A forum for reverse engineering, OS internals and malware analysis 

Win32/Spatet

Forum for analysis and discussion about malware.

Win32/Spatet

 #5237  by EP_X0FF
 Tue Mar 01, 2011 4:35 am
markusg wrote:cyber gate
Trojan PWS with AntiVM stuff on board.
Likely Spatet, however DrWeb for example marks it like CyberGate. This is generic detection.

Re: Malware/MSIL-BA

 #5290  by EP_X0FF
 Thu Mar 03, 2011 2:02 pm
markusg wrote:Ulitmate Adobe Photoshop CS5 Keygen.exe?
http://www.virustotal.com/file-scan/rep ... 1299152371
Crashes on start.
markusg wrote:TuneUpUtilities2011_keygen.exe
http://www.virustotal.com/file-scan/rep ... 1299153266
drops payload which crashes on start due to incorrect decryption.
markusg wrote:http://www.virustotal.com/file-scan/rep ... 1299152545
Kaspersky IS 2011 Patch (30-06-11).exe?
dotnet container for Win32 Spatet.

unpacked result
https://www.virustotal.com/file-scan/re ... 1299160220
markusg wrote:BulletStorm Keygen.exe
http://www.virustotal.com/file-scan/rep ... 1299153626
same info stealer

Re: Malware/MSIL-BA

 #5308  by EP_X0FF
 Fri Mar 04, 2011 12:10 pm
markusg wrote:IPMonitor.exe
http://www.virustotal.com/file-scan/rep ... 1299183148
Dotnet container for trojan info stealer, payload executed in vbc.exe address space (Delphi, AntiSandbox/AntiVM, Cryptor + UPX).
Spatet/Rebhib/CyberGate.1

https://www.virustotal.com/file-scan/re ... 1299240275

the names of the same. Reviewed many times.

Posts moved.
  • 1
  • 3
  • 4
  • 5
  • 6
  • 7
 Return to “Malware”