[markusg]

winlogon_72.exe
http://www.virustotal.com/file-scan/rep ... 1299686606

Winlogon.exe
http://www.virustotal.com/file-scan/rep ... 1299686204
winlogon.exe
http://www.virustotal.com/file-scan/rep ... 1299686416

[markusg]

MS77E3~1.EXE
http://www.virustotal.com/file-scan/rep ... 1299856542

[markusg]

Patch.exe
http://www.virustotal.com/file-scan/rep ... 1299937869

[EP_X0FF]

Patch.exe
http://www.virustotal.com/file-scan/rep ... 1299937869

Blackshades NET joined with Roboform7 patcher, according to forum rules attach has been removed.
Extracted bot attached, posts moved.

[markusg]

pg_ctl1.exe
http://www.virustotal.com/file-scan/rep ... 1299947982

[nullptr]

pg_ctl1.exe
http://www.virustotal.com/file-scan/rep ... 1299947982

This is Blackshades NET - C:\Users\Admin\Desktop\Blackshades project\Blackshades NET\server\server.vbp
Runs as %USERPROFILE%\Application Data\Msnupdate8799.exe

bss_server
usrReverseRelay
usrRelay
tmrLiveLogger
tmrIntervalUpdate
_extentx
_extenty
tmrGrabber
sckFormGrab
bss_server.usrRelay
tmrFocus
tmrAlarms
picThumb
picThumbSize
tmrDoWork
tmrPersistant
tmrWebHide
tmrInfoTO
sckInfo
bss_server.Socket
tmrAudio
sckServer
tmrCrazy
picWC
tmrAlive
tmrScreenshot
tmrDOS
tmrInaktivitet
picScreenshot
tmrSprid
tmrSpara
tmrAnslut
sckTransfer
modFuctions
modOS
modSpread
modAPI
modSS
modSocketMaster
CSocketMaster
socket
frmSck
usrRelay
modIInet
modICallBack
WinInetAsync
modPWs
modLaunchWeb
cCDECL
cFFPD
modRegistry
cSubCls
iSubCls
modSniff
modSqueezer
modAudio
frmHijack
modHijack
frmChat
modInfect
modTorrentSeed
modInjPE
modCrypt
cImage
modScreencap
mWinsock
modBtKiller
Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1) Gecko/20090612 Firefox/3.5
Software\Microsoft\Internet Explorer\IntelliForms\Storage2
{00020404-0000-0000-C000-000000000046}
tmrDoWork
tCE
AIJ
BtmrIntervalUpdate
tmrDOS
tmrInfoTO
tmrAlarms
tmrSprid
sckServer
picThumbSize
tmrInaktivitet
picThumb
tmrPersistant
picScreenshot
tmrScreenshot
tmrAlive
tmrLiveLogger
K6sckInfo
tmrAudio
tmrCrazy
tmrAnslut
tmrSpara
Form
tmrFocus
tmrWebHide
MTheBrowser
C_Mutex
Delay
iSubCls_Antes
iSubCls_Despues
GetBrowserName2
PATH_WINLOGON
TheBrowser_BeforeNavigate2
TheBrowser_OnQuit
BROWSER_FB_DocumentComplete
BROWSER_FB_OnQuit
FACEBOOK_START
+ lots more

Uses WH_KEYBOARD_LL and WH_MESSAGE hooks to log data to a DAT file in same directory as executable.
Connected to hxxp://smellyass.zapto.org

[nullptr]

Winlogon.exe
http://www.virustotal.com/file-scan/rep ... 1299686204

Blackshades NET, pretty much same as http://www.kernelmode.info/forum/viewto ... 5451#p5451

[markusg]

crypted.exe
http://www.virustotal.com/file-scan/rep ... 1304526004

[EP_X0FF]

crypted.exe
http://www.virustotal.com/file-scan/rep ... 1304526004

Backdoor Blackshades NET (Ainslot.A), crypted + packed with UPX.
In attach fully unpacked. Posts moved.

[markusg]

unrar.exe
http://www.virustotal.com/file-scan/rep ... 1305990757