Re: Rogue Antimalware (FakeAV, 2012 year)
PostPosted:Fri Dec 14, 2012 2:35 pm
Win32:Virut wrote:2 URLs, probably FakeAVNecurs maybe?
Code: Select allhxxp://guchpaygoogles.info/data.exe hxxp://monitorsupremenike.com/data.exe
A forum for reverse engineering, OS internals and malware analysis
https://www.kernelmode.info/forum/
Win32:Virut wrote:2 URLs, probably FakeAVNecurs maybe?
Code: Select allhxxp://guchpaygoogles.info/data.exe hxxp://monitorsupremenike.com/data.exe
Buster_BSA wrote:Yes, part of.Win32:Virut wrote:2 URLs, probably FakeAVNecurs maybe?
Code: Select allhxxp://guchpaygoogles.info/data.exe hxxp://monitorsupremenike.com/data.exe
bcdedit.exe -set TESTSIGNING ON wb %s\drivers\%s.sys %x runas ComSpec \\.\NtSecureSys SeShutdownPrivilege kernel32 IsWow64Process rb Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection *EUDC* ZwQuerySystemInformation ntdll.dll svchost.exe SystemDefaultEUDCFont EUDC\%d ObReferenceObjectByHandle ZwDuplicateToken ObOpenObjectByPointer PsReferencePrimaryToken PsInitialSystemProcess ObfReferenceObject IoGetCurrentProcess KeDelayExecutionThread