[sysopfb]

Sample and config attached

[Xylitol]

additional info: http://securityintelligence.com/watch-o ... -the-wild/
one month old sample: https://www.virustotal.com/en/file/50d2 ... 449767956/

[p1nk]

Anyone reversed the packing that it's using (working on reinstalling my analysis vm). It doesn't look terribly complex and the encoded data likely starts in the data section at 0x0041E023

[sysopfb]

Here's a new config with some different targets and ATS urls

Sample came from Brad at MTA: https://isc.sans.edu/forums/diary/Every ... 2015/20477

[sysopfb]

Releasing a paper I wrote last year on this.

[ikolor]

thanks .

https://www.virustotal.com/en/file/dcc8 ... 497533985/

[maddog4012]

thanks .

https://www.virustotal.com/en/file/dcc8 ... 497533985/

file dropped by js file

[EP_X0FF]

thanks .

https://www.virustotal.com/en/file/dcc8 ... 497533985/

file dropped by js file

It is CoreBot. In attach extracted. Posts moved.