Malwarebytes

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

bot2.exe

Started by sho-dan, Mar 02 2009 12:40 AM

You cannot reply to this topic
Go to first unread post

1 reply to this topic

#1
sho-dan

Posted 02 March 2009 - 12:40 AM

कैंसर योद्धा

Honorary Members
3,023 posts

Gender:Not Telling
Location:Jah Jersey Shore

h**p://www.trafficmonsterinc.ru/bot2.exe

Quote

File bot2.exe received on 03.02.2009 01:22:07 (CET)
Current status: finished
Result: 24/39 (61.54%)

15.0 KB
virustotal

"Don't worry about a thing,
'Cause every little thing gonna be all right!"

#2
Fatdcuk

Posted 02 March 2009 - 08:51 PM

Malware BBQ'er

Moderators
16,158 posts

Gender:Male
Location:127.0.0.1

Hi ya,

Thankfully we have the installer flagged as Trojan.Dropper

If allowed to install it patch's kernel32.dll with its own code and also the clean copy held in DLL backup folder which makes restoration a PITA
http://www.virustotal.com/analisis/152cc4f...9629b8cb646f52c

Patched Kernel32.dll will fail signature verification and *clean* copy of the original file has been renamed to kbdpx.dll located in <system32> folder.
http://www.threatexpert.com/report.aspx?md...48c968dab05a467