mercredi 16 août 2017

Quick look at another Alina fork: XBOT-POS

Edit: In fact after looking at the sample it's a pure copy pasta of Tiny Nuke :) - cd025523e3aec57f809552b9d1adc4b89526cc632f6d4c481aa2c8c3501dda6b

Hi, it's time for a new post. Today I'll try to have a look at the "Team NZMR"
I've found this funny team by hazard on Twitter via the bot @ScumBots I would like to write this little blog post because I think that this is interesting to see an Alina panel behind a .onion domain and as you can see later, I like look at some weird panels :D.
Let's have a look on this server.
As we know, we have an Alina (Well known POS malware) panel at thzsmrjqqzpaz2mz.onion.link/al/loading.php.
Samples: 26aa9709d0402157d9d36e4849b1f9bacecd8875169c7f26d7d40c5c0c3de298 (http://thzsmrjqqzpaz2mz.onion.link/al/Spark.exe)


In the same boring way, we can found:
  • a Fareit/Pony panel at https://thzsmrjqqzpaz2mz.onion.link/pn/admin.php (I don't have sample)
  • an Atmos at https://thzsmrjqqzpaz2mz.onion.link/at/cp.php :
    Sample e34720cc8ab3718413064f19af5cc704e95661e743293a19f218d3b675147525 (https://thzsmrjqqzpaz2mz.onion.link/at/files/us.exe)

    Thanks to CCAM we can get 2 new servers used by this team:
    • http://netco1000.ddns.net/at/file.php
    • http://22klzn6kzjlwlmt2.onion.link/at/file.php
Those guys really want your creds and your credit card numbers :D


They also try to deal with ransomware (NZMR Ransomware) at https://thzsmrjqqzpaz2mz.onion.link/ed2/ without success...


But I've write this quick blog post for the last panel,
Let me introduce you XBOT panel \o/: https://thzsmrjqqzpaz2mz.onion.link/panel/
(click to enlarge)

The bot ad:
Selling xbot ,new bank trojan -- Modules -- Webinject -- Formgrabber -- Socket4/5 -- Hidden VNC
New bot bank xbot is available for rent (800$/monthly) -- server on tornetwork/clearnet
Customized programming service and web developer/c/c++/Python/NET/others
Team Coder/NZMR
xbot costs 3k $ modules available >webinject -- formgrabber -- Socket4/5 -- Hidden VNC
When buying xbot what do you get?
You will get the builder,bin/exe+socket.exe/server.exe hvnc
[+] - Free installation on your server in tornetwork or clearnet, you choose
[+] - monthly support paid 100 $ (you choose,with or without support)
[+] - Update bot for new version 400 $
[+] Rent xbot
Panel access (Clearnet/Tornetwork)
Bin (exe)
Socket.exe/hvnc.exe
Priçe
800 $ monthly (First 6 customers, others 1k $)
Support monthly 100 $ (btc)
I don't have any sample yet but if you have one, i'm REALLY interrested :D.
Thanks to Xylitol this panel looks like a mix between Alina and Dexter. For example the URI scheme "/front/stats.php", the successstatuscode 666 or this page "Version Control":

This panel looks designed for Banking stuff (webinjects) and POS malware.
From XBOT panel you can DL/Exec, Start VNC sessions, socks sessions and update bots:


We can also found some strange "webinjects" stuff:

where "view content" leads to these kinds of data:


Some settings (look at the Alinas 666 status code):


You can also add some bins in the panel database. Currently, they have 8472 Bins in the database.
And finally the bot lists (~600 bots if I trust the bots list).

I've uploaded the whole list of bots on this album. Ping me if you're on the list :D I'm really curious to see the binary part
And finally the database structure reminds again Alina: By this way we will find soon more Alina forks than Zeus forks \o/

So, NOPE! it's not a super new next gen POS malware, it's just another Alina Fork :D but this webinjects part looks curious :) and the team seems very active.
But come one, 3k$ for open sourced malware haha...

Thanks for your time, thanks to Xylitol and happy hunting :)

IOCs:

http://thzsmrjqqzpaz2mz.onion.link/al/Spark.exe (Alina) http://thzsmrjqqzpaz2mz.onion.link/payload.exe (Neutrino) http://thzsmrjqqzpaz2mz.onion.link/at/files/us.exe (Atmos) http://22klzn6kzjlwlmt2.onion.link/al/Spark.exe (Alina) http://22klzn6kzjlwlmt2.onion.link/al/payload.exe (Neutrino http://22klzn6kzjlwlmt2.onion.link/al/files/us.exe (Atmos) http://netco1000.ddns.net http://netco400.ddns.net/Dia (Gorynch) http://netco400.ddns.net/at/(Atmos) e34720cc8ab3718413064f19af5cc704e95661e743293a19f218d3b675147525 (atmos) 26aa9709d0402157d9d36e4849b1f9bacecd8875169c7f26d7d40c5c0c3de298 (Alina) 8a62f61c4d11d83550ab4baceb9b18d980a4c590723f549f97661a32c1731aff (neutrino)

26 commentaires:

  1. Ce commentaire a été supprimé par un administrateur du blog.

    RépondreSupprimer
  2. Ce commentaire a été supprimé par l'auteur.

    RépondreSupprimer
  3. Programming help provided by allassignmenthelp.com takes care of these fundamentals and most of our tutors are efficient with every programming assignment.

    RépondreSupprimer
  4. So far, I found this website very professional for assignment writing. I took Assignment Help from them for my Science homework. I am really happy with the experience and I will recommend this website to you guys if you need quality writing services for your project.
    I had to complete my English assignment and I was worried because my assignment was not ready. I took the help from google but still fail to write. Then, I took Assignment Help Online from greatassignmenthelp and I was amazed by the work I received. Their expert provided me the instant support and helped me in my assignment. Thank you guys for your assignment help and support.

    RépondreSupprimer
  5. Nice Post!!....
    Do you ever think about the dreadful situation of HP Printer? It may be occurred in your genuine computer peripheral without giving any intimation message to you. Appearance of minute quotient of failure in HP printer does not let you to achieve the prospective result. A number of professionals think about to fetch the most perfect scanning outcome even though they have stand on verge of million HP printer disorder. How to get recovery from the negative functionality of HP printer is a trick question. Instead of applying different method and technology, it is nice to ask the full help and guidance through HP Printer Support executive. There is no further need to stay connected with this problem as the troops of our third party professional teams help you to recover from this issue. Our team is offering the soon solution of problem as you send the quote on its toll free number. In order to know more information, you can browse our web portal.
    View More Information:- https://www.hpprintersupportpro.com/
    HP Printers Support !! HP Printer Support Phone Number !! HP Support !! HP Printer Support Number
    !! HP Phone Number !! HP Support Number
    https://printersupportpro.blogspot.com/2019/06/how-to-fix-hp-support-assistant-not.html
    https://hpprintersupport.photo.blog/2019/06/21/how-to-fix-hp-support-assistant-not-working-issue/
    https://carter120blog.tumblr.com/post/185745102724/how-to-fix-hp-support-assistant-not-working-issue
    https://poptype.co/printrsupportpro/how-to-fix-hp-support-assistant-not-working-issue
    https://slashdot.org/~carter120
    http://printersupportcare.pen.io/
    https://www.evernote.com/shard/s444/client/snv?noteGuid=392a9a2c-d770-46ea-be7f-96b7da7c64bc&noteKey=f293bb2224be5e858eb9f058035a1005&sn=https%3A%2F%2Fwww.evernote.com%2Fshard%2Fs444%2Fsh%2F392a9a2c-d770-46ea-be7f-96b7da7c64bc%2Ff293bb2224be5e858eb9f058035a1005&title=How%2Bto%2BFix%2BHP%2BSupport%2BAssistant%2Bnot%2Bworking%2Bissue%253F
    https://www.playbuzz.com/item/766f37f0-3fd4-4fbf-aa84-6c1f734466f1

    RépondreSupprimer
  6. Great post! I appreciate you for the effort you take to share your knowledge with people. Thanks for you time and knowledge. Great!!! Get support click here Office 365 Help
    Office 365 Support
    Microsoft 365 Support
    Microsoft Office 365 Support
    Outlook Support
    Microsoft Outlook Support
    Outlook Support Number
    Outlook Support Phone Number

    RépondreSupprimer
  7. Very nice!!! This is really good blog information thanks for sharing. We are a reliable third party QuickBooks support phone number company, offering technical support for various types of technical errors.

    Quickbooks online backup

    QuickBooks online customer service

    RépondreSupprimer

  8. I, Josh George is anxious about to get some desirable change to enjoy the proficient features and functions in the aspect of data protection software assets. That’s why I turn my passion into profession and offering the valuable support for removing the technical issue in the different suites and packages of avast antivirus. I hold the great experience in this business field. In case you are facing various antivirus turbulence, then you knock the door of Avast Customer Support Phone Number center. For saturating the whole demand of customers, we are offering the instant support all the time. No specific time has been defined for this.

    RépondreSupprimer
  9. Allassignmenthelp.com having a great reputation among students, we deliver knowledge with full information.

    RépondreSupprimer
  10. From last couple of months, I am working with Apple Support team and eliminating customer’s problems at ease. If you want to know about my service, then you see the happy faces of customers who take services at their door steps. At this support, not only me but my whole team is available all the time and working efficiently to provide best-in-class service. Thus, if you need guidance in getting rid of your Apple device’s issues, then you can call at Apple Support number which is also reachable throughout the day and night.

    RépondreSupprimer
  11. In this modern world, HP printers have quickly become a must-have office or home device to print optimum quality images. Also, the installation of these printers has been considerably streamlined over the years. While we can install the majority of the printers automatically, but adding the HP printer with a network or sharing your printer with other users can still be a difficult part. But, once you become familiar with the complete steps to install printer software then you can use your printer very with no trouble. To know more about this, you can dialHP Tech Support Phone Number to know the appropriate steps to install printer driver and software.

    RépondreSupprimer
  12. Nice blog for getting office 365 support. I got the solution for my issue related to office 365 here. This blog is very important for Microsoft 365 support. Thanks for sharing this blog!
    Visit here:- http://www.microsoftoutlookoffice.com/office-365-support
    office 365 Support
    office 365 help
    Microsoft office 365 support
    Microsoft 365 support

    RépondreSupprimer
  13. Hii i am donaldgeorge and i am a senior technician in Quickbooks .If you face any technical issues in quickbooks then must dial Quickbooks Support Phone Number
    to get an instant solutions.

    RépondreSupprimer
  14. Overall, I really enjoyed the aid provided from Microsoft Outlook Support. I personally thought their guidance and instructions are trouble-free for me to follow. Thus, I will recommend this support to everyone if they face any kind of issue related to outlook. Get support click here Outlook Support
    Outlook Support Number
    Outlook Tech Support
    Outlook Technical Support
    Outlook Support Phone Number
    Outlook Customer Support Phone Number
    Outlook Customer Service Phone Number
    Office 365 Help
    Office 365 Support
    Microsoft 365 Support
    Microsoft Office 365 Support

    RépondreSupprimer
  15. Thank you so much for sharing such an amazing blog with us. Visit lifestyle magazine for creative events.
    Lifestyle Magazine

    RépondreSupprimer
  16. Always we are working to offer best and updated assignment service always. Don't search more for the research paper topic you can get it's best service at studentsassignmenthelp.com. World's best experts are giving amazing service and can complete all your demands. Our experts are online to offer you amazing services and they are offering 24x7 online facility.

    RépondreSupprimer
  17. Excellent post.I like your concept very much. Especially the way you explain it, it’s impressive.Though I am very new to your post but really want to know more in future.Great work Keep it up...Get outlook support in USA.

    RépondreSupprimer
  18. Thanks for sharing this unique article. The creative juices are flowing so fast I can’t even hold them back! I just want to share this with the world! office 365 support is a customer care helpline that is offered by one of the world's best Technical service provider. For more info Contact Microsoft supports.
    http://www.microsoftoutlookoffice365.com/outlook-365-support.html

    RépondreSupprimer
  19. Oh cool. Looking forward to having a play with your updates. Keep us posted. As a side note, can you develop it to “Microsoft 365 Support”? That will be great.
    If you wanna read more for Microsoft office 365 Support then visit the office 365 Support website.

    RépondreSupprimer
  20. Our website AllAssignmenthelp.com is affiliated with the site of various nations. We give our administration everywhere around the world. Our assignment assistance is given to students all through.
    Assignment Help Online
    Assignment Expert Canada

    RépondreSupprimer
  21. Just dial 1-877-916-7666, the tech support number of Assistance for All. We are the most popular tech support agency operating around the country. Get More Information Visit My Website:- https://www.assistanceforall.com/

    RépondreSupprimer
  22. With time and technology, the importance of computer has augmented immeasurably. Microsoft offers several windows versions as per the people need and also keeps updating them for excellent functionality.
    office 365 customer service phone number
    outlook tech support phone number
    Microsoft Support Phone Number
    Office 365 tech support phone number
    Office 365 technical support phone number

    RépondreSupprimer