· 10 years ago · Oct 03, 2015, 09:42 PM
1OpenBlackList (twitter: @OpenBlackList) . A project by ElCatapan (twitter: @ElCatapan).
2
3This paste contain information about attacks collected from my honeypot systems.
4
5
6
7Date: 2015-10-03
8
9Source of the attack: 186.74.238.212 (AS11556-Cable & Wireless Panama),located in Panama
10
11Service attacked: SMB
12
13Action: Malware propagation
14
15MD5 sample: 4d4c2729b8aa56e70eaf9ef84e9d5d3d
16
17Downloads number: 1
18
19Download URL:
20smb://::ffff:186.74.238.212
21
22Offer URL:
23smb://::ffff:186.74.238.212/csrss.exe
24
25
26
27VirusTotal Analisys:
28
29Antivirus total: 56
30Antivirus positives: 52
31
32
33Antivirus: Bkav
34Antivirus version: 1.3.0.7237
35Antivirus update: 20150928
36Malware: W32.TBrambulA.Trojan
37
38Antivirus: MicroWorld-eScan
39Antivirus version: 12.0.250.0
40Antivirus update: 20150929
41Malware: Worm.Generic.230976
42
43Antivirus: nProtect
44Antivirus version: 2015-09-25.01
45Antivirus update: 20150925
46Malware: Trojan-Spy/W32.Agent.57344.KT
47
48Antivirus: CMC
49Antivirus version: 1.1.0.977
50Antivirus update: 20150928
51Malware: Trojan-Spy.Win32.Agent!O
52
53Antivirus: CAT-QuickHeal
54Antivirus version: 14.00
55Antivirus update: 20150928
56Malware: TrojanSpy.Agent.bbel.n4
57
58Antivirus: ALYac
59Antivirus version: 1.0.1.4
60Antivirus update: 20150929
61Malware: Trojan.Spammer.57344
62
63Antivirus: Malwarebytes
64Antivirus version: 2.1.1.1115
65Antivirus update: 20150929
66Malware: Trojan.Agent
67
68Antivirus: VIPRE
69Antivirus version: 44142
70Antivirus update: 20150929
71Malware: Trojan.Win32.Generic!BT
72
73Antivirus: TheHacker
74Antivirus version: 6.8.0.5.681
75Antivirus update: 20150929
76Malware: Trojan/Spy.Agent.bmxb
77
78Antivirus: BitDefender
79Antivirus version: 7.2
80Antivirus update: 20150929
81Malware: Worm.Generic.230976
82
83Antivirus: K7GW
84Antivirus version: 9.210.17358
85Antivirus update: 20150928
86Malware: Backdoor ( 04c4f2671 )
87
88Antivirus: K7AntiVirus
89Antivirus version: 9.210.17358
90Antivirus update: 20150928
91Malware: Backdoor ( 04c4f2671 )
92
93Antivirus: NANO-Antivirus
94Antivirus version: 0.30.26.3725
95Antivirus update: 20150929
96Malware: Trojan.Win32.Agent.bmgds
97
98Antivirus: Cyren
99Antivirus version: 5.4.16.7
100Antivirus update: 20150929
101Malware: W32/Agent.IX.gen!Eldorado
102
103Antivirus: Symantec
104Antivirus version: 20141.2.0.56
105Antivirus update: 20150928
106Malware: Trojan Horse
107
108Antivirus: ESET-NOD32
109Antivirus version: 12325
110Antivirus update: 20150929
111Malware: Win32/Pepex.F
112
113Antivirus: TrendMicro-HouseCall
114Antivirus version: 9.800.0.1009
115Antivirus update: 20150929
116Malware: WORM_MYDOOM.WA
117
118Antivirus: Avast
119Antivirus version: 8.0.1489.320
120Antivirus update: 20150929
121Malware: Win32:Agent-AOKX [Trj]
122
123Antivirus: ClamAV
124Antivirus version: 0.98.5.0
125Antivirus update: 20150929
126Malware: Trojan.Spy-78857
127
128Antivirus: Kaspersky
129Antivirus version: 15.0.1.10
130Antivirus update: 20150929
131Malware: Email-Worm.Win32.Pepex.o
132
133Antivirus: Agnitum
134Antivirus version: 5.5.1.3
135Antivirus update: 20150928
136Malware: Trojan.Brambul!EaXSuFVXfdU
137
138Antivirus: ViRobot
139Antivirus version: 2014.3.20.0
140Antivirus update: 20150929
141Malware: Trojan.Win32.Agent.57344.TI[h]
142
143Antivirus: SUPERAntiSpyware
144Antivirus version: 5.6.0.1032
145Antivirus update: 20150929
146Malware: Trojan.Agent/Gen-Brambul
147
148Antivirus: Rising
149Antivirus version: 25.0.0.17
150Antivirus update: 20150928
151Malware: PE:Backdoor.Win32.Mnless.diy!1541335[F1]
152
153Antivirus: Ad-Aware
154Antivirus version: 12.0.163.0
155Antivirus update: 20150929
156Malware: Worm.Generic.230976
157
158Antivirus: Sophos
159Antivirus version: 4.98.0
160Antivirus update: 20150928
161Malware: Mal/Spy-Y
162
163Antivirus: Comodo
164Antivirus version: 23321
165Antivirus update: 20150929
166Malware: TrojWare.Win32.Agent.mtv0
167
168Antivirus: F-Secure
169Antivirus version: 11.0.19100.45
170Antivirus update: 20150929
171Malware: Worm.Generic.230976
172
173Antivirus: DrWeb
174Antivirus version: 7.0.15.8310
175Antivirus update: 20150929
176Malware: Win32.HLLW.Bumble
177
178Antivirus: Zillya
179Antivirus version: 2.0.0.2419
180Antivirus update: 20150928
181Malware: Trojan.Agent.Win32.100751
182
183Antivirus: TrendMicro
184Antivirus version: 9.740.0.1012
185Antivirus update: 20150929
186Malware: WORM_MYDOOM.WA
187
188Antivirus: McAfee-GW-Edition
189Antivirus version: v2015
190Antivirus update: 20150929
191Malware: Downloader-CUZ
192
193Antivirus: Emsisoft
194Antivirus version: 3.5.0.642
195Antivirus update: 20150929
196Malware: Worm.Generic.230976 (B)
197
198Antivirus: F-Prot
199Antivirus version: 4.7.1.166
200Antivirus update: 20150929
201Malware: W32/Agent.IX.gen!Eldorado
202
203Antivirus: Jiangmin
204Antivirus version: 16.0.100
205Antivirus update: 20150927
206Malware: TrojanSpy.Agent.mza
207
208Antivirus: Avira
209Antivirus version: 8.3.2.2
210Antivirus update: 20150929
211Malware: TR/Agent.mtv
212
213Antivirus: Antiy-AVL
214Antivirus version: 1.0.0.1
215Antivirus update: 20150929
216Malware: Trojan[Spy]/Win32.Agent
217
218Antivirus: Kingsoft
219Antivirus version: 2013.4.9.267
220Antivirus update: 20150929
221Malware: Win32.Troj.Agent.(kcloud)
222
223Antivirus: Arcabit
224Antivirus version: 1.0.0.567
225Antivirus update: 20150929
226Malware: Worm.Generic.D38640
227
228Antivirus: AhnLab-V3
229Antivirus version: 2015.09.29.00
230Antivirus update: 20150928
231Malware: Trojan/Win32.Npkon
232
233Antivirus: Microsoft
234Antivirus version: 1.1.12101.0
235Antivirus update: 20150929
236Malware: Trojan:Win32/Brambul.A!dha
237
238Antivirus: TotalDefense
239Antivirus version: 37.1.62.1
240Antivirus update: 20150929
241Malware: Win32/Tnega.WW
242
243Antivirus: McAfee
244Antivirus version: 6.0.6.653
245Antivirus update: 20150929
246Malware: Downloader-CUZ
247
248Antivirus: AVware
249Antivirus version: 1.5.0.21
250Antivirus update: 20150929
251Malware: Trojan.Win32.Generic!BT
252
253Antivirus: VBA32
254Antivirus version: 3.12.26.4
255Antivirus update: 20150928
256Malware: TrojanSpy.Agent
257
258Antivirus: Panda
259Antivirus version: 4.6.4.2
260Antivirus update: 20150928
261Malware: Generic Malware
262
263Antivirus: Tencent
264Antivirus version: 1.0.0.1
265Antivirus update: 20150929
266Malware: Win32.Worm-email.Pepex.Pegi
267
268Antivirus: Ikarus
269Antivirus version: T3.1.9.5.0
270Antivirus update: 20150929
271Malware: Trojan-Spy.Win32.Agent
272
273Antivirus: GData
274Antivirus version: 25
275Antivirus update: 20150929
276Malware: Worm.Generic.230976
277
278Antivirus: AVG
279Antivirus version: 16.0.0.4419
280Antivirus update: 20150929
281Malware: PSW.Agent.AHCN
282
283Antivirus: Baidu-International
284Antivirus version: 3.5.1.41473
285Antivirus update: 20150928
286Malware: Worm.Win32.Pepex.F
287
288Antivirus: Qihoo-360
289Antivirus version: 1.0.0.1015
290Antivirus update: 20150929
291Malware: Win32/RootKit.Rootkit.7e5
292
293
294
295
296Static analysis with PEframe:
297
298Short information
299------------------------------------------------------------
300File Name 4d4c2729b8aa56e70eaf9ef84e9d5d3d
301File Size 57344 byte
302Compile Time 2009-10-14 14:45:54
303DLL False
304Sections 4
305Hash MD5 4d4c2729b8aa56e70eaf9ef84e9d5d3d
306Hash SHA-1 e10c84a65e928dbc03e5a84ee4dc5a96304d2707
307Imphash 2b018f96d7cda0b915d2c1dcb16595c4
308Detected Packer, Anti Debug
309Directory Import, Resource
310
311Packer matched [4]
312------------------------------------------------------------
313Packer Microsoft Visual C++ v6.0
314Packer Microsoft Visual C++ 5.0
315Packer Microsoft Visual C++
316Packer Installer VISE Custom
317
318Anti Debug discovered [3]
319------------------------------------------------------------
320Function GetLastError
321Function TerminateProcess
322Function UnhandledExceptionFilter
323
324Suspicious API discovered [34]
325------------------------------------------------------------
326Function CloseHandle
327Function CopyFileA
328Function CreateFileA
329Function CreateProcessA
330Function CreateServiceA
331Function ExitProcess
332Function FindResourceA
333Function GetCommandLineA
334Function GetCurrentProcess
335Function GetModuleFileNameA
336Function GetModuleHandleA
337Function GetProcAddress
338Function GetStartupInfoA
339Function GetSystemDirectoryA
340Function GetTickCount
341Function GetUserNameA
342Function LoadLibraryA
343Function LockResource
344Function RegCloseKey
345Function RegOpenKeyExA
346Function Sleep
347Function StartServiceA
348Function TerminateProcess
349Function UnhandledExceptionFilter
350Function VirtualAlloc
351Function VirtualFree
352Function WSAStartup
353Function WriteFile
354Function closesocket
355Function connect
356Function recv
357Function send
358Function sendto
359Function socket
360
361Suspicious Sections discovered [1]
362------------------------------------------------------------
363Section .rsrc
364Hash MD5 885b726aee5a5c6372c32a6860008a17
365Hash SHA-1 f754c4e383c9c220da418922c75a8e4ddf95a80a
366
367File name discovered [12]
368------------------------------------------------------------
369Executable %SystemRoot%\csrss.exe
370Executable %s\admin$\csrss.exe
371Executable \lsasvc.exe
372Library 32.dll
373Library ADVAPI32.dll
374Library KERNEL32.dll
375Library MSVCRT.dll
376Library USER32.dll
377Library WS2_32.dll
378Library dnsapi.dll
379Library iphlpapi.dll
380Library user32.dll
381
382Url discovered [5]
383------------------------------------------------------------
384Url gmail-smtp-in.l.google.com
385Url gmail.com
386Url google.com
387Url johnS203@yahoo.com
388Url whiat1001@gmail.com