+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: My password were changed after downloading a RAT (/showthread.php?tid=4575525)
Pages: Pages
1
2
My password were changed after downloading a RAT - Badplum - Dec 8, 2014
Okay it was stupid of me I know. I downloaded a RAT by accident and I did a system restore. I though I was safe only to notice that my MC passwords were changed (I have 2 accounts) and I'm worried he will get my steam next. I dont even feel safe on the web right now until its removed. Ill have a link of were I downloaded it. Anyone know how to uninstall it? Im very nervous and fairly scared...
(removed)
* - Aura - Dec 8, 2014
Remove the download link if its infected. PM me it directly and I'll take a look to gather more information
* - -Hyperion - Dec 8, 2014
and you need to run a scan right away then change your passwords please follow these basic removal instructions https://hackforums.net/showthread.php?tid=4558828 then post the logs. We can go more in depth after
* - Aura - Dec 8, 2014
(Dec 8, 2014 07:20 PM)-Hyperion Wrote: and you need to run a scan right away then change your passwords please follow these basic removal instructions https://hackforums.net/showthread.php?tid=4558828 then post the logs. We can go more in depth after
I got information about the file, its a DarkComet stub with a miner in it. Want screenshots and shit?
* - -Hyperion - Dec 8, 2014
(Dec 8, 2014 07:23 PM)Aurа Wrote: I got information about the file, its a DarkComet stub with a miner in it. Want screenshots and shit?
if it was something good I might... hell even cryptolocker mundane now. Why don't you try running it on the new site I found and see what it finds as a test?
* - Aura - Dec 8, 2014
(Dec 8, 2014 07:25 PM)-Hyperion Wrote: if it was something good I might... hell even cryptolocker mundane now. Why don't you try running it on the new site I found and see what it finds as a test?
Which new website? I'm not aware of any new website? And its a basic stub too. Killing the processes actually kills it and if you disable it in msconfig and delete the stubs, it doesn't comeback. Top tier skiddy material.
* - -Hyperion - Dec 8, 2014
https://www.hybrid-analysis.com/ this one see what report it drops
* - Aura - Dec 8, 2014
(Dec 8, 2014 07:31 PM)-Hyperion Wrote: https://www.hybrid-analysis.com/ this one see what report it drops
Oh alright, let me boot up a VM.
Meanwhile:
https://i.imgur.com/MgOH2NH.png
https://i.imgur.com/U0EiFnO.png
https://www.virustotal.com/en/file/a3cd7db1bd6e0eca2e735b073c1016df77a99e155ca3ef518e57a76e88c4e402/analysis/
* - Badplum - Dec 8, 2014
Wait so it was only Dark comet? Nothings in my ms config that's suspicious I checked after running a scan and system restoring. If its not in the start up do you think im safe now? I changed my passwords but he got 1 of my mine craft accounts :(
"Whole Computer Scan"
"High severity";"6";"6";"0"
"Medium severity";"32";"32";"0"
"Scanned folders:";"Scan Whole Computer"
"Started:";"12/8/2014, 5:20:46 PM"
"Finished:";"12/8/2014, 6:48:45 PM"
"Scanned items:";"266848"
"Launched by:";"Badplum25"
"Name";"Description";"Status";"Status";"Priority"
"C:\Users\Badplum25\Desktop\Random RATS\Terraria.exe.exe";"Trojan horse Downloader.Generic13.AWJB";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xBDC0 -> aswSnx.sys +0x2D9BC";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0x15CA4 -> aswSnx.sys +0x2F5C8";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0xF90 -> aswSnx.sys +0x2F614";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x8630 -> aswSnx.sys +0x2D6B0";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SIIT6E3K\BiTool[1].dll";"Adware Generic5.AOJI";"Secured";"Healed";"Medium"
"c:\Program Files (x86)\Spyrix Free Keylogger\spkl.exe (3048)";"Trojan horse PSW.Generic12.ATPL";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x12F34 -> aswSnx.sys +0x2E2F4";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xE368 -> aswSnx.sys +0x2E40C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys XLATEOBJ_cGetPalette+0x6440 -> aswSnx.sys +0x2FB28";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xB8A0 -> aswSnx.sys +0x2E190";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngFntCacheLookUp+0x8F20 -> aswSnx.sys +0x2F38C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x148E8 -> aswSnx.sys +0x2DBE0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x6400 -> aswSnx.sys +0x2D760";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xBF2C -> aswSnx.sys +0x2D938";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngPaint+0x914 -> aswSnx.sys +0x2FE90";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R5WNQS50\setup[1].exe";"Found MalSign.Generic.2E0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x5AF8 -> aswSnx.sys +0x2E438";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngSetPointerTag+0x130 -> aswSnx.sys +0x30190";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Darkcomet\DarkComet.exe";"Trojan horse Downloader.Generic13.AWJB.dropper";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x25DC -> aswSnx.sys +0x2DDF0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x81EC -> aswSnx.sys +0x2DB00";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys STROBJ_fxBreakExtra+0x1E00 -> aswSnx.sys +0x3000C";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngRestoreFloatingPointState+0x3EF8 -> aswSnx.sys +0x2D570";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0xE1EC -> aswSnx.sys +0x2E568";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngRestoreFloatingPointState+0x1150 -> aswSnx.sys +0x2F568";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x5788 -> aswSnx.sys +0x2DCC0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x46C4 -> aswSnx.sys +0x2D180";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x7CCC -> aswSnx.sys +0x2E594";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngFntCacheLookUp+0x1240C -> aswSnx.sys +0x2D390";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Darkcomet\Celesty Binder\Celesty.exe";"Trojan horse Generic23.AVVP.dropper";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x6B5C -> aswSnx.sys +0x2E3E0";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x9188 -> aswSnx.sys +0x2E6BC";"Secured";"Healed";"Medium"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngBitBlt+0x606C -> aswSnx.sys +0x2E174";"Secured";"Healed";"Medium"
"C:\Users\Badplum25\Desktop\Batch files\Skype.exe";"Found Win32/DH{ATZCKQ}";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys W32pArgumentTable+0x2670 -> aswSnx.sys +0x2DF04";"Secured";"Healed";"Medium"
"C:\Games\Watch Dogs\bin\Watch_Dogs.exe";"Virus found Win32/Blacked";"Secured";"Healed";"High"
"C:\Windows\system32\drivers\aswSnx.sys";"Inline hook win32k.sys EngCopyBits+0x16D8 -> aswSnx.sys +0x2F500";"Secured";"Healed";"Medium"
Heres my log
* - Aura - Dec 8, 2014
(Dec 8, 2014 07:49 PM)Badplum Wrote: Wait so it was only Dark comet? Nothings in my ms config that's suspicious I checked after running a scan and system restoring. If its not in the start up do you think im safe now? I changed my passwords but he got 1 of my mine craft accounts :(
I'm running the stub again in my VM to see if it have the same behavior. But the VirusTotal (and my analysis) confirm that it's indeed a skiddy DarkComet RAT stub with a CPUMiner feature.
Well, that's some detailled analysis indeed, the scan time is just extremely long:
https://www.hybrid-analysis.com/sample/a3cd7db1bd6e0eca2e735b073c1016df77a99e155ca3ef518e57a76e88c4e402/
* - -Hyperion - Dec 8, 2014
did you follow all the directions OP? if so then change your passwords
* - Aura - Dec 8, 2014
(Dec 8, 2014 08:11 PM)-Hyperion Wrote: did you follow all the directions OP? if so then change your passwords
Along with that, if possible, enable 2FA (Two-Factor Authentification) on every accounts you can to drastically increase the security of these accounts.
* - AcidBurnTrump - Dec 8, 2014
whats the link where you download the rat i would like to have it
add on skype AcidBurnTrump
* - Aura - Dec 8, 2014
(Dec 8, 2014 09:55 PM)AcidBurnTrump Wrote: whats the link where you download the rat i would like to have it
add on skype AcidBurnTrump
I have it, why would you like to have it?
* - Accelerator. - Dec 8, 2014
Try Darkcomet Remover?
Wasn't it made by the same guy who made Darkcomet?