A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #4831  by GMax
 Mon Jan 31, 2011 5:42 pm
new source
hxxp://werodvix.info/36ohvynmbtsgh596nj38xbqdbxb1o4jc/pornoplayer.exe

HomoBlocker
http://www.virustotal.com/file-scan/rep ... 1296462681
Code: Select all
Number to Call: 9652857296
Number to Call: 9671979528
Unlock key: PLANET HELL
http://www.virustotal.com/file-scan/rep ... 1296491333
Code: Select all
Number to Call: 9671979547
Unlock key: WISH I HAD AN ANGEL
 #4861  by Xylitol
 Thu Feb 03, 2011 1:48 pm
 #4935  by Xylitol
 Mon Feb 07, 2011 2:14 pm
Ransom deliver, locs:
hXXp://erontube.info/35f52dncs6f5va86611e15w5a23g8f9o/pornoplayer.exe
hXXp://erontube.info/xxx/ukiy3i8u1s684x1mbd574vk9p834red7/pornoplayer.exe
hXXp://erokoffe.info/player/pornoplayer.exe

BlueTrash:
Code: Select all
Number to Call: 9645215342
Number to Call: 9645213731
Code to unlock Windows: STARCRAFT
Homoblocker:
Code: Select all
Number to Call: 9645215166
Code to unlock Windows: ELVENPATH
https://www.virustotal.com/file-scan/re ... 1297087375
https://www.virustotal.com/file-scan/re ... 1297087434
https://www.virustotal.com/file-scan/re ... 1297088296
https://www.virustotal.com/file-scan/re ... 1297089404
https://www.virustotal.com/file-scan/re ... 1297089043
http://www.virustotal.com/file-scan/rep ... 1297091842

Image

Image

Image

Image
Attachments
see archive comment for password
(81.38 KiB) Downloaded 54 times
see archive comment for password
(71.79 KiB) Downloaded 52 times
 #4943  by GMax
 Mon Feb 07, 2011 8:23 pm
List of currently active sites "spermTV" with downloading file pornoplayer.exe (HomoBlocker).
Some addresses have already referred.
Anakedgirls.info
Aworldxxx.info
Dworldxxx.info
Enakedgirls.info
Eworldxxx.info
Fuckgirlse.info
Fuckgirlsi.info
Fuckgirlso.info
Fuckgirlsp.info
Fuckgirlsr.info
Fuckgirlst.info
Fuckgirlsw.info
Gigasexe.info
Gigasexg.info
Gigasexh.info
Gigasexj.info
Gigasexk.info
Gigasexq.info
Gigasexr.info
Gigasexw.info
Kliiker.info
Klikerss.info
Klliker.info
Kllikers.info
Onakedgirls.info
Pnakedgirls.info
Pworldxxx.info
Qworldxxx.info
Rnakedgirls.info
Rworldxxx.info
Snakedgirls.info
Sworldxxx.info
Tnakedgirls.info
Wworldxxx.info
Xclipeplay.info
Xclipiplay.info
Xclipqplay.info
Xcliprplay.info
Xcliptplay.info
Xclipuplay.info
Xclipwplay.info
Xclipyplay.info
Xxxbazad.info
Xxxbazae.info
Xxxbazaf.info
Xxxbazag.info
Xxxbazaq.info
Xxxbazar.info
Xxxbazaw.info
Ynakedgirls.info
 #4985  by Xylitol
 Thu Feb 10, 2011 8:44 am
Attachments
See arhive comment for password
(100.66 KiB) Downloaded 45 times
 #4999  by Xylitol
 Thu Feb 10, 2011 5:34 pm
Attachments
See archive comment for the password.

EXTRACTED-F6C2FD3339FED3BD60EE61F70D6E0858_pornoplayer.exe.ViR
EXTRACTED-C012E113CBC69ADA6772AC3851B75524_pornoplayer.exe.ViR
EXTRACTED-3E2D3C5F033F0D000C87F91F935BAC38_pornoplayer.exe.ViR

(125.16 KiB) Downloaded 46 times
  • 1
  • 3
  • 4
  • 5
  • 6
  • 7
  • 17