[leeno]

Help on following sample will be highly appreciated
Details : http://www.microsoft.com/security/porta ... em.D#tab=2
SHA1 = 68bdc6815394470cb672b2ec2d8f5bc0aed465d2
No Md5 Details

Thanks and Warm Regards
Arvind Kumar

[Xylitol]

I've only found Nitedrem.A related to the same host that Micosoft talk about.

Code: Select all

GET /down.asp?action=install&u=xiaoyao&p=AA6FF431A49443538BEA73E71227F111&t=4662 HTTP/1.1
User-Agent: fucking
Host: bucks.onepiecedream.com:99

HTTP/1.1 200 OK
Date: Sun, 07 Jul 2013 18:31:14 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 2
Content-Type: text/html
Set-Cookie: ASPSESSIONIDCCDDCRCT=DEJAAENAIJLLODIDJAADFPNF; path=/
Cache-control: private

https://www.virustotal.com/en/file/ef24 ... 405335315/
Apparently it's distributed from an affiliate ?

Code: Select all

http://bucks.onepiecedream.com/index.asp?page=Login
http://bucks.onepiecedream.com:99/admin/qinshou.asp