About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Saturday, August 10, 2013

BunituB-Proxy strings - CRIME (2)

robohash
File: BunituB-Proxy_B64D221166E494AC00251594304BE072
MD5:  b64d221166e494ac00251594304be072
Size: 15872






Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
.text
.rdata
@.data
.reloc
PUX]KP
SVWR
Z_^[
Rns01.kukaramba.co.uk
!h$'
It19B
W QR
3u 3
_PQh
_PQh
WSVhF,
D8%f
Ph%'
BNM8YH-SJOLA-CV9MSGJ
aoilrtew
nabled:
SPGTWARE\Micros
oft\Windows NT\CurrentVersion\Vinlogon\Notify\noyluwa
Start
SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\
@tEHPh|
f=//t
</tM<:t
@tHHPhL
FosDTgkmns10.kukaramba.co.uk
Ki*m?T-5ns09.kukaramba.co.uk
cnvfat.dll
noyluwa.dll
AZ_^
PPhA=
,$Wu
il32
Ph\c
:*:EZSV
Ahc{
.Ph\c
VWS3
F<a|
NNh|@
LoadLibraryExW
KERNEL32.dll
WS2_32.dll
RtlGetAce
ntdll.dll
noyluwa.dll
noyluwa
zvoprterw.dll
wrrr/1.0 200 OK
 C0nnection*Fai1ed
8.8F8L889m9t9
9?:H:Z:c:n:
:7;C;N;Z;q;
;8<T<_<
>#>2>:>A>I>R>_>f>n>v>}>
0.090F0X0^0m0
3"303<3G3M3U3j3~3
7!7(7b7
7+848<8Q8k8
9:9A9K9
: :4:::C:I:O:m:t:~:
; ;&;-;6;?;E;e;
<!<-<:<D<Y<i<t<
<,=3=;=W=s={=
>*>/>I>Q>W>\>p>
?$?*?0?I?

Unicode Strings:
---------------------------------------------------------------------------
kernel32
advapi32
ws2_32
Labels: ,