Skip navigation.


rop shellcode


Hi, I'm writing some tools to analyze rop shellcode using jit method. Can anybody share me the rop shellcode sample? Is there any repository/place where I can download this kind of sample?

malware exploiting vulnerability

| |

how do we find out (during analysis) that this particular malware is exploiting this particular vulnerability.
any links and indications highly appreciated.
thanks in advance

Fragus Crimepack - Source code


Source code for Fragus Crimepack - a recent variant of the crimepack sold for $800 USD... The archive has everything you need to build it!

Download here

RAR Password: "infected" (without quotes)

Cheers :)

Help in analysing RTF documents


Hi all,
I am trying to extract the shell code from rtf document.I tried with malscanner,offis scanner but i failed.They are displaying that it is not a valid ole32 file. But the rtf document drops a *.doc file and invoke internet explorer to connect to a site.could anyone help me with this file for analysis.


Doc sample malware

| |

Hi All,

I have one sample of malware collected in doc format .It would be greatly appreciated if anybody can extract the malicious CnC out of the sample .

password for file is infected

Thanks !!!!!!!!!1

Trojan.Fadeluxnet aka Fake Stuxnet Cleaner

| | | |

Hi, can anybody supply me a sample of Trojan.Fadeluxnet which claims to be a Stuxnet Cleaner but deletes all the data present in C: drive !

Sample of W32.TmpHide

| | | |

Hi everyone, I am looking for a sample of a new worm called TempHid or TmpHider which exploits Windows shell vulnerability (CVE-2010-2568) to execute arbitrary code, the worm also contains rootkit-like capabilities to hide its presence


Does anyone have a sample of rootkit.tmphider / drop.stuxnet.a.5


i'm looking for a sample which apparently has the md5 of 016169ebebf1cec2aad6c7f0d0ee9026, and has been known to propagate over USB by exploiting an lnk file based exploit.. any pointers would be appreciated

Intelligence and operational level by Siberia Exploit Pack

| |

Siberia Exploit Pack is a crimeware, evolution of Napoleon Exploit Pack, which we've done a brief description on another occasion. However, since the time of that description to this day, the landscape has expanded its developer.

In this regard, and while it ends up being one of the bunch, the interesting thing about this crimeware is information provided by their panel of statistics (intelligence for the attacker), by the way very similar to that provided by Eleonore Exploit Pack, which provide data regarding the success of business which has the exploit  pack for recruitment zombie, discriminating on the basis of these data:

  • Countries affected
  • Most exploited Operating Systems
  • Reference domains with the highest percentage by which vulnerabilities are exploited
  • Browsers exploited
  • Pre-compiled exploits in this version of the package

Let me stress (because it's a minor detail) with this collection of information is nothing more than to intelligence, which allows the attacker to know, at first instance:

In the former case, the population of which country is more vulnerable, perhaps because of their level of piracy, which brings to attention the lack of security updates for operating systems and applications, because as we will see to reach exploits, all these are known and have long been concerned with the patch that fixes the vulnerability.

In this case, the first five countries where this crimeware has higher infection rate include the United States, Britain, Canada, Russia and Germany.

The same approach is being pursued with the data we obtained on operating systems "vulnerable" in quotes because, as I said above, the degree of vulnerability of the OS depends directly on a number of aspects that should be covered by hardening, in which an important factor is the implementation of security patches.

For example, the vulnerability in MDAC (Microsoft Data Access Components) from the year 2006 (four years), described in Microsoft Official Bulletin MS06-014. The impact on operating systems have this version of crimeware, we can see in the picture below.

The list of operating systems is large and attacked the three with the highest vulnerability gap belongs to the family of Microsoft (which is obviously due to the massiveness of use), and other MS also.

However, the crimeware cover other non-Windows operating systems, including PlayStation consoles (GNU / Linux or Black Rhino) and Nintendo Wii (ironically a modified version of a GNU/Linux), in the case of OS used and Workstations high-end mobile phones, including:

  • Mac OS
  • GNU/Linux
  • FreeBSD
  • iPhone
  • Windows Mobile
  • Windows CE
  • Pocket PC
  • Symbian OS

Here we are beginning to recognize that criminals have broadened the scope of coverage, incorporating into its portfolio of options exploitation of vulnerabilities (through the browser) and recruitment of zombies on other operating systems used in other computer technologies.

State of the art in CRiMEPACK Exploit Pack

| |

CRiMEPACK exploit pack is a widespread and accepted in the crime scene in this area came under the slogan "Highest Lowest rates for the price".

He is currently In-the-Wild 3.0 version is being developed as alpha (the first of this version). That's, is in the middle stage of evaluation, perhaps in the next few days will go on sale in underground forums, at which time it will know your actual cost.

Like any pack exploit, it also consists of a set of pre-compiled exploits to take advantage of a number of vulnerabilities in systems with weaknesses in some of its applications, then download and run (Drive-by-Download & Execute) codes malicious and convert that system into a zombie, and therefore part of the apparatus crime.

And I mean ... "criminal" because those behind the development of this type of crimeware do for this purpose. And judging by the pictures (a washcloth, a handgun, a wallet, money and what appears to be cocaine, own scenario of all mafia) observed in the authentication interface your control panel, this definition is very evident.

The first time I found this package was in 2009, when version In-the-Wild was version 2.1 and later expressed his "great leap" to one of the most popular: version 2.8 (still active) which in early 2010 had incorporated into its portfolio of exploits CVE-2010-0188 y CVE-2010-0806; in addition to adding an iframe generator and function "Kaspersky Anti-emulation", at a cost of USD 400.

Syndicate content