Buckrogers wrote:Initially I thought it was the dropper, but apparently this dir is created and deleted on every boot.It is hidden by NtQueryDirectoryFile hook in Explorer.
Ring0 - the source of inspiration
A forum for reverse engineering, OS internals and malware analysis
Attachments
pwd: malware
(395.17 KiB) Downloaded 47 times
(395.17 KiB) Downloaded 47 times
gritland wrote:http://www.virustotal.com/file-scan/rep ... 1312635892Equal to this, multipacked recrypt.
In attach unpacked.
Attachments
pass: malware
(308.03 KiB) Downloaded 54 times
(308.03 KiB) Downloaded 54 times
Ring0 - the source of inspiration
some av detect this as dropper of tdl :D
Attachments
pwd: malware
(152.2 KiB) Downloaded 48 times
(152.2 KiB) Downloaded 48 times
gritland wrote:http://www.virustotal.com/file-scan/report.html?id=c37427fb19d01c8b3eb657cd7e322c272772506545f87733ea0230cb9c67d292-1312720402Equal to this and this.
Updated gates list.
hxxp://www.solodiyi.com/main/gate.php;100
hxxp://www.verdumnn.com/main/gate.php;100
hxxp://www.aaggrreesssor.com/main/gate.php;100
hxxp://www.trressuryy.com/main/gate.php;100
Ring0 - the source of inspiration
SpyEye 1.3.x
Base path x:\Romano.Bin, file and config file names are hexadecimal random.
Crap is failed to hide itself after installation
Pass for decrypted config: FD9EBD0F32D1D60DB9E58344C38FABEF
Gates:
Original 0/ 43 (0.0%)
http://www.virustotal.com/file-scan/rep ... 1313203186
Unpacked 17/ 42 (40.5%)
http://www.virustotal.com/file-scan/rep ... 1313203802
Base path x:\Romano.Bin, file and config file names are hexadecimal random.
Crap is failed to hide itself after installation
Pass for decrypted config: FD9EBD0F32D1D60DB9E58344C38FABEF
Gates:
hxxp://banistabank.ru/ko.php;300Plugins: customconnector, ccgrabber.
hxxp://eewtoopqq.ru/www5.php;300
Original 0/ 43 (0.0%)
http://www.virustotal.com/file-scan/rep ... 1313203186
Unpacked 17/ 42 (40.5%)
http://www.virustotal.com/file-scan/rep ... 1313203802
Attachments
pass: malware
(172.95 KiB) Downloaded 58 times
(172.95 KiB) Downloaded 58 times
Ring0 - the source of inspiration
Attachments
pass: malware
(166.17 KiB) Downloaded 48 times
(166.17 KiB) Downloaded 48 times
gritland wrote:http://www.virustotal.com/file-scan/rep ... 1313272926The same as http://www.kernelmode.info/forum/viewto ... 6382#p6382, re-crypt with new servers list.
Ring0 - the source of inspiration
Article about Spyeye Builder patch from Xyliton ( 
) : http://blog.damballa.com/?p=1357
I do not understand why they say it was leaked? Xylitol have you hacked yourself? :)
) : http://blog.damballa.com/?p=1357I do not understand why they say it was leaked? Xylitol have you hacked yourself? :)
