[rkhunter]

http://blog.gdatasoftware.com/blog/arti ... -name.html

SHA256: show in "an interesting spyeye build"

and maybe kaspersky also found it

http://www.securelist.com/en/blog/208193513/Big_Brother

MD5: 1a47e3325f64a60442666de6f3184d56
SHA256: f9d0beaba8b5fd62a3f18e13be94470344dbb1db9e4b088158dbb1374f0828cb
Trojan:Win32/EyeStye.N

[leeno]

Help on Following any live samples for
spyeye variant:
http://www.securelist.com/en/blog/208193513/Big_Brother

Thanks

Leeno

[rkhunter]

Help on Following any live samples for
spyeye variant:
http://www.securelist.com/en/blog/208193513/Big_Brother

Was posted before - http://www.kernelmode.info/forum/viewto ... 375#p13375

[360Tencent]

http://blogs.technet.com/b/mmpc/archive ... estye.aspx

[kmd]

1.3.48 builder fully cracked
credits to banned from opensc
pass infected

[Xylitol]

SpyEye loaded onto http loader used by HF skids for selling installs hxxp://fpbb.com.br/images/zeusyo.exe
VT: 3/44 >> https://www.virustotal.com/file/7adfaff ... 353266757/

Code: Select all

cn1: hxxp://control.av-update-server.net/~ciscoFirewall/

md5 pw: 546e89665afe59ee8d5748f6e2c83f85
Small botnet: 593 offline, 232 online with no back connect db, looks like they are guys stupid enought to use this.

[EP_X0FF]

SpyEye loaded onto http loader used by HF skids for selling installs hxxp://fpbb.com.br/images/zeusyo.exe
VT: 3/44 >> https://www.virustotal.com/file/7adfaff ... 353266757/

Code: Select all

cn1: hxxp://control.av-update-server.net/~ciscoFirewall/

md5 pw: 546e89665afe59ee8d5748f6e2c83f85
Small botnet: 593 offline, 232 online with no back connect db, looks like they are guys stupid enought to use this.

ver=10348

Decrypted dropper and decrypted config in attach.

Pass for config: 5076848FB39AC6DD00000051E39468E3

Must be HF l33t kids used leaked and cracked builder.

[markusg]

one of my users send me this sample.
its 3 days old, because i was not at home
https://www.virustotal.com/file/b6bf03d ... /analysis/

[STRELiTZIA]

hxxp://www.chengdaepe.com/system/gate.php;90
hxxp://members-save.com/components/gate.php;90
hxxp://www.sibylleallgaier.com/wp-content/gate.php;90
hxxp://www.paydaysupermarket.com/wp-content/gate.php;90
hxxp://btmir.ru/admin/gate.php;90
hxxp://www.stoneplus.cn/it/gate.php;90
hxxp://uttraining.com/data/gate.php;90

95.170.86.84:443

Password to unzip config: 4B234ADDC6118EAB4B2678E3F694E9FE

[Aleksandra]

MD5: 059789e2e3920a773d12c0706c80896b
SHA1: 685c517483788734538cef992ea35332f744908f
https://www.virustotal.com/file/f189b7a ... /analysis/