A forum for reverse engineering, OS internals and malware analysis 

Win32/Gataka

Forum for analysis and discussion about malware.

Re: Win32/Gataka.B

 #14601  by rkhunter
 Thu Jul 12, 2012 7:57 am
markusg wrote:https://www.virustotal.com/file/f7f8703 ... 342016779/
According to MS - Trojan:Win32/Gataka.D, description is absent...
"Decrypted" in attach.
+5 to detection https://www.virustotal.com/file/2255575 ... 342079273/
He-h, seems Kaspersky takes it by crypter, detection lost.
Attachments
pass:infected
(210.72 KiB) Downloaded 86 times

Re: Win32/Gataka.B

 #15106  by Xylitol
 Fri Aug 10, 2012 11:36 pm
One old sample of Mariofev.B/Tatanga.A in attach and some recent plugins of tatanga (crypted and uncrypted stolen from bad guys server :) )
http://blog.trendmicro.com/more-on-the- ... ng-trojan/

uncrypted plugins are all 0/42:
https://www.virustotal.com/file/d88e373 ... 344641546/
https://www.virustotal.com/file/0ccc0d2 ... 344641547/
https://www.virustotal.com/file/f8c49df ... 344641588/
https://www.virustotal.com/file/2cc571f ... 344641589/
https://www.virustotal.com/file/3596564 ... 344641591/
https://www.virustotal.com/file/b3fd1f8 ... 344641592/
https://www.virustotal.com/file/dfc07d2 ... 344641594/

Also see HermesCore, part of Tatanga, you can find several samples here with unpacked: http://www.kernelmode.info/forum/viewto ... 87&p=17724
Attachments
infected
(1.93 MiB) Downloaded 140 times
 Return to “Malware”