[AaLl86]

59 items from naretkolas.in as domain (2012-03-28) for the Sinowal BHEK.
I plan to stop posting this (kind of Danaids feeling...) except if told it's of some use by someone.

We appreciate your sharing. Even if your messages are not getting replies, it does not mean that they are not interesting to anyone.

I'm agree with EP_X0FF, your samples are very usefull for us, even if maybe we forget to reply and express gratitude ....
Andrea

[Kafeine]

Thx :)

72 items. 2012-04-04_184.82.147.166.zip
http://minus.com/mbkiPTU7Bc/7f
(thread: http://min.us/mbkiPTU7Bc )

[rkhunter]

72 items. 2012-04-04_184.82.147.166.zip

ba64d3a3997fc942a1a9f681e4ed6b61->Reveton
d5d84fee739a9e40a3251ec2b9b746a6->Not a Sinowal I think (at least by behaviour and Kaspersky verdict - Trojan-Spy.Win32.Lurk.uu)
Others are Sinowal.

[Kafeine]

2012-04-05 -> http://minus.com/mbkiPTU7Bc/8f
Thread : http://min.us/mbkiPTU7Bc
Seems something moved in the nginx config of the BH EK. Had to slightly adapt Scripts.

@rkhunter:
Strange ba64d3a3997fc942a1a9f681e4ed6b61 was also present on BH EK from a different group ( for instance : 195.26.18.15 - 195.26.18.127 )
The other file is steady over BHs. And it's not a PE Files right ?...i guess as others around 68KB. An idea anyone ?

[Kafeine]

2012-04-06 around 1am -> http://minus.com/mbkiPTU7Bc/9f <-- maybe the last >10 items zip.
Thread : http://min.us/mbkiPTU7Bc

At noon BH EK seems to have far less files + files* 404 escape. BH EK Spring cleaning ?? (Hello Guys if you are reading :roll: )

[rkhunter]

2012-04-06 around 1am -> http://minus.com/mbkiPTU7Bc/9f

Sinowal exactly.

[thisisu]

MD5: 9508ca694b60c30b0bb6bea0ca4a6b02
https://www.virustotal.com/file/52a24b2 ... /analysis/

[thisisu]

MD5: bbf96f55d34021df7154301c2b952c88
https://www.virustotal.com/file/3928d7d ... /analysis/

[Kafeine]

2 items only. As written before, less files on BH EK it seems.
http://minus.com/mbkiPTU7Bc/10f (attached too)
Thread: http://minus.com/mbkiPTU7Bc

[Kafeine]

6 items only.
http://minus.com/mbkiPTU7Bc/11f (attached too)

2 items...but strange BH EK...don't really understand why Sinowal was here with reveton and other stuff...(1 of both items confirmed as Sinowal by Rkhunter)
http://minus.com/mbkiPTU7Bc/12f

Thread: http://minus.com/mbkiPTU7Bc