A forum for reverse engineering, OS internals and malware analysis 

Win32/Kovter

Forum for analysis and discussion about malware.

Re: Win32/Kovter

 #25621  by EP_X0FF
 Sun Apr 12, 2015 9:41 am
virusremover wrote:how do you run these files :D
With magic. Something more specific to ask?

Re: Win32/Kovter

 #26753  by R136a1
 Thu Sep 17, 2015 12:54 pm
Kovter using Poweliks methods:
https://reaqta.com/2015/09/poweliks-fil ... -evolving/

Config:
http://pastebin.com/5C6cjamP

Sample:
https://www.virustotal.com/en/file/673b ... /analysis/

Thanks to Horgh for clarifying
Attachments
PW: infected
(273.88 KiB) Downloaded 96 times

Re: Win32/Kovter

 #26754  by EP_X0FF
 Thu Sep 17, 2015 4:01 pm
R136a1 wrote:Kovter using Poweliks methods:
https://reaqta.com/2015/09/poweliks-fil ... -evolving/
Oh lol, this gang still use Delphi, after so many years...

It took them 1.5 years to translate Powerliks idea in Delphi code. Of course this have nothing in common with original Poweliks which I believe came from Alureon devs (wowliks as previous version).

Fully decrypted Delphi EXE in attach.

Decrypted VT result.
https://www.virustotal.com/en/file/b320 ... 442505459/
Attachments
pass: infected
(141.86 KiB) Downloaded 80 times

Kovter

 #28429  by hdtra
 Wed Apr 27, 2016 8:08 pm
A client was hit with Kovter. The dropper {flashplayer.exe, 0433edb27a1ef8028cbdc8ba973693576d6b76bb2d6f29dc7eb474978d4e465c} was downloaded from http://soophsakeena.com/6321112935147/6 ... player.exe (https://virustotal.com/en/url/29194a1fb ... /analysis/). It's not letting me download the file directly so if anyone has this particular piece or can access the file from the site I'd appreciate it. Thanks.

Re: Kovter

 #28446  by patriq
 Mon May 02, 2016 9:27 pm
0433edb27a1ef8028cbdc8ba973693576d6b76bb2d6f29dc7eb474978d4e465c is not in VT , do you have another hash?

Re: Kovter

 #28448  by hdtra
 Tue May 03, 2016 12:03 am
Unfortunately I don't. SHA-256 is the only hash type the reporting tool on the system recorded. I've been checking Google, Malwr, VT, etc everyday and it's not showing anywhere.

Re: Kovter

 #28454  by patriq
 Tue May 03, 2016 10:08 pm
having trouble finding the actual payloads.. but got a step closer.
https://virustotal.com/en/domain/soophs ... formation/

droppers everywhere (examples attached):
wscript (3/57!)
https://virustotal.com/en/file/d368c350 ... /analysis/

powershell (1/57 !!)
https://virustotal.com/en/file/45485ad4 ... /analysis/

I have a good idea: Don't bother running AV since it does nothing anyway. Problem solved. ;)
Attachments
(1.18 KiB) Downloaded 74 times
 Return to “Malware”