[Xylitol]

Dexter sample, extracted from an infected machine.
https://www.virustotal.com/en/file/65fd ... 379698058/

[patriq]

Dexter sample, extracted from an infected machine.
https://www.virustotal.com/en/file/65fd ... 379698058/

https://malwr.com/analysis/ZWNmMDZjMWFl ... Y4ZjkxMGU/
http://cybercrime-tracker.net/index.php ... .76.44.111

"Strings" from this sample:
62.76.44.111
/fk/gateway.php


Dexter panel: hxxp://62.76.44.111/fk/

[Xylitol]

Unknown PoS malware, similar to ProjectHook.
found on a previously infected machine as replacement for Dexter
https://www.virustotal.com/en/file/1c6e ... 379752374/

It call

Code: Select all

htxp://193.109.68.10:80/3VEjLtintFETnAenGM3h5yg4pHnREw/index.php

[morgan]

hi guys but no one here have original dexter v2 or alina in full version that i can test out and anaylis value thanks pm me

[Xylitol]

Have you even looked the content of this thread ? there is Alina samples in almost every page.
Dexter v2: http://www.kernelmode.info/forum/viewto ... 110#p20877
Alina 5.6: http://www.kernelmode.info/forum/viewto ... 100#p19430

[morgan]

ah yes i know but is only exe is not source or compiler that i can test out!

[Xylitol]

i doubt someone will post the source :|
In attach another Dexter i've extracted from infected PoS system
https://www.virustotal.com/en/file/b592 ... 379779988/

[btclord]

i tried to play with dexter and what i am getting is encrypted text to my website.
how to get these strings decrrypted to know what is really uploading? is there php files or panel source?

[Xylitol]

i tried to play with dexter and what i am getting is encrypted text to my website.
how to get these strings decrrypted to know what is really uploading? is there php files or panel source?

xor/base64
http://cybercrime-tracker.net/dexter.php
In attach another Dexter sample, and same, extracted from infected PoS.
https://www.virustotal.com/en/file/db5c ... 379848040/

[morgan]

i will be realy happyfull if i can game with dexter v2 or alina and analysis it in full :) who have can contact me in pm thanks