Collection of Upatre Samples ( alpha version)

Config File for 3148a81be2e3bc586ef4cad99bb84810

md5
3148a81be2e3bc586ef4cad99bb84810
source
virusshare
link
download.4n6?sample=534b5e3f29c17c2f37a82985e1bec50e26ac047f0550440f2ca83761829ae20f
malware_name
salyban.exe
temp_file
scandate
2015-08-22 00:20:58
parsed
2015-09-17 23:02:00
decrypt_keys
3e281d47
check_keys
c2_server
93.185.4.90
baseport
9587
useragent
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.36 (KHTML, like Gecko) Chrome/44.0.2455.81 Safari/535.36
payload_format
sim
old
0
clientip
checkip.dyndns.org
nr_targets
51
nr_delivery_sites
50
nr_delivery_sites_online
17
nr_payloads
1
ksa
dec
pdir
ACE3
delivered payloads:
1
d49fb790b2cf06c8e0e425c8421469b1
downloaded
2015-07-21 23:40:35
scanned (on VT)
2015-07-21 15:20:08
positives
17 / 56
detected as
Bkav
HW32.Packed.CA92
VIPRE
Trojan.Win32.Generic!BT
K7GW
Trojan ( 004c8fe31 )
K7AntiVirus
Trojan ( 004c8fe31 )
ESET-NOD32
a variant of Win32/Kryptik.DQQB
Kaspersky
Trojan-Banker.Win32.Dyre.th
ViRobot
Trojan.Win32.Upatre.489984[h]
Tencent
Win32.Trojan.Inject.Auto
McAfee-GW-Edition
Artemis
Sophos
Mal/Generic-S
Avira
TR/Crypt.ZPACK.79241
McAfee
Artemis!E3D75642A71E
AVware
Trojan.Win32.Generic!BT
Baidu-International
Adware.Win32.iBryte.DQQB
Ikarus
Trojan.Win32.Crypt
AVG
Crypt4.BNBU
Qihoo-360
HEUR/QVM20.1.Malware.Gen
not detected by:
MicroWorld-eScan, nProtect, CAT-QuickHeal, ALYac, Malwarebytes, SUPERAntiSpyware, TheHacker, Alibaba, NANO-Antivirus, F-Prot, Symantec, TrendMicro-HouseCall, Avast, ClamAV, GData, BitDefender, Agnitum, ByteHero, Ad-Aware, Emsisoft, Comodo, F-Secure, DrWeb, Zillya, TrendMicro, Cyren, Jiangmin, Antiy-AVL, Kingsoft, Arcabit, AegisLab, AhnLab-V3, Microsoft, TotalDefense, VBA32, Zoner, Rising, Fortinet, Panda
delivery sites:
1
https://24.220.92.193/ac13.png
2
https://176.36.251.208/ac13.png
3
https://67.221.195.6/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
4
https://69.163.81.211/ac13.png
5
https://216.254.231.11/ac13.png
6
https://24.33.131.116/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
7
https://104.174.123.66/ac13.png
8
https://72.230.82.80/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
9
https://173.248.31.6/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
10
https://173.243.255.79/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
11
https://69.9.204.114/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
12
https://188.255.239.34/ac13.png
13
https://69.144.171.44/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
14
https://65.33.236.173/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
15
https://216.16.93.250/ac13.png
16
https://98.214.11.253/ac13.png
17
https://24.148.217.188/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
18
https://173.216.247.74/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
19
https://77.48.30.156/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
20
https://37.57.144.177/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
21
https://68.55.59.145/ac13.png
22
https://95.143.141.50/ac13.png
23
https://194.228.203.19/ac13.png
24
https://87.249.142.189/ac13.png
25
https://85.135.104.170/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
26
https://76.84.81.120/ac13.png
27
https://84.246.161.47/ac13.png
28
https://217.168.210.122/ac13.png
29
https://81.90.175.7/ac13.png
30
https://81.93.205.218/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
31
https://81.93.205.251/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
32
https://68.70.242.203/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
33
https://64.111.36.52/ac13.png
34
https://178.222.250.35/ac13.png
35
https://94.154.107.172/ac13.png
36
https://68.119.5.32/ac13.png
37
https://194.106.166.22/ac13.png
38
https://188.255.243.105/ac13.png
39
https://188.255.236.184/ac13.png
40
https://98.181.17.39/ac13.png
41
https://67.207.229.215/ac13.png
d49fb790b2cf06c8e0e425c8421469b1
42
https://67.206.96.68/ac13.png
43
https://67.222.197.54/ac13.png
44
https://69.8.50.85/ac13.png
45
https://67.22.167.163/ac13.png
46
https://209.40.238.170/ac13.png
47
https://98.102.44.38/ac13.png
48
https://64.111.42.64/ac13.png
49
https://192.232.14.249/ac13.png
50
https://72.174.240.148/ac13.png