SafeGroup

tomatto007 napisał(a): 92 files - Identified as malicious on VT (probably many AdWare)
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

pw: sg [/malware]

Avast - 78/92 84.78%
+ Malwarebytes - 87/92 94.56%
+ HitmanPro - 89/92 96.73%

ZBot nowy
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

pass: sg[/malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

Dodano: 27 sie 2012, 19:50

Webroot kosi . Ostatnio naprawdę całkiem ładnie z wykrywalnością takich sampli

Waves97 napisał(a):ZBot nowy
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

pass: sg[/malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

Dodano: 27 sie 2012, 19:50

Webroot kosi . Ostatnio naprawdę całkiem ładnie z wykrywalnością takich sampli

EAMmilczy. Wysłane do labu.

MBAM wykrywa.

pewnie ze wykrywa bo regularnie im wysyłamdo laboratorium malwarebytes ; )

Bullguard - nie wykrywa. Podczas uruchomienia pliku jednak szkodliwa aplikacja jest blokowana.

przydały by sie testy też Anvi Smart Defender Pro 1.6 ;D

tomatto007 napisał(a): 92 files - Identified as malicious on VT (probably many AdWare)
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

pw: sg
Files MD5:
A04D613113BBEF8A2EC5B0F9B708A896
CC305F1D272D0DC0F8379075530D4969
6C55B3C4D59420B2F4198B2B2EA32D25
5393A8B71D68792FE5082B4DEB78AE7B
1FD38241915FC30589631DFC43B251C8
BC2F0AFC479B89FA88E931ADA63E5A2E
326698A481DE38F377C4264E10DF3D9C
4D915BB3310445529A42DD1DD3D94CCA
8621953FB3C76CE4ACC1C9783B3D981B
C14C75705B2E61E4E329014FD86E3629
D668191DAA59B0E98AA68F313A0C7575
C245574474BB211985D485D07F3A99C4
E8309EA91A9F8405E5B9ADEEF77427CD
7B00DB63BB1DAE8526C251AF9173B3B0
DE2E43E0A244E49187A1386C294AFFB1
DDE047A97C17F4E7F66F3DA9B0981506
E375BAC7AEBE053C3202DD92990051A2
47232A579F6122647CA057FC1349D49C
8B34A27BE7B671A072560C0FA20B2C8D
7EBB8CC58202DDBA27A94961795AD76F
FD4AF52EF8CD5EFF91F90D2090184027
2DABBD0C0BC7026771C7645B3C99E99A
2E4EB048BEE904B253EDBA279DE53B62
E0AD3995758AB8EE5A58EE805218491F
84AE05B29F3172DC16D02B78D2C656C0
485C37AE5B64BA01601DB4747B7BFDF5
B24C353D55AD7ACA1C3175BC1668C919
F9A71BA1D68035D0399D8A2CBE6C6401
EE1A857AEA73BC5C79E33007926B0AFA
96E7CEB8474C34D0393D66378D4AD142
C2F24480E70D6199F76EA66AA6A2D5A5
7B03A65E7D5A6600B6BE334BADD26BD0
C3898A7485BDD77E532CCC1795E6158A
10A30EA12A06B931B86E7C2D7005000D
653A67CA5684FE4AAF7E320B27548BA8
9389957E83F75DAE81302C3F51F37B73
F9A4968BE09540A7A35FBC94C39A1F53
8E5C8631E5781EAA7724D1A9DA691A7E
97D405BAE3EF5302FB47E3CAEA126738
13D96E96A854B1A80DC4BF2C3EDF5287
3836D4A1D250CDA01A204BF9739820E1
6AA379559A1696AD525B3F9B099B6332
B3B4BED7026CF137EF4D7154C310736B
CE38E267BA2D295E1B34D78A467846FB
31B50BE109490FB073B682F01A053453
4E563C491A23266C38E47EB49C7D7010
5BE1E50EB8526BBA40A4277A8A71EFBD
13CFBEF0799A049EE97723CD37C5B78A
592D0DD1631FFAA1A27AC9C78A01B2D3
EB7F049B7A381F8A229C5A7F1C81B21D
B36C4E0EF061080D7ED34C811658C920
33FEC3509539F7E1796E7837E4735DDA
3AA3DB11E18EE5512BEE2A3E63C5613A
BD1EAE0AB49D65D85009A7061A269290
32FFD7375F79007FD1AE2806724E0912
97EF961A104F3A83AB17E11C1AF2E1C1
777036C1157130E2FCE275AC796B2E0E
C124E5E85CC0C57D7C96D240CCF1F8EC
F556271E1338DFC224CBEBF6FE8F8EAE
426719884AF1AD94E9A3F475323017E0
F6B21E44C8FCBD99BCAC240BBAD3D1A8
030FC0553D0CC726953A37111081722A
0FA988B0ED1972D38055F07ABD2E7D22
FEFBE1F7D27C4216F5D6FE06DE37022B
20DD8FE28EDBAEC9DB32315FE3CD6E8E
BEED1643E02D4E55F6C798ED236AE259
F2036DF7F3408EB242F3D76BF8CB899A
C4A879BD4A8177BD62E23D7E6C4FA2FC
F93033F13747823ED2E5FDA54AA71742
0CC82BBBEE2E88B88D8BA955CA30BE8E
BC2AE7758E8EF96115DF47AFA2D34FD4
9718DB5B9703A2E275154053FF9DCE5F
10FA7C67947F55106856E8044D5F158E
89BEEF88B66FE09300A59B21F281532F
1B096919579E5AC16F5E6CE1F57DDFAD
D1751FAC8A843207EBA9E8CACC6E4779
3EC8109E825CB4384647A48306D6FE99
1EEFB33D61D1A3D94184DAA99A6B070A
781167737D75D44145D49CAEF9648E1C
5459CDC6FDCCE4E4F8059210E15923F5
371988DA9B69259AC65D98194FE3B6E0
5E5A0362866F71AD701D5783373FBF86
1F6CAFB0E637E17A351D03FDEDD519A5
02A394988FAE5752DC7E6DDF2D373C29
BB249C6C5BFF6377F90EAC3CE5B6424E
0897E1D1355652E24C372DBA2B7273B1
4C3C32ED8E65619CBCE6E4CEF9CE4545
D74AA4365D647ED4C20DB0E5BF37924F
5B8C616D6B5DEFEA726C73F44FFD83ED
4A8DA9E8DC18C340BB62202DF4012B0C
957194C660C39F3CC7BF3AB5306C79F3
30EEFF8AF6F2D99C24F9739A5C88E1B0[/malware]

Bullguard IS - 79/92 = 85,8 %

4x ZBOT
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]
kolejne 3
[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]

Bullguard - nie wykrywa. Podczas uruchomienia pliku jednak szkodliwe aplikacje są blokowane.

F4z napisał(a): Paczuszka z 11 plikami

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

hasło: sg[/malware]

Avast 9/11

CRIDEX

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]

Code injection in process: c:\windows\system32\cmd.exe
Created a mutex named: Local\XMI00000B6C
Created a mutex named: Local\XMI000011C0
Created a mutex named: Local\XMM00000B6C
Created a mutex named: Local\XMM000011C0
Created an event named: Local\XME00000B6C
Created an event named: Local\XME000011C0
Created process: (null),"C:\Windows\system32\cmd.exe" /c "C:\Users\tachion\AppData\Local\Temp\exp1461.tmp.bat",(null)
Created process: C:\Users\tachion\AppData\Roaming\KB01256595.exe,(null),(null)
Defined file type created: C:\Users\tachion\AppData\Roaming\KB01256595.exe


FakeAV - WinWebSec - Live Security Platinum

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]

Comodo wykrywa przy uruchamianiu sygnaturą generyczną.

Info. dla Alexa
po czym rozpoznać że to to cridex po tym KB01256595.exe <!-- s--> <!-- s-->

tachion napisał(a): CRIDEX

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]

Code injection in process: c:\windows\system32\cmd.exe
Created a mutex named: Local\XMI00000B6C
Created a mutex named: Local\XMI000011C0
Created a mutex named: Local\XMM00000B6C
Created a mutex named: Local\XMM000011C0
Created an event named: Local\XME00000B6C
Created an event named: Local\XME000011C0
Created process: (null),"C:\Windows\system32\cmd.exe" /c "C:\Users\tachion\AppData\Local\Temp\exp1461.tmp.bat",(null)
Created process: C:\Users\tachion\AppData\Roaming\KB01256595.exe,(null),(null)
Defined file type created: C:\Users\tachion\AppData\Roaming\KB01256595.exe


FakeAV - WinWebSec - Live Security Platinum

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]

Pierwszy po uruchomieniu usunięty, a drugi:

[Aby zobaczyć linki, zarejestruj się tutaj]

Ktoś tam chciał sality

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]
Size: 10036305
Entropy: 7,91

[Aby zobaczyć linki, zarejestruj się tutaj]

paker
(PEiD) = Nothing found [RAR SFX]*
Win32 GUI

log wykonania
Checked for debuggers
Code injection in process: c:\xx\tachion\defaultbox\drive\c\windows\system32\aa.exe
Created process: C:\Windows\System32\aa.exe,"C:\Windows\System32\aa.exe" ,C:\Windows\System32
Defined Autostart file created: C:\autorun.inf
Defined Autostart file created: D:\autorun.inf
Defined Autostart file created: E:\autorun.inf
Defined Autostart file created: F:\autorun.inf
Defined Autostart file created: H:\autorun.inf
Defined file type created in Windows folder: C:\Windows\System32\aa.exe
Defined file type created: C:\urslgb.exe
Defined file type created: D:\opjugs.pif
Defined file type created: E:\xardhp.pif
Defined file type created: F:\lbkyx.pif
Defined file type created: H:\cffw.pif
Defined file type modified in Windows folder: C:\Windows\SYSTEM.INI
Defined file type modified: C:\AMD\Support\12-6_vista_win7_32_dd_ccc_whql\Packages\Apps\AppEx\AppEx\ABC.exe
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\System32\aa.exe = C:\Windows\System32\aa.exe:*:Enabled:ipsec
Detected backdoor listening on port: 8751
Detected process privilege elevation
Enumerated running processes
Got computer name
Got system default language ID
Got user name information
Hide file from user: C:\autorun.inf
Hide file from user: C:\urslgb.exe
Hide file from user: D:\autorun.inf
Hide file from user: D:\opjugs.pif
Hide file from user: E:\autorun.inf
Hide file from user: E:\xardhp.pif
Hide file from user: F:\autorun.inf
Hide file from user: F:\lbkyx.pif
Hide file from user: H:\autorun.inf
Hide file from user: H:\cffw.pif
zapytania dns
wyłączenie tej sekcji
Security Center settings change: machine\software\microsoft\security center\antivirusdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\antivirusoverride = 00000001
Security Center settings change: machine\software\microsoft\security center\firewalldisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\firewalloverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\antivirusdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\antivirusoverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\firewalldisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\firewalloverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\uacdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\updatesdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\uacdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\updatesdisablenotify = 00000001

Show hidden files and folders: user\current\software\microsoft\windows\currentversion\explorer\advanced\hidden = 00000002

tachion brak linka .

Hi już jest

haa ! oo browarek ! nie rób smaka piona !

tachion napisał(a):Ktoś tam chciał sality

[Aby zobaczyć linki, zarejestruj się tutaj]

[malware]

[Aby zobaczyć linki, zarejestruj się tutaj]

[/malware]
Size: 10036305
Entropy: 7,91

[Aby zobaczyć linki, zarejestruj się tutaj]

paker
(PEiD) = Nothing found [RAR SFX]*
Win32 GUI

log wykonania
Checked for debuggers
Code injection in process: c:\xx\tachion\defaultbox\drive\c\windows\system32\aa.exe
Created process: C:\Windows\System32\aa.exe,"C:\Windows\System32\aa.exe" ,C:\Windows\System32
Defined Autostart file created: C:\autorun.inf
Defined Autostart file created: D:\autorun.inf
Defined Autostart file created: E:\autorun.inf
Defined Autostart file created: F:\autorun.inf
Defined Autostart file created: H:\autorun.inf
Defined file type created in Windows folder: C:\Windows\System32\aa.exe
Defined file type created: C:\urslgb.exe
Defined file type created: D:\opjugs.pif
Defined file type created: E:\xardhp.pif
Defined file type created: F:\lbkyx.pif
Defined file type created: H:\cffw.pif
Defined file type modified in Windows folder: C:\Windows\SYSTEM.INI
Defined file type modified: C:\AMD\Support\12-6_vista_win7_32_dd_ccc_whql\Packages\Apps\AppEx\AppEx\ABC.exe
Defined registry AutoStart location created or modified: machine\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\System32\aa.exe = C:\Windows\System32\aa.exe:*:Enabled:ipsec
Detected backdoor listening on port: 8751
Detected process privilege elevation
Enumerated running processes
Got computer name
Got system default language ID
Got user name information
Hide file from user: C:\autorun.inf
Hide file from user: C:\urslgb.exe
Hide file from user: D:\autorun.inf
Hide file from user: D:\opjugs.pif
Hide file from user: E:\autorun.inf
Hide file from user: E:\xardhp.pif
Hide file from user: F:\autorun.inf
Hide file from user: F:\lbkyx.pif
Hide file from user: H:\autorun.inf
Hide file from user: H:\cffw.pif
zapytania dns
wyłączenie tej sekcji
Security Center settings change: machine\software\microsoft\security center\antivirusdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\antivirusoverride = 00000001
Security Center settings change: machine\software\microsoft\security center\firewalldisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\firewalloverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\antivirusdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\antivirusoverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\firewalldisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\firewalloverride = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\uacdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\svc\updatesdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\uacdisablenotify = 00000001
Security Center settings change: machine\software\microsoft\security center\updatesdisablenotify = 00000001

Show hidden files and folders: user\current\software\microsoft\windows\currentversion\explorer\advanced\hidden = 00000002

Emsisoft 1/ 1=100%