About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Monday, August 12, 2013

WEBC2-RAVE strings - APT

File: WEBC2-RAVE_sample_BF0EE4367EA32F8E3B911C304258E439
MD5:  bf0ee4367ea32f8e3b911c304258e439
Size: 13824

scroll for #2  WEBC2-RAVE_sample_438983192903F3FECF77500A39459EE6




Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
---------------snip
5DQ@
>"u:F
XPVSS
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-/
Sleep
CloseHandle
DisconnectNamedPipe
DeleteFileA
TerminateProcess
TerminateThread
WaitForMultipleObjects
CreateThread
CreateProcessA
CopyFileA
GetTempPathA
GetSystemDirectoryA
DuplicateHandle
GetCurrentProcess
GetStartupInfoA
CreatePipe
ReadFile
PeekNamedPipe
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameA
SetProcessPriorityBoost
SetThreadPriority
GetCurrentThread
SetPriorityClass
lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
KERNEL32.dll
SHChangeNotify
ShellExecuteExA
SHELL32.dll
WSASocketA
WS2_32.dll
MFC42.DLL
sprintf
atol
strncpy
strchr
MSVCRT.dll
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
MSVCP60.dll
GetModuleHandleA
0123456789ABCDEF
12345
123!@#qweQWE
CreateThread2
CreateThread1
CreateProcess
%s%s
iniet.exe
%s\%s
cmd.exe
CreatePipe2
CreatePipe1
exit
Open
 > nul
/c del
COMSPEC
hX59Z

Unicode Strings:
---------------------------------------------------------------------------
Hello from MFC!

========================


File: WEBC2-RAVE_sample_438983192903F3FECF77500A39459EE6
MD5:  438983192903f3fecf77500a39459ee6
Size: 16384

Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
VUUU
|$ ;
9l$$
VUUUV
-----------snip
XPVSS
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-/
GetModuleFileNameA
CloseHandle
WriteFile
ReadFile
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
DisconnectNamedPipe
DeleteFileA
TerminateProcess
TerminateThread
WaitForMultipleObjects
CreateThread
CreateProcessA
CopyFileA
GetTempPathA
GetSystemDirectoryA
DuplicateHandle
GetCurrentProcess
GetStartupInfoA
CreatePipe
PeekNamedPipe
SetFilePointer
KERNEL32.dll
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegCloseKey
StartServiceA
RegSetValueExA
RegOpenKeyExA
CreateServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
ADVAPI32.dll
WSASocketA
WS2_32.dll
MFC42.DLL
strncpy
atoi
strchr
sprintf
__dllonexit
_onexit
MSVCRT.dll
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
MSVCP60.dll
GetModuleHandleA
_strcmpi
0123456789ABCDEF
12345
123!@#qweQWE
HTTP Mozilla/5.0(compatible+MSIE)
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
Wininet.dll
CreateThread2
CreateThread1
CreateProcess
%s%s
iniet.exe
%s\%s
cmd.exe
CreatePipe2
CreatePipe1
exit
DevFS
DependOnDeivce
PlugPlay
Description
SYSTEM\CurrentControlSet\Services\DEVFS
Device File System
Saves installation files used for updates and repairs and is required for the downloading of Setup updates and Watson error reports.
Mozilla/4.0 (compatible; MSIE 7.0;)
WriteFile
Kernel32.dll

Unicode Strings:
---------------------------------------------------------------------------
jjjj
jjjjjj
Hello from MFC!