diff --git a/conf/database.xml b/conf/database.xml new file mode 100644 index 0000000..5a00a1c --- /dev/null +++ b/conf/database.xml @@ -0,0 +1,649 @@ + + + 190220141439 + + + "Source/Original/Dokan_Dec2008/Dokan_Dec2008" + "botnet" + "Dokan" + "unknown" + "unknown" + + + + "c" + "00/12/2008" + "x86" + + + + "Source/Original/ShadowBotv3_March2007/ShadowBotv3_March2007" + "botnet" + "ShadowBot" + "3" + "unknown" + + + + "cpp" + "03/2007" + "x86" + + + + "Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004" + "botnet" + "rBot" + "0.3.3" + "unknown" + + + + "cpp" + "00/05/2004" + "x86" + + + + "Source/Original/ZeuS2.0.8.9_Feb2013/ZeuS2.0.8.9_Feb2013" + "botnet" + "ZeuS" + "2.0.8.9" + "unknown" + + + + "c" + "02/2013" + "x86" + + + + "Source/Original/X0R-USB_Jan2009/X0R-USB_Jan2009" + "virus" + "X0R-USB-Virus" + "unknown" + "unknown" + + + + "c" + "00/01/2009" + "x86" + + + + "Source/Original/LoexBot1.3_Sep2008/LoexBot1.3_Sep2008" + "botnet" + "LoexBot" + "1.3" + "unknown" + + + + "cpp" + "00/09/2008" + "x86" + + + + "Source/Original/ZunkerBot1.4.5_Sep2007/ZunkerBot1.4.5_Sep2007" + "botnet" + "ZunkerBot" + "1.4.5" + "unknown" + + + + "php" + "09/2007" + "x86" + + + + "Source/Original/DopeBotv0.22_UnCrippled_Feb2007/DopeBotv0.22_UnCrippled_Feb2007" + "botnet" + "DopeBot-UnCrippled" + "0.22" + "unknown" + + + + "cpp" + "00/02/2007" + "x86" + + + "Source/Original/vbBot_Jan2007/vbBot_Jan2007" + "botnet" + "vbBot" + "unknown" + "unknown" + + + + "vb" + "01/2007" + "x86" + + + "Source/Original/xTBot0.0.2_2Feb2002/xTBot0.0.2_2Feb2002" + "botnet" + "xTBot" + "0.0.2" + "unknown" + + + + "cpp" + "02/2002" + "x86" + + + "Source/Original/VBS.Win32.Vabian/VBS.Win32.Vabian" + "VBS-Worm" + "VBS.Win32.Vabian" + "botnet" + "unknown" + + + + "vb" + "unknown" + "x86" + + + "Source/Original/DopeBotv0.22_CrippledFeb2007/DopeBotv0.22_CrippledFeb2007" + "botnet" + "DopeBot-Crippled" + "0.22" + "unknown" + + + + "cpp" + "00/02/2007" + "x86" + + + "Source/Original/Win32.MiniPig_Nov2006/Win32.MiniPig_Nov2006" + "Worm" + "Win32.MiniPig" + "virus" + "unknown" + + + + "c" + "00/11/2006" + "x86" + + + "Source/Original/HellBotv3.0_10June2005/HellBotv3.0_10June2005" + "botnet" + "Hellbot" + "3.0" + "unknown" + + + + "cpp" + "00/06/2005" + "x86" + + + "Source/Original/Win32.ogw0rm_Nov2008/Win32.ogw0rm_Nov2008" + "Worm" + "Win32.ogwOrm" + "unknown" + "unknown" + + + + "cpp" + "00/11/2008" + "x86" + + + "Source/Original/DopeBot.B_Dec2004/DopeBot.B_Dec2004" + "botnet" + "DopeBot.B" + "unknown" + "unknown" + + + + "cpp" + "00/12/2004" + "x86" + + + "Source/Original/LiquidBot_May2005/LiquidBot_May2005" + "botnet" + "LiquidBot" + "unknown" + "unknown" + + + + "cpp" + "00/05/2005" + "x86" + + + "Source/Original/SpazBot2.12_June2007/SpazBot2.12_June2007" + "botnet" + "SpazBot" + "2.12" + "unknown" + + + + "vb" + "00/06/2007" + "x86" + + + "Source/Original/DBotv3.1_March2007/DBotv3.1_March2007" + "botnet" + "DBot" + "3.1" + "unknown" + + + + "c" + "00/03/2007" + "x86" + + + "Source/Original/CyberBotv2.2_October2006/CyberBotv2.2_October2006" + "botnet" + "CyberBot" + "2.2" + "unknown" + + + + "cpp" + "00/10/2006" + "x86" + + + "Source/Original/DopeBot.A_Dec2004/DopeBot.A_Dec2004" + "botnet" + "DopeBot.A" + "unknown" + "unknown" + + + + "cpp" + "00/12/2004" + "x86" + + + "Source/Original/MyDoom.A_Jan2004/MyDoom.A_Jan2004" + "virus" + "MyDoom.A" + "unknown" + "unknown" + + + + "c" + "00/01/2004" + "x86" + + + "Source/Original/ShadowBot_Sep2008/ShadowBot_Sep2008" + "botnet" + "ShadowBot" + "unknown" + "unknown" + + + + "cpp" + "00/09/2008" + "x86" + + + "Binaries/CryptoLocker20Nov2013/CryptoLocker20Nov2013" + "ransomeware" + "CryptoLocker" + "Unknown" + "Unknown" + + + + "bin" + "20/12/2013" + "x86" + + + "Binaries/CryptoLocker_10Sep2013/CryptoLocker_10Sep2013" + "ransomeware" + "CryptoLocker" + "Unknown" + "Unknown" + + + + "bin" + "10/12/2013" + "x86" + + + "Binaries/IllusionBot_May2007/IllusionBot_May2007" + "botnet" + "Illusion Bot" + "Unknown" + "Unknown" + + + + "bin" + "00/05/2007" + "x86" + + + "Source/Original/NBot_July2008/NBot_July2008" + "botnet" + "nBot" + "0.32" + "Unknown" + + + + "c" + "00/05/2008" + "x86" + + + "Binaries/Trojan.Dropper.Gen/Trojan.Dropper.Gen" + "trojan" + "Dropper" + "Unknown" + "Unknown" + + + + "bin" + "00/01/2014" + "x86" + + + "Binaries/Trojan.NSIS.Win32/Trojan.NSIS.Win32" + "trojan" + "NSIS" + "Unknown" + "Unknown" + + + + "bin" + "00/01/2014" + "x86" + + + "Binaries/Trojan.Win32.Bechiro.BCD/Trojan.Win32.Bechiro.BCD" + "trojan" + "Bechiro" + "BCD" + "Unknown" + + + + "bin" + "00/01/2014" + "x86" + + + "Binaries/AndroRat_6Dec2013/AndroRat_6Dec2013" + "botnet" + "AndroRat" + "Dec2013" + "Unknown" + + + + "java" + "06/12/2013" + "x86" + + + "Binaries/CryptoLocker_22Jan2014/CryptoLocker_22Jan2014" + "ransomeware" + "CryptoLocker" + "Jan2014" + "Unknown" + + + + "bin" + "22/01/2014" + "x86" + + + "Binaries/njRAT-v0.6.4/njRAT-v0.6.4" + "botnet" + "njRAT" + "0.6.4" + "Unknown" + + + + "bin" + "00/09/2013" + "x86" + + + "Binaries/ZeusBankingVersion_26Nov2013/ZeusBankingVersion_26Nov2013" + "botnet" + "Zeus - zBot" + "Nov2013" + "Unknown" + + + + "bin" + "23/11/2013" + "x86" + + + "Source/Original/NullBot_Dec2006/NullBot_Dec2006" + "botnet" + "NullBot" + "Dec2006" + "Unknown" + + + + "cpp" + "00/12/2006" + "x86" + + + "Binaries/Artemis" + "trojan" + "Artemis" + "Unknown" + "Unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Somoto" + "apt" + "Somoto" + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Variant.Kazy" + "trojan" + "Variant.Kazy" + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Win32/Brontok.W" + "Worm" + "Brontok.FE" + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Trojan.Loadmoney.1" + "trojan" + "LMclicker.1" + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Win32Dircrypt.Trojan.Ransom.ABZ" + "ransomeware" + "Trojan.Ransom" + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/TrojanWin32.Duqu.Stuxnet" + "botnet" + "Trojan.Win32.Duqu.Aoq ." + "unknown" + "unknown" + + + + "bin" + "00/00/0000" + "x86" + + + "Binaries/Win32.Botnet.Stuxnet.B" + "apt" + "Stuxnet Duqu" + "Realtek Signed B" + "Unknown" + + + + "bin" + "00/00/2007" + "x86" + + + "Binaries/Win32.Botnet.Stuxnet.A" + "apt" + "Stuxnet Duqu" + "C-Media Electronics Incorporation Signature - A" + "Unknown" + + + + "bin" + "00/00/2009" + "x86" + + + "Binaries/Skywiper-A.Flame" + "apt" + "Skywiper AKA Flame" + "A" + "Unknown" + + + + "bin" + "00/00/2012" + "x86" + + + "Binaries/Careto_Feb2014" + "apt" + "Careto aka The Mask" + "A" + "Unknown" + + + + "bin" + "15/02/2014" + "x86" + + + "Binaries/ZeusGamever_Feb2014" + "botnet" + "Zeus" + "Gamever" + "Unknown" + + + + "bin" + "19/02/2014" + "x86" + + + "Binaries/Android.Spy.49_iBanking_Feb2014" + "botnet" + "Android Spy 29" + "Banking Version" + "Unknown" + + + + "apk" + "19/02/2014" + "arm" + + + "Binaries/Win32.Cridex" + "worm" + "Cridex" + "B" + "Unknown" + + + + "bin" + "00/02/2014" + "x86" + + \ No newline at end of file diff --git a/conf/db.ver b/conf/db.ver index d74565a..a4c7eb1 100644 --- a/conf/db.ver +++ b/conf/db.ver @@ -1 +1 @@ -190220141439 \ No newline at end of file +092715032014 \ No newline at end of file diff --git a/conf/index.csv b/conf/index.csv index c66dd5f..ed3416a 100644 --- a/conf/index.csv +++ b/conf/index.csv @@ -1,49 +1,54 @@ -1,Source/Original/Dokan_Dec2008/Dokan_Dec2008,botnet,Dokan,unknown,unknown,c,00/12/2008,x86,win32 -3,Source/Original/ShadowBotv3_March2007/ShadowBotv3_March2007,botnet,ShadowBot,3,unknown,cpp,03/2007,x86,win32 -4,Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004,botnet,rBot,0.3.3,unknown,cpp,00/05/2004,x86,win32 -5,Source/Original/ZeuS2.0.8.9_Feb2013/ZeuS2.0.8.9_Feb2013,botnet,ZeuS,2.0.8.9,unknown,c,02/2013,x86,win32 -6,Source/Original/X0R-USB_Jan2009/X0R-USB_Jan2009,virus,X0R-USB-Virus,unknown,unknown,c,00/01/2009,x86,win32 -7,Source/Original/LoexBot1.3_Sep2008/LoexBot1.3_Sep2008,botnet,LoexBot,1.3,unknown,cpp,00/09/2008,x86,win32 -8,Source/Original/ZunkerBot1.4.5_Sep2007/ZunkerBot1.4.5_Sep2007,botnet,ZunkerBot,1.4.5,unknown,php,09/2007,x86,win32 -9,Source/Original/DopeBotv0.22_UnCrippled_Feb2007/DopeBotv0.22_UnCrippled_Feb2007,botnet,DopeBot-UnCrippled,0.22,unknown,cpp,00/02/2007,x86,win32 -10,Source/Original/vbBot_Jan2007/vbBot_Jan2007,botnet,vbBot,unknown,unknown,vb,01/2007,x86,win32 -11,Source/Original/xTBot0.0.2_2Feb2002/xTBot0.0.2_2Feb2002,botnet,xTBot,0.0.2,unknown,cpp,02/2002,x86,win32 -12,Source/Original/VBS.Win32.Vabian/VBS.Win32.Vabian,VBS-Worm,VBS.Win32.Vabian,botnet,unknown,vb,unknown,x86,win32 -13,Source/Original/DopeBotv0.22_CrippledFeb2007/DopeBotv0.22_CrippledFeb2007,botnet,DopeBot-Crippled,0.22,unknown,cpp,00/02/2007,x86,win32 -14,Source/Original/Win32.MiniPig_Nov2006/Win32.MiniPig_Nov2006,Worm,Win32.MiniPig,virus,unknown,c,00/11/2006,x86,win32 -15,Source/Original/HellBotv3.0_10June2005/HellBotv3.0_10June2005,botnet,Hellbot,3.0,unknown,cpp,00/06/2005,x86,win32 -16,Source/Original/Win32.ogw0rm_Nov2008/Win32.ogw0rm_Nov2008,Worm,Win32.ogwOrm,unknown,unknown,cpp,00/11/2008,x86,win32 -17,Source/Original/DopeBot.B_Dec2004/DopeBot.B_Dec2004,botnet,DopeBot.B,unknown,unknown,cpp,00/12/2004,x86,win32 -18,Source/Original/LiquidBot_May2005/LiquidBot_May2005,botnet,LiquidBot,unknown,unknown,cpp,00/05/2005,x86,win32 -19,Source/Original/SpazBot2.12_June2007/SpazBot2.12_June2007,botnet,SpazBot,2.12,unknown,vb,00/06/2007,x86,win32 -20,Source/Original/DBotv3.1_March2007/DBotv3.1_March2007,botnet,DBot,3.1,unknown,c,00/03/2007,x86,win32 -21,Source/Original/CyberBotv2.2_October2006/CyberBotv2.2_October2006,botnet,CyberBot,2.2,unknown,cpp,00/10/2006,x86,win32 -22,Source/Original/DopeBot.A_Dec2004/DopeBot.A_Dec2004,botnet,DopeBot.A,unknown,unknown,cpp,00/12/2004,x86,win32 -23,Source/Original/MyDoom.A_Jan2004/MyDoom.A_Jan2004,virus,MyDoom.A,unknown,unknown,c,00/01/2004,x86,win32 -24,Source/Original/ShadowBot_Sep2008/ShadowBot_Sep2008,botnet,ShadowBot,unknown,unknown,cpp,00/09/2008,x86,win32 -25,Binaries/CryptoLocker20Nov2013/CryptoLocker20Nov2013,ransomeware,CryptoLocker,Unknown,Unknown,bin,20/12/2013,x86,win32 -26,Binaries/CryptoLocker_10Sep2013/CryptoLocker_10Sep2013,ransomeware,CryptoLocker,Unknown,Unknown,bin,10/12/2013,x86,win32 -27,Binaries/IllusionBot_May2007/IllusionBot_May2007,botnet,Illusion Bot,Unknown,Unknown,bin,00/05/2007,x86,win32 -28,Source/Original/NBot_July2008/NBot_July2008,botnet,nBot,0.32,Unknown,c,00/05/2008,x86,win32 -29,Binaries/Trojan.Dropper.Gen/Trojan.Dropper.Gen,trojan,Dropper,Unknown,Unknown,bin,00/01/2014,x86,win32 -30,Binaries/Trojan.NSIS.Win32/Trojan.NSIS.Win32,trojan,NSIS,Unknown,Unknown,bin,00/01/2014,x86,win32 -31,Binaries/Trojan.Win32.Bechiro.BCD/Trojan.Win32.Bechiro.BCD,trojan,Bechiro,BCD,Unknown,bin,00/01/2014,x86,win32 -32,Binaries/AndroRat_6Dec2013/AndroRat_6Dec2013,botnet,AndroRat,Dec2013,Unknown,java,06/12/2013,x86,win32 -33,Binaries/CryptoLocker_22Jan2014/CryptoLocker_22Jan2014,ransomeware,CryptoLocker,Jan2014,Unknown,bin,22/01/2014,x86,win32 -34,Binaries/njRAT-v0.6.4/njRAT-v0.6.4,botnet,njRAT,0.6.4,Unknown,bin,00/09/2013,x86,win32 -35,Binaries/ZeusBankingVersion_26Nov2013/ZeusBankingVersion_26Nov2013,botnet,Zeus - zBot,Nov2013,Unknown,bin,23/11/2013,x86,win32 -36,Source/Original/NullBot_Dec2006/NullBot_Dec2006,botnet,NullBot,Dec2006,Unknown,cpp,00/12/2006,x86,win32 -37,Binaries/Artemis,trojan,Artemis,Unknown,Unknown,bin,00/00/0000,x86,win32 -38,Binaries/Somoto,apt,Somoto,unknown,unknown,bin,00/00/0000,x86,win32 -39,Binaries/Variant.Kazy,trojan,Variant.Kazy,unknown,unknown,bin,00/00/0000,x86,win32 -40,Binaries/Win32/Brontok.W,Worm,Brontok.FE ,unknown,unknown,bin,00/00/0000,x86,win32 -41,Binaries/Trojan.Loadmoney.1,trojan,LMclicker.1,unknown,unknown,bin,00/00/0000,x86,win32 -42,Binaries/Win32Dircrypt.Trojan.Ransom.ABZ,ransomeware,Trojan.Ransom,unknown,unknown,bin,00/00/0000,x86,win32 -43,Binaries/TrojanWin32.Duqu.Stuxnet,botnet,Trojan.Win32.Duqu.Aoq .,unknown,unknown,bin,00/00/0000,x86,win32 -45,Binaries/Win32.Botnet.Stuxnet.B,apt,Stuxnet Duqu,Realtek Signed B,Unknown,bin,00/00/2007,x86,win32 -44,Binaries/Win32.Botnet.Stuxnet.A,apt,Stuxnet Duqu,C-Media Electronics Incorporation Signature - A,Unknown,bin,00/00/2009,x86,win32 -46,Binaries/Skywiper-A.Flame,apt,Skywiper AKA Flame,A,Unknown,bin,00/00/2012,x86,win32 -47,Binaries/Careto_Feb2014,apt,Careto aka The Mask,A,Unknown,bin,15/02/2014,x86,win32 -48,Binaries/ZeusGamever_Feb2014,botnet,Zeus,Gamever,Unknown,bin,19/02/2014,x86,win32 -49,Binaries/Android.Spy.49_iBanking_Feb2014,botnet,Android Spy 29,Banking Version,Unknown,apk,19/02/2014,arm,android -50,Binaries/Win32.Cridex,worm,Cridex,B,Unknown,bin,00/02/2014,x86,win32 \ No newline at end of file +1,Source/Original/Dokan_Dec2008/Dokan_Dec2008,botnet,Dokan,unknown,unknown,c,00/12/2008,x86,win32,0 +3,Source/Original/ShadowBotv3_March2007/ShadowBotv3_March2007,botnet,ShadowBot,3,unknown,cpp,03/2007,x86,win32,0 +4,Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004,botnet,rBot,0.3.3,unknown,cpp,00/05/2004,x86,win32,0 +5,Source/Original/ZeuS2.0.8.9_Feb2013/ZeuS2.0.8.9_Feb2013,botnet,ZeuS,2.0.8.9,unknown,c,02/2013,x86,win32,1 +6,Source/Original/X0R-USB_Jan2009/X0R-USB_Jan2009,virus,X0R-USB-Virus,unknown,unknown,c,00/01/2009,x86,win32,0 +7,Source/Original/LoexBot1.3_Sep2008/LoexBot1.3_Sep2008,botnet,LoexBot,1.3,unknown,cpp,00/09/2008,x86,win32,0 +8,Source/Original/ZunkerBot1.4.5_Sep2007/ZunkerBot1.4.5_Sep2007,botnet,ZunkerBot,1.4.5,unknown,php,09/2007,x86,win32,0 +9,Source/Original/DopeBotv0.22_UnCrippled_Feb2007/DopeBotv0.22_UnCrippled_Feb2007,botnet,DopeBot-UnCrippled,0.22,unknown,cpp,00/02/2007,x86,win32,0 +10,Source/Original/vbBot_Jan2007/vbBot_Jan2007,botnet,vbBot,unknown,unknown,vb,01/2007,x86,win32,0 +11,Source/Original/xTBot0.0.2_2Feb2002/xTBot0.0.2_2Feb2002,botnet,xTBot,0.0.2,unknown,cpp,02/2002,x86,win32,0 +12,Source/Original/VBS.Win32.Vabian/VBS.Win32.Vabian,VBS-Worm,VBS.Win32.Vabian,botnet,unknown,vb,unknown,x86,win32,0 +13,Source/Original/DopeBotv0.22_CrippledFeb2007/DopeBotv0.22_CrippledFeb2007,botnet,DopeBot-Crippled,0.22,unknown,cpp,00/02/2007,x86,win32,0 +14,Source/Original/Win32.MiniPig_Nov2006/Win32.MiniPig_Nov2006,Worm,Win32.MiniPig,virus,unknown,c,00/11/2006,x86,win32,0 +15,Source/Original/HellBotv3.0_10June2005/HellBotv3.0_10June2005,botnet,Hellbot,3.0,unknown,cpp,00/06/2005,x86,win32,0 +16,Source/Original/Win32.ogw0rm_Nov2008/Win32.ogw0rm_Nov2008,Worm,Win32.ogwOrm,unknown,unknown,cpp,00/11/2008,x86,win32,0 +17,Source/Original/DopeBot.B_Dec2004/DopeBot.B_Dec2004,botnet,DopeBot.B,unknown,unknown,cpp,00/12/2004,x86,win32,0 +18,Source/Original/LiquidBot_May2005/LiquidBot_May2005,botnet,LiquidBot,unknown,unknown,cpp,00/05/2005,x86,win32,0 +19,Source/Original/SpazBot2.12_June2007/SpazBot2.12_June2007,botnet,SpazBot,2.12,unknown,vb,00/06/2007,x86,win32,0 +20,Source/Original/DBotv3.1_March2007/DBotv3.1_March2007,botnet,DBot,3.1,unknown,c,00/03/2007,x86,win32,0 +21,Source/Original/CyberBotv2.2_October2006/CyberBotv2.2_October2006,botnet,CyberBot,2.2,unknown,cpp,00/10/2006,x86,win32,0 +22,Source/Original/DopeBot.A_Dec2004/DopeBot.A_Dec2004,botnet,DopeBot.A,unknown,unknown,cpp,00/12/2004,x86,win32,0 +23,Source/Original/MyDoom.A_Jan2004/MyDoom.A_Jan2004,virus,MyDoom.A,unknown,unknown,c,00/01/2004,x86,win32,0 +24,Source/Original/ShadowBot_Sep2008/ShadowBot_Sep2008,botnet,ShadowBot,unknown,unknown,cpp,00/09/2008,x86,win32,0 +25,Binaries/CryptoLocker20Nov2013/CryptoLocker20Nov2013,ransomeware,CryptoLocker,Unknown,Unknown,bin,20/12/2013,x86,win32,1 +26,Binaries/CryptoLocker_10Sep2013/CryptoLocker_10Sep2013,ransomeware,CryptoLocker,Unknown,Unknown,bin,10/12/2013,x86,win32,1 +27,Binaries/IllusionBot_May2007/IllusionBot_May2007,botnet,Illusion Bot,Unknown,Unknown,bin,00/05/2007,x86,win32,0 +28,Source/Original/NBot_July2008/NBot_July2008,botnet,nBot,0.32,Unknown,c,00/05/2008,x86,win32,0 +29,Binaries/Trojan.Dropper.Gen/Trojan.Dropper.Gen,trojan,Dropper,Unknown,Unknown,bin,00/01/2014,x86,win32,0 +30,Binaries/Trojan.NSIS.Win32/Trojan.NSIS.Win32,trojan,NSIS,Unknown,Unknown,bin,00/01/2014,x86,win32,0 +31,Binaries/Trojan.Win32.Bechiro.BCD/Trojan.Win32.Bechiro.BCD,trojan,Bechiro,BCD,Unknown,bin,00/01/2014,x86,win32,0 +32,Binaries/AndroRat_6Dec2013/AndroRat_6Dec2013,botnet,AndroRat,Dec2013,Unknown,java,06/12/2013,x86,win32,0 +33,Binaries/CryptoLocker_22Jan2014/CryptoLocker_22Jan2014,ransomeware,CryptoLocker,Jan2014,Unknown,bin,22/01/2014,x86,win32,1 +34,Binaries/njRAT-v0.6.4/njRAT-v0.6.4,botnet,njRAT,0.6.4,Unknown,bin,00/09/2013,x86,win32,0 +35,Binaries/ZeusBankingVersion_26Nov2013/ZeusBankingVersion_26Nov2013,botnet,Zeus - zBot,Nov2013,Unknown,bin,23/11/2013,x86,win32,1 +36,Source/Original/NullBot_Dec2006/NullBot_Dec2006,botnet,NullBot,Dec2006,Unknown,cpp,00/12/2006,x86,win32,0 +37,Binaries/Artemis,trojan,Artemis,Unknown,Unknown,bin,00/00/0000,x86,win32,0 +38,Binaries/Somoto,apt,Somoto,unknown,unknown,bin,00/00/0000,x86,win32,0 +39,Binaries/Variant.Kazy,trojan,Variant.Kazy,unknown,unknown,bin,00/00/0000,x86,win32,0 +40,Binaries/Win32/Brontok.W,Worm,Brontok.FE ,unknown,unknown,bin,00/00/0000,x86,win32,1 +41,Binaries/Trojan.Loadmoney.1,trojan,LMclicker.1,unknown,unknown,bin,00/00/0000,x86,win32,0 +42,Binaries/Win32Dircrypt.Trojan.Ransom.ABZ,ransomeware,Trojan.Ransom,unknown,unknown,bin,00/00/0000,x86,win32,0 +43,Binaries/TrojanWin32.Duqu.Stuxnet,botnet,Trojan.Win32.Duqu.Aoq .,unknown,unknown,bin,00/00/0000,x86,win32,1 +45,Binaries/Win32.Botnet.Stuxnet.B,apt,Stuxnet Duqu,Realtek Signed B,Unknown,bin,00/00/2007,x86,win32,1 +44,Binaries/Win32.Botnet.Stuxnet.A,apt,Stuxnet Duqu,C-Media Electronics Incorporation Signature - A,Unknown,bin,00/00/2009,x86,win32,1 +46,Binaries/Skywiper-A.Flame,apt,Skywiper AKA Flame,A,Unknown,bin,00/00/2012,x86,win32,1 +47,Binaries/Careto_Feb2014,apt,Careto aka The Mask,A,Unknown,bin,15/02/2014,x86,win32,0 +48,Binaries/ZeusGamever_Feb2014,botnet,Zeus,Gamever,Unknown,bin,19/02/2014,x86,win32,1 +49,Binaries/Android.Spy.49_iBanking_Feb2014,botnet,Android Spy 29,Banking Version,Unknown,apk,19/02/2014,arm,android,0 +50,Binaries/Win32.Cridex,worm,Cridex,B,Unknown,bin,00/02/2014,x86,win32,0 +51,Binaries/Win32.Alina.3.4.B,apt,Alina,3.4B,Unknown,bin,15.3.2014,x86,win32,1 +52,Binaries/Win32.Boaxxe.BB,botnet,Boaxxe,BB,Unknown,bin,15.3.2014,x86,win32,0 +53,Binaries/Win32.Infostealer.Dexter,botnet,Dexter,Unknown,Unknown,bin,15.3.2014,x86,win32,0 +54,Binaries/Win32.Caphaw.Shylock,botnet,Shylock,Unknown,Unknown,bin,15.3.2014,x86,win32,1 +55,Binaries/Win32.Turla,apt,Torola\Urubus rootkit,Unknown,Russia,bin,15.3.2014,x86,win32,1 \ No newline at end of file diff --git a/imports/globals.py b/imports/globals.py index 44df3db..34650e0 100644 --- a/imports/globals.py +++ b/imports/globals.py @@ -41,6 +41,8 @@ class init: column_for_uid = 0 column_for_arch = 8 column_for_plat = 9 + column_for_vip = 10 + conf_folder = 'conf' eula_file = conf_folder + '/eula_run.conf' maldb_ver_file = conf_folder + '/db.ver' @@ -77,6 +79,7 @@ class vars: column_for_uid = 0 column_for_arch = 8 column_for_plat = 9 + column_for_vip = 10 conf_folder = 'conf' eula_file = conf_folder + '/eula_run.conf' diff --git a/imports/manysearches.py b/imports/manysearches.py index 8c63eba..312f9bf 100644 --- a/imports/manysearches.py +++ b/imports/manysearches.py @@ -18,10 +18,11 @@ class MuchSearch(object): print "\nPayloads Found:" array = m i = 0 - print "ID\tType\t\tLang\tArch\tPlat\tName" - print '---\t-----\t\t-----\t----\t-----\t----------------' + print "ID\tVIP\tType\t\tLang\tArch\tPlat\tName" + print '---\t---\t-----\t\t-----\t----\t-----\t----------------' for element in array: answer = array[i][globals.vars.column_for_uid] + answer = array[i][globals.vars.column_for_vip] answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_type])) answer += '\t%s' % ('{0: <12}'.format(array[i][globals.vars.column_for_pl])) answer += array[i][globals.vars.column_for_arch] + '\t' diff --git a/imports/terminal_handler.py b/imports/terminal_handler.py index fe42389..51f6f53 100644 --- a/imports/terminal_handler.py +++ b/imports/terminal_handler.py @@ -23,7 +23,7 @@ class Controller: self.searchmeth = [ ("arch","which architecture etc; x86, x64, arm7 so on..."), ("plat","platform: win32, win64, mac, android so on..."), ("lang","c, cpp, vbs, bin so on..."), - ("","")] + ("vip", "1 or 0")] self.modules = self.GetPayloads() @@ -32,7 +32,7 @@ class Controller: self.arch = '' self.lang = '' self.type = '' - + self.vip = '' def GetPayloads(self): m = [] @@ -77,6 +77,8 @@ class Controller: ar = manySearch.sort(ar, globals.vars.column_for_pl, self.lang) if len(self.type) > 0: ar = manySearch.sort(ar, globals.vars.column_for_type, self.type) + if len(self.vip) > 0: + ar = manySearch.sort(ar, globals.vars.column_for_vip, self.vip) printController = manysearches.MuchSearch() printController.PrintPayloads(ar) self.MainMenu() diff --git a/malware-db.py b/malware-db.py old mode 100644 new mode 100755 diff --git a/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.md5 b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.md5 new file mode 100644 index 0000000..5055c0a --- /dev/null +++ b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.md5 @@ -0,0 +1 @@ +6ec4bb6df9ddd7a59734b79b96271327 Win32.Alina.3.4.B.zip diff --git a/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.pass b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.pass new file mode 100644 index 0000000..ba701bf --- /dev/null +++ b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.sha256 b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.sha256 new file mode 100644 index 0000000..94d4ce3 --- /dev/null +++ b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.sha256 @@ -0,0 +1 @@ +d584d876e3b4706066cebab7c5459d9c80a0a9a7fd095e509832dc685221401b Win32.Alina.3.4.B.zip diff --git a/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.zip b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.zip new file mode 100644 index 0000000..be124f9 Binary files /dev/null and b/malwares/Binaries/Win32.Alina.3.4.B/Win32.Alina.3.4.B.zip differ diff --git a/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.md5 b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.md5 new file mode 100644 index 0000000..6b94850 --- /dev/null +++ b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.md5 @@ -0,0 +1 @@ +9c6a1317b6ddf6c11ec34f3e3240b3c7 Win32.Boaxxe.BB.zip diff --git a/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.pass b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.pass new file mode 100644 index 0000000..ba701bf --- /dev/null +++ b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.sha256 b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.sha256 new file mode 100644 index 0000000..8995ca0 --- /dev/null +++ b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.sha256 @@ -0,0 +1 @@ +947ae5e40254363d6bdf8007a5aaffe43a8fc43c5ae4608192c9ea248459baca Win32.Boaxxe.BB.zip diff --git a/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.zip b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.zip new file mode 100644 index 0000000..5065bc2 Binary files /dev/null and b/malwares/Binaries/Win32.Boaxxe.BB/Win32.Boaxxe.BB.zip differ diff --git a/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.pass b/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.pass new file mode 100644 index 0000000..ba701bf --- /dev/null +++ b/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.zip b/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.zip new file mode 100644 index 0000000..2a4f8b4 Binary files /dev/null and b/malwares/Binaries/Win32.Caphaw.Shylock/Win32.Caphaw.Shylock.zip differ diff --git a/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.md5 b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.md5 new file mode 100644 index 0000000..0a6e933 --- /dev/null +++ b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.md5 @@ -0,0 +1 @@ +bd7bad534d1e5a2ad6c11829b96a23e4 Win32.Infostealer.Dexter.zip diff --git a/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.pass b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.pass new file mode 100644 index 0000000..ba701bf --- /dev/null +++ b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.sha256 b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.sha256 new file mode 100644 index 0000000..bbe4c34 --- /dev/null +++ b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.sha256 @@ -0,0 +1 @@ +282032b31c4cbaa9110cf95e9f3a838788301bcb4be1a3e9f13d39a737f322e6 Win32.Infostealer.Dexter.zip diff --git a/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.zip b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.zip new file mode 100644 index 0000000..0598d21 Binary files /dev/null and b/malwares/Binaries/Win32.Infostealer.Dexter/Win32.Infostealer.Dexter.zip differ diff --git a/malwares/Binaries/Win32.Turla/Win32.Turla.md5 b/malwares/Binaries/Win32.Turla/Win32.Turla.md5 new file mode 100644 index 0000000..9cb3678 --- /dev/null +++ b/malwares/Binaries/Win32.Turla/Win32.Turla.md5 @@ -0,0 +1 @@ +92f70259f6667fe26bd52d2156ffec9a Win32.Turla.rar diff --git a/malwares/Binaries/Win32.Turla/Win32.Turla.pass b/malwares/Binaries/Win32.Turla/Win32.Turla.pass new file mode 100644 index 0000000..ba701bf --- /dev/null +++ b/malwares/Binaries/Win32.Turla/Win32.Turla.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Binaries/Win32.Turla/Win32.Turla.rar b/malwares/Binaries/Win32.Turla/Win32.Turla.rar new file mode 100644 index 0000000..e3b41a7 Binary files /dev/null and b/malwares/Binaries/Win32.Turla/Win32.Turla.rar differ diff --git a/malwares/Binaries/Win32.Turla/Win32.Turla.sha256 b/malwares/Binaries/Win32.Turla/Win32.Turla.sha256 new file mode 100644 index 0000000..3e11043 --- /dev/null +++ b/malwares/Binaries/Win32.Turla/Win32.Turla.sha256 @@ -0,0 +1 @@ +538167744e9225bea9aa75648d79584ae597ec943f6e451a36bdcf7c7e313388 Win32.Turla.rar diff --git a/mdbv0.2/maldb_0.2.py b/mdbv0.2/maldb_0.2.py old mode 100644 new mode 100755