KernelMode.info

TeamRocketOps wrote:XP Defender 2013

Looks like NameChanger / FakeRean season is here :lol:

frame4-mdpro wrote:

Win32:Virut wrote:Key:

Code: Select all

3425-814615-3990

Is this for the XP Defender 2013 ?

yes, this is for XP Defender 2013 / Win 7 Defender 2013

One more sample, detected only by AhnLab:
https://www.virustotal.com/file/6aec1a0 ... /analysis/
Attached.

Looks like FakeAV.

EDIT

This is System Progressive Protection. Can you move this post?

landing and panel cash

^^^ Fake IObit scanner...you dont have the exe file??

Hi All, :D

SKYPE users targeted by Ransomware.

Web link - hxxp://goo.gl/5q1sx?img=radix.abhijeetsawant


Regards,

rough_spear. ;)

Hi, :D

Here is one more Fake AV.

Urls -

hxxp://178.77.103.54:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://188.212.156.180:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://202.169.224.202:8080//get/faa91cf5e79a76602f094ed38fad5872.exe
hxxp://50.22.136.150:8080/get/faa91cf5e79a76602f094ed38fad5872.exe

Regards,


rough_spear. ;)

System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

TeamRocketOps wrote:System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

This sample calls DSEditSecurity function. What is the purpose of that?

Buster_BSA wrote:

TeamRocketOps wrote:System Progressive Protection

Fresh Sample

Low detection

VT 3/43

https://www.virustotal.com/file/59394be ... 350178423/

This sample calls DSEditSecurity function. What is the purpose of that?

There is no purpose like any other. This is a part of fake import table.