::: Malware Analysis Tutorials :::

Hello guys,

Here i'm sharing the link to download the "Malware Analysis Tutorial"

Credits: www.securityxploded.com

::: RAKABULLE - Advanced Remote Administration Tool from DarkComet :::

I hope you all still remember the famous and powerful remote-access Trojan (RAT) called 'Dark Comet', developed by a French computer geek 'Jean-Pierre Lesueur', also known as 'DarkCoderSc'.

However, He had closed the Dark Comet project, when the Syrian government found to be using it to track down and to spy on their people. After that DarkCoderSc started working under a new banner 'Phrozen Software' to develop many new security softwares and penetration testing tools.

On 16 January, 2014 , Jean-Pierre and his team-mate Fabio Pinto from French University, have released a new tool called 'Rakabulle', a file binder with some cool features for penetration testers and malware researchers.

What is a File Binder ?
File binder is an application that allows a user to bind multiple files together, resulting in a single executable file. When you execute that single application, all previous merged files will be extracted to a temporary location, and will be executed normally.

"The builder Rakabulle application will create a stub and inject in its resource the target files to extract and execute. The stub is the little generate part of the program which is designed to extract from its resource the target files to a temporary location and execute. In our application the stub also got a part to inject in Explorer or Internet Explorer process and load custom made plugins".

Below are the features of  "Rakabulle":

File binder, auto file extractor and executor.
REM (Remote Code Execution), Execute code (Plugins) in target process (Explorer or Internet Explorer)
Support 32 and 64 Process.
The application is a 32bit Application (Soon we will compile the 64bit version)
Support UPX compression for the stub (Without compression stub size is about 38KiB using pure Windows API no extra libraries; with compression stub size is approximately 16KiB) The UPX compression doesn’t change the way the application work only the final size.
Support Windows startup.
Doesn’t require administrative privileges.
Plugins and File list support drag and drop.
Support plugins with an open source example.
The stub and the builder are coded using Unicode encoding.

Video Demo
Download Rakabulle here

::: New w0rm (Linux.Darlloz) Creates Havoc for Linux PC's :::

What is Computer W0rm ?

A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers.Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. Unlike a computer virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

Linux.Darlloz - A new worm is targeting x86 computers running Linux and PHP, and variants may also pose a threat to devices such as home routers and set-top boxes based on other chip architectures.

According to security researchers from Symantec, the malware spreads by exploiting a vulnerability in php-cgi, a component that allows PHP to run in the Common Gateway Interface (CGI) configuration. The vulnerability is tracked as CVE-2012-1823 and was patched in PHP 5.4.3 and PHP 5.3.13 in May 2012.

The new worm, which was named Linux.Darlloz, is based on proof-of-concept code released in late October, the Symantec researchers said Wednesday in a blog post.

For more details : check the link

source : www.computerworld.com , www.symantec.com

What is Neutrino Exploit Kit ?

Neutrino Exploit Kit is a threat that is spreading. It is currently ranked 34 in the world for online malware. Neutrino Exploit Kit has been detected by AVG on victims' machines in 173 countries during the last month. There are currently 291 websites in 18 countries that host Neutrino Exploit Kit.

For more info .... Click here
Source : www.avgthreatlabs.com

Matrix Virus

try this to .....save as Matrix.bat

@ echo off
title Virus
echo Your system is affected by virus
PAUSE
echo:
echo Windows will now try to undo changes
PAUSE
echo:
echo FAILED !
PAUSE
echo:
echo Your system is crashed
PAUSE
echo:
color 2
:start
echo %random% %random% %random% %random% %random% %random% %random% %random% %random% %random% %random% %random% %random% %random%
goto start

Virus to Open CD-ROM

Set oWMP = CreateObject("WMPlayer.OCX.7" )
Set colCDROMs = oWMP.cdromCollection
if colCDROMs.Count >= 1 then
do
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next ' cdrom
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next ' cdrom
loop
End If



copy this into notepad and save it as anyname.vbs like virus.vbs
and then double click on it...what u see....bingo

Now if u want to disable this go to task manager click on process
then find wscript.exe and end this process