Packed.Win32.CPEX-based.ao / naked164.com

[Malekal_morte]

Autre variante Naked

Créé les fichiers :

%Windir%\cftxith.exe
%System%\dllcache\explorer.exe
%Windir%\explorer.exe.tmp
%System%\image.jpg
%System%\tmp.txt

Fichier naked164.com reçu le 2008.01.24 21:59:51 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 5/30 (16.67%)


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.1.25.10 2008.01.24 -
AntiVir 7.6.0.48 2008.01.24 DR/Delphi.Gen
Authentium 4.93.8 2008.01.24 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.24 -
BitDefender 7.2 2008.01.24 -
CAT-QuickHeal 9.00 2008.01.24 -
ClamAV 0.91.2 2008.01.24 -
DrWeb 4.44.0.09170 2008.01.24 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5482 2008.01.24 -
Ewido 4.0 2008.01.24 -
FileAdvisor 1 2008.01.24 -
Fortinet 3.14.0.0 2008.01.24 -
F-Prot 4.4.2.54 2008.01.24 -
Ikarus T3.1.1.20 2008.01.24 Trojan-PWS.Win32.LdPinch.ajz
Kaspersky 7.0.0.125 2008.01.24 Heur.Trojan.Generic
McAfee 5215 2008.01.24 -
Microsoft 1.3109 2008.01.24 -
NOD32v2 2820 2008.01.24 -
Norman 5.80.02 2008.01.24 W32/Malware
Panda 9.0.0.4 2008.01.24 -
Prevx1 V2 2008.01.24 -
Rising 20.28.31.00 2008.01.24 -
Sophos 4.24.0 2008.01.24 Mal/Emogen-I
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.24 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.24 -
Information additionnelle
File size: 73728 bytes
MD5: f2e71f5c61669632b682ca37efdb563f
SHA1: d8932d4e18aa4e516f7fa6ce02ae000a466cb753
PEiD: -
norman sandbox: [ General information ]<br /> * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [email protected] - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.<br /> * File length: 73728 bytes.<br /><br /> [ Process/window information ]<br /> * Modifies other process memory.<br /> * Modifies execution flow of a remote process.<br /><br />

Réponse de Kaspersky :

Hello,

naked164.com - Packed.Win32.CPEX-based.ao

New malicious software was found in this file. It's detection will be included
in the next update. Thank you for your help.

Please quote all when answering.

[Malekal_morte]

Détecté en Packed.Win32.CPEX-based.ao par Kaspersky.

[Malekal_morte]

L'infection se propage aussi via de fausses E-Card de de la saint valentin : hxxp://www.you4valentine.com/?=ADRESSE_MSN
Un lien propose de télécharger le fichier valentine-card.scr.
En exécutant le fichier l'infection s'installe sur le système.




Voici le scan aujourd'hui... encore une fois, Avast! ne le détecte pas.
C'est pourquoi nous recommandons plutôt Antivir à Avast!, voir Avast! VS Antivir

Fichier naked164.com reçu le 2008.01.26 01:53:18 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 10/32 (31.25%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.1.26.10 2008.01.25 -
AntiVir 7.6.0.53 2008.01.25 TR/Hijacker.Gen
Authentium 4.93.8 2008.01.26 -
Avast 4.7.1098.0 2008.01.25 -
AVG 7.5.0.516 2008.01.25 Generic9.AUKW
BitDefender 7.2 2008.01.26 Trojan.Dropper.Delf.AXE
CAT-QuickHeal 9.00 2008.01.25 -
ClamAV 0.91.2 2008.01.25 -
DrWeb 4.44.0.09170 2008.01.25 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5484 2008.01.25 -
Ewido 4.0 2008.01.25 -
FileAdvisor 1 2008.01.26 -
Fortinet 3.14.0.0 2008.01.25 -
F-Prot 4.4.2.54 2008.01.25 -
F-Secure 6.70.13260.0 2008.01.25 W32/Malware
Ikarus T3.1.1.20 2008.01.25 Trojan-PWS.Win32.LdPinch.ajz
Kaspersky 7.0.0.125 2008.01.26 Packed.Win32.CPEX-based.ao
McAfee 5216 2008.01.26 -
Microsoft 1.3109 2008.01.25 -
NOD32v2 2823 2008.01.25 Win32/IRCBot.ADD
Norman 5.80.02 2008.01.24 W32/Malware
Panda 9.0.0.4 2008.01.25 -
Prevx1 V2 2008.01.26 -
Rising 20.28.41.00 2008.01.25 -
Sophos 4.25.0 2008.01.25 Mal/Emogen-I
Sunbelt 2.2.907.0 2008.01.25 -
Symantec 10 2008.01.26 -
TheHacker 6.2.9.198 2008.01.25 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.25 -
Webwasher-Gateway 6.6.2 2008.01.25 Trojan.Hijacker.Gen
Information additionnelle
File size: 73728 bytes
MD5: f2e71f5c61669632b682ca37efdb563f
SHA1: d8932d4e18aa4e516f7fa6ce02ae000a466cb753

[Malekal_morte]

Nouvelle Variante : http://www.threatexpert.com/report.aspx ... eabaf6943a
Merci guibou : http://forum.malekal.com/viewtopic.php? ... 798#p59798

[Fichier MODEL76.com reçu le 2008.02.03 20:31:58 (CET)
Situation actuelle: terminé

Résultat: 8/32 (25.00%)
Formaté Impression des résultats
Antivirus Version Dernière mise à jour Résultat

AhnLab-V3 2008.2.3.10 2008.02.02 -
AntiVir 7.6.0.61 2008.02.01 HEUR/Malware
Authentium 4.93.8 2008.02.03 -
Avast 4.7.1098.0 2008.02.02 Win32:WinFixer-S
AVG 7.5.0.516 2008.02.03 Agent.2.AP
BitDefender 7.2 2008.02.03 -
CAT-QuickHeal 9.00 2008.02.01 -
ClamAV 0.92 2008.02.03 -
DrWeb 4.44.0.09170 2008.02.03 -
eSafe 7.0.15.0 2008.01.28 Suspicious File
eTrust-Vet 31.3.5504 2008.02.01 -
Ewido 4.0 2008.02.03 -
FileAdvisor 1 2008.02.03 -
Fortinet 3.14.0.0 2008.02.03 -
F-Prot 4.4.2.54 2008.02.02 -
F-Secure 6.70.13260.0 2008.02.03 -
Ikarus T3.1.1.20 2008.02.03 -
Kaspersky 7.0.0.125 2008.02.03 -
McAfee 5221 2008.02.01 -
Microsoft 1.3204 2008.02.03 Worm:Win32/Pakabot.gen
NOD32v2 2845 2008.02.02 a variant of Win32/IRCBot.AAL
Norman 5.80.02 2008.02.01 -
Panda 9.0.0.4 2008.02.03 -
Prevx1 V2 2008.02.03 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.03 Mal/Basine-C
Sunbelt 2.2.907.0 2008.02.02 -
Symantec 10 2008.02.03 -
TheHacker 6.2.9.207 2008.02.03 -
VBA32 3.12.6.0 2008.02.03 -
VirusBuster 4.3.26:9 2008.02.03 -
Webwasher-Gateway 6.6.2 2008.02.03 Heuristic.Malware

Information additionnelle
File size: 99328 bytes
MD5: 75e3980a29cf70a88f54811ea0cbb4cc
SHA1: 79a1af14c5cef5f69b0dae3b54542266a84642cb
PEiD: Armadillo v1.71

EDIT : Ajouté par Kaspersky en Trojan.Win32.Patcher.j

Hello,

MODEL76.com_ - Trojan.Win32.Patcher.j

New malicious software was found in this file. It's detection will be included
in the next update. Thank you for your help.

[Malekal_morte]

Autre variante :

File youtube.com received on 02.10.2008 22:05:31 (CET)
Current status: finished
Result: 11/31 (35.48%)

Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.2.6.10 2008.02.05 -
AntiVir 7.6.0.62 2008.02.10 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2008.02.10 -
Avast 4.7.1098.0 2008.02.10 -
AVG 7.5.0.516 2008.02.10 Agent.2.AP
BitDefender 7.2 2008.02.10 -
CAT-QuickHeal None 2008.02.08 -
ClamAV 0.92 2008.02.10 -
DrWeb 4.44.0.09170 2008.02.10 -
eSafe 7.0.15.0 2008.01.28 suspicious Trojan/Worm
eTrust-Vet 31.3.5522 2008.02.08 -
Ewido 4.0 2008.02.10 -
FileAdvisor 1 2008.02.10 -
Fortinet 3.14.0.0 2008.02.10 -
F-Prot 4.4.2.54 2008.02.10 W32/Injector.A.gen!Eldorado
F-Secure 6.70.13260.0 2008.02.10 -
Ikarus T3.1.1.20 2008.02.10 -
Kaspersky 7.0.0.125 2008.02.10 Trojan.Win32.Patched.bl
McAfee 5226 2008.02.08 -
Microsoft 1.3204 2008.02.10 Worm:Win32/Pakabot.gen
NOD32v2 2861 2008.02.09 a variant of Win32/IRCBot.AAL
Norman 5.80.02 2008.02.08 -
Panda 9.0.0.4 2008.02.10 Suspicious file
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.10 Mal/HckPk-A
Sunbelt 2.2.907.0 2008.02.09 VIPRE.Suspicious
Symantec 10 2008.02.10 -
TheHacker 6.2.9.215 2008.02.09 -
VBA32 3.12.6.0 2008.02.09 -
VirusBuster 4.3.26:9 2008.02.10 -
Webwasher-Gateway 6.6.2 2008.02.10 Trojan.Crypt.ULPM.Gen
Additional information
File size: 63697 bytes
MD5: a6fd3f60fbeca98a6d010a8fa74dba24
SHA1: ab8bf952f68ac5abab40f447f807e2976b54051b
PEiD: -
packers: Yoda, UPX

Le scan deux jours après...

File girl68.com received on 02.12.2008 18:26:32 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 13/32 (40.63%)


Antivirus Version Last Update Result
AhnLab-V3 2008.2.13.10 2008.02.12 -
AntiVir 7.6.0.65 2008.02.12 TR/Crypt.ULPM.Gen
Authentium 4.93.8 2008.02.11 -
Avast 4.7.1098.0 2008.02.12 -
AVG 7.5.0.516 2008.02.12 Agent.2.AP
BitDefender 7.2 2008.02.12 -
CAT-QuickHeal None 2008.02.12 -
ClamAV 0.92 2008.02.12 -
DrWeb 4.44.0.09170 2008.02.12 -
eSafe 7.0.15.0 2008.02.11 suspicious Trojan/Worm
eTrust-Vet 31.3.5530 2008.02.12 -
Ewido 4.0 2008.02.12 -
FileAdvisor 1 2008.02.12 -
Fortinet 3.14.0.0 2008.02.12 -
F-Prot 4.4.2.54 2008.02.11 W32/Injector.A.gen!Eldorado
F-Secure 6.70.13260.0 2008.02.12 Trojan:W32/Agent.EIZ
Ikarus T3.1.1.20 2008.02.12 -
Kaspersky 7.0.0.125 2008.02.12 Trojan.Win32.Patched.bl
McAfee 5227 2008.02.11 -
Microsoft 1.3204 2008.02.12 Worm:Win32/Pakabot.gen
NOD32v2 2868 2008.02.12 a variant of Win32/IRCBot.AAL
Norman 5.80.02 2008.02.12 W32/Smalltroj.CSZY
Panda 9.0.0.4 2008.02.12 Suspicious file
Prevx1 V2 2008.02.12 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.12 Mal/HckPk-A
Sunbelt 2.2.907.0 2008.02.12 VIPRE.Suspicious
Symantec 10 2008.02.12 -
TheHacker 6.2.9.217 2008.02.11 -
VBA32 3.12.6.0 2008.02.11 -
VirusBuster 4.3.26:9 2008.02.12 -
Webwasher-Gateway 6.6.2 2008.02.12 Trojan.Crypt.ULPM.Gen
Additional information
File size: 63697 bytes
MD5: a6fd3f60fbeca98a6d010a8fa74dba24
SHA1: ab8bf952f68ac5abab40f447f807e2976b54051b
PEiD: -
packers: Yoda, UPX