Collection of Upatre Samples ( alpha version)

Config File for 37e3023f2f2cdada61339e74294713d4

md5
37e3023f2f2cdada61339e74294713d4
source
malwr
link
https://malwr.com/analysis/MGU5ZTliZDRkZTE5NDhjNTgxNTUxNTI2ZjU0MTk4Mjg/
malware_name
gebadof.exe
temp_file
GEB-91C9.tmp
scandate
2015-06-24 07:05:53
parsed
2015-06-25 23:21:44
decrypt_keys
54867b21
check_keys
028cf74f
c2_server
93.185.4.90
baseport
9587
useragent
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/539.36 (KHTML, like Gecko) Chrome/44.0.2457.83 Safari/539.36
payload_format
reg
old
0
clientip
icanhazip.com
nr_targets
47
nr_delivery_sites
46
nr_delivery_sites_online
41
nr_payloads
1
ksa
chk
pdir
W22
delivered payloads:
1
31defde79266a9d5c32d99ce1643549f
downloaded
2015-06-24 15:24:49
scanned (on VT)
2015-06-24 13:09:48
positives
22 / 56
detected as
MicroWorld-eScan
Gen:Variant.Dyzap.16
ALYac
Gen:Variant.Dyzap.16
Malwarebytes
Spyware.Dyre
F-Prot
W32/Dropper.gen8!Maximus
ESET-NOD32
a variant of Win32/Exploit.CVE-2013-3660.P
TrendMicro-HouseCall
Cryp_Xin2
Avast
Win32:Injector-CPV [Trj]
GData
Gen:Variant.Dyzap.16
BitDefender
Gen:Variant.Dyzap.16
Ad-Aware
Gen:Variant.Dyzap.16
Emsisoft
Gen:Variant.Dyzap.16 (B)
Comodo
TrojWare.Win32.PWS.Dyzap.MY
F-Secure
Gen:Variant.Dyzap.16
DrWeb
MULDROP.Trojan
TrendMicro
Cryp_Xin2
Sophos
Troj/UACMe-A
Cyren
W32/Dropper.gen8!Maximus
Avira
W32/Etap
Arcabit
Trojan.Dyzap.16
VBA32
suspected of Trojan.Downloader.gen.h
AVG
Win32/DH{eYETICIjfAA1}
Panda
Trj/Genetic.gen
not detected by:
Bkav, nProtect, CAT-QuickHeal, Zillya, AegisLab, K7AntiVirus, Alibaba, K7GW, TheHacker, NANO-Antivirus, Symantec, ClamAV, Kaspersky, Agnitum, SUPERAntiSpyware, ByteHero, Tencent, VIPRE, McAfee-GW-Edition, Jiangmin, Antiy-AVL, Kingsoft, ViRobot, AhnLab-V3, Microsoft, TotalDefense, McAfee, AVware, Baidu-International, Zoner, Rising, Ikarus, Fortinet, Qihoo-360
delivery sites:
1
https://66.196.63.33/wi4.png
31defde79266a9d5c32d99ce1643549f
2
https://71.99.130.24/wi4.png
31defde79266a9d5c32d99ce1643549f
3
https://216.16.93.250/wi4.png
31defde79266a9d5c32d99ce1643549f
4
https://98.246.210.27/wi4.png
31defde79266a9d5c32d99ce1643549f
5
https://66.196.61.218/wi4.png
31defde79266a9d5c32d99ce1643549f
6
https://98.214.11.253/wi4.png
31defde79266a9d5c32d99ce1643549f
7
https://24.148.217.188/wi4.png
31defde79266a9d5c32d99ce1643549f
8
https://98.209.75.164/wi4.png
31defde79266a9d5c32d99ce1643549f
9
https://76.105.248.137/wi4.png
31defde79266a9d5c32d99ce1643549f
10
https://173.216.247.74/wi4.png
31defde79266a9d5c32d99ce1643549f
11
https://77.48.30.156/wi4.png
31defde79266a9d5c32d99ce1643549f
12
https://77.95.195.68/wi4.png
13
https://37.57.144.177/wi4.png
31defde79266a9d5c32d99ce1643549f
14
https://68.55.59.145/wi4.png
31defde79266a9d5c32d99ce1643549f
15
https://95.143.141.50/wi4.png
31defde79266a9d5c32d99ce1643549f
16
https://188.255.243.105/wi4.png
31defde79266a9d5c32d99ce1643549f
17
https://95.143.132.118/wi4.png
31defde79266a9d5c32d99ce1643549f
18
https://194.228.203.19/wi4.png
31defde79266a9d5c32d99ce1643549f
19
https://94.127.129.182/wi4.png
31defde79266a9d5c32d99ce1643549f
20
https://87.249.142.189/wi4.png
31defde79266a9d5c32d99ce1643549f
21
https://85.135.104.170/wi4.png
31defde79266a9d5c32d99ce1643549f
22
https://76.84.81.120/wi4.png
31defde79266a9d5c32d99ce1643549f
23
https://84.246.161.47/wi4.png
24
https://217.168.210.122/wi4.png
31defde79266a9d5c32d99ce1643549f
25
https://81.90.175.7/wi4.png
31defde79266a9d5c32d99ce1643549f
26
https://62.204.250.26/wi4.png
31defde79266a9d5c32d99ce1643549f
27
https://94.103.54.19/wi4.png
28
https://81.93.205.218/wi4.png
31defde79266a9d5c32d99ce1643549f
29
https://81.93.205.251/wi4.png
31defde79266a9d5c32d99ce1643549f
30
https://87.229.109.250/wi4.png
31defde79266a9d5c32d99ce1643549f
31
https://216.51.193.145/wi4.png
31defde79266a9d5c32d99ce1643549f
32
https://96.46.103.232/wi4.png
31defde79266a9d5c32d99ce1643549f
33
https://68.70.242.203/wi4.png
31defde79266a9d5c32d99ce1643549f
34
https://66.215.30.118/wi4.png
31defde79266a9d5c32d99ce1643549f
35
https://96.46.99.183/wi4.png
31defde79266a9d5c32d99ce1643549f
36
https://96.46.100.49/wi4.png
31defde79266a9d5c32d99ce1643549f
37
https://64.111.36.52/wi4.png
31defde79266a9d5c32d99ce1643549f
38
https://194.106.166.22/wi4.png
31defde79266a9d5c32d99ce1643549f
39
https://188.255.147.104/wi4.png
40
https://188.255.236.184/wi4.png
31defde79266a9d5c32d99ce1643549f
41
https://75.98.149.138/wi4.png
31defde79266a9d5c32d99ce1643549f
42
https://79.101.42.247/wi4.png
43
https://96.46.99.215/wi4.png
31defde79266a9d5c32d99ce1643549f
44
https://178.222.250.35/wi4.png
31defde79266a9d5c32d99ce1643549f
45
https://94.154.107.172/wi4.png
31defde79266a9d5c32d99ce1643549f
46
https://68.119.5.32/wi4.png
31defde79266a9d5c32d99ce1643549f