Showing posts with label policelock. Show all posts
Showing posts with label policelock. Show all posts

Monday, 1 July 2013

Money laundering

Please refer to the following Web site: http://krebsonsecurity.com/2013/06/cashout-service-for-ransomware-scammers/

Login:

Table check:

Дорогие клиенты в связи с падением пробива на эксплойтах вы вынужденны поднять цену! Цена теперь 0.6
Приношу мои извинения что так получилось, но меня заставляет рынок!
И еще правила возврата я всем объяснял не раз , возврашем тока чек которые у меня возвращается если его потом с наливаем резкий лок акк будет теперь ! Есть много людей кто идет без возвратов вообще , вот я оставлю только таких людей заранее предупреждаю.
Translate (thanks @Malwageddon):
Dear customers,
Due to low callback volumes on the exploits we have to raise the price bar!
The price is now 0.6. My sincere apologies, but the current market leaves
me no choice!
And one more thing, I have explained the return policy many times now - we
only return checks that return to me. If you cash it out your account will
be locked immediately. I have many people who do not have any returns, I
think I'll be only working with these people going forward - giving you
warning in advance.

My check:

Logs:

var_dump() mode:

We tell us some interesting query like:
select * from users where id = 8
select * from checks where user_id = 8 and validated=3
select count(*) c, sum(amount) a from checks where user_id=0 and validated=2 order by id desc limit 1000
select count(*) c from checks where user_id=0 and validated=0 order by id desc limit 1000
select * from checks where user_id=0 and validated=2 order by dt desc limit 1000
select * from log where user_id=8 order by id desc limit 1000
#!/usr/bin/php SQL:select `check`, count(*) c, min(id) m from checks group by `check` having c > 1 order by c

https://www.betamerica.com/login_simple.jsp
proxy:socks://**.***.***.224:29583
Meisbatman:******

betamerica.com is an online gambling site, they probably use this service to launder money:

History:

Pony:

Monday, 10 June 2013

Trojan:Win32/Tobfy.M Affiliate

Came across a Tobfy sample today, things was interesting so here is a post.
I will skip the reversing part: i'm a bit bored to take 50 screenshots and go step by step about what's do the 'M' version of Tobfy. (this winlock is very primitive and relatively easy to understand)
So, let's go directly to the C&C part.

French landing when loaded (buggy IP retrieving, and geoloc):
• dns: 1 ›› ip: 91.226.212.174 - adresse: HKKPOGMPG.POLEXT-FREEHOST.RU
• dns: 1 ›› ip: 91.226.212.174 - adresse: AREKOV.COM


Login:
Registration:

News:

Statistics:

Checks:

Links/EXE (39090a097cfbe4ab766317e5f3d74b53):

Rules:

Affiliate stats:
(Ignore the 'admin' account, it's also made by me)

Affiliate Checks:


Some samples took from the server:
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=2214&start=10#p19581

I'm a bit unaware about Tobfy but that the first time i see this one on affiliate system.

Tuesday, 22 January 2013

Trojan:Win32/Reveton

[root@heretyghyuiiiojk www]#
What a cool hostname.

"v" is GeoLiteCity.dat mixed with some php.
images.rar is a payload downloaded by Reveton (cf here)
The sql database have 4 tables: `balances`, `content`, `geoip_isp`, `stat_ips`

Just the basic, landing for Italian ransom.

And traces of german landing

Code comments and variables name are in english

By looking the code source of pages i've see that "shared.php" is used as panel with GET req only

DB content:

Codes:
There is also a feature to erase vouchers.

Thursday, 25 October 2012

Silence Winlocker 5.0

 Having a look on a version who play MP3 file.

Now let's start the boring part (reversing)
At first it call the time service dept and retrieve the date and check it with 29 Oct
(I've passed on some part of the code)
It's a protection inside Silence Winlocker, the bad guys have 7 days to f*ck ppl with his bin, after the bin will not work and should buy a new one.

Kill process:

Add a startup key:

Load from ressource an MP3 file:

And about ressource there is even one picture

Call the C&C:

Remove some entry in registry:

Kill taskmgr if found:

Play the MP3 file:
md5: 819be88d910d97bb06e02bc255977999

Call the C&C for picture:


And here we go

The C&C look's like this:

Main:

Number of connections:

Payement:

You have 72 hours to pay the fine!

Tring with a 'working' MoneyPak code

Wait! Your request is processed within 24 hours.

Code appeared on the panel:

DA:

Files:


The latest version of Silent Winlocker (5.0) have not changed alot, they replaced the fbi sound by webcam feature after... it's still the same crap who do same things.

thread:

kill proc:

Startup:

Call the gate:

lol'd:

Landing fail:

It should look's like this:

Main:

Number of connections:

Ukash/PSC/MoneyPak Payment:

Picture:


Panel files

picture.php:

CameraExample.swf:




Also got the Citadel HID calculator
I lol'd of guys who cry 'Citadel leak is fake'
ppl dont know that the protection message is 'CORRUPTED EXE SHIT'