A forum for reverse engineering, OS internals and malware analysis 

Rogue Antimalware (FakeAV, 2015 year)

Forum for analysis and discussion about malware.
 Topic locked

Re: Rogue Antimalware (FakeAV, 2015 year)

 #25724  by Grinler
 Wed Apr 22, 2015 11:19 pm
EP_X0FF wrote:@Blaze

Such a hello from the past :)

http://www.kernelmode.info/forum/viewto ... 4712#p4712
Here is the list of rogues in this family: http://www.bleepingcomputer.com/virus-r ... cdefender/

Yup, last one we saw from this family was AntiVirus Plus 2014 from 12/06/13. This was never a prolific family, with only about 11-12 variants released over a 4 year period.

Image

Re: Rogue Antimalware (FakeAV, 2015 year)

 #25931  by Xylitol
 Mon May 25, 2015 9:09 pm
Antivirus Pro 2017
Image Image Image

Original: https://www.virustotal.com/en/file/312f ... 432579379/ > 26/57
Unpacked: https://www.virustotal.com/en/file/5187 ... 432579640/ > 15/56

Fraudulent payment processor for fake Antivirus: secure.billingauto.com ⚫ 194.54.83.82
FakeAV call home: twinkcam.net ⚫ 74.86.20.50
Fake site: securerem.com ⚫ 194.54.83.83

Persistance: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017
Fake Antivirus can be unistalled by using the argument: -uninstall
Image
Unlock key: Y65RAW-T87FS1-U2VQF7A
Vidya: https://www.youtube.com/watch?v=Z_pLtVUCz8c

Thanks to siri for the sample.
Attachments
infected
(2.07 MiB) Downloaded 156 times

Re: Rogue Antimalware (FakeAV, 2015 year)

 #26742  by Xylitol
 Wed Sep 16, 2015 5:06 pm
Security Defender
ImageImageImage
Open random visa/xhamster/paypal websites and flash (epilepsy warning).

Network activity:
Code: Select all
95.213.186.51:81/purchase.php?a=0&v=1005&u=3c48680fa1def47c7406eff698ef4a67&bgload=1
VT: 6/52
Attachments
infected
(472.73 KiB) Downloaded 108 times
 Topic locked
 Return to “Malware”