Malware Database

Note: This site is distributing Rogue “Fake” Anti-Malware product.  Do not visit, pay, or download the software discussed below.

We found a new site pushing RealAV today.  The download link pushes more than one binary. This is NOT  a real Antivirus product!  Do not download or install it!

Site: http://real-antivirus.com  – http://real-antivirus.org
Download: hxxp://real-antivirus.com/cgi-bin/download.pl?code=00000000
File: RealAV.exe
VirusTotal: Result: 2/36 (5.56%)
Additional information
File size: 1954304 bytes
MD5…: aaa18c5564891bad2636e98c60c11842
SHA1..: 61ba85670781d513cd5166e50fc9b642295592db
SHA256: 642594b433ec6421764e58d8b556d9d3ead16254bacad50f49b3a9da239d89f3
SHA512: 9e131ef300832706bc823b8fdd3466f5bbd795a6a08c7611a1420bd309af4ce9
3d5cfb1b28a583a84a19914d17c342c0b0a05723cbef6f4c656b69c0f3a4532e
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (80.9%)
Win32 Executable Generic (8.0%)
Win32 Dynamic Link Library (generic) (7.1%)
Generic Win/DOS Executable (1.8%)
DOS Executable Generic (1.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x5dc6b4
timedatestamp…..: 0x47d00775 (Thu Mar 06 15:02:13 2008)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0×1000 0x1dbfaa 0x1dc000 8.00 0149aea4dcfc5237618a57aec6faa4f8
.data 0x1dd000 0xaa3 0xa00 4.98 9a9e7d8c4e76cbfbef3957499f3edab3
.rsrc 0x1de000 0×398 0×400 3.07 abfcff94d64f4e80fd119ac67c89283a

ThreatExpert:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File MD5
1	%DesktopDir%\RealAV.lnk	620 bytes	0xE9A1298101E75059D6B2B2DAF50FD6D5
2	%Temp%\stylrit0.tmp	567,416 bytes	0xC8F83A8327B280A6E33CF667904C9607
3	%Programs%\RealAV\RealAV.lnk	632 bytes	0xC93690825D178EB769AD4473A5230818
4	%ProgramFiles%\RealAV\RealAV.exe [file and pathname of the sample #1]	1,954,304 bytes	0xAAA18C5564891BAD2636E98C60C11842
5	%ProgramFiles%\RealAV\vscan.tsi	10,073 bytes	0x5BC533CD757B5BC635EB6E7FAB5E1C8E
6	%ProgramFiles%\RealAV\zlib.dll	196,608 bytes	0x4D60C419FB5BB06D30B6F6AD5607E480

• The following directories were created:
  • %Programs%\RealAV
  • %ProgramFiles%\RealAV
  • %ProgramFiles%\RealAV\Infected
  • %ProgramFiles%\RealAV\Suspicious

  Registry Modifications

• The following Registry Key was created:
  • HKEY_CURRENT_USER\Software\RealAV

• The newly created Registry Values are:
  • [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    • RealAV.exe = “%ProgramFiles%\RealAV\RealAV.exe”

  so that RealAV.exe runs every time Windows starts

  • [HKEY_CURRENT_USER\Software\RealAV]
    • Autorun = 0×00000001
    • RegisterShellExtension = 0×00000001
    • CheckForUpdates = 0×00000000
    • QuickScanAtStartup = 0×00000001
    • StartMinimized = 0×00000001
    • ID = 0×00000001
    • ScanArchives = 0×00000001
    • ScanFiles = 0×00000001
    • ScanMail = 0×00000001
    • ScanProcesses = 0×00000001
    • ScanRegistry = 0×00000001
    • BasesVersion = 0×00000001
    • CoreVersion = 0×00000001
    • TotalScans = 0×00000001
    • lastScanDate = 0x130A07D8
    • lastScanTime = 0x122D003B
    • lastUpdateDate = 0×00000000
    • lastUpdateTime = 0×00000001

Note: This site is distributing Rogue “Fake” Anti-Malware product.  Do not visit, pay, or download the software discussed below.  See how to remove AntiMalware 2009 below.

Today we found an older Smart Antivirus domain distributing a newly undetected (0/36 on VirusTotal) rogue installer.

Site: http://s-avirus2009.com
File: setup.ver1_1000.0_.exe
VirusTotal: Result: 0/36 (0.00%)

File Size: 114688 bytes
MD5…: b55bc958eb37ae1e2c325d45857c22eb
SHA1..: 4dd883998504bd856b5fe343b2242e1f5eb49b97
SHA256: cbb56264d1abc9c77502f93b0ad7a4d1749f60dd3bf916e9fad41f7332b0b622
SHA512: b09ddceb8fe45b5e8e6053cb6f7223093b41f8a91cbb1bdaff7fb5270e22391d
58e49240924f4e8939fd35e34f372c96a6391b97438e76e9c5b99fa8db5f100a

Removal:

Remove this threat with MalwareBytes!

Today I came across a site (downloadmalware.com) and I initially thought that it was just an interesting title for a site similar to Malware Database. So anyway… I visit this site and what do I find?

I briefly skimmed through the page and found some super crazy story about how they want to stop viruses by injecting their malware into your system. HUH?! After reading this story in pure disgust I eventually came across a link to a live malware executable of the vundo family.

Read the excerpt from the site below. My comments are in red.

Everyone knows that it’s no fun getting a virus, and viruses can be obtained by doing basically anything on the internet. That’s why we created Malware, in order to finally put a stop to constant viral infections on your personal computer.

Malware to stop viruses, eh? That’s some class A BS right there!

We have many competitors, and they may be more popular than us, but at some point in this company’s career, we will surpass them.

Which point would that be?

It’s all about persistence and determination, and I would know because I just wrote an essay about that.

Our Approach: As stated on the main page, our methods of preventing viruses are very similar to how the common flu is prevented. We inject your computer with a small ‘virus‘ so that your computer can build up an immunity to all viruses in general.

A “flu shot” malware to prevent further infections? Just when you thought their bullshit scams were bad!! This is a whole new league of doucheness!

In the past, technology was incapable of developing a program like this, but thanks to new dreamweaver technology by adobe, millions of users around the world are now protected from the most deadly computer viruses.

Huh?

To, Delve into the Situation Further: Our malware program includes a packaged installer. This packaged installer contains two separate files. One of these files is full of little bits of viruses, and the other package contains the white blood cells of nanotechnology. After the virus is installed, the Wano Cells (White-Nano-Cells) are released into the computer’s data stream. The Wano’s are programmed to seek, analyze, and destroy any form of virus that your computer might have. This super advanced sense of analyzition is almost like human instinct, and is the future of virus prevention and removal!

Holy crap! You guys are fscking crazy! They also seem to think that their malware has Chuck Norris strength!

File: Malware.exe
Creates:

• %Temp%\removalfile.bat
• %System%\qoMgddCr.dll –> injected to explorer.exe
• %System%\ssqQjJYq.dll
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{420959A7-1B3F-49EE-848E-6DE631A39223}
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{420959A7-1B3F-49EE-848E-6DE631A39223}\InprocServer32
  • (Default) = “%System%\qoMgddCr.dll”
  • ThreadingModel = “Both”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Settings
  • Time = D0 AF 9A 53 FF 30 C9 01 00 00 00 00
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qoMgddCr
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  • {420959A7-1B3F-49EE-848E-6DE631A39223} = “”
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qoMgddCr]
  • Asynchronous = 0×00000001
  • DllName = “qoMgddCr.dll”
  • Impersonate = 0×00000000
  • Logon = “o”
  • Logoff = “f”
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\00cd0861]
  • (Default) = “8908679E25944863A713F954075BFF50&”
• [HKEY_CURRENT_USER\Software\Microsoft\Installer]
  • (Default) = 16 55 C3 53 FF 30 C9 01

Modifies:

• [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
  • 1A10 = 0×00000000
  • {AEBA21FA-782A-4A90-978D-B72164C80120} = 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 13 37 13 12 14 1A 15 2A
  • {A8A88C49-5EB2-4990-A1A2-0876022C854F} = 1A 37 61 59 23 52 35 0C 7A 5F 20 17 2F 1E 1A 19 0E 2B 01 73 13 37 13 12 14 1A 15 2A

VirusTotal: Result: 7/36 (19.44%)
File size: 50176 bytes
MD5…: fd877051a26132ccb53c06fe00ab1209
SHA1..: 635d5e20f27d52de168aa4c9ecbe233a88de8d88
SHA256: 0d91a0551e0727029775c67432895ac4b650275bfc4c165e6d2e9ebf9b6b3fa6
SHA512: 7ec31c6ca83d8fc7c79ab2b558768f5490a957da9e4318c2fb86f9d1d25fed28
4cb6b42460ce3fcc09986bf740165b429dc04119ccfb908868d82b082235dfe9

Removal:

Remove this threat with MalwareBytes!