[Xylitol]

http://news.drweb.com/show/?i=2679&lng=en&c=14
Sample for Windows/GNU-Linux/Solaris/Mac OS X + Shellcodes in attach.
Small note, for Mac there is the Mach-O and the Application Bundle

[bsteo]

Isn't this one NetWire RAT? Seems like it.

[maddog4012]

Here is a variant of Netwire I can across today I have included the word doc that is sent to the victim e-mail. when the doc is opened it downloads Netwire

[Xylitol]

What's the password?
edit: virus

Doc file downloading

Code: Select all

http://247financedeal.com/dbust.exe

https://www.virustotal.com/en/file/ae22 ... 454114939/
Win32/Spy.Weecnaw.A (ESET) ~ http://www.virusradar.com/en/Win32_Spy. ... escription

[tWiCe]

Code: Select all

http://247financedeal.com/dbust.exe

https://www.virustotal.com/en/file/ae22 ... 454114939/
Win32/Spy.Weecnaw.A (ESET) ~ http://www.virusradar.com/en/Win32_Spy. ... escription

ESET has NetWeird name for OSX/Linux/Solaris samples, but for Windows they've picked another alias? it's strange..

[patriq]

Another NetWire on the same server

Code: Select all

hxtp://247financedeal.com/cbust.exe

https://www.virustotal.com/en/file/8e27 ... 444788304/

Xyl wrote about this
http://www.xylibox.com/2012/07/netwire- ... m-rat.html

[markusg]

SHA256:
69f61b266fbcdbfd90b23ce4087206488f509ae3a38f356ff64e4d241e02dfad
Dateiname:
LICENS~1.EXE
Erkennungsrate:
14 / 59
https://virustotal.com/de/file/69f61b26 ... 498699772/

[markusg]

SHA256:
69f61b266fbcdbfd90b23ce4087206488f509ae3a38f356ff64e4d241e02dfad
Dateiname:
LICENS~1.EXE
Erkennungsrate:
14 / 59
https://virustotal.com/de/file/69f61b26 ... 498699772/

not able to edit post,
its perhaps
TrojanSpy: Win32/Loyeetro.A

[Antelox]

SHA256:
69f61b266fbcdbfd90b23ce4087206488f509ae3a38f356ff64e4d241e02dfad
Dateiname:
LICENS~1.EXE
Erkennungsrate:
14 / 59
https://virustotal.com/de/file/69f61b26 ... 498699772/

It's NetWire RAT.

C2s:

85.95.184.183:33360
xdem777.duckdns.org:20000
xdem777.linkpc.net:7777

In attachment the unpacked.

BR,

Antelox

[ikolor]

thanks .Malware from your server

https://www.virustotal.com/#/file/21bbb ... /detection