A forum for reverse engineering, OS internals and malware analysis 

Win32/GetShell

Forum for completed malware requests.

Win32/GetShell

 #14547  by frame4-mdpro
 Tue Jul 10, 2012 8:31 am
Looking for this new, multi-platform malware:

""Multi-platform Backdoor Lurks in Colombian Transport Site""
http://www.f-secure.com/weblog/archives/00002397.html

Hashes:
Trojan-Downloader:Java/GetShell.A (sha1: 4a52bb43ff4ae19816e1b97453835da3565387b7)
Backdoor:OSX/GetShell.A (sha1: b05b11bc8520e73a9d62a3dc1d5854d3b4a52cef)
Backdoor:Linux/GetShell.A (sha1: 359a996b841bc02d339279d29112fe980637bf88)
Backdoor:W32/GetShell.A (sha1: 26fcc7d3106ab231ba0ed2cba34b7611dcf5fc0a)

Thanks,

Re: Malware Requests, part 2

 #14555  by Xylitol
 Tue Jul 10, 2012 12:37 pm
frame4-mdpro wrote:Looking for this new, multi-platform malware:

""Multi-platform Backdoor Lurks in Colombian Transport Site""
http://www.f-secure.com/weblog/archives/00002397.html

Hashes:
Trojan-Downloader:Java/GetShell.A (sha1: 4a52bb43ff4ae19816e1b97453835da3565387b7)
Attachments
infected
(4.31 KiB) Downloaded 65 times

Re: Malware Requests, part 2

 #14575  by leeno
 Wed Jul 11, 2012 12:42 pm
Xylitol wrote:W32/GetShell.A
Hi Xylitol,

Did u uploaded the same compiled Java class
Trojan-Downloader:Java/GetShell.A (sha1: 4a52bb43ff4ae19816e1b97453835da3565387b7. I tried to run the applet with appletviewer.exe but don't see any cnc communication or dropped file .

Thanks

arvind Kumar
 Return to “Completed Malware Requests”