[kalptarunet]

Hello,

I'm looking sample of

Dofoil”, also known as “Bredo”/ “Zurgop”,

AutoRun Value:

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\dxdiag.exe

Sorry not having any info or MD5.

Thanks,

[hx1997]

Hello,

I'm looking sample of

Dofoil”, also known as “Bredo”/ “Zurgop”,

AutoRun Value:

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\dxdiag.exe

Sorry not having any info or MD5.

Thanks,

Maybe this one?
C1E5DAE72A51A7B7219346C4A360D867 - Win32/TrojanDownloader.Zurgop.AB trojan

Password "infected"

[dumb110]

SHA256: 9b200cd9c38f78e589dbe259b34fbb3da0a292b1fa2710927823d7dc14800aee

sample please..

[rkhunter]

SHA256: 9b200cd9c38f78e589dbe259b34fbb3da0a292b1fa2710927823d7dc14800aee

sample please..

MD5: c6b3a65256f0948d65ce38d6435a9db8
SHA1: 1654bed972c0b5d75f9431f5fe39a7a9cfc61133

[EP_X0FF]

Dofoil using simplified version of PowerLoader style inject. Sample courtesy of noxnox. Dropper and payload attached.
Set breaks on NtCreateSection/SetWindowLongA to see more.

https://www.virustotal.com/en/file/83ed ... /analysis/

[sugar]

for zbot fix Imagebase to 108B0000

[thisisu]

Win32/Dofoil.T

MD5 8176a3ec0aec664fb4170fdf9c9ee261
SHA1 034cee51257195b9b29e68d5ec714671de9ccc0d
SHA256 3d773d150fa014625c9c8718068d91b6a32b05431601754808e91ec1932512a8
https://www.virustotal.com/en/file/3d77 ... /analysis/

Code: Select all

HKU\Owner\...\Policies\Explorer\Run: [Ukcmedia] => C:\Users\Owner\AppData\Roaming\udbsfdsv\sgfautuj.exe [128008 2010-11-21] ()

[Aleksandra]

http://www.virusradar.com/en/Win32_Troj ... escription
http://www.microsoft.com/security/porta ... 2/Dofoil.T

MD5: 4aec1448f93ba213efcad9a1ea9b377c
SHA1: 31f7d08659b54918c2654bd36dcc866ab5612cd1
https://www.virustotal.com/ru/file/428a ... /analysis/