A forum for reverse engineering, OS internals and malware analysis 

Rootkit ZeroAccess (alias MaxPlus, Sirefef)

Forum for analysis and discussion about malware.

Re: Rootkit ZeroAccess (aka MAX++)

 #6556  by Flopik
 Fri May 27, 2011 2:17 pm
erikloman wrote:Anybody got a dropper of the new x64 variant?
Still got no sample of the x64?
Last edited by Flopik on Fri May 27, 2011 5:12 pm, edited 1 time in total.

Re: Rootkit ZeroAccess (aka MAX++)

 #6559  by EP_X0FF
 Fri May 27, 2011 2:29 pm
I think nullptr have it :)

from hxxp://miliardov.com

Re: Rootkit ZeroAccess (aka MAX++)

 #6561  by EP_X0FF
 Fri May 27, 2011 3:41 pm
Not sure which one this. Anyway it's ZeroAccess.

dropper also attached (trol.exe)
Attachments
pass: malware
(31.12 KiB) Downloaded 110 times
pass: malware
(83.53 KiB) Downloaded 99 times

Re: Rootkit ZeroAccess (aka MAX++)

 #6564  by EP_X0FF
 Fri May 27, 2011 5:57 pm
Update.

Here is full data dump of this ZeroAccess rootkit made with help of our internal tool.

It's volume contains two folders

U (user mode), few dlls (debug names: click.pdb, resident.pdb), copy of dropper, scripts
L (loader), infected driver clean copy
GUID-file (settings)

All in attach, pass: malware.

Completely not Zero access I must say.
Attachments
(128.96 KiB) Downloaded 121 times

Trojan:Win64/Sirefef.B

 #6810  by hnpl2011
 Wed Jun 15, 2011 7:23 am
I'm looking for sample with MD5:adf1ddd89d424e8d0e275cc42747ec81
anyone have it, please post it here
thank,

Re: Malware Requests

 #6813  by EP_X0FF
 Wed Jun 15, 2011 9:06 am
hnpl2011 wrote:I'm looking for sample with MD5:adf1ddd89d424e8d0e275cc42747ec81
anyone have it, please post it here
thank,
This is ZeroAccess. Check dedicated thread.

Re: Malware Requests

 #6853  by hnpl2011
 Sat Jun 18, 2011 8:51 am
EP_X0FF wrote:
hnpl2011 wrote:I'm looking for sample with MD5:adf1ddd89d424e8d0e275cc42747ec81
anyone have it, please post it here
thank,
This is ZeroAccess. Check dedicated thread.
have no file with MD5:adf1ddd89d424e8d0e275cc42747ec81 in thread ZeroAccess
thank,

Re: Malware Requests

 #6854  by EP_X0FF
 Sat Jun 18, 2011 9:13 am
hnpl2011 wrote:have no file with MD5:adf1ddd89d424e8d0e275cc42747ec81 in thread ZeroAccess
thank,
Take any ZAccess sample unless yours is something special which I believe not.

Correction: You looking for x64 dll that ZAccess uses instead of rootkit on x64 systems.
Well you have to wait until someone will post it in dedicated thread.
  • 1
  • 5
  • 6
  • 7
  • 8
  • 9
  • 38
 Return to “Malware”