Attachments
(87.47 KiB) Downloaded 51 times
Can someone have a look at this active beast - if not I will pick up again later, thanks :)
http://www.virustotal.com/file-scan/rep ... 1295873874
A forum for reverse engineering, OS internals and malware analysis
Attachments
pass=malware
(97.59 KiB) Downloaded 50 times
(97.59 KiB) Downloaded 50 times
Who controls the past controls the future
Who controls the present controls the past
Who controls the present controls the past
connects to:
* fivecross.in
* voozioapple.in
* devalex.in
internal build date: Jan 21 2011, 22:14:38
* fivecross.in
* voozioapple.in
* devalex.in
internal build date: Jan 21 2011, 22:14:38
Attachments
pass: malware
(40.33 KiB) Downloaded 46 times
(40.33 KiB) Downloaded 46 times
Thanks nullptr :)
Security Zone change
File C:\WINDOWS\system32\sshnas21.dll
File C:\WINDOWS\Spuxoa.exe
Registry entry "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS\ImagePath" (created) :
New entry was set to <%SystemRoot%\system32\svchost.exe -k netsvcs>
Registry entry "HKEY_CURRENT_USER\software\microsoft\windows\currentVersion\Run\CE8SIIFGSU" (created) :
New entry was set to <C:\DOCUME~1\user\LOCALS~1\Temp\Sn1.exe>
Registry entry "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SSHNAS\Parameters\ServiceDll" (created) :
New entry was set to <C:\WINDOWS\system32\sshnas21.dll>
Scheduled task "{22116563-108C-42c0-A7CE-60161B75E508}.job" (created) :
New scheduled task: <C:\Documents and Settings\user\Local Settings\Temp\Sn1.exe >
Scheduled task "{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job" (created) :
New scheduled task: <C:\Documents and Settings\user\Local Settings\Temp\Sn2.exe >
Scheduled task "{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job" (created) :
New scheduled task: <C:\WINDOWS\Spuxoa.exe >
Process Spuxoa.exe <C:\WINDOWS\Spuxoa.exe>
Process Sn2.exe <C:\Documents and Settings\user\Local Settings\Temp\Sn2.exe>
Process rundll32.exe <C:\WINDOWS\system32\rundll32.exe>
Process Sn1.exe <C:\Documents and Settings\user\Local Settings\Temp\Sn1.exe>
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
CE8SIIFGSU Windows Setup API (Not Verified) Avira GmbH c:\documents and settings\user\local settings\temp\sn1.exe
CL2GFOKBC9 Windows Setup API (Not Verified) Avira GmbH c:\windows\spuxoa.exe
HKLM\System\CurrentControlSet\Services
SSHNAS Windows Setup API (Not verified) Avira GmbH c:\windows\system32\sshnas21.dll
Attachments
(17.46 KiB) Downloaded 43 times
Who controls the past controls the future
Who controls the present controls the past
Who controls the present controls the past
Nhk.exe
http://www.virustotal.com/file-scan/rep ... 1297266914
Nhl.exe
http://www.virustotal.com/file-scan/rep ... 1297267005
http://www.virustotal.com/file-scan/rep ... 1297266914
Nhl.exe
http://www.virustotal.com/file-scan/rep ... 1297267005
Attachments
(229.58 KiB) Downloaded 42 times
flashPlugin.40028.exe
you can change the last 2 numbers at the end from 01 till 99 and get files with other md5
Code: Select all
http://www.virustotal.com/file-scan/rep ... 1308769637 http://moviehugestorage.us/flashPlugin.40028.exeyou can change the last 2 numbers at the end from 01 till 99 and get files with other md5
Attachments
(75.1 KiB) Downloaded 40 times
markusg wrote:flashPlugin.40028.exeTrojan Downloader Renos.
Code: Select allhttp://www.virustotal.com/file-scan/rep ... 1308769637http://moviehugestorage.us/flashPlugin.40028.exe
you can change the last 2 numbers at the end from 01 till 99 and get files with other md5
Posts moved.
Ring0 - the source of inspiration
All recrypted samples in attach.
Attachments
pass: malware
(3 MiB) Downloaded 44 times
(3 MiB) Downloaded 44 times
pass: malware
(4.25 MiB) Downloaded 47 times
(4.25 MiB) Downloaded 47 times
Ring0 - the source of inspiration
Virtual.Dj.7.0.5.Crack.45186.exe
http://www.virustotal.com/file-scan/rep ... 1313260926
http://www.virustotal.com/file-scan/rep ... 1313260926
Attachments
(65.58 KiB) Downloaded 53 times
markusg wrote:Virtual.Dj.7.0.5.Crack.45186.exeTrojan Downloader Renos.
http://www.virustotal.com/file-scan/rep ... 1313260926
Posts moved.
Ring0 - the source of inspiration