Sep 21, 2010 07:45 AM
(This post was last modified: Sep 22, 2010 07:07 AM by The Janitor.)
Hi hackforums,
Please take a good look at this
Ok so because of security reasons, i ran the borlo.exe in anubis, this is the report:
Quote:1. General Information
- Information about Anubis' invocation
Time needed: 21 s
Report created: 09/21/10, 14:34:17 UTC
Termination reason: All tracked processes have exited
Program version: 1.74.3110
- Popups
Process Window Name Window Text Screenshot Number of Displayed Times
csrss.exe borlo.exe - Application Error OK The application failed to initialize properly (0xc0000135). Click on OK to terminate the application. 1
2. borlo.exe
- General information about this executable
Analysis Reason: Primary Analysis Subject
Filename: borlo.exe
MD5: 3dad36ac2a27907de5b72e02c3d59648
SHA-1: 16e620bbbc9bf0a9a32298368f22fa66c3fd4e13
File Size: 25088 Bytes
Process-status at analysis end: dead
Exit Code: -1073741515
- Load-time Dlls
Module Name Base Address Size
C:\WINDOWS\system32\ntdll.dll 0x7C900 0x000AF000
2.a) borlo.exe - Other Activities
- Windows SEH exceptions:
Description Times
Exception 0xc0000135 at 0x7c96478e
The DLL File it ran, i checked it . I found this on the internet about NTdll.dll
Quote:Description: File ntdll.exe is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 138,760 bytes (75% of all occurrence), 216,064 bytes, 241,664 bytes.
The program has a visible window. There is no information about the maker of the file. The file is not a Windows system file. The application is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Therefore the technical security rating is 42% dangerous, however also read the users reviews.
Recommended: Identify ntdll.exe related errors
External information from Paul Collins:
"ntdll" definitely not required. Added by the BIONET.404 TROJAN!
Important: Some malware camouflage themselves as ntdll.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the ntdll.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.
Than i scanned the crypter, same results.
Quote:Analysis Report for Crypter.exe
Comment on this report
Summary:
No threats could be detected by Anubis. This does not imply that execution of this executable is safe.
Table of Contents
expand all collapse all
General information
Crypter.ex.exe
1. General Information
- Information about Anubis' invocation
Time needed: 45 s
Report created: 09/21/10, 14:41:43 UTC
Termination reason: All tracked processes have exited
Program version: 1.74.3110
- Popups
Process Window Name Window Text Screenshot Number of Displayed Times
csrss.exe Crypter.ex.exe - Application Error OK The application failed to initialize properly (0xc0000135). Click on OK to terminate the application. 1
2. Crypter.ex.exe
- General information about this executable
Analysis Reason: Primary Analysis Subject
Filename: Crypter.ex.exe
MD5: fd8653759dff9f347ca26d04281dcf1a
SHA-1: 5b105780d02d2304bd0de03264451f285cc61c5a
File Size: 377856 Bytes
Process-status at analysis end: dead
Exit Code: -1073741515
- Load-time Dlls
Module Name Base Address Size
C:\WINDOWS\system32\ntdll.dll 0x7C900 0x000AF000
2.a) Crypter.ex.exe - Other Activities
- Windows SEH exceptions:
Description Times
Exception 0xc0000135 at 0x7c96478e 1
I found the
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Odd so i researched it.
It is possible it is an anti anubis.
Now tell me why does the crypter+the Borlo have an anti-anubis build in?
ALSO. My firewall said that the crypter is trying to act like a server and accept incoming connections, It was also trying to do something with .net error thing. So yeah thats what i found about it . Proof:
[IMG]http://i56.[censored].com/nxqd01.jpg[/IMG]
Novirusthanks scans:
Borlo.exe
File Info
Report date: 2010-09-20 22:43:58 (GMT 1)
File name: borlo-exe
File size: 25088 bytes
MD5 Hash: 3dad36ac2a27907de5b72e02c3d59648
SHA1 Hash: 16e620bbbc9bf0a9a32298368f22fa66c3fd4e13
Detection rate: 1 on 16 (6%)
Status: INFECTED
Detections
a-squared -
Avast -
AVG -
Avira AntiVir - TR/Dropper.Gen
BitDefender -
ClamAV -
Comodo -
Dr.Web -
F-PROT6 -
Ikarus T3 -
Kaspersky -
NOD32 -
Panda -
TrendMicro -
VBA32 -
VirusBuster -
Scan report generated by
NoVirusThanks.org
Now this doesnt mean ANYTHING , it just means that if you crypt its detected by avira, so no problems about this :]
Crypter:
File Info
Report date: 2010-09-20 23:03:08 (GMT 1)
File name: crypter-exe
File size: 377856 bytes
MD5 Hash: fd8653759dff9f347ca26d04281dcf1a
SHA1 Hash: 5b105780d02d2304bd0de03264451f285cc61c5a
Detection rate: 0 on 16 (0%)
Status: CLEAN
Detections
a-squared -
Avast -
AVG -
Avira AntiVir -
BitDefender -
ClamAV -
Comodo -
Dr.Web -
F-PROT6 -
Ikarus T3 -
Kaspersky -
NOD32 -
Panda -
TrendMicro -
VBA32 -
VirusBuster -
Scan report generated by
NoVirusThanks.org
DLL File:
File Info
Report date: 2010-09-17 21:31:13 (GMT 1)
File name: devcomponents-dotnetbar2-dll
File size: 3489792 bytes
MD5 Hash: 8b081fe5490845a366094324b45542ea
SHA1 Hash: 6de3a27289954c602d237b7fa6099b8e4bf3f9d1
Detection rate: 0 on 16 (0%)
Status: CLEAN
Detections
a-squared -
Avast -
AVG -
Avira AntiVir -
BitDefender -
ClamAV -
Comodo -
Dr.Web -
F-PROT6 -
Ikarus T3 -
Kaspersky -
NOD32 -
Panda -
TrendMicro -
VBA32 -
VirusBuster -
Scan report generated by
NoVirusThanks.org
Explain it to me :]
Quote:Description: File ntdll.exe is located in the folder C:\Windows\System32. Known file sizes on Windows XP are 138,760 bytes (75% of all occurrence), 216,064 bytes, 241,664 bytes.
The program has a visible window. There is no information about the maker of the file. The file is not a Windows system file. The application is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). Therefore the technical security rating is 42% dangerous, however also read the users reviews.
Recommended: Identify ntdll.exe related errors
External information from Paul Collins:
"ntdll" definitely not required. Added by the BIONET.404 TROJAN!
Important: Some malware camouflage themselves as ntdll.exe, particularly if they are located in c:\windows or c:\windows\system32 folder. Thus check the ntdll.exe process on your pc whether it is pest. We recommend Security Task Manager for verifying your computer's security. It is one of the Top Download Picks of 2005 of The Washington Post and PC World.
i think thats definitely fishy, no offense to the person who made the crypter but that raises a lot of eyebrows. :-\ i'm going to run the crypter through a few programs and get back to this thread! :)
Sep 21, 2010 08:18 AM
(This post was last modified: Sep 21, 2010 08:19 AM by The Janitor.)
(Sep 21, 2010 08:15 AM)phillybiker1022 Wrote: i think thats definitely fishy, no offense to the person who made the crypter but that raises a lot of eyebrows. :-\ i'm going to run the crypter through a few programs and get back to this thread! :)
It's not just that theres more actually,
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Sometimes is used for Anti-Anubis, it was found ON The crypter and the stub.
The netdll.dll is used by different Games and comes with Windows.
If you speak German you can read this http://forum.chip.de/windows-alte-versio...20166.html
(Sep 21, 2010 08:25 AM)jonny5252 Wrote: The netdll.dll is used by different Games and comes with Windows.
If you speak German you can read this http://forum.chip.de/windows-alte-versio...20166.html
Hi Johnny,
Even if its used for that (wich it isnt in this case) why would a crypter execute it? :] As you can see in my post, it can be used as malware to .
Kind regards
Gtaclick
I dont know.
I only wanted to say that the part The program has a visible window. There is no information about the maker of the file. The file is not a Windows system file. wrong is.
Hi Johnny,
As i said i looked it up on the internet, on a security site. They might say that the CUSTOME one isn't made by windows :]
Kind Regards, Gtaclick
(Sep 21, 2010 08:18 AM)The Janitor Wrote: It's not just that theres more actually,
Description Times
Exception 0xc0000135 at 0x7c96478e 1
Sometimes is used for Anti-Anubis, it was found ON The crypter and the stub.
Anti-Anubis doesn't work as Anubis can't run .Net files.
So no anti-anubis was not found.
its false positives. starts on boot up, kinda fishy, avira says its a trojan, but its a crypter, gonna say that. all in all, your into blackhat tools, and free ones at that, your gonna get good and bad ones, if you dont trust it or its source, trash it.
When hell freezes over, and the world is burning, I will be holding the flamethrower.
-Fallenour
kind of fishy to be honest nice find
Sep 21, 2010 10:43 AM
(This post was last modified: Sep 21, 2010 10:49 AM by c6p0.)
lol its loopback for antidebugger !
my crypter its clean and my borlo avira detected the runpe .
the source crypter its protected ...
reflector dont view my source,whats problem with my n00b protect ?
you dont copy this ? ....
(Sep 21, 2010 10:43 AM)c6p0 Wrote: lol its loopback for antidebugger !
my crypter its clean and my borlo avira detected the runpe .
the source crypter its protected ...
reflector dont view my source,whats problem with my n00b protect ?
you dont copy this ? ....
after looking at the crypter for a while, i'm going to have to agree with its maker. i was a bit skeptical at first (but that has nothing to do with c6po.. just in general of a lot of the users on here) so i looked into it and i dont think it is anything to thread over. :)
Sep 21, 2010 12:42 PM
(This post was last modified: Sep 21, 2010 12:47 PM by The Janitor.)
Hmm it might not, but it is possible,
At his update 1.3 he "accidently" uploaded a rat instead of his borlo, my firewall tripped and blocked it, i can find the post somewhere just a sec...
Ah here we go, the update of 1.3 with his "mistake" now i might be crazy but someone doesnt "accidently" upload a rat instead of a stub :]
(Sep 20, 2010 01:54 AM)The Janitor Wrote: Lol you trying to infect us? With your rat ? Someone run stub in sandbox btw edit password! I cant effig crack
(Sep 20, 2010 01:32 AM)The Janitor Wrote: Hmm, Hitman Pro Says the stub is a . Cybergate Backdoor.. No good.
Someone can run it in sandbox? XD (Sep 20, 2010 01:51 AM)c6p0 Wrote: ok sorry wrong borlo !
redownload this and try !
forget to add write ressource in memory sorry !
thanks for feedback !
Sep 21, 2010 01:06 PM
(This post was last modified: Sep 21, 2010 01:28 PM by c6p0.)
send borlo who do not walk I'm wrong!
I have 6 Borlo created so sometimes I'm wrong.
I do not answer to you in the post!.
and I did not answer a hitman either!
has nothing to do with a rat? .
but that tells you?
whats problem you have ? my loopback anti debugger or this old post with my wrong borlo ?
you sell crypt here ?
LOOK:
As i said my firewall tripped because the crypter was trying to act like a server and accept incoming stuff, also the DLL it loads can be used as malware, so its possible its a virus. in version 1.3 YOU "accidently" uploaded a RAT Instead of a borlo.exe and named it borlo.exe. NOW Why would you make 6 borlo wherefrom 1 is a rat! Please read the proof i posted
|
