[p4r4n0id]

Hi,

http://www.welivesecurity.com/2013/09/0 ... -the-wild/

attached zasilka.pdf.exe sample: d3c7d6d10cd6f3809c4ca837ba9ae2e8

Enjoy

p4r4n0id

[kloent]

Decrypted from the post above, with extracted core DLL's (core_x86.bin, core_x64.bin). Authors internal name - Hesperus (http://en.wikipedia.org/wiki/Hesperus).

[N3mes1s]

Hesperbot "technical" analysis part 1/2
http://www.welivesecurity.com/2013/09/0 ... s-part-12/

[alonium]

N3mes1s
You put in quotes word "technical" because you think that is not? I fully agree with you.
Here is more technical article from McAfee:
http://blogs.mcafee.com/mcafee-labs/hes ... ker-trojan (They even have 1 OllyDbg screen)

[N3mes1s]

Yes, alonium.

http://www.welivesecurity.com/2013/09/0 ... s-part-22/
this second part seems to be more technical