A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #15017  by Aleksandra
 Sun Aug 05, 2012 6:47 am
MD5: 6ad655563c28c36f90a009ac78feaab1
SHA1: 37d8e65b7109a28d3cb253829bdb0f5decbf96d9
12/41

Infected files attached.
Attachments
pass: virus
(1.25 MiB) Downloaded 156 times
 #18717  by EP_X0FF
 Wed Mar 27, 2013 6:34 am
Win32/Expiro.BD in attach.

SHA256: 1a0e3a6ec64bc1a7301f113c797e6620feda24030f5037214cc1d2f000354d4e
SHA1: cf95e3a56836285fa8a3f5408ef23108de9d8d77
MD5: 195deba36bc846f4f6b29cf86862b565

https://www.virustotal.com/en/file/1a0e ... 364365902/

Refer to encyclopedia entry for more info.
Attachments
pass: malware
(130.75 KiB) Downloaded 112 times
 #20390  by Cody Johnston
 Mon Aug 05, 2013 7:21 pm
This is likely the dropper for the file posted above:

3/46

MD5: 4928fa5ed61c213b66ae8036a96037d1

https://www.virustotal.com/en/file/4b45 ... /analysis/

Does anyone know of a working removal tool for this variant? The AVG remover is not working as expected.
Attachments
Password: infected
(128.69 KiB) Downloaded 92 times
 #20876  by Mosh
 Fri Sep 20, 2013 3:53 pm
Win32/Expiro and Postbank phishing site on 178.211.45.186 (Turkey)

SHA256: 2594b3b280d60bb7d19687de48bca90b260c4ad13171f6ecb67f5968eab024b5
SHA1: 5649d1dc81eba450cec8f67b10232718ee0add8f
MD5: 4d6d41cf255d73e278ed2eef43432fc3
File size: 574.0 KB ( 587776 bytes )
File name: usbhost.exe
File type: Win32 EXE
Tags: peexe
Detection ratio: 27 / 48
https://www.virustotal.com/en/file/2594 ... 379690433/

Postbank site: http://urlquery.net/report.php?id=5625934
Attachments
infected
(312.63 KiB) Downloaded 80 times
 #20887  by Cody Johnston
 Fri Sep 20, 2013 11:21 pm
All these found on the same PC yesterday. Includes Expiro, Buzus and Symmi.

Expiro

SHA256: 537787a529c820dbafa3ce43e93f4a1c12f0d957e86d691285afe7ae8ca36b8a
SHA1: be9e892b38698bc6e1b4dee946f15e984d72e2a0
MD5: f2601abb1c460023658a2e6d357efb42
Detection ratio: 32 / 48

https://www.virustotal.com/en/file/5377 ... 379624778/


Buzus

SHA256: 4576b2c909a9a4c06aa64846769d6f62e845235c3ac4af793b3a5b5c5f76a873
SHA1: 2270b7859a6309d23bf6d816a8bca4ff43e353c0
MD5: 17866d1d370ef87d631817c93939ebff
Detection ratio: 20 / 46

https://www.virustotal.com/en/file/4576 ... /analysis/


Symmi

SHA256: 4cb4d564303baabdbaa2a9ea0bb1ce542b3498882a4695bf4de8226da2883503
SHA1: 10051817a0e164f8724330ae1dd3e1133dcb1753
MD5: 6308daca641d6314d0751e906a596519
Detection ratio: 6 / 48

https://www.virustotal.com/en/file/4cb4 ... /analysis/
Attachments
Password: infected
(802.33 KiB) Downloaded 83 times