[Userbased]

Win32/Napolar http://www.microsoft.com/security/porta ... /Napolar.A
MD5: 60a8e935b5418a76593bb97120da1adc
https://www.virustotal.com/en/file/0c63 ... 379897504/

The bot has a site listing features and a panel file at solarbot.net
Dumped from a Autoit packer (Thanks to Betamonkey for help unpacking).

[uCares]

Panel :

Code: Select all

hxtp://canc3r1nf0rmat10n.pw/Panel/

[Xylitol]

Code: Select all

hxxp://kasvatus.org/solar/index.php?login

http://kasvatus.org/serve/crysol.exe 
http://kasvatus.org/serve/crypsoliar.exe 
http://kasvatus.org/serve/crypsola.exe

[Thanat0S]

Panel :

Code: Select all

hxtp://canc3r1nf0rmat10n.pw/Panel/

not working, reupload panel src please I want to analyze it

edit, you mean gate not panel , well I thought it was panel source code, anyways if anyone find it, please post it

[Xylitol]

edit, you mean gate not panel , well I thought it was panel source code, anyways if anyone find it, please post it

panel source can be downloaded from the solar website. (and the TOR site of solar is offline seem)
and canc3r1nf0rmat10n.pw is online and working FYI.

[domin]

Straight from the website before it went down

[TheExecuter]

olly crashes on normal debugging. winxp olly terminates immediately even when i apply system breakpoint O_O
tried immunity, it works.
unpacking first file , piece of cake.
second file contains TLS code and no EP.
1st call back, 2nd callback obvious.
last call RVA 0x109A (encoded before hand, decoded in TLS callback code)
2 decryption routines.
then final ep RVA 0xB0AA
malwr.com analysis still pending after 24 hours. what the hell?

[Apocalypse]

OEP = 0

If fix it, ollydbg + strongod (break on tls) = profit!!!

Btw, so many shit :roll:

[N3mes1s]

Win32/64:Napolar: New Trojan shines on the cyber crime-scene

[p4r4n0id]

Win32/64:Napolar: New Trojan shines on the cyber crime-scene

All mentioned hashes are attached

p4r4n0id