Hi,
here sample for Windows Custom Safety
- maddy
here sample for Windows Custom Safety
- maddy
Attachments
infected
(1.51 MiB) Downloaded 90 times
(1.51 MiB) Downloaded 90 times
A forum for reverse engineering, OS internals and malware analysis
Just me thats gets tired on Fake.Vimes fakeavs? Because there is so many versions of them:/
devstaff wrote:Just me thats gets tired on Fake.Vimes fakeavs? Because there is so many versions of them:/It because they all basically the same. Only redesigned GUI and randomized names. I remember 3 year ago I could go on MDL and download bunch of FakeAV's and most of them were totally different - different design (not only GUI), different distribution group etc. All ended in 2010. Now boring crap mostly from Severa and ko.
Ring0 - the source of inspiration
EP_X0FF wrote:Now boring crap mostly from Severa and ko.Severa isn't in spam/pharma business ?
Xylitol wrote:Security Shield type FakeAV associates for me only with this guy as it initial promoter. Dont really know if he still promotes it distribution directly like before. But yes you right, last time I saw it was speaking about spam services based on his own mailer :)EP_X0FF wrote:Now boring crap mostly from Severa and ko.Severa isn't in spam/pharma business ?
Ring0 - the source of inspiration
Kaspersky Internet Security 2013
tre.exe - Trojan.Win32.FakeAV.oddg
New malicious software was found in this file. It's
detection will be included in the next update. Thank you for your help.
Attachments
pw:infected
(397.72 KiB) Downloaded 96 times
(397.72 KiB) Downloaded 96 times
XP/Vista/Win 7 Antivirus Pro 2013
VT 11/42:
https://www.virustotal.com/file/6b81b3a ... /analysis/
Puts file association in HKCU\Software\Classes\.exe to start itself
VT 11/42:
https://www.virustotal.com/file/6b81b3a ... /analysis/
Puts file association in HKCU\Software\Classes\.exe to start itself
Attachments
Password: infected
(185.37 KiB) Downloaded 143 times
(185.37 KiB) Downloaded 143 times
Hello,
XP/Vista/Win 7 Antispyware Pro 2013
File attached.
XP/Vista/Win 7 Antispyware Pro 2013
File attached.
Attachments
Password is "infected" without quotes
(179.95 KiB) Downloaded 111 times
(179.95 KiB) Downloaded 111 times
Win32:Virut wrote:Hello,It launches antivirus Pro 2013 version for me, not antispyware ?
XP/Vista/Win 7 Antispyware Pro 2013
gied wrote:This one has random names. Sometimes may be slightly different than what was originally posted. Still same infection though.Win32:Virut wrote:Hello,It launches antivirus Pro 2013 version for me, not antispyware ?
XP/Vista/Win 7 Antispyware Pro 2013
