Rouge - Ransomware v 2.1 preview/misc

Found this today, a  member made a ransomware and trying to sell it. Looks very basic and have no panel either, payment are build in the ransomware. No landing page threading with law suit and so one.
If you scroll down a little there is a youtube video the author made.

Quick analyse the ransomware accept Paypal and Liberty Reversed.
Paypal is not a good idea i think since they are very global and world video.
Liberty reversed are growing as well, most common so far i know is ukash.

Another essential part for Ransomware is being hard to remove and evade detection and removal.
Etc most user do have a Anti virus, but also prevent user from removing it them self.

That's all so far, i hope i can get my hand one a bin our two pretty soon. Maybe a "test" copy our something :) Edit: found out that it's made in visual basic 6 omg most i have heard off and seen are made in c++ our other more pure native langauge :D.

Unpack Mpress + sample [.NET]

Hello and i hope that you will enjoy this post :), I am also working one a few project i will share later. Now pack to topic, today i will talk about packer. There are a few packer, such as upx and mpress. We will focus since it support .net and upx does not.


 A packer, do the following taking the PE/APP (PE = Portable Executable). And use a compression methood such as gzip,zip our equal.And store the orginal application / .dll as resource. During runtime the Application is decompressed and executed. This is have the following inpact, it lower the since and can be used to bypass Anit Virus solution since the file it self compressed does not contain in most case any bad "data".  How ever it's not fail and can easily be unpacked, just doing the decompression but with out executing the PE.

To be continue, as soon i have more spare time :3




 MPRESS website: http://www.matcode.com/mpress.htm

Napalm Web Auth (Short Review)

Short post about Napalm Web Auth, not much to say ate this moment since it's still in beta.
OnForm Load it try to connect to host, and Check if when loaded contains "Napalm Web Auth"
After that we have the login it self pretty straight forward And Finally the cheese it self once logged in, It Download the program which turn out to be a .dll, as byte[] And invoke it with entry point as "EntryPoint" and Namespace as "NWA_Server.NWA" :) Have a nice day and if there are any thing incorrect i am still learning.

How to Get MD5 checksum off file in C# (Snippet)

Basic Application to get MD5 checksum off a program our file, i used the snippet from http://sharpertutorials.com/calculate-md5-checksum-file/, It use the following namespace


using System.Security.Cryptography;

using System.IO;


All i did was adding a openfile dialog, not much but :)

Download
http://www.sendspace.com/file/h85wfj

VirusTotal Scan (Off compiled Bin)
https://www.virustotal.com/file/a3eaacf713934157e63be6b0949f409148c59bc3875ff42a0686a24d45c5cc47/analysis/

Hades DDOS bot (vb.net) source

Hades DDOS bot a simple IRC bot writen in visual Basic, i am sharing both builder and stub source.
I don't think any one will get far with this.

Any way path to builder '\DDoS Bot\HBuilder\bin\Release' builder is called HBuilder.exe.
Now if you are connect to internet and try starting it, it will fail since it connect to dropbox to check if your HWID match. To get around that in this case just disconnect from internet our reject connection.

Press Continue our Fortsätt in my case,
And the builder will show up.

Pretty simple :) ?


Now we will use ilspy just to check why the above works. When Form is loaded it check if our HWID is in a text file, by "calling" cAntiLeak.Check();



And in cAntiLeak we find this,


What makes it work by just disconnecting is that it it fail connecting it handle that using try catch. Download: http://www.sendspace.com/file/6k69bb Password for Archive is infected. And only for education usage, don't abuse. Have a nice day.

Mono.Cecil Obfuscater [C#]

Obfuscating is quite basic, replace string and other thing such as Namespace,Type and so one.

Making it harder to read and offer protection against thief off the code. Making it harder to read,understand and copy. It's used to prevent cracking off product such as a paide program.

Very recommended to be used in managed application, and also abused in other product such as exploit pack to evade detection and in Malware to once again prevent detection from Anti virus.

Here is a scan off a .net bot, (used .net bot since mono cecil allow you only to obfuscate .net logic).
When  i posted this it had a detection rate off 16 / 43~, after using obfuscater (Self made based on Mono.Cecil our using Cecil what ever.)

We get this result 13/44, we lower it with 3, how ever when comparing the analysis i noticed that some detection dropped.

And if we bother comparing they are 15% similar and 85% different, Now with a more advanced obfuscater the result would be different (lower) since a more complex obfuscate would do more then just rename.

http://en.wikipedia.org/wiki/Obfuscation

Have a nice day :)

C# Compare two files Winform application

Based ona snippet from leetcoders, original source http://leetcoders.org/Thread-c-compare-2-files.
Credit goes to CaptainBri how ever a few small change :)

Download Full project as it
http://www.sendspace.com/file/yzu5dv






Small notice, not sure if the .exe in debug really is latest...
Might been some chance after that :)

VirusTotal Scan
https://www.virustotal.com/file/30c027c5eb5cc43a9dcc0a2b06079e10a45648561a880c39dcdcf23d6e4f8dcd/analysis/1352722288/

Using ILSPY to decompile .NET application

Quick tutorial one how to use ILSPY, notice ILSPY is one off many tools i found during lonely nights in front off a computer screen. In the feature i will hopefully post short tutorials about using other tools from basic to average and so one. ILSPY is a decompilern, when a program our application is compiler interprets your C# or Visual Basic .NET statements, and creates a series of MSIL statements that will be executed by the .NET Framework. What a decompiler does should be quite self explained :) it does what the compiler does reversed. And there by allowing you to inspect source code off a Compiled application.

 How need a decompiler ? Decompiler can be used to find bugs, and sadly be abused to crack software. Keep in mind that copyright laws does exist.  But Decompiler can alos be used for good reasons such as giving a detailed information about how a program works (etc malware).

 Where can i download ILSPY ? Offical website for ilspy, In the menu in the upper right corner "Download Binaries" to download a working binary copy off ILSPY.
Notice that  .NET framwork 4.0 is needed.

 How to start it ? First after unzipping, the folder should contain a few .dlls and a .exe, The content might be different then the screenshot i attached since my version might not be up to date based one when you are reading this. ILSPY.exe is the application it self start it

You will now see something like this, the dropbox showing "C#" repressent what langauge should be used to display the decompile result.
The icon in the menu stripe that looks like a refrehs button from a web browser, allows you to reload a assembly. Now to check out a assembly just Click one "File" and a Open File Dialog should pop up.


If you would like to save a decompiled assembly, go File and then "save code..." How ever the source will most like not be compile able right after being saved some error might exist :)












http://en.wikipedia.org/wiki/Decompiler

C# Matrix Look a like snippet

Made this yesterday if i remember right, i where really bored. Most people rank Matrix as one off the best "geek movies". How ever i have only seen small part off it, and the only thin i remember is the matrix effect, and the name Neo.

C# Get Windows Version Snippet

This snippet will check Windows Version and if x64 our x86 architecture.

The snippet will  use Environment.OSVersion.Version.Minor & Environment.OSVersion.Version.Minor, To find out what Version off Windows running.And Environment.Is64BitOperatingSystem in order to find out if x64 our x86.