MD5: D37E913DE5A101812C263965AB17CCED
0/43
0/43
Attachments
pass:infected
(133.54 KiB) Downloaded 78 times
(133.54 KiB) Downloaded 78 times
A forum for reverse engineering, OS internals and malware analysis
Attachments
pwd: malware
(165.82 KiB) Downloaded 75 times
(165.82 KiB) Downloaded 75 times
i am looking for:
http://minotauranalysis.com/search.aspx ... 2cc93d2b54
http://minotauranalysis.com/search.aspx ... 2cc93d2b54
dumb110 wrote:i am looking for:
http://minotauranalysis.com/search.aspx ... 2cc93d2b54
Attachments
pass: malware
(123.48 KiB) Downloaded 72 times
(123.48 KiB) Downloaded 72 times
Ring0 - the source of inspiration
today night, we get some requests from infected peoples, they get in a message, this files, via sendspacee urls
https://www.virustotal.com/file/2b5ef3b ... /analysis/
normaly it comes as zip archiv
https://www.virustotal.com/file/2b5ef3b ... /analysis/
normaly it comes as zip archiv
Attachments
(160.63 KiB) Downloaded 61 times
it connect to:
promos.fling.com
and other ips, i seen in zero access samples, so perhaps z-access.
it loads other files from hotfile, i will attach
promos.fling.com
and other ips, i seen in zero access samples, so perhaps z-access.
it loads other files from hotfile, i will attach
Attachments
(271.84 KiB) Downloaded 61 times
ok
the produkt name
ProductName..............: ;%`TODO;%`:;%`Product;%`;%`Name;%`
of
File name:
weifgwf.ong
shows me also, its z-access, i see this in the uploaded samples of main in the last days
but this one drops z-access into recycler
the produkt name
ProductName..............: ;%`TODO;%`:;%`Product;%`;%`Name;%`
of
File name:
weifgwf.ong
shows me also, its z-access, i see this in the uploaded samples of main in the last days
but this one drops z-access into recycler
Last edited by markusg on Sun Sep 30, 2012 3:43 am, edited 1 time in total.
a ok, so
ogxEz57
is the file sending the infekted links to kontakts:
url chema:
sendspace.com/pro/dl/8a963g?image =kontaktname
ogxEz57
is the file sending the infekted links to kontakts:
url chema:
sendspace.com/pro/dl/8a963g?image =kontaktname