Casier - Revision history

Eric.freyssinet: Text replacement - "=Unknown" to "="

2015-08-08T13:47:52Z

Text replacement - "=Unknown" to "="

← Older revision		Revision as of 13:47, 8 August 2015
Line 17:		Line 17:
	\|Parent=Goldenbaks,		\|Parent=Goldenbaks,
	\|Target=Microsoft Windows,		\|Target=Microsoft Windows,
	\|UserAgent=~~Unknown~~		\|UserAgent=
	\|CCProtocol=~~Unknown~~		\|CCProtocol=
	\|Feature=Affiliation,		\|Feature=Affiliation,
	\|Status=~~Unknown~~		\|Status=
	\|BeginYear=2012		\|BeginYear=2012
	\|EndYear=~~Unknown~~		\|EndYear=
	\|Group=Police lock, Ransomware,		\|Group=Police lock, Ransomware,
	\|Illustrations==== 2012/09 ===		\|Illustrations==== 2012/09 ===

Eric.freyssinet at 13:09, 2 August 2015

2015-08-02T13:09:25Z

← Older revision		Revision as of 13:09, 2 August 2015
Line 19:		Line 19:
	\|UserAgent=Unknown		\|UserAgent=Unknown
	\|CCProtocol=Unknown		\|CCProtocol=Unknown
			\|Feature=Affiliation,
	\|Status=Unknown		\|Status=Unknown
	\|BeginYear=2012		\|BeginYear=2012

Eric.freyssinet at 14:41, 31 July 2015

2015-07-31T14:41:39Z

← Older revision		Revision as of 14:41, 31 July 2015
Line 1:		Line 1:
	{{Botnet		{{Botnet
	\|Introduction=* Could be related to [[parent::Goldenbaks]]		\|Introduction=Samples of the Karagny.L (? MS) Dropper:

	Samples of the Karagny.L (? MS) Dropper:
	MD5:		MD5:
	69e83126e526bda1edb44c802d9a1a6c		69e83126e526bda1edb44c802d9a1a6c
Line 17:		Line 15:
	<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C		<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C
	\|Alias=Retacino, Karagny.L, Undefined-07,		\|Alias=Retacino, Karagny.L, Undefined-07,
			\|Parent=Goldenbaks,
	\|Target=Microsoft Windows,		\|Target=Microsoft Windows,
	\|UserAgent=Unknown		\|UserAgent=Unknown

Eric.freyssinet at 20:25, 30 July 2015

2015-07-30T20:25:22Z

← Older revision		Revision as of 20:25, 30 July 2015
Line 23:		Line 23:
	\|BeginYear=2012		\|BeginYear=2012
	\|EndYear=Unknown		\|EndYear=Unknown
	\|Group=Police lock		\|Group=Police lock, Ransomware,
	\|Illustrations==== 2012/09 ===		\|Illustrations==== 2012/09 ===
	{{#ask: [[threat::Casier]][[month::2012-09]]		{{#ask: [[threat::Casier]][[month::2012-09]]

Eric.freyssinet at 20:23, 30 July 2015

2015-07-30T20:23:19Z

← Older revision		Revision as of 20:23, 30 July 2015
Line 16:		Line 16:
	<NOWIKI>lewinckybest50.in POST /image/vladiny/price.php HTTP/1.1 64.62.146.81 </NOWIKI> 04/09/12		<NOWIKI>lewinckybest50.in POST /image/vladiny/price.php HTTP/1.1 64.62.146.81 </NOWIKI> 04/09/12
	<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C		<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C
	\|Alias=Retacino, Karagny.L,		\|Alias=Retacino, Karagny.L, Undefined-07,
	\|Target=Microsoft Windows,		\|Target=Microsoft Windows,
	\|UserAgent=Unknown		\|UserAgent=Unknown

Eric.freyssinet at 20:22, 30 July 2015

2015-07-30T20:22:57Z

← Older revision		Revision as of 20:22, 30 July 2015
Line 16:		Line 16:
	<NOWIKI>lewinckybest50.in POST /image/vladiny/price.php HTTP/1.1 64.62.146.81 </NOWIKI> 04/09/12		<NOWIKI>lewinckybest50.in POST /image/vladiny/price.php HTTP/1.1 64.62.146.81 </NOWIKI> 04/09/12
	<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C		<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C
			\|Alias=Retacino, Karagny.L,
			\|Target=Microsoft Windows,
			\|UserAgent=Unknown
			\|CCProtocol=Unknown
			\|Status=Unknown
			\|BeginYear=2012
			\|EndYear=Unknown
			\|Group=Police lock
	\|Illustrations==== 2012/09 ===		\|Illustrations==== 2012/09 ===
	{{#ask: [[threat::Casier]][[month::2012-09]]		{{#ask: [[threat::Casier]][[month::2012-09]]
Line 25:		Line 33:
	\|format=gallery\|perrow=4\|widths=300\|heights=300		\|format=gallery\|perrow=4\|widths=300\|heights=300
	}}		}}
	~~\|UserAgent=Unknown~~
	~~\|CCProtocol=Unknown~~
	~~\|Target=Unknown~~
	~~\|Status=Unknown~~
	~~\|BeginYear=2012~~
	~~\|EndYear=Unknown~~
	~~\|Group=Police lock~~
	~~\|Alias=Karagny.L~~
	\|Vendor1=Microsoft		\|Vendor1=Microsoft
	~~\|Alias=Retacino~~
	\|Vendor2=Eset		\|Vendor2=Eset
	\|Victime4=		\|Victime4=
	}}		}}

Eric.freyssinet: 1 revision imported

2015-02-04T22:02:07Z

1 revision imported

← Older revision		Revision as of 22:02, 4 February 2015
(No difference)

Eric.freyssinet at 15:42, 20 February 2013

2013-02-20T15:42:37Z

New page

{{Botnet
|Introduction=* Could be related to [[parent::Goldenbaks]]

Samples of the Karagny.L (? MS) Dropper:
MD5:
69e83126e526bda1edb44c802d9a1a6c
13d4fa60a9bd7c12c0020ec3031cdc8e
f3b37ec88b279cb6f6a10df5104543c1
884f5d75b9ed1dcf9248a2378f82db72
1b0edaa16e19954f319088fbf5f67829
9a42acc44c3ab4435e3c160d8bcfaead 28/08/2012
df2dc152f63576fda0c1bcd846840d65 04/09/12
a4811501e920c5f39229dbbca41aa816 21/10/12
http:
<NOWIKI>logunasens10.in POST /image/9rs/price.php 64.62.146.82</NOWIKI>
<NOWIKI>lewinckybest50.in POST /image/vladiny/price.php HTTP/1.1 64.62.146.81 </NOWIKI> 04/09/12
<NOWIKI>87.107.121.138 POST /price.php </NOWIKI> 21/10/12 - SubC&C
|Illustrations==== 2012/09 ===
{{#ask: [[threat::Casier]][[month::2012-09]]
|?Has description
|format=gallery|perrow=4|widths=300|heights=300
}}
=== 2012/08 ===
{{#ask: [[threat::Casier]][[month::2012-08]]
|format=gallery|perrow=4|widths=300|heights=300
}}
|UserAgent=Unknown
|CCProtocol=Unknown
|Target=Unknown
|Status=Unknown
|BeginYear=2012
|EndYear=Unknown
|Group=Police lock
|Alias=Karagny.L
|Vendor1=Microsoft
|Alias=Retacino
|Vendor2=Eset
|Victime4=
}}