About contagio exchange

CONTAGIO EXCHANGE Contagio exchange has been created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection. The site offers an upload dropbox for you to share your general (non-mobile) malware samples and follows the same post format as you see on Contagio Mobile . You can also download any samples individually or in one zip. Please be kind to the housekeeper (Mila) and follow The Rules

CONTAGIO MINI DUMP - MOBILE MALWARE
Contagio Mobile Mini-dump is a community driven mobile malware collection. The site offers an upload dropbox for you to share your mobile malware samples. You can also download any samples individually or in one zip.
CONTAGIO MALWARE DUMP Contagio Malware Dump is a personal malware analysis site maintained by Mila. If you need any samples from there, email her for the password - email address is in the profile.

Monday, June 25, 2012

023 Crime OSX DNS Changer / OSX.RSPlug.A - web -2007


SHA256: 2bdcdab0a5d41f4b6aa48e2ab55177552c8419c3f8ce140c4850a0616d7a2f3e
SHA1: f620af9a43d6e46e6b028dc8b109ff5d4cced911
MD5: 5291beb71cba2c5779119bff7a10abdb
File size: 16.6 KB ( 17034 bytes )
File name: ultracodec1237.dmg



 Download (pass infected)


 

Thursday, June 7, 2012

023 Crime Downloader Trojan (name?) - web - June 7, 2012

Audio_Recording_MP3
MD5: FDC170166CB958E138E7D401F3C6F896
SHA256: A3253B1732A50146038A68B3B46260F80BEC6C1C

 Download (pass infected)

pcap file




022 Crime Win32/Bakcorox.A - proxy bot - web - June 7, 2012

 Download (pass infected)


pcap file



DNS query:  day7read.info
DNS response:  day7read.info ⇒ 74.207.249.7
Connects to:  day7read.info:443 (74.207.249.7)
Sends data to:  8.8.8.8:53
Sends data to:  day7read.info:443 (74.207.249.7)
Receives data from :  8.8.8.8:53
Receives data from:  day7read.info:443 (74.207.249.7)
 

Monday, June 4, 2012

021 Crime TDL - web - June 4, 2012

malicious domain
newgenerationp.com/d/u


 
Download (pass infected)

xor key 85 
MD5  A16977E9CCBF86168CE20DFC33E0A93C
SHA-256 05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01


https://www.virustotal.com/file/05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01/analysis

Thursday, May 10, 2012

020 Crime Ramnit Rootkit - web -May, 10 2012

Sample credit - Artem Baranov and Hendrik Adrian

Research:

 
Download (pass infected)


Size: 135680
MD5:  607B2219FBCFBFE8E6AC9D7F3FB8D50E

Thursday, May 3, 2012

019 APT Speech.doc MacOS_X/MS09-027.A Word exploit for MS Word

Someone uploaded. Thank you for sharing.
Document language code is Arabic, which is kind of interesting.

Research: Microsoft An interesting case of Mac OSX malware


 Download (pass infected)

File: speech.doc
Size: 158854
MD5:  F4CBFE4F2DDF3F599984CF6D01C1B781


Sunday, April 29, 2012

018 Crime "Microsoft Update" phish -> Blackhole exploit kit with Zeus payload - web - April 2012

File: KB971033.exe
Size: 201216
MD5:  EC750B75E83749C715D7834E130FCE8E

File: hnszs0.exe
Size: 184832
MD5:  9DB4174373601F74FCE0ECBC77A9577D

Sample credit Bryan Nolen

Download (pass infected)


LIST OF FILES INCLUDED
│   investigation_notes.txt

├───dropped_files
│   ├───exe
│   │       hnszs0.exe
│   │       KB971033.exe
│   │
│   ├───java
│   │       jar_cache.zip
│   │
│   ├───pdf
│   │       ap1.pdf
│   │       ap2.pdf
│   │
│   └───swf
│           score.swf

├───email
│       MSUPDATE.eml

├───extracted_files
│       pid_1412_Explorer_Dumped.EXE

├───html
│       exploit.html
│       landing.html

└───pcap
        dump.pcap



Quick analysis made by Bryan Nolen

Landing page (hxxp://volozhin.gov.by/pub/KB971033/?clien-e=3D1093821896211 and saved as html/landing.html) contains a hidden IFRAME that leads to the exploit page. This landing page also contains a META REFRESH that leads to another suspect binary (hxxp://volozhin.gov.by/pub/KB971033/KB971033.exe saved as dropped_files/exe/KB971033.exe) - detection on this second binary is low ( https://www.virustotal.com/file/0e14f5e6cdab9218135d3a7eed11f0457c9934210859f6075d63bc609469d43b/analysis/1335596875/ )

Exploit page (hxxp://fewfewfewfew.ibiz.cc/main.php?page=95fc4549d83b0486 and saved as html/exploit.html) utilises a trio of exploits designed to attack java, adobe acrobat, or flash.

Analysis of the javascript was perfomed with the assistance of URLQUERY report link (http://urlquery.net/report.php?id=47909).

The attack payloads are saved as
  • dropped_files/pdf/ap1.pdf 
  • dropped_files/pdf/ap2.pdf 
  • dropped_files/swf/score.swf 
  • dropped_files/java/jar_cache.zip

The "final" malicious payload is saved as (dropped_files/exe/hnszs0.exe) and its detection is VERY poor ( https://www.virustotal.com/file/c48df0394939fccb9a3ac0853d0ae696d04e7c5230d3a6468ebce257a0be4ccc/analysis/1335598639/ )

A copy of explorer.exe extracted from the memory image after infection is included, based on observations this is the process it migrated into after infection. It is saved in (extracted_files/pid_1412_Explorer_Dumped.EXE)

PCAP is supplied in the pcap folder. The hosts identified in this malware are:

Landing Page:    volozhin.gov.by         212.98.162.62
Exploit Page:    fewfewfewfew.ibiz.cc         83.69.233.156
C2:        google-analytics-sv1.com     91.230.147.222
(alt C2):    localdomain01.com         91.230.147.145

Note: the Alternate C2 was seen in earlier investigations of this malware and changed to the C2 address above when this round of investigation was performed.

Full memory dumps from my sandbox VM avaliable on request.

I have a strong suspicion this is a Zeus varient.


-Bryan Nolen <bryan _at_ arc .dot. net .dot. au>
@bryannolen

SITE TYPE
LEGITIMATE, COMPROMISED   
212.98.162.62
volozhin.gov.by
    Belarus    AS12406 Business network j.v.    Business Network JV
                       
BLACKHOLE    
83.69.233.156
fewfewfewfew.ibiz.cc 
   Russian Federation    AS28762 AWAX Telecom Ltd    AWAX Telecom Ltd.

PAYLOAD - ZEUS   
C2
91.230.147.222
google-analytics-sv1.com
Russian Federation    AS57189 PE Spiridonova Vera Ana    OOO Aldevir Invest
 
C2
91.230.147.145
localdomain01.com Russian Federation    AS57189 PE Spiridonova Vera Ana    OOO Aldevir Invest





Sunday, April 8, 2012

Old (circa 2009-2010) vxhaven's binary collection - 270,000+ files - via torrent

Vxhaven old malware collection.

Vxhavens forum that served malware research community for many years went dark on March 23, 2012. You can read about it (and support if you don't agree with the takedown) here: http://vx.netlux.org/index.html


Regarding the collection:

This collection is not result of the takedown. It has been released as a torrent earlier this year, and but since it is out there in public and already seeded by many and posted in many places, I am posting the torrent link there now as well because it is useful for research and the primary source is not available.  I understand that was not released by owners but I still want to thank Vxhavens members who collected all these samples.

For your convenience, I added a list of binaries in the text file and scroll boxes below.
All binaries in the torrent are older than 2010 (over 270K files, many variants of the same malware), but if you need for some mega testing of your sandbox or need to pick a few special files for some research and comparison, might be useful.

If you need only one or few and desperate/cannot download all on your own, you can ping me, I can send send those few.

Torrent (47GB compressed) - http://thepiratebay.se/torrent/7066921/Vx_heavens_collection%28all%29

Download the text log of all files - no password on the log 

or categorized log is here (save as HTML)

Wednesday, April 4, 2012

017 Crime Dozmot.D trojan web Feb-Mar 2012

MD5 2190db2c50c6cebffdb13ddeeec23186

  Download (pass infected)




016 Crime SCKeyLog.O trojan keyloger web Feb-Mar 2012

MD5 bf53d17ace809cb3015eaed88a46d8aa

Download (pass infected)


 

015 Crime Koutodoor.F trojan web Feb-Mar 2012

MD5 ecd4aa51e755f174a39434df02775cc1

Download (pass infected)






014 - Crime - Sinowal Mebroot Torpig -rootkit-trojan - Web - Feb-Mar 2012

MD5:  13CE4CD747E450A129D900E842315328
MD5:  C2BB7A8316EF7A106E6A3B3BB8D5532A
MD5:  CBE853D5D7EC089EF0302789284D6C44
MD5:  E16261185C13FB16213288A3860C1B8D


Download (pass infected)



013 - Crime -Kelihos.B -trojan- - Web - Feb 2012

MD5 eca54de6268f57ed1a9a2b9f0f877cb4
 spam trojan

Download (pass infected)

 

012 - Crime - ZeroAccess.D -rootkit - Web - Feb-Mar 2012


MD5 07665069649a5b4df0316c29ec2b0cdc

Download (pass infected) 




Saturday, March 3, 2012

Thursday, March 1, 2012

Welcome to Contagio Exchange - community malware dump


Mila P.
Greetings,
as you see from the description above, Contagio Exchange is meant to be a communal malware collection. Contagio mobile dump has been very successful and useful because researchers can upload their samples and download them without waiting for me to analyze or post it - directly from the mediafire box.

Whenever I have time, I will moderate and post descriptions for the files and individual download links (in addition to the main dropbox link) in the same format you see on the  mobile malware dump.

This collection is meant to be a shared library of malware samples, not a repository of every type and sample in existence. I would like it to have current and useful samples for everyone to analyze and play with. Links for search and download are in the right hand column.


This collection is not meant to be a
  •  replacement for Contagio malware dump, it will continue to operate as usual.
  •  mega catchall dump of everything you can download from Malwaredomainlist,   Cleanmx, or offensivecomputing.net
  •  competitor to the above or any similar collections and sites
  •  mess of zipped and unzipped generic and "lord knows what it is" files
  •  repository of every sample in existence
  •  danger to society
For this collection to succeed, please follow these simple rules:
  1. Zip all and every file with the password 'infected' before uploading. Zip is better than rar for consistency.
  2. Read #1 again - it is very important to prevent the mediafire dropbox from turning into a hazard
  3. Add your name to the description (if you want a credit), description itself, links to research or sandbox results to explain what it is.  You can add a text file inside the package called description.txt or use the comment box during the upload. Please do not upload mystery files.
  4. Name zip files like this "virusname_md5.zip" or include MD5 in the name of the zip - if possible
  5. If you are not sure what it is and / or the detection is generic, please do not dump it into a sorted main exchange box but use U.F.O. - Unidentified Flying Object box so that others knew what to expect

Mediafire dropbox information
  • This is a paid and long standing mediafire account with unlimited storage and more than enough bandwidth to support it. 
  • Your samples are not held hostage as you can download them and store on your system each time or on a schedule. If there is ever any change to this storage, I will give enough warning or ways to get them.   
  • All links are direct, no ads
  • Dropbox works on all OS but best on Firefox and Chrome. I did not try it on Safari and it has issues on IE and Palemoon. If you have a problem with using it, you can email the samples (rename the file extension and double zip exe files) and indicate it is for the exchange.
  • As an added benefit, you can use the dropbox for malware exchange with anyone - if you don't mind your sample to become public. Once you upload, go to the download link on top of the upload box and click on a round gear next to the sample and select 'share'. It will generate a direct link you can post or email.

P.S. I don't financially benefit from the dropbox downloads (in fact, it is the opposite) , posts, or malware samples. It is for the sake of fun and education.

thank you!