[onthar]

One more sample
C39A99122B89F23FFF8A04A0A6B6A13F
Connetcts with 146.185.242.78.
Plugin list:

bot.plug|bkC0zyP.tiff
cyberplat.plug|jxcYsFb.tiff
ddos.plug|YxarZtqdsC27y4NbVfgXJ89nQp.psd
miniav.plug|Yfgb7Q.bmp
passw.plug|N736TDBjpWbkY4zcVS1RPZfywKvJHXQ2.tiff
sb.plug|CHd5FAY3.tiff
stopav.plug|fRwX5Q.bmp

Again data from russian bank operations grabbed.

VT: 2 / 43
https://www.virustotal.com/file/7632abc ... 329013888/

AVZ quarantine attached

[rkhunter]

MD5: 77c1009c278c18cdcbd8970ffeeff0e4
1/43

[rkhunter]

Probably Carberp, don't sure.

MD5: EA59FC75406EDC43744F0BE52BB0D5F3
2/43

[rkhunter]

Downloader

MD5: AF26E6B11BF71F39A5A0E708D4D14F09
12/43

[rkhunter]

Gang was arrested
http://translate.google.ru/translate?sl ... _103367%2F
http://www.mvd.ru/news/show_103367/

[rkhunter]

Carberp after "death", BH payload.

MD5: B3222F717A49950D7AED0CEBB5AFA35C
https://www.virustotal.com/file/1c2fa5d ... /analysis/

[rkhunter]

MD5: aed2f52c5ab617485247ea50f8c50b22
https://www.virustotal.com/file/95add24 ... 337448962/

[Brookit]

Carberp Gang Evolution: CARO 2012 presentation

Blogpost: http://blog.eset.com/2012/05/24/carberp ... -caro-2012

Presentation: Carberp Evolution and BlackHole: Investigation Beyond the Event Horizon

[Neurofunk]

"Russian K-force operatives cuff suspected Carberp trojan bank raider"
http://www.theregister.co.uk/2012/06/26 ... st_russia/

[360Tencent]

http://blog.eset.com/2012/07/02/all-car ... s-arrested