Attachments
Password: infected
(173.38 KiB) Downloaded 71 times
(173.38 KiB) Downloaded 71 times
Buster_BSA wrote:New variant?Not really.
https://www.virustotal.com/file/06585ab ... /analysis/
A forum for reverse engineering, OS internals and malware analysis
Attachments
pass: infected
(82.42 KiB) Downloaded 59 times
(82.42 KiB) Downloaded 59 times
Ring0 - the source of inspiration
Buster_BSA wrote:New variant?Orig cabinet in attach.
Attachments
pass:infected
(112.85 KiB) Downloaded 60 times
(112.85 KiB) Downloaded 60 times
rkhunter wrote: SHA1: ee82783374ac3298978cb4d555f6039fe8c06b27http://www.kernelmode.info/forum/viewto ... 220#p14409
MD5: 137496bbad2022442280c10b6798fb7c
rkhunter wrote:SHA1: 355dd21d69f349fa2519116f00144ef3b3c09082http://www.kernelmode.info/forum/viewto ... 220#p14410
MD5: 30d8cfa7509168edad468b3b61b618ac
Aleksandra wrote: MD5: 5e5a57e39fe8010ff25009425ab642d2http://www.kernelmode.info/forum/viewto ... 220#p14414
SHA1: ef6cffc993e541fa7e8de06c88672e3f3c7e8749
Attachments
pass:infected
(137.33 KiB) Downloaded 60 times
(137.33 KiB) Downloaded 60 times
pass:infected
(136.68 KiB) Downloaded 56 times
(136.68 KiB) Downloaded 56 times
pass:infected
(136.67 KiB) Downloaded 59 times
(136.67 KiB) Downloaded 59 times
Guys, did you know that ZeroAccess already not rootkit?
McAfee already knows... http://blogs.mcafee.com/mcafee-labs/zer ... -file-link #lolzz
McAfee already knows... http://blogs.mcafee.com/mcafee-labs/zer ... -file-link #lolzz
It took 2 with a half months to guy find and describe PEB patch. Ah lol yes this is the best and most interesting what they got from this trojan.
Ring0 - the source of inspiration
Some guys told me that it's normal - publish research about malware that were already 3 month ago...there are people who believe to such mega-corporations.
Yes it is OK, when content is OK. He can add when this malware initially started spreading, add statistics, tell about affiliate who is behind, sensitive referenses and more *useful* content describing malware overall behaviour. He is wokring in AV company, which is one of the most largest corps in a world with increadible resources. So what this guy actually did? Fired up windbg and typed few commands. Oh really - great research! This is one of the most dumbest writeups from McAfee what I ever read.
Ring0 - the source of inspiration
I don't remember any really good research from them....
This is a really basic thing... I tried this months ago "for fun"
They could also have used Dll Unlink to completely hide it
Sans titre 1.png (97.44 KiB) Viewed 599 times
They could also have used Dll Unlink to completely hide it
