[ikolor]

New attack for browser.Firefox died .
Cryptowall

http://www.object32.site/
http://www.corner87.site/


new

https://www.virustotal.com/pl/file/6bf1 ... 501502095/

[heart888]

Downloaded file 2f15629f816d4bdc7eab2768f3632307, hash not found in VT yet.

New attack for browser.Firefox died .
Cryptowall

http://www.object32.site/
http://www.corner87.site/


new

https://www.virustotal.com/pl/file/6bf1 ... 501502095/

[Antelox]

The sample with SHA256: 6bf1ec3bc2f0a97bdca700f02a99db02543fc00e6e9e88bbc444e56c4f74dfc5 is Geodo/Emotet doc downloader.

BR,

Antelox

[ikolor]

hi

https://www.virustotal.com/#/file/4a5d8 ... /detection

[Antelox]

hi

https://www.virustotal.com/#/file/4a5d8 ... /detection

Geodo/Emotet doc downloader

The binary downloaded: https://www.virustotal.com/en/file/fb06 ... /analysis/

From:

Code: Select all

hxxp://downlowpictures.com/TjPEWaKl/

BR,

Antelox

[ikolor]

thanks
https://www.virustotal.com/#/file/befff ... /detection

[Antelox]

thanks
https://www.virustotal.com/#/file/befff ... /detection

This is Geodo/Emotet doc downloader.

The binary dropped: https://www.virustotal.com/en/file/2b68 ... /analysis/

BR,

Antelox

[ikolor]

thanks you Antelox

https://www.virustotal.com/#/file/1c44a ... /detection

[Antelox]

thanks you Antelox

https://www.virustotal.com/#/file/1c44a ... /detection

This is Geodo/Emotet doc downloader.

It downloads this: https://www.virustotal.com/en/file/da7c ... /analysis/

BR,

Antelox

[xors]

I will leave this article here, "Hijacks a Windows API",no comment:

http://blog.trendmicro.com/trendlabs-se ... -analysis/