memory. Winlogon binary itself is not malicious.
Payload code looks similar to http://www.kernelmode.info/forum/viewto ... f=16&t=518.
I think it's the modification of the same stuff.
edit: forum software killed posts order.
Ring0 - the source of inspiration
Attachments
(536.12 KiB) Downloaded 59 times
markusg wrote:http://www.virustotal.com/file-scan/rep ... 1291894474Yet the same.
New copy of winlogon.exe spawned and payload code (crypted inside container in .NET dropper) mapped. Payload contains VM detection code, described above.
Ring0 - the source of inspiration
After additional analysis (thanks to topic starter for pointing on this) actual malware found. It is second file placed in container together with MS Office 2007 keygen.
Some sort of Spyrat modification.
Malware attached.
Some sort of Spyrat modification.
Malware attached.
Attachments
pass: malware
(323.83 KiB) Downloaded 55 times
(323.83 KiB) Downloaded 55 times
Ring0 - the source of inspiration