A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #32139  by FakeAVHunter
 Sun Sep 23, 2018 4:11 pm
This topic is about malwares so BestMP IS categorized as malware
Here is Best.zip sample first i run the ms_update107_2230.exe that installs
This rogue cant be installed so he leaved a folder and 0 kb file
Folder name : e8e775
File NAME : BMe8e_2230.exe
That part with e8e is writted by foldername and file it have a match
I Runned the external file And crash Runtime error i think is caused by other things.He leaved cmdhost that delete itself because error occured.
Is the sample exe broken?
Is invalid folders and file names.
Do needs unpack?
I think do not spam but i will do malware unpack request 2 later.
Now i create a folder.
First i insert the following characters b49 that are associated with BMb49_2230.exe
Example of folder names for this file
b49 - xxx three random characters you want WARNING MAX 6 CHARACTERS FOLDER
Like example b492ht b493jb and b49 - (Many more)
The file name at start is BM = Best malware protection at end is _2230 random things.
The folder has been created finally
I Moved the old 4 -5 fakeav years in the folder name that i invented his random name and opening command prompt.
The rogue exe is encrypted so he cant run without this crappy commands /hkd or /s /d
So i inserted this command /s /d and after the command he dropped folders and finally works
I Learned a lesson about this fakevimes threat.He refuse to be runned on virtual machine antivm So he like to be runned on my host pc and i dont care i can remove this with MBAM OR Remove manually
I Dont like spam so i showed my clever or nice attempts to make him works in present.For more PM ME.
Blame the file and folder name.So is a lower change to make this to work on host OS windows