A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #14566  by Ommenator
 Tue Jul 10, 2012 11:22 pm
This is the same infection posted by TeamRocketOps on June 28. I'm posting these in case you wish to compare the files for commonalities. Infect in the same way:
- Drop the .exe to %temp% (this is where it appears in the wild).
- Drop ctfmon.lnk to the startup folder. I altered it's properties with the %temp% variable so it will work on any Windows computer. In the wild the path appears as a literal.
- The .pad file is not really necessary since it will be created in the Common App Data folder when the .exe is run.

https://www.virustotal.com/file/703f1b9 ... 341961945/

MD5: aab13a145892ba07df443a9fb89ec1c8
Attachments
password: infected
(976.06 KiB) Downloaded 101 times
 #14833  by dumb110
 Mon Jul 23, 2012 10:38 am
Attachments
Pw: infected
(391.04 KiB) Downloaded 113 times
 #14854  by dumb110
 Tue Jul 24, 2012 11:22 am
2 more trojan ransom crap!! :)

SHA-1
47837159703ef7e25966b2a429ff93d0a65eb5ca
3462bb3952b96c33686e87c9614f33bcb890bbc9
Attachments
Pw: infected
(182.83 KiB) Downloaded 74 times
Last edited by EP_X0FF on Sun Dec 09, 2012 12:24 pm, edited 1 time in total. Reason: SHA-1 added
  • 1
  • 3
  • 4
  • 5
  • 6
  • 7
  • 16