[StamilT]

https://www.virustotal.com/file/42ce752 ... 328632936/
Detection ratio: 26/42

https://www.virustotal.com/file/320f401 ... 328633907/
Detection ratio: 34/43

MD5: 53AA566C17D0EEEE6E03CD8ACEF5545E
https://www.virustotal.com/file/b90615f ... 328634598/
Detection ratio: 28/43

MD5: D3E713DD85BE03C2D8488CE5432F7EBB
https://www.virustotal.com/file/bde6d93 ... 328635809/
Detection ratio: 24/41

[rkhunter]

Fresh dropper

MD5: 50f2e009281e113c7d8291602b0bf183
2/43

[EP_X0FF]

Fresh dropper

MD5: 50f2e009281e113c7d8291602b0bf183
2/43

What is the source of this dropper? Can you share?

[rkhunter]

Code: Select all

hxxp://host138-flash.3utilities.com/download-id79629/flash_player_installer.exe

[dcmorton]

MD5: 50f2e009281e113c7d8291602b0bf183

This seems to be a newer variant on ZA; ran into one of these yesterday actually.

Haven't tied it on x86 yet, but on x64 its added a service that re-infects the Session Manager\Subsystems\Windows key on boot.

[rkhunter]

I have captured today one more fresh dropper, this one.

MD5: 49430556598255cd3a19830d30f38380
2/43

[rkhunter]

MD5: F5DD565288E19C6125F15ED05A46F43F
7/43

[B-boy/StyLe/]

This seems to be a newer variant on ZA; ran into one of these yesterday actually.
Haven't tied it on x86 yet, but on x64 its added a service that re-infects the Session Manager\Subsystems\Windows key on boot.

Yeah, this version has an extra layer of protection. Many NetSvcs are being inserted, and the junctions are recreated on every reboot.


Regards,
G.

[Aleksandra]

MD5: f3e480e05a286c5e985419eceae62cda
SHA1: 443c07734550ebd7ba9ed00336107a6668f698cb
1/43

[rkhunter]

MD5: 2A057C89B1D96CED1724C089B154753B
4/43