About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Monday, November 17, 2014

AlienSply RAT strings db46adcfae462e7c475c171fbe66df82

File: unXX0JIhwW.txt
MD5:  db46adcfae462e7c475c171fbe66df82
Size: 131178



Ascii Strings:
---------------------------------------------------------------------------
META-INF/MANIFEST.MF
LK-.
q,HL
stub/stub.dll
!-vk5
rvOe)
-dR6
rW yP
-U%V
/\]C
b`YGi
;?'k
Nn4^&
'8(i
L/U#+
lx^^
B\4a
Oz2%C
hxUy=
~V@a\
1}-j
)]Rd
o&f0
7L2P
dSjq
vW C
rZ!P
H[eX~
\,H|
]68Bn&
Gt:g
uCu3
>-4L
3q{{
^uX%
~Ey|
-r+#
recu
v\~b
S#$G]Y
2)Rw'F
TQ]:p
z:u_
jz!'
1W+j
x'W"
3H/Kt
+Ot0t
gXp{dJ
hhgM
+`B~1
QVM*B
p0*hI
OF/E.b
SkZ^
p9M^
63Y^~
bc%x
rs>mr)
N<>*
/7iNm
?9&s
G\!c
@waY
aw%t
wV`Jj.
3d#$
=afw
]Cs"%
QcxC2
zYy%#
Zp-o
F$n;b
 LfUVG
DJug
K_[Ec.A<
uj~7K
\?N"if
}z*Y
snn,
cMcn$fgsT
yli0
vH<bB
Ll':,1
q-wX
a<)7I
@nT(
i9bo
4apNK
r[V^z
JBrK
a!X8
r;5|
ab1'
(Dd#
v6ENn
|kt|f
Nt?(
4}g{
D&%?7rKM
vv/G0
Y,](
'q34
n`J[
#`r%j\
tz '
SNm*!
xqxr
[O<K
wVy%=;
:]|S
)YS/8
x\|1
]rs&&XM
{j+5+
GtHy
TH-6ZFa
:MZa
bA4#
2*mE
Wdir
)<-0
u:bm#
Cm3(tH
NYY6
<j[E
w+||e
rji/
\>`I)
Z5:_
5Z |
v4/\
&@r`(
$@tE
cPCd
\qbiJ*b
5/I|
UD2]
Hsgm{
"#+e
GtU$v
^Ql=
8YhC+%?
DhaU,
{,[@-
cE_z+s
ub<yJ7
e\.W
/,voD
/B/"
G5~U
u,8$
g~EX*
3,*I
Du&,
Z_;5,
"ZLVo
UGZoQ
pu!,
; O6"6
lbMr
r%f?
jeH/
!.Yn
$2@G
i}R9o
CLVH
nK:D<m
y\|-
S~IQ
Ha^f
W +;
0Vev)t
tI<i
N%rR0[M
/Y"7
vxi+
cN5?
0Qp'
Xi!k
KpO5
R%H3
RB}3
2rAl8
Bh9moSr
J3`M
Mr.i
jp-|
~FJr
&azK
T QB
?xN;
<S+:
W>NOv
\/TE
Qp^@
"sf(
EeAw
9+330$
{q\e
bhsk
z4X{
~uq}
\h-~
;h{]1(
Jx1_
wy".S
QE8s
$RFt
_kYhfe
Fa>_OFe
fG_W
j9HY
tCf@N
%U#0yVB*
,wEs`
6,[(vZB'
s79*K
xMMx|bf)5
s&K>
XUKG
$1_o/
]mF.
^#\X
8ISF
_>["2
M|@'Ip
=:f;=|{;
U9N&q0~
BXXM\
[r~pa
>ybzc
&O'@
oaW`
s-NH
$Imc
';_e0y
oRbaj
i%sD
^E3O<_Q!%*^
-/7vi
HO.3
~qq+P
tqO$B
'd.N
GG=~
jLz~
[\tK
JV,I5
W2"~
-GnuM
~~=Y
''TI
Wv.Rj
0>0t
!5BX
) -C
4w0eB
g4U$K
^U@<5C<P
#!$F
MM$C"
)AgaP
{SRv
b.@M
xuaOP
SiwT
5^Be
-'q,
R`yuK%
7:e,
PVW=
hBq7
N!6p1d
y=]8
T>Az
et_IQ
:2=,
Kfq'
3`Gp
.{\=
Ow}1
`Q6&
|i/m
d\}[
x5v#!
c_;`
}G2$a
ypr'}2
#Z"9
[nSV
euCK
_Z*H
?'_(
6vc@
vOJP
L_S:
T+#-\
9/A2
,=MM=
E%p_
Ma8w
rJ0E
D+#bS0m\,
4U'u
>|[F$;
Qpf`2
D}xC[e-
-JkL
X<MY
anD5T\
sh*]J
JK(;
%iZ%ls
{Oerc
w*}K
!g*S
Q33
IaG&5v
e4-|
@4uH4z\k
zGuC
~VfB>
WR~w
n*.I=R
:N?S
T8U,
M37s
40IHo
o|}w
_'-&
.[]-
"aZ!
t5MK
?%oi*
&.<M
PFX)
>fww
Y2z
yPh.Ql
WUq40
P%KS
3Ab4
WBB49F{
~4fMV
x6ZFO
f8OW
ps~Cx
E$]v
#<E'
~~Xx4
6aSJk
zk+HF
',E$
Y!rO
1Z}\
?!{b
)$=e
dF)]r
3&+i
z/,V
nX7Mb
"p,9
gk'8i
v^3sW
hH>}
Np$z
 <xEV
|=W,
<2;K
qcG^)
p/tQ}
"tuv]
5,y+
&4U6*
VsT'
5;fh
Ie0~qX
9~X6
7j5Y
]^`_
;NN\
a<Wy
@DJn
lQXr~(
0Dn\
_E?IjB:
@P_E
E]1,
z>wYz
xRjXTe
irB'T
 MSa
`2Xu
!q\C
C![&
H H`e
hU+f
j!0E
I@F.
J$h;vc
=+@7
+PoP
*;5rVhE
JJ6ecS
&i:zsp
1]Ig
/v6X*
&r</
M{nEt
P$m(&^|D
 m</
#y)[
d$xR
CGms_/zp
0~?$+d9h
PTo)
QmIh
m?<tq
E5f)/
RMV`z
uSS)
i)=P
IrkH
2;ex
Z_^:
3r7<*
L_^{N+
P"2\x9jD
L&bX
G`&C
Vz{p
)i66
ACJg
Q~}t
:4&>6
skLQsN
V\H=&
8Vt]
n: O
(q}$*x"^
32\m
-Y=RN
weGZP
pk_T
+$<N
f:Uj
}&yj
gS34Q}k
0ik'@
\1Z3
G6vS
~4}3
p83T
GYckwA
;VXE
oO,+
~E9Jq8
l)6/
-e=N
z;-b
,h5#
<{&raI*b
Zh r
F['$
2'}~|
At40
]y_.
'S4&-
+S*v
J"m.
/"^|
f`Kd
tjcs
<4\]2
O8LL}o
CF'!\
wrJs
?:@U
Og\l>
zk+*N
<9v,
U^\_
`zo}
1n{*
-+u.
"+yO
+l,?
QF+y
WkX~G
q[Q;N
jcBE
I4vS
!WT_,
#eNS#
PC>U
BK^z
V-|SC{
_&R0
i&(v
:\my
jo}/
2bb:
=UbN
6/4{
'@{X,
%7ScNm
]y`!
\0@Ny
TA)xH~U
j3tCh!K
=9sS
c%G
dx=%E
QsN%
Gsgx
ISdj
>9[nN
liUukZ?
a5u~
V?rx2hX
|QdRn(
273:1K
&oEt
ht."I
TVp!
5ZF*
Rpg&
|)?Hz
pam9
bx.U
yh*]
stub/EcryptedWrapper.class
WYOe>
;4*(
]kT(
xig<
" "[
f!$X
#@*LFI
=`]8
op!J
HGBB
!YDG
.xO<
%o!M
H5D'R
=A-@jS
ngD4
"*2w`
5G#;9
#@&?
/VGv
!8W<
*zJz
r34]
uy6|)/C
}J$zSI
CG*5A
`}u
l6z@
^h93
9`~C
V,<me
i{=z
u=x8
xuF"
^_`Eo
^z_D
^C||
BX,`
J`}p0
0?p$2&p
!fPG
8*h8R"h"R*h68
`np$
LHix)
C;CWh?
HpXmT
FT%&F4
MGL%
OEv26F
""GX
&5<r
mu\;
82?n
0/n1
^,~4E
,a2Y=a
ELItY
hJKLs
7s:q
`;:i
Or)mhrU
Q<EvMMqW
%#RF0
gik*
jZu6)
EydL%>g
Lw2/3
weeV
/S%s
7{g'qDv
rZN}
Ws%aE
JPn1
t~Cec~k=0
N `5
$YmA.
(<Df
(o}E-
8QEg
C\dK
3[#>J[H
,!9f*i
9T)M
iByK
MT{z/
L/dPf
xi(3
iMdS,
$`RCA
PAo/
z=i>
KZen
7J/b
O}dmT
Oo&z
cX|9
1uU2
a&2w
;bVc
;M]d
s<jq
%y/S
|~iu}
/|GSo|
!A*/
mYP}
=6h$
01h?Y3
k{H>
WFxm5,
Fd(7*2
DFnU
"#_s_"
L3'z
\}AL
gc=I66DZ
*J^qud-
"1N<
h4Kr
-.Kjj_K
f%MP
*"9e+
MyMTO
NH-.%
?S$-
fxJQ
'70k
_xj6
0*)w
_Q4s
Y#l3
)|`{
G*r1H
oxma
h6# {
2T[E&X
:BNU
iAyN
4b~(
XJWYU
} ,e_
B97i8
IHT\B
HYhh
0Z_+L3
a5yO
p][$<ty
aI$p
\*]ta
P</s
FF+^
SJU&Pi
H9`.VN
iQrm-U
t5P_
2|eN
K]ss
N/sw
SJww
u/T<
oml
ExyA
{E@O
^Ypw
u}$a
?LO_D<
_zQ0
ykHk
Y-r!
k!gd2
BCY"4A
< ,HF
QaV>'
mRX/
8$<J8
PRd=
qdslld')>
gbhat
2~*3&~
Ifs,]f
,U2/
_bc-*
;q-v9q
$P*Mb
S,\hJ6
~O-bG
d2/u
O[?ii
Jb}Z;
\zzk
am3N
:lA&N
e{gZ
dn`Zg
;f~D
d}#6f
\v:#e
cv520{"
<rBN9
FZin
&rA~4{:?
hH~;$)
"8cA
Ptna
Xdag
gQS<
x-j,
A]->L
HG;;
^u|&
RAiO
Kw)?J
&,.7s
e-kY
e-kY
e-kY
NQP?
n0UN
E}8*
d[8NI
YH49
H.m@
Ed,_
PGP?
BAG1
%`EX
Ij=l.
>h&vR
Xb<n
D7Ad
KSq._
ZH:n
sfI"
, SZ*t
J_9J
sW.U
1 #OgIy
@_S|)T
ue>S
|^MG3
Z9uJk"<
!N54
stub/EncryptedLoader.class
Z%6HO
v(-K
WYIZ
%=kv,7
///VX
thU.
:t-+
1K]q
v-nU
9vQIY
qyQT^$X
z:olXe
}N)l\
!]5*M
'GS#
IzF7[
N2lG
 7Mih
}6=C*
C-!P
,@3,k
@w[e8
SB?8
U91T
lr7F
Poo]
LT'1q
4QIsU
r_CUz
XD-7
3=L?
4b>+
J]7?
u6KY
:f[/\
8I}u\
{:]|
9guv
#<FR
up5<5
KHebdH=imH
3:_/i
wCCYo(#
cb=X
6|G.
l(RL
ET%WAm
=$_A
qex]
!8f2
@q'9F
{j*5
zFCNc
6f0U
evRj
L"k%N
&R*6
\.Ni
t+a1
p^Z*\
c"Ev
tK|
)M&b
CIr3
<An%
sy7yM>
L%+b)k
)GG<enD|P
 :U0s
iIT':)
C'G-WzEm
QwhK
b|lt{
BtO:4z
Qagbl
Z"*f;?8
%),V
b_1_c
d*:.
q=iM
D|\|
7%d2
vLX)&$l
K\Nl
emboan
r/*Y
'TZC
'{I}2
)([1E
JS&2
rlj[
1aL}G
i!bN
NmKK
hZkvxZ
x+m4
2m*36m
^|x:N
>gt`
e{fL
2.J[2n1
Bjf%a{f.
)YS)}
N3iY
Zvejiv=
v'"+
1{8^
TbN4^1'E
Dnw":w
#iG^
y]qG^
%o>q5o
Db~'jE~
2|xa
+(\(
.\+l+
t/<Dw.<K/)
T)X5U
&jFA
}X3=
/AC5
RiBW
z9O4
_50b
,h+
mU!P
Q,Su
HHQ'AFu.jT
C4$l
D3Etk
XsZri
h/q&
l<NF
fjGf
dVQk
i.%'
l~C/3
lmNx
[SYekG
Txn/#I
~F|m
Cf*8
$?8:s
X)4wlf/9~b
\F&9
eg"]
s\yL
j*,u
Ew#j
dpjOe
)AMd4
)vrp
kB$<6
BNHsC.+
 _4Q
z_mr
6.*4T:
C#e64I
PWr!
9|I<
%mCR
9JwG.
 ~BU
]KoE
ox1fV
/o&~ o
H^ s
Mdul+
\j%>
cv*v
}@,f
#_,h
qBca
jb89UL
G<C7
[E|-
,PF9
])RB
J!JM
(v]X
,j{X5
aXCaSXkN
J^xe
Mx=\
#tdA
mff;
C233T2g1333
A kl
gQc*
!'Y[
tu{B
9nMh
cJh'
#F;FEL
'KF$
N~dN
Q=Mo
69:F
Hl!1z
eXLg{
'$9]
cBgsiB?s
%;Qc
Aor?
a>tNg
tZY<
erOby
qOx6s
?\kx\
-/.(
e<N5|QL1
C -G
(T-d
$;It
x2aw
y;eU
`?G"8%
V{!W
#bTtA
4A:W
+l#S
NU$*AE.
SqHfR
wV^c7)
9G}A[
G5tu
zUom{
K{G;L
u:?E/
Y6@O
C3^KC
_b%]
5"`t#
:2mho&
$x23
3[@E
/c.@V3
xh=+
povO
z~-z
mEqd
rQ{d
~8[t
q:~W\
x0P.
Ub'|
:IR@
d'^#9
H2J:
e(2N
#6iWB
: e~}
g`r
\xL`
6v c
 ?|b
Wf1,1
y>Vg^M
3o#N
DWk
?Y{
|tn@C
S]0z
p?&v
 +=o
5pOok
^B^{
Vc3|
@..&J
h lD
>#&A
-f#{
%gC1
M^Fq
C'B:
P/>+4
0(.t
qX:*
6XxX
rTx>
=|-0>|'
"@|}D(
VD'hID_
qPtd&
QihmT
apmt
oot2x%:
A<z:
1Z '
$b=$3
*v9|2v
4 1A
l{b,
j|mRktgR7B
$6&-&
O&Cpbr8
%w&>%
dcJ6<!
ndL*
"QZZ*
EiwHo
bC2{
f!hcV$p?+
-&^e
\6Ht
sAyv9
g?AWe
y]a"o
Phy~"r4?
dhQ2
ZB@Q
'tv1
_lAT
9%*DTb
a@Tz
n,;CBe
dSy,
TxmE!
CIa]$t
`xnC<,l
iL'V4
 v4!d
7='eM
hxs1x
!JIW
1\Sh
xi{9-h'
L)e5
pCWN
6qZq
8K9O9
+8{Y
J^;}!
'`qs
 ]9FP,
72222222222222
8Ld8z
wQqJ3
hc\=
A^.4S
[,q})
T`?/
!uTx
&zTke
h$07
JG=@
48R=
\/|h
Yf=>
*h+y<h
EN%x9!
Joh*U
.R:B
XuAX2
l`97%
z-pI?
wE,t}
6~7o
qQ+AJ
E1((
8j9,
.l7ys
F!\d^
@_1*
g=^l
z62w
<wqvO9'{
(c!7
p?&<f.
7]lq?(
i~)I
CI[<q
Pv{Ie
G.Y\
@10@
CnAR
!hGG
4a4r
HC5"
[38`kC
$r=)#
F9ja
Ml+d
% 6.
{\%|
OHBX!
 ML@
*5CNj
5r4|ONB
"_Dg*
x4HME
mEvi;
g".}!:E_
oC1}'(
<mlG
6N"#
,DF=KA
;s?x
G?1O
.G'zW!
Cde0
F$?x
!d!8
Bpg(
 'l)
f$5l
x1l'
Edk8
D4:<
H{D,
KQ1b%
#MtRd$l
y,r7
OQ,zu
N"wE
hqt2
'z%X
DoCND
FL$X
d\.~:n
O*''
&-tR+
!!5a
BVO,
z~ub
2mJ@
=;%M88%
$?{UR
$mI#
{zr@[
)yH&
b{}Z
1wO+
)eX_
2&?<
G*pD
?#Z{uF
cxF9
>c=v
CMI+
i=XFZ
%Dfz9
&}Iz
7}Lxk
-~V;
'3h69Csdd
|rqF
dF)_
JeGf5-g
3?sH
Es*d
fihN
xhN'
$58+C>
&i{V+
8%,;E
RgHv
y2{y
WO~:
>!' $
sI:4W
~fn9{0w=
8|c^
U>e.
W>Tg
#!g\
~yd5je
EKcC
d8g yT-R
~X =
Et3Z
&:(mDG
ubyz
|<Mz
v."4
3Kl5
[lM\
jf9Y
=_9o/
|%UM\
^KW0~
3IX"
^q+3
J.Nj
U( ^
aH\/
F1Ky[
/59n
~^-w
g{]$
5= ,
z5}F
]twjg
F9=`
KF=}
Wg'z
%<Ok
0O;D
RMG`Y
p]M0S
!sAO
,]oZ
a6j`X
0"p7#
MFe?
)sM;
l6)]2
`n(}
|EYo
iSk1
E8e]'
a=E6Z
0Wl.
qbU#f
}ek);i
d;%Emg
c7&1
^Cjfo
Y,L:
S$;w
REouiU
Hr5d
wsw@
>I^p
&x@D
=&8}
ST{,
K.{ZJ
Boxi
y9@2/
K6y-!v^
=G'{/Jwz
)W|:
M>#h
)]|'e
\d+A
BTl{
^n4d
`,dQ
eih:^
<r_X
.Qma
je~x
D68"G
HuYe$
(-85
ir0z
hOf*:TZ
1$p:f
b\I,&
Fb2x
u\(u4.Q
@H=!V
sB1k
pZpO8
M'm;
5&$cdp2
:9_^
?Rn@
@yGj
\j=s8
43eK
d%i)B{Z>r8
nD\H
{3HvO
&n&CO
1?ej1C
qf$s;3
Sjd=R
9[Oq:
vd_c
QXe?
/'EH
z{1m
MXn?
N^$Q
|#>2
[Z`'
ABJa
(:Q8
hV:Xt
Wpc1
7dwJ
h0j%
Y\I6
TR&eJ
|T*f
4@1V
#l)M
@y#x
W,P{*
4eL*
y4PY
(5S5
W5G<
jK|k
u)Ww
z'BY
\`iC
7vTIWv
h,C*
,ora
nhZC
mNVd4
<Oy7/
@2ZB$
BK6~
mKtL
)Zz6
!h@!_
4`,k
"z.J
_aeJ
@ >.
q* %
8@GE
"YS3
~Y\H
vxM<
stub/EncryptedLoaderOld.class
8a8+
{lRAzDR
9)IYS
gnaFNv
6xVFvjm+
$gANQ~
[TX'
wD"J
=b}0
vzc{>
y8U;
IH&x
gazN
BGGD
oLQJf\
5,#,,,#C
;1.zzLB
GGOw
s^^Qy
:'nBiA~Yn
5,;(g
$NYPl
wAqr
v^A9m#
[EfJN
+o^AirfhDA
$7ev
C{GiA
'AMo
\+k!
^3]S
R3>D>hC~
HARH
Wn-^2V
2@2%X
-'1B
j<7RS(^%
l3Gs
|s)52W
JOZQ
C.n2
s:{p
'gK.
2J0V
fGYm
f*O7s
#1Z,
lX@'P
K8.3p
4,8LA
qiBO
wREg
;?(O
XT#M
D~Qf
<Wjd
Uk8Em
LT;)QU
E@;]
[i&-
abgt9w
:e{V
}?nL
)N:L
&<[>
^?jJ
*]"T
9kdK
Ll23
j&-=]
)n7b
R|>]
#Q#e8
(aO$
plugins/Server.class]P
IcMj
%Nk(
8~&Q
ZHan(p4
f1)]W
9Co4
META-INF/MANIFEST.MF
stub/stub.dllPK
stub/EcryptedWrapper.classPK
stub/EncryptedLoader.classPK
stub/EncryptedLoaderOld.classPK
plugins/Server.classPK

Unicode Strings:
---------------------------------------------------------------------------