About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Monday, August 12, 2013

Coswid strings - APT

File: D62CD4AD2A919B6ACFA6D49D446DFFDB_svchost.exe_
MD5:  d62cd4ad2a919b6acfa6d49d446dffdb
Size: 19968

see md5 other below


Read more »
Labels: ,

COOKIES Cookiebag Dalbot strings - APT (2)

File: COOKIEBAG_sample_543E03CC5872E9ED870B2D64363F518B
MD5:  543e03cc5872e9ed870b2d64363f518b
Size: 126976




Read more »
Labels: , , ,

COOKIES Cookiebag Dalbot strings - APT (1)

File: COOKIEBAG_sample_0C28AD34F90950BC784339EC9F50D288
MD5:  0c28ad34f90950bc784339ec9f50d288
Size: 151552




Read more »
Labels: , , ,

Citadel 1.3.5.1 strings - CRIME (2)

File: Citadel1.3.5.1_296DA66E2F5239F9AF433C1EFBCDC079
MD5:  296da66e2f5239f9af433c1efbcdc079
Size: 276992




Read more »
Labels: ,

Citadel 1.3.5.1 strings - CRIME (1)

File: Citadel1.3.5.1_439333E63DD1DCA5C23653BDBD740CFC
MD5:  439333e63dd1dca5c23653bdbd740cfc
Size: 245568




Read more »
Labels: ,

Beebus Warp strings - APT

File: Beebus_WARP_D7EC457BE3FAD8057580E07CAE74BECB
MD5:  d7ec457be3fad8057580e07cae74becb
Size: 80896




Read more »
Labels: , ,

WEBC2-RAVE strings - APT

File: WEBC2-RAVE_sample_BF0EE4367EA32F8E3B911C304258E439
MD5:  bf0ee4367ea32f8e3b911c304258e439
Size: 13824

scroll for #2  WEBC2-RAVE_sample_438983192903F3FECF77500A39459EE6


Read more »
Labels: ,

Taleret strings - APT (2)

File: Taleret_5328CFCB46EF18ECF7BA0D21A7ADC02C
MD5:  5328cfcb46ef18ecf7ba0d21a7adc02c
Size: 126976




Read more »
Labels: ,

Taleret strings - APT (1)

File: Taleret_FED166A667AB9CBB1EF6331B8E9D7894
MD5:  fed166a667ab9cbb1ef6331b8e9d7894
Size: 36864

Ascii Strings:


Read more »
Labels: ,

Sunday, August 11, 2013

Alina POS v.5.6 strings - CRIME

File: Alinav5.6-POS_5A22ED78B6454E34217D07C4AF37B23B
MD5:  5a22ed78b6454e34217d07c4af37b23b
Size: 167936




Read more »
Labels: ,

Saturday, August 10, 2013

Alina POS v.5.3 strings -CRIME

robohash
File: Alina-POS_
4C754150639AA3A86CA4D6B6342820BE
MD5:  4c754150639aa3a86ca4d6b6342820be
Size: 48128

Ascii Strings:


Read more »
Labels:

BunituB-Proxy strings - CRIME (3)

robohash

File: BunituB-Proxy_BC22DE23FB07EE9E3C02DD1D2B3E52B3
MD5:  bc22de23fb07ee9e3c02dd1d2b3e52b3
Size: 73728




Read more »
Labels: ,

BunituB-Proxy strings - CRIME (2)

robohash
File: BunituB-Proxy_B64D221166E494AC00251594304BE072
MD5:  b64d221166e494ac00251594304be072
Size: 15872




Read more »
Labels: ,

BunituB-Proxy strings - CRIME

File: BunituB-Proxy_A725B21C1F9D24ADA97564F3F152CF50
MD5:  a725b21c1f9d24ada97564f3f152cf50
Size: 16896



Read more »
Labels: ,

Blazebot strings - CRIME

File: Blazebot_DBAF6F1D0EAAB5DC0C88B9CEEC9EA95E.exe_
MD5:  dbaf6f1d0eaab5dc0c88b9ceec9ea95e
Size: 251957



Read more »
Labels: ,

Bladabindi strings - CRIME

File: fe3e87a746bbf71268a35dfc43a6396d1ef3a92e33b99e1350317183edb66da6
MD5:  82f0aeb7ce7c448b763055a10726ed7b
Size: 28672



Read more »
Labels: ,

Bitcoinminer strings - CRIME

File: Bitcoinminer_F865C199024105A2FFDF5FA98F391D74_syu.exe_
MD5:  f865c199024105a2ffdf5fa98f391d74
Size: 589798



Read more »
Labels: ,

Beebone Downloader strings - CRIME (2)

File: Beebone_Downloader_7F5EACBF1CACF19502260AF34ADEB8EF
MD5:  7f5eacbf1cacf19502260af34adeb8ef
Size: 32768



Read more »
Labels: ,

Beebone Downloader strings - CRIME

File: Beebone_Downloader_8C1AF0A0D20FF98D33C31C24D8967E4F
MD5:  8c1af0a0d20ff98d33c31c24d8967e4f
Size: 32768



Read more »
Labels: ,

Avatar Rootkit NETbotnet strings - CRIME

File: Avatar_Rootkit_NETbotnet_32d6644c5ea66e390070d3dc3401e54b_unpacked
MD5:  32d6644c5ea66e390070d3dc3401e54b
Size: 129024



Read more »
Labels: ,

Ardamax Keylogger strings - CRIME

File: ArdamaxKeylogger_E33AF9E602CBB7AC3634C2608150DD18
MD5:  e33af9e602cbb7ac3634c2608150dd18
Size: 802724



Read more »
Labels: ,

ArcomRat strings - CRIME

File: Arcomrat_4015DD5B27EB612CA5DC320033E284C5
MD5:  4015dd5b27eb612ca5dc320033e284c5
Size: 1024960



Read more »
Labels: ,

Andromeda Bot strings - CRIME

File: Andromeda_85F908A5BD0ADA2D72D138E038AECC7D_DHL-LABEL-ID-2456-8344-5362-5466.exe_
MD5:  85f908a5bd0ada2d72d138e038aecc7d
Size: 57344



Read more »
Labels: ,

Pandora DDoS bot strings - CRIME

This summary is not available. Please click here to view the post.
Read more »
Labels: ,

Monday, June 25, 2012

023 Crime OSX DNS Changer / OSX.RSPlug.A - web -2007


SHA256: 2bdcdab0a5d41f4b6aa48e2ab55177552c8419c3f8ce140c4850a0616d7a2f3e
SHA1: f620af9a43d6e46e6b028dc8b109ff5d4cced911
MD5: 5291beb71cba2c5779119bff7a10abdb
File size: 16.6 KB ( 17034 bytes )
File name: ultracodec1237.dmg



 Download (pass infected)


 
Read more »

Thursday, June 7, 2012

023 Crime Downloader Trojan (name?) - web - June 7, 2012

Audio_Recording_MP3
MD5: FDC170166CB958E138E7D401F3C6F896
SHA256: A3253B1732A50146038A68B3B46260F80BEC6C1C

 Download (pass infected)

pcap file




Read more »

022 Crime Win32/Bakcorox.A - proxy bot - web - June 7, 2012

 Download (pass infected)


pcap file



DNS query:  day7read.info
DNS response:  day7read.info ⇒ 74.207.249.7
Connects to:  day7read.info:443 (74.207.249.7)
Sends data to:  8.8.8.8:53
Sends data to:  day7read.info:443 (74.207.249.7)
Receives data from :  8.8.8.8:53
Receives data from:  day7read.info:443 (74.207.249.7)
 
Read more »

Monday, June 4, 2012

021 Crime TDL - web - June 4, 2012

malicious domain
newgenerationp.com/d/u


 
Download (pass infected)

xor key 85 
MD5  A16977E9CCBF86168CE20DFC33E0A93C
SHA-256 05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01


https://www.virustotal.com/file/05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01/analysis

Thursday, May 10, 2012

020 Crime Ramnit Rootkit - web -May, 10 2012

Sample credit - Artem Baranov and Hendrik Adrian

Research:

 
Download (pass infected)


Size: 135680
MD5:  607B2219FBCFBFE8E6AC9D7F3FB8D50E

Read more »

Thursday, May 3, 2012

019 APT Speech.doc MacOS_X/MS09-027.A Word exploit for MS Word

Someone uploaded. Thank you for sharing.
Document language code is Arabic, which is kind of interesting.

Research: Microsoft An interesting case of Mac OSX malware


 Download (pass infected)

File: speech.doc
Size: 158854
MD5:  F4CBFE4F2DDF3F599984CF6D01C1B781


Read more »
Subscribe to: Posts (Atom)