Rogue Antimalware (FakeAV, 2013 year)

[Xylitol]

Can anyone attach the sample for this:
http://blog.malwarebytes.org/intelligen ... he-tables/

[ISergey256]

Internet Security
original https://www.virustotal.com/ru/file/c6c0 ... /analysis/
unpacked https://www.virustotal.com/ru/file/93ac ... /analysis/
Strings

Code: Select all

Houdsodu!Rdbtshux
X79SDV,U67GE0,T2WBG4@
iuuq;..rdbtshuxidmqrtqqnsu/bnl.nqdo/qiq
iuuq;..`tunhourdbtshux/bnl.ctxonv/qiq>che<$`ewhe$
iuuq;..`tunhourdbtshux/bnl.rtqqnsu/iulm
iuuq;..rnguqnsu`m271/bnl.515/qiq>he<$`ewhe$
iuuq;..mhbdobdbidbj35/bnl.`buhw`ud.`buhw`ud/qiq>he<$the$'l`hm<$dl`hm$'nseds^he<$nseds$
iuuq;..mhbdobdbidbj35/bnl.`buhw`ud.`buhw`ud/qiq>he<$the$'
iuuq;..2erdbtsdhoudso`uhno`m/bnl.rtqqnsu/qiq
ogdbude;!Usnk`o,Envomn`eds/Vho23/@fdou

Decript

Code: Select all

Internet Security
Y68REW-T76FD1-U3VCF5A
hxxp://securityhelpsupport.com/open.php
hxxp://autointsecurity.com/buynow.php?bid=%advid%
hxxp://autointsecurity.com/support.html
hxxp://softportal360.com/404.php?id=%advid%
hxxp://licencecheck24.com/activate/activate.php?id=%uid%&mail=%email%&order_id=%order%
hxxp://licencecheck24.com/activate/activate.php?id=%uid%&
hxxp://3dsecureinternational.com/support.php
nfected: Trojan-Downloader.Win32.Agent!

[ISergey256]

XP Micro Antivirus Online Scan

Code: Select all

hxxp://pcspeedplus.com/scan/

https://www.virustotal.com/ru/url/45997 ... /analysis/





Download PS Speed Maximizer