OK, thanks for the feedback guys !
AV Security 2012
http://www.virustotal.com/file-scan/rep ... 1321055800
A forum for reverse engineering, OS internals and malware analysis
Attachments
av security 2012.JPG (24.53 KiB) Viewed 616 times
pass:malware
(1.78 MiB) Downloaded 86 times
(1.78 MiB) Downloaded 86 times
Hi Everybody, :D
SYSTEM RESTORE :evil:
Dropper File - w.php.4.exe
VT link - http://www.virustotal.com/file-scan/rep ... 1321110224
MD5 : c2b22e3118c76204cb4ee757f6ab92df
SHA1 : 3d116dd918efcc9c38ce669813a23dc23207ca6e
SHA256: 3fed97347ee42421197495057b7531397f4b761f48c7bb463282c418778b6a6e
ssdeep: 12288:Kz8Z7yx04tVuwlESx7IbeTuNY7GfmqTOoC9b5UyL9:t14VPwoudaoTy
File size : 496640 bytes
Dropped Files -
8hRnojakbi119d.exe
VT link - http://www.virustotal.com/file-scan/rep ... 1321195448
MD5 : c6b15d582cc107e0be1e213a19a920bd
SHA1 : 0ce96aa5cf58b7fd257daf64008f04eeae969c46
SHA256: 9b22c19bcdb33cd54247557d235ef34d817da6f23c8af43d6d66688a23ffd8ae
ssdeep: 6144:Az8yBZuhyu2iipBV4V1tMdeIMA17jmctq0gKhEQFi+yn1y1m9SRW63y3a6yBRJq3:Az8Bz
3iiudEA17jmctq07Ep+A1y1mF6G
File size : 385024 bytes
and BA97.tmp
VT link - http://www.virustotal.com/file-scan/rep ... 1321193539
MD5 : 97bc7ce7a6ea9af88ea62220512f1112
SHA1 : cebb08b753b30e251da2136618ddeb58d13fac26
SHA256: 531029ef45543ba26dba529fe466ae902c0b7911ac0f7a8b43e8c14811a3b67f
ssdeep: 6144:t0uHK2v3fWAUaWjIDvq/SHgXHsZHhY/dskE4AgK2ak:t0UxfiOvq/SiHIaaYK2a
File size : 335872 bytes
Regards,
rough_spear.
SYSTEM RESTORE :evil:
Dropper File - w.php.4.exe
VT link - http://www.virustotal.com/file-scan/rep ... 1321110224
MD5 : c2b22e3118c76204cb4ee757f6ab92df
SHA1 : 3d116dd918efcc9c38ce669813a23dc23207ca6e
SHA256: 3fed97347ee42421197495057b7531397f4b761f48c7bb463282c418778b6a6e
ssdeep: 12288:Kz8Z7yx04tVuwlESx7IbeTuNY7GfmqTOoC9b5UyL9:t14VPwoudaoTy
File size : 496640 bytes
Dropped Files -
8hRnojakbi119d.exe
VT link - http://www.virustotal.com/file-scan/rep ... 1321195448
MD5 : c6b15d582cc107e0be1e213a19a920bd
SHA1 : 0ce96aa5cf58b7fd257daf64008f04eeae969c46
SHA256: 9b22c19bcdb33cd54247557d235ef34d817da6f23c8af43d6d66688a23ffd8ae
ssdeep: 6144:Az8yBZuhyu2iipBV4V1tMdeIMA17jmctq0gKhEQFi+yn1y1m9SRW63y3a6yBRJq3:Az8Bz
3iiudEA17jmctq07Ep+A1y1mF6G
File size : 385024 bytes
and BA97.tmp
VT link - http://www.virustotal.com/file-scan/rep ... 1321193539
MD5 : 97bc7ce7a6ea9af88ea62220512f1112
SHA1 : cebb08b753b30e251da2136618ddeb58d13fac26
SHA256: 531029ef45543ba26dba529fe466ae902c0b7911ac0f7a8b43e8c14811a3b67f
ssdeep: 6144:t0uHK2v3fWAUaWjIDvq/SHgXHsZHhY/dskE4AgK2ak:t0UxfiOvq/SiHIaaYK2a
File size : 335872 bytes
Regards,
rough_spear.
Attachments
password - malware.
(1019.13 KiB) Downloaded 63 times
(1019.13 KiB) Downloaded 63 times
9SrQQbeTkFJrsC.exe
MD5 : 48a84c01ced4be24ffda9acb28737b5c
https://www.virustotal.com/file-scan/re ... 1321189535
LEnXuYtOREFxPor.exe
MD5 : 4c486111eb5e4e406d83b7b485da9f39
https://www.virustotal.com/file-scan/re ... 1321190028
rJkidNSDHNQGC.exe
MD5 : 86efcd6dfd7a9436c6e16d822142f917
https://www.virustotal.com/file-scan/re ... 1321198738
MD5 : 48a84c01ced4be24ffda9acb28737b5c
https://www.virustotal.com/file-scan/re ... 1321189535
LEnXuYtOREFxPor.exe
MD5 : 4c486111eb5e4e406d83b7b485da9f39
https://www.virustotal.com/file-scan/re ... 1321190028
rJkidNSDHNQGC.exe
MD5 : 86efcd6dfd7a9436c6e16d822142f917
https://www.virustotal.com/file-scan/re ... 1321198738
Attachments
(1.13 MiB) Downloaded 68 times
Cloud AV 2012
Attachments
pw: infected
(1.72 MiB) Downloaded 85 times
(1.72 MiB) Downloaded 85 times
FakeAV's dump from captured blackhole (courtesy of Xylitol), 40 Mb when unpacked, all fresh and cleared from AV detections. Pass malware, multipart rar archive.
Includes "Security Sphere" + Necurs.
Includes "Security Sphere" + Necurs.
Attachments
(3.59 MiB) Downloaded 66 times
(5 MiB) Downloaded 62 times
(5 MiB) Downloaded 62 times
(5 MiB) Downloaded 61 times
(5 MiB) Downloaded 66 times
(5 MiB) Downloaded 61 times
(5 MiB) Downloaded 68 times
Ring0 - the source of inspiration
Got some files from w.php pages.
Example:
lajhkvnwkqgjkasgoiqrht.c0m.li/w.php?f=17&e=6
Example:
lajhkvnwkqgjkasgoiqrht.c0m.li/w.php?f=17&e=6
Attachments
w.php
(2.46 MiB) Downloaded 59 times
(2.46 MiB) Downloaded 59 times
To help protect your computer, Windows Web Security have detected Trojans and ready to remove them.
xwxproductions wrote:Got some files from w.php pages.This is blackhole link format.
Example:
lajhkvnwkqgjkasgoiqrht.c0m.li/w.php?f=17&e=6
Ring0 - the source of inspiration
Security Sphere 2012
New file found!
anti-malware.exe
From iFrame Exploit
Does anyone have XP Security 2012 (Newer version)
New file found!
anti-malware.exe
From iFrame Exploit
Does anyone have XP Security 2012 (Newer version)
Attachments
(321.91 KiB) Downloaded 73 times
To help protect your computer, Windows Web Security have detected Trojans and ready to remove them.
new sample of fakerean
Attachments
pass:malware
(213.78 KiB) Downloaded 62 times
(213.78 KiB) Downloaded 62 times