About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Sunday, March 11, 2012

009 - Crime - DNSChanger - TDL/Alureon rootkit variant - Rootkit - Web - June 2010

MD5:   0d7b87223d6fd2ab7236e56838c5563b

Download (pass infected) 






Name DNSChanger TDL rootkit variant
Category Crime
type rootkit trojan 
vector  Web
Sample credit anonymous
Date June 2010

https://www.virustotal.com/file/d7623db7e16c1d5b9d20a263576afc289e7f974cc9cf15f2032f441b8f87c73c/analysis/1331487072/

SHA256:     d7623db7e16c1d5b9d20a263576afc289e7f974cc9cf15f2032f441b8f87c73c
SHA1:     1bc027cf28a63846ab46ea06d9c27133b5c09578
MD5:     0d7b87223d6fd2ab7236e56838c5563b
File size:     182.0 KB ( 186368 bytes )
File name:     DNSChanger_0d7b87223d6fd2ab7236e56838c5563b.exe
File type:     Win32 EXE
Detection ratio:     38 / 43
Analysis date:     2012-03-11 17:31:12 UTC ( 0 minutes ago )

Antivirus     Result     Update
AhnLab-V3     Win-Trojan/TDSS4.Gen     20120310
AntiVir     TR/Crypt.XPACK.Gen     20120311
Antiy-AVL     Trojan/win32.agent.gen     20120311
Avast     Win32:Trojan-gen     20120311
AVG     Downloader.Agent2.SAW     20120311
BitDefender     Trojan.Generic.4103909     20120311
ByteHero     -     20120309
CAT-QuickHeal     -     20120311
ClamAV     Trojan.Dropper-25529     20120311
Commtouch     W32/Alureon.J.gen!Eldorado     20120311
Comodo     TrojWare.Win32.Olmarik.AME     20120311
DrWeb     BackDoor.Tdss.2215     20120311
Emsisoft     Trojan-Dropper.Win32.TDSS!IK     20120311
eSafe     Win32.VirToolObfusca     20120308
eTrust-Vet     Win32/Alureon.ATL     20120310
F-Prot     W32/Alureon.J.gen!Eldorado     20120311
F-Secure     Trojan.Generic.4103909     20120311
Fortinet     -     20120311
GData     Trojan.Generic.4103909     20120311
Ikarus     Trojan-Dropper.Win32.TDSS     20120311
Jiangmin     TrojanDownloader.Agent.cefc     20120301
K7AntiVirus     Trojan     20120310
Kaspersky     Packed.Win32.Krap.io     20120311
McAfee     FakeAlert-MI     20120307
McAfee-GW-Edition     FakeAlert-MI     20120311
Microsoft     Trojan:Win32/Alureon.CO     20120311
NOD32     Win32/Olmarik.TN     20120311
Norman     W32/Tdss.C!genr     20120311
nProtect     Trojan-Downloader/W32.Agent.186368.AO     20120310
Panda     Suspicious file     20120311
PCTools     Trojan.Generic     20120311
Prevx     -     20120311
Rising     Trojan.Win32.Generic.128B788C     20120309
Sophos     Troj/Virtum-Gen     20120311
SUPERAntiSpyware     Rootkit.Agent/Gen-Trexer     20120308
Symantec     Trojan Horse     20120311
TheHacker     Trojan/Downloader.Agent.dcny     20120309
TrendMicro     TROJ_COSMU.SM     20120311
TrendMicro-HouseCall     TROJ_COSMU.SM     20120311
VBA32     Trojan.Olmarik.tn     20120311
VIPRE     Trojan.Win32.Obfusc.o.gen (v)     20120311
ViRobot     -     20120311
VirusBuster     Trojan.DL.Agent!JRDQILTdMj4     20120311
Labels: , , ,