Another Urausy
Attachments
Password is "infected" without quotes.
(62.15 KiB) Downloaded 89 times
(62.15 KiB) Downloaded 89 times
One more Urausy
https://www.virustotal.com/file/5653c94 ... 355486180/
A forum for reverse engineering, OS internals and malware analysis
Attachments
Password: infected
(46.19 KiB) Downloaded 82 times
(46.19 KiB) Downloaded 82 times
Another Urausy
MD5: aa075b853f4508487f165c74e18f81ad
SHA1: 2823cc9457986c1f23f96128c2a31c95b80fa0fd
SHA256: 69374c5613e88d452256122f24a5cecdc34cc1685f92c52b9a24dabe8bd5563b
https://www.virustotal.com/file/69374c5 ... 355586636/
MD5: aa075b853f4508487f165c74e18f81ad
SHA1: 2823cc9457986c1f23f96128c2a31c95b80fa0fd
SHA256: 69374c5613e88d452256122f24a5cecdc34cc1685f92c52b9a24dabe8bd5563b
https://www.virustotal.com/file/69374c5 ... 355586636/
Attachments
Password: infected
(46.64 KiB) Downloaded 95 times
(46.64 KiB) Downloaded 95 times
Trojan:Win32/Urausy.C
Fresh sample.
SHA256: 4fb7d39698a71d917d8526d6f71f344a82469893bc3881a2775105b9cee5d4e6
SHA1: ade2cabd7c85fc188d2f6566d4418a25395791ab
MD5: 4eb81bd438433786d0df86d3856f68c9
https://www.virustotal.com/file/4fb7d39 ... 358857017/
Landing page : http://i.imgur.com/0koFoP1.png
In attach : sample, stage2 of packer, unpacked binary.
Fresh sample.
SHA256: 4fb7d39698a71d917d8526d6f71f344a82469893bc3881a2775105b9cee5d4e6
SHA1: ade2cabd7c85fc188d2f6566d4418a25395791ab
MD5: 4eb81bd438433786d0df86d3856f68c9
https://www.virustotal.com/file/4fb7d39 ... 358857017/
Landing page : http://i.imgur.com/0koFoP1.png
In attach : sample, stage2 of packer, unpacked binary.
Attachments
Password : infected
(63.79 KiB) Downloaded 104 times
(63.79 KiB) Downloaded 104 times
Urausy.C samples from past few days.
SHA-1:
CEEC9581EC988983D986D9B72A3B3C3EF72D63A4
5DB9D352630D1CE5853DE8ADD5464876F92075FD
391F239E6886C2DB5D7F5723B42F29BC6D579734
FF9E224A1463A08B955F2C6464AF5D9D2A36F0F9
SHA-1:
CEEC9581EC988983D986D9B72A3B3C3EF72D63A4
5DB9D352630D1CE5853DE8ADD5464876F92075FD
391F239E6886C2DB5D7F5723B42F29BC6D579734
FF9E224A1463A08B955F2C6464AF5D9D2A36F0F9
Attachments
pwd: infected
(326.74 KiB) Downloaded 96 times
(326.74 KiB) Downloaded 96 times
Urausy with new template.
Detection 3/45
https://www.virustotal.com/file/9a5501a ... /analysis/
md5: a1cabc87f8c123970190cd7ae4d2d9b5
sha-1: 8d97b4fb84257554bbedb118556b0aeae47136ef
Detection 3/45
https://www.virustotal.com/file/9a5501a ... /analysis/
md5: a1cabc87f8c123970190cd7ae4d2d9b5
sha-1: 8d97b4fb84257554bbedb118556b0aeae47136ef
Attachments
pass: malware
(102.52 KiB) Downloaded 87 times
(102.52 KiB) Downloaded 87 times
Attachments
(61.91 KiB) Downloaded 85 times
Urausy.
Posts moved.
Posts moved.
Ring0 - the source of inspiration
Here is an Urausy Variant that we named : Uremtoo
https://www.botnets.fr/index.php/Uremtoo (to see landings - Seems only 3 countries right now but looks like they are working on adding more)
Note : As for Urausy if your country is not targeted the http call to mothership will be content-lengh : 22 and your computer won't be locked.
https://www.botnets.fr/index.php/Uremtoo (to see landings - Seems only 3 countries right now but looks like they are working on adding more)
Note : As for Urausy if your country is not targeted the http call to mothership will be content-lengh : 22 and your computer won't be locked.
Attachments
Pass: infected - 2 samples of Uremtoo
(166.43 KiB) Downloaded 99 times
(166.43 KiB) Downloaded 99 times
good "Urausy" Analysis
http://angelkillah.blogspot.com/2013/02 ... lysis.html
http://angelkillah.blogspot.com/2013/02 ... lysis.html
@R00tkitSMM
