A forum for reverse engineering, OS internals and malware analysis 

WinNT/Cridex (alias Dridex, Drixed)

Forum for analysis and discussion about malware.

Re: Malware Requests

 #10510  by EP_X0FF
 Thu Dec 22, 2011 7:26 am
sugar wrote:hello, i'm looking for acdd4c2a377933d89139b5ee6eefc464
This is Cridex.
Attachments
pass: malware
(81.85 KiB) Downloaded 280 times

Worm:Win32/Cridex.B

 #10757  by rkhunter
 Tue Jan 03, 2012 9:16 am
http://www.microsoft.com/security/porta ... 2147649733

Cridex

VT (22/43 >> 51.2%)

Seems this is Cridex too, but it detected as not Cridex by all (ZBot, VirTool)...look VT link (probably this is muldrop)

VT (22/43) >> 51.2%)
Attachments
pass:malware
(76.15 KiB) Downloaded 188 times
pass:malware
(58.01 KiB) Downloaded 159 times

Re: Worm:Win32/Cridex.B

 #10758  by EP_X0FF
 Tue Jan 03, 2012 10:05 am
rkhunter wrote:Seems this is Cridex too, but it detected as not Cridex by all (ZBot, VirTool)...look VT link (probably this is muldrop)
Yes it is Cridex.B too (http://www.virustotal.com/file-scan/rep ... 1325584240)

VirTool:Win32/VBInject because of crypter that has VB origin, with CreateProcess(CREATE_SUSPENDED)/NtWriteVirtualMemory/NtSetContextThread/NtResumeThread.
  • 1
  • 2
  • 3
  • 4
  • 5
  • 15
 Return to “Malware”