SkyNet - TOR botnet - analiza + sample

[Usr6]

geographical location of the attacking hosts

The malware sample we retrieved from Usenet has an unusually large size (almost 15MB)

The core code base composes a very simple Tor-enabled IRC bot which incorporates DDoS and a few other capabilities. A large part of the binary appears to be junk data, possibly to better disguise it as a legitimate download. It also empowers several obfuscation routines to twist detection.

The malware comes along with 4 additional embedded resources:

• A ZeuS bot.
  
• The Tor client for Windows.
  
• The CGMiner bitcoin mining tool.
  
• A copy of OpenCL.dll, used by CGMiner for CPU and GPU hash cracking
  

Analiza: https://community.rapid7.com/community/infosec/blog/2012/12/06/skynet-a-tor-powered-botnet-straight-from-reddit

Sample:Download Coldplay-Live_2012-2012-BriBerY.rar from Sendspace.com - send big files the easy way (descarcati doar pentru analiza, la nevoie mai am cateva sampleuri)

Parola: rst

[Maximus]

este interesant!

[seboo00111]

Freenet > TOR

[dancingriver]

Bun?, mul?umesc pentru proba, dar link-ul de download nu func?ioneaz? !!

[Sir-Galahad]

07-09-2013, 10:54 AM

[Usr6]

Update

Skynet samples: https://www.sendspace.com/file/9yqort

pass: infected

@dancingriver

[zebra]

Update

Skynet samples: https://www.sendspace.com/file/9yqort

pass: infected

@dancingriver

sigy?

[zebra]

rar

chestia iti apare la sigy sau la chesti din genul asta crede-ma