1 reply to this topic

[Fatdcuk]

Imported c/o driveby infection@ furryfemales.com

Fake alert generated by>>>

O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Owner\Application Data\jgseig.exe

File jgseig.exe received on 11.18.2007 11:28:05 (CET)

Result: 5/32 (15.63%)

Antivirus Version Last Update Result
AhnLab-V3 2007.11.17.0 2007.11.16 -
AntiVir 7.6.0.34 2007.11.16 DR/Delphi.Gen
Authentium 4.93.8 2007.11.17 -
Avast 4.7.1074.0 2007.11.18 -
AVG 7.5.0.503 2007.11.17 -
BitDefender 7.2 2007.11.18 Trojan.PWS.LDPinch.TDD
CAT-QuickHeal 9.00 2007.11.17 -
ClamAV 0.91.2 2007.11.18 -
DrWeb 4.44.0.09170 2007.11.17 -
eSafe 7.0.15.0 2007.11.14 -
eTrust-Vet 31.2.5304 2007.11.17 -
Ewido 4.0 2007.11.17 -
FileAdvisor 1 2007.11.18 -
Fortinet 3.11.0.0 2007.11.18 -
F-Prot 4.4.2.54 2007.11.16 -
F-Secure 6.70.13030.0 2007.11.17 -
Ikarus T3.1.1.12 2007.11.18 Virus.Win32.Zapchast.DA
Kaspersky 7.0.0.125 2007.11.18 -
McAfee 5165 2007.11.16 -
Microsoft 1.3007 2007.11.18 -
NOD32v2 2665 2007.11.17 -
Norman 5.80.02 2007.11.16 -
Panda 9.0.0.4 2007.11.17 -
Prevx1 V2 2007.11.18 -
Rising 20.18.61.00 2007.11.18 -
Sophos 4.23.0 2007.11.18 Mal/Dropper-T
Sunbelt 2.2.907.0 2007.11.17 -
Symantec 10 2007.11.18 -
TheHacker 6.2.9.133 2007.11.17 -
VBA32 3.12.2.5 2007.11.16 -
VirusBuster 4.3.26:9 2007.11.17 -
Webwasher-Gateway 6.0.1 2007.11.16 Trojan.Dropper.Delphi.Gen
Additional information
File size: 21504 bytes
MD5: 5eff4bcbbb2d86845d8fffa2eceaa3cf
SHA1: 6eed9f6c4f99446a9638d6cfcfc20411da725e5e


Imported file>>>

File load.exe received on 11.18.2007 11:30:03 (CET)

Result: 8/32 (25%)

Antivirus Version Last Update Result
AhnLab-V3 2007.11.17.0 2007.11.16 Win-AppCare/Avola.2248704
AntiVir 7.6.0.34 2007.11.16 -
Authentium 4.93.8 2007.11.17 -
Avast 4.7.1074.0 2007.11.18 -
AVG 7.5.0.503 2007.11.17 SHeur.UIN
BitDefender 7.2 2007.11.18 -
CAT-QuickHeal 9.00 2007.11.17 FraudTool.Avola.a (Not a Virus)
ClamAV 0.91.2 2007.11.18 -
DrWeb 4.44.0.09170 2007.11.17 -
eSafe 7.0.15.0 2007.11.14 suspicious Trojan/Worm
eTrust-Vet 31.2.5304 2007.11.17 -
Ewido 4.0 2007.11.17 -
FileAdvisor 1 2007.11.18 -
Fortinet 3.11.0.0 2007.11.18 -
F-Prot 4.4.2.54 2007.11.16 -
F-Secure 6.70.13030.0 2007.11.17 -
Ikarus T3.1.1.12 2007.11.18 -
Kaspersky 7.0.0.125 2007.11.18 not-a-virus:FraudTool.Win32.Avola.a
McAfee 5165 2007.11.16 -
Microsoft 1.3007 2007.11.18 -
NOD32v2 2665 2007.11.17 -
Norman 5.80.02 2007.11.16 -
Panda 9.0.0.4 2007.11.17 -
Prevx1 V2 2007.11.18 Heuristic: Suspicious File With Persistence
Rising 20.18.61.00 2007.11.18 -
Sophos 4.23.0 2007.11.18 -
Sunbelt 2.2.907.0 2007.11.17 -
Symantec 10 2007.11.18 Awola
TheHacker 6.2.9.133 2007.11.17 -
VBA32 3.12.2.5 2007.11.16 -
VirusBuster 4.3.26:9 2007.11.17 -
Webwasher-Gateway 6.0.1 2007.11.16 Riskware.FakeScanner.UIN
Additional information
File size: 220160 bytes
MD5: 6cd076b6ccff2b9f2c8823c90b67d66b
SHA1: 6d8f31808d262bea3a2289a03228e54b17959f62
packers: UPX
packers: UPX
packers: PE_Patch.UPX, UPX, UPX

Attached is initial Trojan,no more upload space for 204kb zipped installer(load.exe) but MIRT members can grab a copy here>>>
http://www.castlecops.com/t208182-MD5_6cd0...b_load_exe.html

Attached Files

•  jgseig.zip   14.61K   88 downloads

[Fatdcuk]

Oh well now it has a homepage.

hXXp://www.awola.com/

Awola=Avola

Confirmed by compairing installers.