[STRELiTZIA]

Corrupted sample?

Yes, it seems to be broken this VB Dropper...

After a little research on the forum, here is the link (Same password to unzip decoded attached config file).
9B24636E1BB55960CF9B8F04A905FE96

http://www.kernelmode.info/forum/viewto ... FE96#p6489

Regards.

[rkhunter]

Seems SpyEye, under VBInject

MD5: D1A86696778AC1AEE4DE62DFBC30D8CE
https://www.virustotal.com/file/3410319 ... /analysis/

[EP_X0FF]

This is recrypted spyeye, mentioned here http://www.kernelmode.info/forum/viewto ... 178#p12178

[miae]

Sems SpyEye

installs to [NTFS]\[root]\g4fweq23.Bi\40842F38B7A.exe

MD5:7e566b480517cac170e1002fa7414a41
http://www.threatexpert.com/report.aspx ... 2fa7414a41
or
http://malwr.com/analysis/7e566b480517c ... fa7414a41/

virus

40842F38B7A.rar

pass:infected
(160.74 KiB) Downloaded 71 times

config

A8CB55AE2B68EDD.rar

pass:infected
(13.57 KiB) Downloaded 71 times

[STRELiTZIA]

Thanks for sample:
Password to unzip decoded attached config file: 3B298B4955465853185AA4CF0E8B2138

Collectors:

31.184.242.140:41254
31.184.242.41:41254
31.184.242.43:41254
31.184.242.139:41254

Gates:

hxxp://31.184.242.140/gate/gate.php;90
hxxp://31.184.242.139/gate/gate.php;90
hxxp://31.184.242.41/gate/gate.php;90
hxxp://31.184.242.43/gate/gate.php;90
hxxp://fredxs12312.co.cc/uugt/gate.php;90
hxxp://fredxs12323.co.cc/uugt/gate.php;90
hxxp://fredxs12334.co.cc/uugt/gate.php;90
hxxp://fredxs12345.co.cc/uugt/gate.php;90
hxxp://fredxs12357.co.cc/uugt/gate.php;90

[EP_X0FF]

SpyEye

https://www.virustotal.com/file/c87139b ... /analysis/

Gate

hxxp://bys1nessbank1ng.info:8080/im3g9ios.php;150

Password for decrypted config 130CBE0950491F6148A65482B9B50CC4

Dropper + decrypted config in attach.

[rkhunter]

I thought that it died...

[EP_X0FF]

Bot itself will die only when interest to it will die :)

[rkhunter]

Hm, anyone interested in bot of died malware.

[EP_X0FF]

SpyEye was much more widely spread on black market than for example TDL. Many customers still have it and will use last version until it will produce profit.