[Xylitol]

looks like some backdoor trojan to get socks/rdp etc
right now i've not really the time to have a look
https://www.virustotal.com/file/0fab20c ... 351169260/

[Xylitol]

http://krebsonsecurity.com/2012/10/serv ... 500-firms/

[Horgh]

Distributed by the guys behind Ursnif (task for the bots), same packer used too.
In attach sample + unpacked.

Backdoor.Win32.Beksnoc.A.7z

pwd : infected
(70.24 KiB) Downloaded 52 times