The Korean Gaming Industry Is Still Under Fire

360Tencent

https://www.bluecoat.com/securit ... ry-still-under-fire

http://bbs.kafan.cn/thread-1543656-1-1.html

@hx1997

hx1997

样本：http://pan.baidu.com/s/1dDcla7n 提取码：4wu1
压缩包密码：infected

。。。只下了一部分 (46 个, 剩 28 个)，用超了。。。

没下到的：

ZxShell samples related to the Winnti group:

Signed using certificate issued to ESTSoft [serial no. 30d3fe26591d8eac8c30667ac4999bd7]
0be30f5765743e86fe570f58aee0adf7
125fdf4c16f903ec5d34262ed1e13e22
21c75272a97423427abf29867263c97d
6757371e24b7bbd3d0c9799b6c7b51f6
7cf4721fb9fa6e904eee0da9e9b2c106
b6efbc4b4ca4176cccb5de8e61b15e32
c094ac32668b0995fb1ff7b2ff5031c2
cfbc65f46a47ce54a033101e5bf11428
d27f6e24a961394a84fa56bebb18b07a
d5df9fd5a35e8fd7c9f511d147179b18
dcff427d1406f0eecaa1e2890678dde4
df87ea401ac28ed757cf37bb2e6ccdcc

Signed using certificate issued to GameForge GmbH [serial no. 566258224be2966e32660bfa22f6a4bc]
0780b8dd15b5433aa3eeacf177018cb4
4ebed4260e483e1bd4d5c2888de960fe
89dcd18a688a12279a75e973bd223588
b07cc95174bc11717bd65071260afa45
d96d72fdc5631de9805d8c25dfd3245e
f57c4bca1ec98a69c98bccca5d933085
25a4169475a03452577b72d3f57e055a
b0b7a4964ac47ce69bb37bb8a434ccd2
bcc1b9a44c5ad1fdb18adab17f5e5164

Signed using certificate issued to Nexon Corporation [serial no. 7ef9c95a083b63d799015599dacee729]
09c0f3a3099b6b38ec36d001361edd98
551aa0ab2b40fa7d891664caf0da879b
5a4bbbc8651c8d50ea301c93a7812c1e
6677d5209268fe3a06f8877c51bde35e
b7d690cc01bfa3c66ba2f0e809e41b00
bb5cc3ec824d4783ab5dd022004f7dd5

Signed using certificate issued to NHN USA Inc. [serial no. 2b5a383157efc7cd2617ef32f0a7acb9]
9c59537bd660b08095103f8033da28c0

360Tencent

hx1997 发表于 2014-7-22 10:12
样本：http://pan.baidu.com/s/1dDcla7n 提取码：4wu1
压缩包密码：infected

可以发邮件去要求重置，不过这种事不能多干

XywCloud

bav杀12个(不开红伞)

各种有效数签的文件。。。

青春虎

kill 9X

Huorong Network Security Suite v2.5.0.25 (Last update: 2014-07-21 17:10)
Copyright (C) Huorong Security Lab. All rights reserved.

Scan started on 2014-07-22 11:29:56

E:\下载\PassCV\PassCV\127ebf780be5bfd0bf28c6e82f0ce87db91da12c032c07b51fe3777777dcc3be        Heur:Trojan/VC.Fake.d
E:\下载\PassCV\PassCV\2a93cf9550f3622f65b837c97ce2b2415f1c5f8cc764b2d634a5936feb73ce14        Heur:Worm/job
E:\下载\PassCV\PassCV\4e8dc34e7b93faebc05c43efcee6a1d6b7f619c569a3e029e81a0006a3573ca2        Heur:Worm/job
E:\下载\PassCV\PassCV\7ec61a2f01663a9bbcad9cc1db923780cd2b0443ec0787c07ecfef0abbfa1c34        Heur:Worm/job
E:\下载\PassCV\PassCV\8fab1ada2f103762072e321b71ffe2e1fc16c22a4bffa60fce562ba3f5d8d564        Heur:Worm/job
E:\下载\PassCV\PassCV\9800f150260e81623b067ea82b7fc07119f6a587ad39e1572d611612b5737ba2        Heur:Worm/job
E:\下载\PassCV\PassCV\e9c654f8418ea70eafeac825ac160206c19ee0dff57e5d844f69e734e234aef5        Heur:Worm/job
E:\下载\PassCV\PassCV\ef3cce62cd2ca9a48bdb2c1c53b02fe86988a8c3ce6bb114ff243ecab99fba1f        Heur:Worm/job
E:\下载\PassCV\PassCV\ff4e12cf344ab0de04dac358e841907d4e9dc7cc286fd77f65e3246053ba3f8c        Heur:Worm/job

Scan ended on 2014-07-22 11:29:59

Time: 3 second(s). [00:00:03]
Objects scanned: 0
Malware found: 9

Dust-;羅錠

hx1997 发表于 2014-7-22 10:12
样本：http://pan.baidu.com/s/1dDcla7n 提取码：4wu1
压缩包密码：infected

Dr.Web 21x
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\768d574b55585b0b1407a2723b010ba968948eda6179ef22d8baaca2de399ccd - infected with BackDoor.Spy.422
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\ae2143dd87be06d6d51fd1ca206bef1951095fdab04c775a04203db65ace2e9b - infected with BackDoor.Spy.422
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\43b44f40f3312b7755460d02c959d4eb70e6851ef6bd0d08e30837d3d6d46310 - infected with BackDoor.Spy.422
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\f366b09fd77aa15865dd86b88d1e4c0188640950a533d8d5e6cecca9b6534921 - infected with BackDoor.Spy.422
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\c85cf7e2a2e3f6505951bcdb13c3356f5c96e9478c8f634c4123c01826b2b8e0 - infected with BackDoor.Spy.422

C:\Users\lin\Downloads\PassCV\PassCV\Hackdoor_SG Internet\d8678e2cafc4130e1919cec36ef5cb9b0b3124c246723b8e013eecb015acda5d - infected with Trojan.Click3.2904
C:\Users\lin\Downloads\PassCV\PassCV\Gh0st_High1 Entertainment\bf55e3a25bf82b084d82dccd9cd0a6617d49fb63b56a771e41dfcb8ac3afdff2 - infected with BackDoor.Spy.422
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\2a93cf9550f3622f65b837c97ce2b2415f1c5f8cc764b2d634a5936feb73ce14 - infected with Trojan.DownLoader8.41849
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f - infected with Trojan.Syskiller.9
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01 - infected with Trojan.Syskiller.8

C:\Users\lin\Downloads\PassCV\PassCV\PassCV\4e8dc34e7b93faebc05c43efcee6a1d6b7f619c569a3e029e81a0006a3573ca2 - infected with Trojan.Syskiller.7
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\4dbf31c614a2f868fa73df89c3f54b05f12c1377fd8a829fc702899e2d6ea4ef - infected with Trojan.Syskiller.9
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07 - infected with Trojan.Syskiller.9
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\8fab1ada2f103762072e321b71ffe2e1fc16c22a4bffa60fce562ba3f5d8d564 - infected with Trojan.DownLoader8.41849
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\9800f150260e81623b067ea82b7fc07119f6a587ad39e1572d611612b5737ba2 - infected with Trojan.DownLoader8.41849

C:\Users\lin\Downloads\PassCV\PassCV\PassCV\a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3 - infected with Trojan.Syskiller.8
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\127ebf780be5bfd0bf28c6e82f0ce87db91da12c032c07b51fe3777777dcc3be\data001 - infected with BackDoor.Siggen.56261
C:\Users\lin\Downloads\PassCV\PassCV\ZxShell_SG Internet\0d057149042ec48648e200be3b5db7bd081ea6994be98fec915da30d89116edc - infected with BackDoor.Bulknet.1104
C:\Users\lin\Downloads\PassCV\PassCV\ZxShell_SG Internet\2654bb4c6782c964de4e03e556161d4001fa48bc07f00dc31f860dddaae62c14 - infected with Trojan.Inject1.42502
C:\Users\lin\Downloads\PassCV\PassCV\PassCV\e9c654f8418ea70eafeac825ac160206c19ee0dff57e5d844f69e734e234aef5 - infected with Trojan.Syskiller.7

C:\Users\lin\Downloads\PassCV\PassCV\PassCV\fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56 - infected with Trojan.Syskiller.8

a445441

b573684723

好压KILL26X

275751198

360 纯云杀41个，可能是入库了，要不然360面对数签是无力的

fuzhk

VSE 监控 37/46