Atrax - Revision history

Eric.freyssinet: Text replacement - "=Unknown" to "="

2015-08-08T13:46:24Z

Text replacement - "=Unknown" to "="

← Older revision		Revision as of 13:46, 8 August 2015
Line 1:		Line 1:
	{{Botnet		{{Botnet
	\|Target=Microsoft Windows		\|Target=Microsoft Windows
	\|UserAgent=~~Unknown~~		\|UserAgent=
	\|CCProtocol=Tor		\|CCProtocol=Tor
	\|Checksum=a7da414a5033cd3178fa5dc2cd52017e5e658b98, 5bcb59b0025ba397d30938d16bc6904475bb3f89, 16b7b43625ccba34f67258fa1c4b8017e8d0e747,		\|Checksum=a7da414a5033cd3178fa5dc2cd52017e5e658b98, 5bcb59b0025ba397d30938d16bc6904475bb3f89, 16b7b43625ccba34f67258fa1c4b8017e8d0e747,
	\|BeginYear=2013		\|BeginYear=2013
	\|EndYear=~~Unknown~~		\|EndYear=
	\|Group=Stealing		\|Group=Stealing
	\|Fonctionnalités=* [[feature::Virtual machine detection]]		\|Fonctionnalités=* [[feature::Virtual machine detection]]
Line 21:		Line 21:
	* kill – terminate all own threads		* kill – terminate all own threads
	\|Infrastructure=* On Tor (found by ESET): iloii7dnyotii3gr.onion (/auth.php)		\|Infrastructure=* On Tor (found by ESET): iloii7dnyotii3gr.onion (/auth.php)
	\|Etat=~~Unknown~~		\|Etat=
	\|Victime4=		\|Victime4=
	}}		}}

2015-08-03T17:37:55Z

← Older revision		Revision as of 17:37, 3 August 2015
Line 1:		Line 1:
	{{Botnet		{{Botnet
			\|Target=Microsoft Windows
			\|UserAgent=Unknown
			\|CCProtocol=Tor
			\|Checksum=a7da414a5033cd3178fa5dc2cd52017e5e658b98, 5bcb59b0025ba397d30938d16bc6904475bb3f89, 16b7b43625ccba34f67258fa1c4b8017e8d0e747,
			\|BeginYear=2013
			\|EndYear=Unknown
			\|Group=Stealing
	\|Fonctionnalités=* [[feature::Virtual machine detection]]		\|Fonctionnalités=* [[feature::Virtual machine detection]]
	* [[feature::Debugging detection]]		* [[feature::Debugging detection]]
Line 14:		Line 21:
	* kill – terminate all own threads		* kill – terminate all own threads
	\|Infrastructure=* On Tor (found by ESET): iloii7dnyotii3gr.onion (/auth.php)		\|Infrastructure=* On Tor (found by ESET): iloii7dnyotii3gr.onion (/auth.php)
	~~\|UserAgent=Unknown~~
	~~\|CCProtocol=Tor~~
	~~\|Target=Microsoft Windows~~
	\|Etat=Unknown		\|Etat=Unknown
	~~\|BeginYear=2013~~
	~~\|EndYear=Unknown~~
	~~\|Group=Stealing~~
	\|Victime4=		\|Victime4=
	}}		}}

2015-08-03T16:19:04Z

Text replacement - "TOR" to "Tor"

← Older revision		Revision as of 16:19, 3 August 2015
Line 7:		Line 7:
	* dlexec – download and execute file		* dlexec – download and execute file
	* dlrunmem – download file and inject it to browser		* dlrunmem – download file and inject it to browser
	* dltorexec – download ~~TOR~~ executable file and execute		* dltorexec – download Tor executable file and execute
	* dltorrunmem – download ~~TOR~~ executable file inject it to browser		* dltorrunmem – download Tor executable file inject it to browser
	* update – update itself		* update – update itself
	* install – download file, encrypt with AES and save to %APPDATA%		* install – download file, encrypt with AES and save to %APPDATA%
	* installexec – download file, encrypt with AES and save to %APPDATA% and execute afterward		* installexec – download file, encrypt with AES and save to %APPDATA% and execute afterward
	* kill – terminate all own threads		* kill – terminate all own threads
	\|Infrastructure=* On ~~TOR~~ (found by ESET): iloii7dnyotii3gr.onion (/auth.php)		\|Infrastructure=* On Tor (found by ESET): iloii7dnyotii3gr.onion (/auth.php)
	\|UserAgent=Unknown		\|UserAgent=Unknown
	\|CCProtocol=~~TOR~~		\|CCProtocol=Tor
	\|Target=Microsoft Windows		\|Target=Microsoft Windows
	\|Etat=Unknown		\|Etat=Unknown

2015-02-01T20:40:34Z

Text replacement - "OS1=" to "Target="

2015-02-01T14:21:48Z

Text replacement - "Inconnu" to "Unknown"

← Older revision		Revision as of 14:21, 1 February 2015
Line 14:		Line 14:
	* kill – terminate all own threads		* kill – terminate all own threads
	\|Infrastructure=* On TOR (found by ESET): iloii7dnyotii3gr.onion (/auth.php)		\|Infrastructure=* On TOR (found by ESET): iloii7dnyotii3gr.onion (/auth.php)
	\|UserAgent=~~Inconnu~~		\|UserAgent=Unknown
	\|CCProtocol=TOR		\|CCProtocol=TOR
	\|OS1=Microsoft Windows		\|OS1=Microsoft Windows
	\|Etat=~~Inconnu~~		\|Etat=Unknown
	\|BeginYear=2013		\|BeginYear=2013
	\|EndYear=~~Inconnu~~		\|EndYear=Unknown
	\|Group=Stealing		\|Group=Stealing
	\|Victime4=		\|Victime4=
	}}		}}

2015-02-01T14:21:06Z

Text replacement - "AnnéeFin=" to "EndYear="

2015-02-01T14:12:55Z

Text replacement - "AnnéeDébut=" to "BeginYear="

2015-02-01T14:09:30Z

Text replacement - "Groupe=" to "Group="

2015-02-01T14:04:11Z

Text replacement - "CC1=" to "CCProtocol="

← Older revision		Revision as of 14:04, 1 February 2015
Line 15:		Line 15:
	\|Infrastructure=* On TOR (found by ESET): iloii7dnyotii3gr.onion (/auth.php)		\|Infrastructure=* On TOR (found by ESET): iloii7dnyotii3gr.onion (/auth.php)
	\|UserAgent=Inconnu		\|UserAgent=Inconnu
	\|~~CC1~~=TOR		\|CCProtocol=TOR
	\|OS1=Microsoft Windows		\|OS1=Microsoft Windows
	\|Etat=Inconnu		\|Etat=Inconnu

2015-02-01T13:54:58Z

1 revision imported

← Older revision		Revision as of 13:54, 1 February 2015
(No difference)