A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #4932  by Xylitol
 Mon Feb 07, 2011 1:30 pm
Attachments
See archive comment for password
(774.88 KiB) Downloaded 66 times
 #4984  by Xylitol
 Thu Feb 10, 2011 8:24 am
Attachments
see archive comment for password
(820.75 KiB) Downloaded 55 times
 #5023  by Xylitol
 Sat Feb 12, 2011 2:34 pm
Attachments
see archive comment for password
(821.3 KiB) Downloaded 62 times
 #5024  by EP_X0FF
 Sat Feb 12, 2011 2:38 pm
btw, have you tried to send abuses to the hosting providers (for example in case of Yandex lock'em'all crap this worked), or they are all bulletproof?
 #5039  by Xylitol
 Sun Feb 13, 2011 2:07 pm
EP_X0FF wrote:btw, have you tried to send abuses to the hosting providers (for example in case of Yandex lock'em'all crap this worked), or they are all bulletproof?
yes and that work ;)

new loc: hXXp://trololo.mcdir.ru/quicktime9_update.exe
Disguised as fake QuickTime update.

Image

Image

vt: https://www.virustotal.com/file-scan/re ... 1297591167
Attachments
See archive comment for password
(849.7 KiB) Downloaded 60 times
 #5082  by Xylitol
 Thu Feb 17, 2011 1:59 pm
new loc: hXXp://opalicki9hpcarole.narod2.ru/xxx_video.exe
Code: Select all
Number to Call: 8-965-349-54-36
Number to Call: 8-964-531-17-12
Number to Call: 8-964-770-61-17
Number to Call: 8-965-376-03-05
Number to Call: 8-965-134-73-86
Number to Call: 8-965-350-73-74
Number to Call: 8-964-531-26-03
Number to Call: 8-905-592-08-01
Number to Call: 8-962-941-15-44
Number to Call: 8-965-265-33-47
Image
Attachments
see archive comment for password
(638.17 KiB) Downloaded 65 times
 #5086  by Xylitol
 Thu Feb 17, 2011 11:02 pm
loc: hXXp://olivernehru.narod2.ru/xxx_video.exe
Code: Select all
8-906-798-28-09
8-906-798-28-04
8-906-798-28-03
8-909-650-77-06
8-909-650-76-77
8-909-650-76-71
8-909-650-81-53
8-909-650-81-51
8-909-161-78-68
8-909-161-78-94
http://www.virustotal.com/file-scan/rep ... 1297983528
http://www.virustotal.com/file-scan/rep ... 1297983545
Attachments
see archive comment for password
(639.19 KiB) Downloaded 60 times
 #5098  by Xylitol
 Sat Feb 19, 2011 8:47 am
loc: hXXp://isaacbranden.narod2.ru/xxx_video.exe
Code: Select all
8-909-986-39-51
8-909-986-41-79
8-909-986-41-51
8-909-986-41-48
8-909-986-41-13
8-909-986-56-06
8-909-986-50-45
8-909-986-50-43
8-909-986-50-39
8-909-986-50-38
Attachments
See archive comment for password
(628.01 KiB) Downloaded 55 times
 #5185  by Xylitol
 Sun Feb 27, 2011 2:28 pm
new loc: hXXp://amxxxvid.cz.cc/free/xxx_video.exe
Code: Select all
8-906-097-04-22
8-906-097-13-04
8-909-650-79-86
8-909-650-79-85
8-906-097-12-33
8-906-097-12-67
8-909-650-75-19
8-909-650-74-99
8-909-650-74-87
8-909-650-74-77
https://www.virustotal.com/file-scan/re ... 1298816808

edit:

new loc: hXXp://rumikas.ru/porno_video1019.avi.exe
Code: Select all
Number to Call: 8-965-240-49-18 ~ 89652404918
Number to Call: 8-967-027-18-99 ~ 89670271899
Number to Call: 8-967-171-23-65 ~ 89671712365
Number to Call: 8-905-545-97-92 ~ 89055459792
Number to Call: 8-967-150-24-66 ~ 89671502466
http://www.virustotal.com/file-scan/rep ... 1298817570
Attachments
See archive comment for password
(817.3 KiB) Downloaded 55 times
See archive comment for password
(651.83 KiB) Downloaded 56 times