Malware
"Have You Here" Anyone?
Submitted by adam1mc on Thu, 2010-09-09 13:10. Malware | Sample RequestsLooking for the "Here You Have" email virus that is apparently making the rounds today:
http://abcnews.go.com/Technology/virus-mail-spreads-online/story?id=11596433
Help with analysis of sample file
Submitted by rscrsc81 on Wed, 2010-09-08 06:38. Analysis and Samples | MalwareI was trying to run through two malicious office file samples statically to manually extract the malware using IDA pro. I am unable to find the encryption routine when looking at the malicious file with IDA pro. Wondering if someone would be willing to help out with the analysis. This is more for my educational purposes, I've run through several other office files which I download from the internet and have been able to extract the embedded malware using IDA but i am stuck when looking at these two samples.
Alureon dropper and sample that can bluescreen the box.
Submitted by parandroid on Tue, 2010-09-07 05:11. Malware | Sample RequestsHi all,
Can anyone supply an Alureon sample that is one of the earlier versions that can bluescreen a machine. Versions before .G I guess with the hardcoded RVAs that had this issue. Many thanks in advance,
Parandroid
AV Defender 2011
Submitted by Trackeditor on Sun, 2010-08-29 03:05. Malware | Sample RequestsDoes anyone have a sample of this rogue AV?... I would be most grateful since I need to do some research on it.
Mobile malware
Submitted by as.u.want on Thu, 2010-08-26 07:44. Malware | Sample RequestsI plan to do research on mobile malware. How to get malware sample for smartphones? i.e Android,blackberry, iphone etc. I only got jailbreakme PDF now.
Server-based botnet floods net with brutish SSH attacks
Submitted by Pondus on Sun, 2010-08-22 02:12. Malware | Sample Requestsdoes anyone have a sample of this. File name dd_ssh, with MD5 24dac6bab595cd9c3718ea16a3804009
VirusTotal - dd_ssh - 6/41
http://www.virustotal.com/file-scan/report.html?id=95dda5f750510e0d7d49512b425548d4cb400ddb129d331bdcfaae6f2424566c-1281659595
Server-based botnet floods net with brutish SSH attacks
http://www.theregister.co.uk/2010/08/12/server_based_botnet/
SSH - new brute force tool?
http://isc.sans.edu/diary.html?storyid=9370
Botnet Trend: phpMyAdmin & SSH Attacks
http://www.malwarecity.com/community/index.php?showtopic=1177
Looking for a sample of this Trojan
Submitted by dranfu on Fri, 2010-08-20 15:55. Malware | Sample RequestsHello All,
I'm doing some research on a particular Trojan and having some trouble locating it. Found it on company network, and then found some of the code online, here: http://pastebin.com/BhCPJ6Xa
At least according to the code online (written in VB.net surprisingly), the virus is key-logging, iterating through files, posting to a web server, creating command lines with redirected input/output and a lot more. . The actual executable references STM.EXE, but as I do a web search, I can't find a precise match (meaning the symptoms of infection aren't exactly the same)
ASAP: Need Droid/eWalls, AndroidOS.Ewalls [symantec]
Submitted by ANETGames on Sun, 2010-08-01 19:22. Malware | Sample RequestsIf anyone could supply any part(s) of AndroidOS.Ewalls, it would be greatly appreciated. It is a new threat and needs to be researched.
Thank you in advanced.
Need Samples that use the .LNK shortcut flaw!
Submitted by fint on Thu, 2010-07-29 12:41. Malware | Sample RequestsHello, can anyone help me get any sample (malware) that use the new .LNK shortcut flaw to spread, please I need it, any help would be appreciated...
new variant of Palevo-worm?
Submitted by Chato Flores on Thu, 2010-07-29 11:48. Malware | Sample RequestsAt the moment, there is a real 'wave' of spreading a MSN-bot in the Netherlands.
This malware sends an e-mail to all MSN-contacts with a message like "It that you on this picture?" and a link which directs to a fake MSN-login page (phishing).
Obvisiously they want to capture your credentials and send them to a remote server.
