Posted 10 May 2018 - 08:27 AM
Looks like a Trojan to me.
Also has bank names in strings in memory.
Tries to reach out to: (all dead)
bun.companythings[.]bid ny.feelingeffect[.]bid ake.needmonth[.]bid hxxp://ake.needmonth[.]bid/stub_maker.php?program=sevenzip&tid=20568506&pid=3262&b_typ=pe&reb=1&name=PrivaZer.Donors.v3.0.42.0.E.Portable.Multilingua
SHA: 9dacaf54c9bafd7618c1d166752a823054f878a0ce72003cf1a539355c32a754
Posted 10 May 2018 - 10:06 AM
If you haven't scanned your computer for malware and adware....you should. You can get help with that
starting a new topic in the Am I infected? What do I do? or ask a moderator (hamluis) to move this topic to that forum.
Be sure to mention the site you downloaded that program from if you start a new topic.
“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”― Lawrence M. Krauss
A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”
RED VANITY to be replaced by BLUE SANITY on 01-20-21 in the WH.
Posted 10 May 2018 - 01:56 PM
Yes, this looks suspicious.
I downloaded the latest PrivaZer from their site (MD5 F5A9F1730D03A3F945A8F2C190E8C700), and it does not contain these bid URLs.
This one does have a valid digital signature, your sample does not.
Where did you get this sample? It was submitted only once to VirusTotal March 17th 2018.
Edited by Didier Stevens, 10 May 2018 - 01:58 PM.
Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com
SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2021
If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.
Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"
Posted 10 May 2018 - 02:22 PM
The bid URLs contain BASE64 that decodes to:
PrivaZer.Donors.v3.0.42.0.E.Portable.Multilingua
Probably cracked software.
Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com
SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2021
If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.
Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"
Posted 11 May 2018 - 09:08 AM
I got it from VTI after doing a retrohunt with some specific yara rules. I do not know the original vector.
Sec & Web Browser Enthusiast
Posted 11 May 2018 - 11:20 AM
Edited by midimusicman79, 11 May 2018 - 11:23 AM.
0 members, 1 guests, 0 anonymous users
Back to top
