[rick8295]

ok so recently my friend said his facebook account is hacked....
i went over to his home and found this in his pc...

now iv been trying to analyse...
:|
but this cant be run on sandbox...
nor can i use wireshark to log the connections to trace the attacker...
since in both cases the program terminates... :3

If any1 can analyze this and give me a ip... or tips would be great.. :D

http://malwr.com/analysis/0c2236e007857 ... a3fad8597/

[EP_X0FF]

You didn't password protected your file. Attach has been replaced. This file seems damaged and not working either due to crypter. However the following pattern inside

kernel32.dll CreateProcessA ntdll.dll NtUnmapViewOfSection WriteProcessMemory GetThreadContext ReadProcessMemory SetThreadContext ResumeThread VirtualAllocEx VirtualAlloc VirtualFree

is a classic set of functions used in injector based cryptors. As I said this malware crashes in process of decryption. Someone else can try again :)

[nullptr]

It looks like an alpha version of a crypter used for some Zbot variants. Most were unexecutable due to bugs in the crypter,
but I did find a few that actually worked. I'll check through my archives for working samples.