[Kimberly]

Which is easy ... don't allow Windows Explorer to access internet ;)

[unixfreaxjp]

The post is not meant for you obviously. it is even easier to "just read + commenting" than sharing stuff in here (KM).
You want to share work in here or just to be commentator to "comment" other's post who is just willing to share?
If you "personally" don't like nor agree to my posts, DON'T even read it them!!

[EP_X0FF]

@unixfreaxjp
I do not think Kimberly was trying to offend you or challenge your work.

[unixfreaxjp]

@unixfreaxjp
I do not think..

Copy that.
We have tons of these campaign now.
I am picking up significant samples only for KM friends who want to use some pcap, samples or etc.

[Xylitol]

K&A: Behind the scenes of crawling P2P botnets - http://blog.kleissner.org/?p=455

[Kimberly]

The post is not meant for you obviously. it is even easier to "just read + commenting" than sharing stuff in here (KM).
You want to share work in here or just to be commentator to "comment" other's post who is just willing to share?
If you "personally" don't like nor agree to my posts, DON'T even read it them!!

He obviously has an attitude problem with several security researchers.

I was just point out that there is no need to reinvent the wheel or complicate things when they are easy.

[unixfreaxjp]

Recent malvertisement of Gameover:


Read the VT comment for the details on infection source & callbacks CNC ip or domains.

Upatre: https://www.virustotal.com/en/file/7427 ... 395485713/
Gameover: https://www.virustotal.com/en/file/abf2 ... 395486009/

Sample:

Code: Select all

974e42b15014a9ff294f539334a4b0ae 013.eml
abe06f8c7eec9339d2185f7a420d81ed 2103USp1.qta
a2f2b24bd6fa13095c319f7f61c21d2f 3ad77ce.sys
2c3f9638d9d21b684d70e3c11e79b603 adslo.exe
68f7bd2e404d904dd65100b091fcf92d boci.exe
76229e27d6dbd8d636ee3863310b90df Case_03212014.exe
ec3bad2b139e9f77bb216edb0b8a522a sawon.exe

[unixfreaxjp]

Details are in VT comment
Upatre: https://www.virustotal.com/en/file/3924 ... 395495834/
Zeus/GMO: https://www.virustotal.com/en/file/e49c ... 395522582/
Necurs: https://www.virustotal.com/en/file/f147 ... /analysis/
Full samples, spam+upatre+gameover+traffic attached

[unixfreaxjp]

Details are in VT comment
Upatre: https://www.virustotal.com/en/file/1c3a ... 395523675/
Zeus/GMO: https://www.virustotal.com/en/file/e527 ... /analysis/
Necurs: https://www.virustotal.com/en/file/f147 ... 395524342/
Full samples, spam+upatre+gameover+traffic attached

[malwarelabs]

It's look like another Zbot sample but peID return C# signature