[RomaNNN]

Dr Web added curing BOOT-sectors with a reboot. ;)

Cure.png (34.11 KiB) Viewed 926 times

Control rescan:

1) 2020.exe
Dropper - http://www.virustotal.com/file/04bc28d0 ... 329243364/
VBR - http://www.virustotal.com/file/8b9af078 ... /analysis/
MBR - http://www.virustotal.com/file/2bd7abf8 ... /analysis/

2) 2030.exe
Dropper - http://www.virustotal.com/file/efa74b50 ... 329243666/
VBR - http://www.virustotal.com/file/97629e56 ... 329243696/
MBR - http://www.virustotal.com/file/1f4b6982 ... 329243760/

3) 3000.exe
Dropper - http://www.virustotal.com/file/bb0fabf3 ... 329243907/
VBR - http://www.virustotal.com/file/05616285 ... 329243955/
MBR - http://www.virustotal.com/file/c645c8f6 ... 329243988/

[rkhunter]

Guys, what about x64, anyone look it?

[AaLl86]

Great news! I'm starting to anlyze it...
KernelMode.info is as usually a very good place for us...

Regards,
Andrea

[rkhunter]

Great news! I'm starting to anlyze it...
KernelMode.info is as usually a very good place for us...

Regards,
Andrea

:D
Peace for all!

[rkhunter]

http://blog.eset.com/2012/02/22/rovnix- ... -evolution

[Kafeine]

Look like this is a test run no ?
Or or preprod server...Stats are really stranges.

Rovnix.b C&C



1 ip only (??) In fact 2..both from Lease web. The other one ( 178.162.174.xx) not far from the C&C (178.162.132.xx)





Note the 2020 group (See Eset Post)




On the Other IP.

[rkhunter]

Kafeine, hi here :)

[erikloman]

VBR detection remains quite low (as per above VT results).
According to this tweet there seems to be some interesting self-defense.

Looking for some recent droppers for research, thanks!

[Xylitol]

http://blog.eset.com/2012/07/13/rovnix- ... rk-updated
Rovnix.D in attach.
https://www.virustotal.com/file/65bbaeb ... 342259506/

[Flamef]

http://blog.eset.com/2012/07/27/rovnix- ... tion-story