By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
SmartData Collective
  • Analytics
    AnalyticsShow More
    construction analytics
    5 Benefits of Analytics to Manage Commercial Construction
    5 Min Read
    benefits of data analytics for financial industry
    Fascinating Changes Data Analytics Brings to Finance
    7 Min Read
    analyzing big data for its quality and value
    Use this Strategic Approach to Maximize Your Data’s Value
    6 Min Read
    data-driven seo for product pages
    6 Tips for Using Data Analytics for Product Page SEO
    11 Min Read
    big data analytics in business
    5 Ways to Utilize Data Analytics to Grow Your Business
    6 Min Read
  • Big Data
  • BI
  • Exclusive
  • IT
  • Marketing
  • Software
Search
© 2008-23 SmartData Collective. All Rights Reserved.
Reading: Virtumondo/Virtumundo – virus hunt, continued
Share
Notification Show More
Latest News
cloud-centric companies using network relocation
Cloud-Centric Companies Discover Benefits & Pitfalls of Network Relocation
Cloud Computing
construction analytics
5 Benefits of Analytics to Manage Commercial Construction
Analytics
database compliance guide
Four Strategies For Effective Database Compliance
Data Management
Digital Security From Weaponized AI
Fortifying Enterprise Digital Security Against Hackers Weaponizing AI
Security
DevOps on cloud
Optimizing Cost with DevOps on the Cloud
Cloud Computing Development Exclusive IT
Aa
SmartData Collective
Aa
Search
  • About
  • Help
  • Privacy
Follow US
© 2008-23 SmartData Collective. All Rights Reserved.
SmartData Collective > Uncategorized > Virtumondo/Virtumundo – virus hunt, continued
Uncategorized

Virtumondo/Virtumundo – virus hunt, continued

Editor SDC
Last updated: 2009/04/22 at 11:16 AM
Editor SDC
3 Min Read
SHARE
- Advertisement -

I couldn’t remove this virus. I might if I had the system CD, so that I could start up without starting the logon process (virus uses winlogon notifiers). Here is, however, some information in case people want to pursue this:

- Advertisement -

Functionality is in a dll named “__c00*.dat”, where the star is a number in hexadecimal format and

MD5=6717D534A44C9913FFFE9985EE7E933F:

More Read

big data improves

3 Ways Big Data Improves Leadership Within Companies

IT Is Not Analytics. Here’s Why.
Romney Invokes Analytics in Rebuke of Trump
WEF Davos 2016: Top 100 CEO bloggers
In Memoriam: Robin Fray Carey
  • It “calls home” to “nx1.zappoworld.com”, which is based in the Netherlands.
  • Error output from the file can be found in “c:\xcrashdump.dat”
  • Files it hooks on are:
    • iexplore.exe
    • explorer.exe
    • services.exe
    • winlogon.exe
    • firefox.exe
    • opera.exe
  • Functionality includes
    • HttpSendRequestA (call home)
    • CreateWindowExA (show information)
    • SetWindowsHookExA (log stuff, I suspect key logging)
    • UrlDownloadFileA (download more stuff to update it self, maybe)
    • CreateMutex (I guess so that only one instance runs)
    • WriteProcessMemory (don’t know, looks evil)
    • GetProcAddress (load what ever functionality from dlls, I couldn’t find LoadLibrary, however)
    • CreateRemoteThread (looks bad)
    • Process Management and file management
    • Registry functions
    • String handling, both from shell api and native, both ANSI and UNICODE
    • SetSecurityDescriptorDacl

MD5=69FEB378121DB99F80E15D597EC60124

  • Lingvo9…



- Advertisement -

I couldn’t remove this virus. I might if I had the system CD, so that I could start up without starting the logon process (virus uses winlogon notifiers). Here is, however, some information in case people want to pursue this:

Functionality is in a dll named “__c00*.dat”, where the star is a number in hexadecimal format and

MD5=6717D534A44C9913FFFE9985EE7E933F:

  • It “calls home” to “nx1.zappoworld.com”, which is based in the Netherlands.
  • Error output from the file can be found in “c:\xcrashdump.dat”
  • Files it hooks on are:
    • iexplore.exe
    • explorer.exe
    • services.exe
    • winlogon.exe
    • firefox.exe
    • opera.exe
  • Functionality includes
    • HttpSendRequestA (call home)
    • CreateWindowExA (show information)
    • SetWindowsHookExA (log stuff, I suspect key logging)
    • UrlDownloadFileA (download more stuff to update it self, maybe)
    • CreateMutex (I guess so that only one instance runs)
    • WriteProcessMemory (don’t know, looks evil)
    • GetProcAddress (load what ever functionality from dlls, I couldn’t find LoadLibrary, however)
    • CreateRemoteThread (looks bad)
    • Process Management and file management
    • Registry functions
    • String handling, both from shell api and native, both ANSI and UNICODE
    • SetSecurityDescriptorDacl

MD5=69FEB378121DB99F80E15D597EC60124

  • Lingvo9Netpatch from 2003
  • LocalAlloc and VirtualAlloc (memory allocation functions without their freeing counterparts) #”¤#””¤ memory leaks?
  • OpenFile
  • C-runtime functions
  • Looks sloppy written
  • Not detected by any virus scanners I’ve tried!

 

- Advertisement -

Analysis done with FileAlyzer.

So, I’m off to support so they can wipe my machine. ¤#”%”#”!%”#¤@work.

Zappoworld.com…
Flashget.com catch url…

BTW, I found a nice hosts file at: http://mvps.org/winhelp2002/hosts.htm, http://mvps.org/winhelp2002/hosts.txt

- Advertisement -

Editor SDC April 22, 2009
Share this Article
Facebook Twitter Pinterest LinkedIn
Share
- Advertisement -

Follow us on Facebook

Latest News

cloud-centric companies using network relocation
Cloud-Centric Companies Discover Benefits & Pitfalls of Network Relocation
Cloud Computing
construction analytics
5 Benefits of Analytics to Manage Commercial Construction
Analytics
database compliance guide
Four Strategies For Effective Database Compliance
Data Management
Digital Security From Weaponized AI
Fortifying Enterprise Digital Security Against Hackers Weaponizing AI
Security

Stay Connected

1.2k Followers Like
33.7k Followers Follow
222 Followers Pin

You Might also Like

big data improves
Big DataJobsKnowledge ManagementUncategorized

3 Ways Big Data Improves Leadership Within Companies

6 Min Read
Image
Uncategorized

IT Is Not Analytics. Here’s Why.

7 Min Read

Romney Invokes Analytics in Rebuke of Trump

4 Min Read

WEF Davos 2016: Top 100 CEO bloggers

14 Min Read

SmartData Collective is one of the largest & trusted community covering technical content about Big Data, BI, Cloud, Analytics, Artificial Intelligence, IoT & more.

AI chatbots
AI Chatbots Can Help Retailers Convert Live Broadcast Viewers into Sales!
Artificial Intelligence Chatbots Exclusive
ai is improving the safety of cars
From Bolts to Bots: How AI Is Fortifying the Automotive Industry
Artificial Intelligence Chatbots Exclusive

Quick Link

  • About
  • Contact
  • Privacy
Follow US

© 2008-23 SmartData Collective. All Rights Reserved.

Removed from reading list

Undo
Go to mobile version
Welcome Back!

Sign in to your account

Lost your password?