A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #22689  by Xylitol
 Tue Apr 15, 2014 1:03 pm
Filled your request because that look interesting but for further requests have a look here: http://www.kernelmode.info/forum/viewto ... =20&t=1950
a_d_13 wrote: [*]Requests from users with zero posts, "thank-you" only posts, or requests-only posts not allowed. Make your effort for this place before asking anything.
--AD
VT:
https://www.virustotal.com/en/file/670b ... 397566854/ > 3/51
https://www.virustotal.com/en/file/be8f ... 397566915/ > 3/51
https://www.virustotal.com/en/file/d836 ... 397566916/ > 19/51
https://www.virustotal.com/en/file/3698 ... 397566854/ > 23/51
Attachments
infected
(3.12 MiB) Downloaded 174 times
 #24824  by EP_X0FF
 Sun Jan 04, 2015 4:37 am
Up.

Gootkit variant equiped with BkLoader bootkit (Cidox/Rovnix from Carberp source leak). Implements shim UAC bypass. Presumable previous version of next gen Win32/Xswkit