Submit Malware Here To Be Blacklisted - 2019 (NO LIVE MALWARE!)

meidan · July 28, 2019, 5:49pm

Hi,

Thank you for your submission, we’ll check it.

Kind Regards,
Erik M.

Emre_Kagan · August 25, 2019, 8:14pm

Umamaheshwari · August 26, 2019, 4:40am

Hi,

Thank you for your submission, we’ll check it.

Kind Regards,
Umamaheshwari M

Emre_Kagan · August 26, 2019, 1:42pm

Hi Umamaheshwari,

Umamaheshwari · August 27, 2019, 6:29am

Hi,

Thank you for your submission, we’ll check it.

Kind Regards,
Umamaheshwari M

pio · November 28, 2019, 1:55pm

Riskware.Unsafe.Tweakbit.PcRepairKit

Some suspicious/malicious Indicators : Compiler/Packer Signature: Compiler: Borland Object Pascal, Packer: Inno Setup Module 5 SFX - [v.(5.5.7) [ 5.5.9 Unicode ] ] - Delphi 2009, File has multiple binary anomalies (File ignores DEP, The location of the entry-point is suspicious > section: .itext:“0x000117DC”, Contains zero size sections, Contains several executable sections, Contains a virtualized section section: “.tls,2”), Found mutliple Anti-VM Strings (Tries to suspend Cuckoo threads, Checks the version of Bios, Checks the CPU name from registry, Queries the disk size, Checks adapter addresses), Escalade priviledges, Reads Windows Product ID, Reads Windows owner settings, Reads the cookies of Mozilla Firefox, Runs a Keylogger, Calls the “sleep-function” many times, Checks if process is being debugged, Possible date expiration check, exits too soon after checking local time, Creates guardes memory sections, Changes read-write memory protection to read-execute, Duplicates the process handle of an other process to obtain access rights to that process, Steals private information from local Internet browsers (Firefox & Chrome), Changes settings of System certificates, Modifies WPAD proxy autoconfiguration file for traffic interception, HTTP traffic contains suspicious features (HTTP traffic contains multiple POST requests with no referer header > suspicious_request: hxxp://www.google-analytics.com/collect), Connects to an IP/Domain that is known to spread harmful content > “104.237.131.139” - “tweakbit.com” > VirusTotal

e_xistense · November 28, 2019, 4:42pm

Hi pio,

We will verify it.

Regards,
Ionel

pio · November 29, 2019, 12:28am

Hi Ionel,

thanks for notification and classification!

Since I assume that the Human Expert Analysis also includes the simultaneous creation of a signature, I would like to point out that until now none has been created. :a0

Due to the sheer amount of malicious software distributed by Tweakbit, would it be appropriate to rate this manufacturer as untrustworthy via File Certificate Validation?! In this way, Valkyrie could automatically create a negative verdict for unrecognized and future applications of this vendor, and also CAV/CIS could detect files without Signature via File Certificate (Vendor) validation.

As can be seen from the link, the list of malicious files downloaded from “Tweakbit.com” is almost “endless”.

Best Regards,
pio

pio · December 10, 2019, 1:25am

Some older files with high detection rates on VT, so I will not give any more indicators this time.

Trojan.Glupteba

Trojan.Banload

Trojan.Packed.Autoit

Trojan.Spy.Fareit

Trojan.Generic

Trojan.Spy.HawkEye

qiuhui · December 10, 2019, 1:51am

Hi,

Thank you for your submission, we’ll check it.

Kind Regards,
Qiuhui.■■■■

pio · December 13, 2019, 2:48am

Some more older files with very high recognition rates. Verified with a short counter-analysis.

Trojan.Script.Dropper

Riskware.Application.RemoteAgent.UltraVNC

Trojan.Generic

qiuhui · December 13, 2019, 3:31am

Hi pio,

Thank you for your submission, we’ll check it.

Kind Regards,
Qiuhui.■■■■

gvvsss · December 24, 2019, 12:03pm

Malware confirmed by more than 50 scan engines

but not detected by comodo as well as valkyrie

e_xistense · December 24, 2019, 12:40pm

Hi SivaSuresh,

We will check it.

Regards,
Ionel

Citizen_K · December 31, 2019, 9:16pm

Please continue in Submit Malware Here To Be Blacklisted - 2020 (NO LIVE MALWARE!).

This topic will stay open to handle open submissions.