[InsaneKaos]

Here is another sample with some improvements. aswMBR wasn't able to remove it, but detected TDL4. mbr.exe missed it. TDSSKiller still got it. I did not use any other tools, yet. Tested on Windows XP Sp3 (atapi + iaStor).

From the config.ini

Code: Select all

[main]
version=0.03
aid=40787
sid=0
builddate=351
rnd=1482476501
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://4tag16ag100.com/;hxxps://zna61udha01.com/;hxxps://dg6a51ja813.com/;hxxps://7gaur15eb71.com/;hxxps://ka18i7gah10.com/
wsrv=hxxp://bangl24nj14.com/;hxxp://lkeopee32.com/;hxxp://63.223.106.16/;hxxp://63.223.106.17/;hxxp://iau71nag001.com/;hxxp://baj19kall10.com/
psrv=hxxp://cikh71ynks66.com/;hxxp://clkh71yhks66.com/
version=0.15

VT-Report: http://www.virustotal.com/file-scan/rep ... 1304819009

[markusg]

Download Accelerator Plus (9.6.).exe
http://www.virustotal.com/file-scan/rep ... 1305109828

[EP_X0FF]

Download Accelerator Plus (9.6.).exe
http://www.virustotal.com/file-scan/rep ... 1305109828

Muldrop, drops TDL4

[main]
version=0.03
aid=30000
sid=3
builddate=351
rnd=1645522239
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://lo4undreyk.com/;hxxps://sh01cilewk.com/;hxxps://cap01tchaa.com/;hxxps://kur1k0nona.com/;hxxps://u101mnay2k.com/
wsrv=hxxp://gnarenyawr.com/;hxxp://rinderwayr.com/;hxxp://jukdoout0.com/;hxxp://swltcho0.com/;hxxp://ranmjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.15

Along with TDL4 install some VB junk, see attach

[ConanTheLibrarian]

http://it.slashdot.org/story/11/05/16/1 ... -New-Level

[markusg]

pEshicjyaucyYuw.exe
http://www.virustotal.com/file-scan/rep ... 1305629390

[markusg]

this, i found on infected machine:
http://www.virustotal.com/file-scan/rep ... 1305725343
its dropping this file:
k.exe
http://www.virustotal.com/file-scan/rep ... 1305725700
i saw this file info a wile ago for an tdl sample, so it looks like, for me, its tdl.

[Meriadoc]

VT - 5/43 http://www.virustotal.com/file-scan/rep ... 1305764606

update to usermode component?

from cfg.ini

Code: Select all

[main]
version=0.03
aid=40787
sid=0
builddate=351
rnd=602162358
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://4tag16ag100.com/;hxxps://zna61udha01.com/;hxxps://dg6a51ja813.com/;hxxps://7gaur15eb71.com/;hxxps://ka18i7gah10.com/
wsrv=hxxp://bangl24nj14.com/;hxxp://lkeopee32.com/;hxxp://63.223.106.16/;hxxp://63.223.106.17/;hxxp://iau71nag001.com/;hxxp://baj19kall10.com/
psrv=hxxp://cikh71ynks66.com/;hxxp://clkh71yhks66.com/
version=0.175

[markusg]

http://www.virustotal.com/file-scan/rep ... 1306435508

[EP_X0FF]

http://www.virustotal.com/file-scan/rep ... 1306435508

[main]
version=0.03
aid=30041
sid=0
builddate=351
rnd=602162358
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=hxxps://lo4undreyk.com/;hxxps://sh01cilewk.com/;hxxps://cap01tchaa.com/;hxxps://kur1k0nona.com/;hxxps://u101mnay2k.com/
wsrv=hxxp://gnarenyawr.com/;hxxp://rinderwayr.com/;hxxp://jukdoout0.com/;hxxp://swltcho0.com/;hxxp://ranmjyuke.com/
psrv=hxxp://crj71ki813ck.com/
version=0.175

data in attach
I'll try to merge your posts with samples in one because actually thats the same recrypted bot.

[markusg]

dll.exe
http://www.virustotal.com/file-scan/rep ... 1306514048

i.exe
http://www.virustotal.com/file-scan/rep ... 1306586293

dll.exe
http://www.virustotal.com/file-scan/rep ... 1306760505

dll.exe
http://www.virustotal.com/file-scan/rep ... 1306860743