A forum for reverse engineering, OS internals and malware analysis 

Rogue Antimalware (FakeAV, 2013 year)

Forum for analysis and discussion about malware.
 Topic locked

Re: Rogue Antimalware (FakeAV, 2013 year)

 #17615  by EP_X0FF
 Sat Jan 05, 2013 7:47 am
Thats "XP Defender". It changes default reg ".exe" association so every time you try to launch exe this crap will popup.

Main part of FakeAV downloads from

hxxp://terminologyipadinitiating.org/

Image

"Definitions", resources and decrypted loader attached.
Attachments
pass: malware
(9.73 KiB) Downloaded 216 times
pass: malware
(685.01 KiB) Downloaded 298 times

Re: Rogue Antimalware (FakeAV, 2013 year)

 #17936  by Xylitol
 Thu Jan 31, 2013 9:54 am
Disk Antivirus Professional
Image

Original: https://www.virustotal.com/file/95e4027 ... 359625432/ > 21/46
Unpack: https://www.virustotal.com/file/41fc7f7 ... 359625192/ > 12/45
Network:
Code: Select all
GET /api/urls/?ts=f3626e3f&affid=00100 HTTP/1.1
Host: 112.121.178.189
---
GET /api/stats/install/?ts=f3626e3f&affid=00100&ver=3070024&group=dap HTTP/1.1
Host: 112.121.178.189
---
GET /p/?&lid=3070024&affid=00100&nid=8065D52C&group=dap HTTP/1.1
Host: kilopaybilling.com
Attachments
infected
(746.93 KiB) Downloaded 279 times

Re: Rogue Antimalware (FakeAV, 2013 year)

 #17989  by EP_X0FF
 Sat Feb 02, 2013 11:44 am
gied wrote:Does it has Geo / VM protection?
It has at least VPC/Vmware detection.

Vmware by cpuid "VmwareVmware" and by VMX backdoor.
VPC by invalid command.

This detection located at @0043AEB7 in Xylitol dump.
 Topic locked
  • 1
  • 2
  • 3
  • 4
  • 5
  • 15
 Return to “Malware”