New files for Zeus servers

[SysAdMini]

zeus trojans (and other related malmare):

Code: [Select]

hxxp://bhostonline.com/loaderadv562.exemd5sum ===> afe0c42bd76163762ac798938046743a
for:

Code: [Select]

hxxp://96.9.183.149/app21.bin
hxxp://174.36.237.84/app21s.bin    incoming?

Code: [Select]

hxxp://bhostonline.com/loaderadv563.exemd5sum ===> 5b12cf0e2439517af6af8c8ba6b0f7b4
for

Code: [Select]

hxxp://174.36.237.84/app21s.bin

No Zeus.

[jackberri]

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/booking.gifmd5sum ===> b770e441c0895780e97dda9f4f451cf6
http://camas.comodo.com/cgi-bin/submit?file=1b0efba7105ec95eae83b6b5d768982a7be7ce7ab9c94f8f672a3d60b8e1f642

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/dinner.gifmd5sum ===> 31aa27b634d83f5e40d760b15272ff65

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/feedback.gifmd5sum ===> 9873aabb10242b6bd4e8064855d72090

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/lunch.gifmd5sum ===> 156816d80ee0773b7fe86372936b2704

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/party.gifmd5sum ===> f3559c7f5b41e14d2af00755962fc3ef

Code: [Select]

hxxp://camerinorestaurant.com/data_bak/wine.gifmd5sum ===> 0e936e1ce527ced4ae4dbe10433eeefc

[jackberri]

Code: [Select]

hxxp://kalowweb.de/1/images/css.pngmd5sum ===> bf4556e525fa41e017d97d8bb6a6236e
http://www.virustotal.com/es/analisis/5e2c1af0f53abda78f376ca269c6b97aec8ec48e5a9e001981de91d15435edd8-1266622344

[jackberri]

Code: [Select]

hxxp://195.78.108.22/brgr/config.binmd5sum ===> 6996992a601cb082d3e7e5f5ba4153c5

[jackberri]

Code: [Select]

hxxp://apsight.ru/123/valid.exemd5sum ===> 507f74fc84bf3db508e09f9d0f0f6869
http://www.virustotal.com/analisis/fd5ebde8cb1861f0532a414edb9ba123737daee9c57f8b53ae77ccd4055e9f5e-1266924790

[jackberri]

Code: [Select]

http://yrots.ru/56/antirap.exemd5sum ===>  4e3e8d63bb90e09a34478e201202b255
IP:91.201.28.43

[jackberri]

IP:91.201.28.43

IP is :92.241.176.18

[SysAdMini]

Code: [Select]

http://yrots.ru/56/antirap.exemd5sum ===>  4e3e8d63bb90e09a34478e201202b255
IP:91.201.28.43

I don't know what it is, but it isn't Zeus.

http://www.threatexpert.com/report.aspx?md5=4e3e8d63bb90e09a34478e201202b255

I guess you found the url  in this TE report. This sample drops Zeus, but not only Zeus.

http://www.threatexpert.com/report.aspx?md5=1799a729fc7cadf40d1e3c6d9d35d9ba

[SysAdMini]

IP:91.201.28.43

IP is :92.241.176.18

??

[jackberri]

I don't know what it is, but it isn't Zeus.

You're right

[jackberri]

IP:91.201.28.43

IP is :92.241.176.18

??

The first ip (91.201.28.43) is wrong

[SysAdMini]

IP:91.201.28.43

IP is :92.241.176.18

??

The first ip (91.201.28.43) is wrong

You can modify your existing messages. 

[jackberri]

You can modify your existing messages. 

Errare humanum est 

[jackberri]

Code: [Select]

hxxp://rapidshare.com/files/354880881/powtmd5sum ===> d3457887e4410b493e0c7790bf9dfc1d

Not seems to be a zeus...
http://camas.comodo.com/cgi-bin/submit?file=6ec4ad4ffe87252cda23eae344725a112c5736d116494362866b9ef0f418c1cd
http://www.sunbeltsecurity.com/cwsandboxreport.aspx?id=12056452&cs=D6CD35A5722D460D654AC6348EA5417F

but:
http://www.virustotal.com/analisis/6ec4ad4ffe87252cda23eae344725a112c5736d116494362866b9ef0f418c1cd-1266995507
VT 3/41 (7.32%)

[jackberri]

Code: [Select]

hxxp://googlanaliktics.com/QWEASDZXCV/gate.php
hxxp://googlanaliktics.com/german/US/config.bin