Meta tags:
description=A security blog provides notes, programming and interesting finding, malware analysis and related.;

Headings (most frequently used words):

2014, wednesday, thursday, june, february, of, greendispenser, pages, september, 30, 2015, 12, april, march, 13, 19, saturday, friday, 21, 2013, search, facebook, twitter, blog, archive, subscribe, collection, atm, malware, samples, full, sha, 256, hash, list, tweetdeck, xss, vulnerability, cause, user, auto, retweet, heartbleed, may, broken, your, heart, as, data, leaks, dendroidbot, quick, analysis, countdown, to, windows, xp, end, support, apachebench, behind, the, encoded, vbe, file, python, basic, virustotal, uploader, ploutos, suceful, tyupkin, neopocket, download, from, google, drive, references, update,

Text of the page (most frequently used words):
the (32), share (22), file (19), this (18), com (16), #heartbleed (15), and (13), your (12), #malware (10), virustotal (10), comments (9), https (9), september (8), 2014 (8), facebook (8), email (8), with (8), april (7), alternat0r (7), labels (7), analysis (7), pinterest (7), blogthis (7), posted (7), kamil (7), alta (7), that (7), for (7), you (7), www (7), read (7), from (7), http (7), june (6), atm (6), greendispenser (6), can (6), its (6), windows (6), test (6), user (6), november (5), february (5), samples (5), quick (5), sample (5), encoded (5), will (5), has (5), website (5), bug (5), xss (5), tweetdeck (5), post (5), posts (4), january (4), march (4), may (4), blog (4), not (4), vbe (4), use (4), some (4), been (4), phone (4), here (4), sms (4), messages (4), retweet (4), atom (3), august (3), october (3), december (3), 2015 (3), twitter (3), just (3), key (3), get (3), sys (3), argv (3), mfile (3), content (3), around (3), below (3), called (3), wednesday (3), protected (3), version (3), access (3), network (3), text (3), vulnerable (3), honeynet (3), filippo (3), message (3), vulnerability (3), openssl (3), download (3), tyupkin (3), 2006 (2), data0 (2), net (2), loading (2), all (2), subscribe (2), july (2), 2013 (2), collection (2), home (2), about (2), python (2), code (2), public (2), api (2), import (2), postfile (2), main (2), inputfile (2), host (2), selector (2), fields (2), file_to_send (2), open (2), files (2), json (2), play (2), see (2), what (2), name (2), got (2), script (2), shown (2), binary (2), into (2), vbs (2), svchost (2), exe (2), run (2), most (2), already (2), program (2), apachebench (2), web (2), although (2), saturday (2), end (2), support (2), countdown (2), apk (2), dendroid (2), make (2), thanks (2), give (2), once (2), java (2), also (2), running (2), list (2), recent (2), other (2), apps (2), modify (2), system (2), full (2), call (2), mms (2), thursday (2), malaysia (2), webserver (2), org (2), how (2), protect (2), yourself (2), github (2), references (2), causing (2), library (2), cause (2), affected (2), only (2), yang (2), pada (2), example (2), click (2), update (2), hash (2), feel (2), free (2), ploutos (2), research (2), threat (2), password (2), copyright, 2021, powered, blogger, 2004, 2005, 2007, 2008, 2009, 2010, 2011, 2012, archive, tweets, search, older, tools, little, note, submitting, reminded, handling, error, properly, reference, replace, own, getopt, def, vtapi, scan, apikey, post_multipart, print, __name__, __main__, basic, uploader, friday, recently, received, friend, looks, suspicious, request, manage, inside, s64, 0b826d9869b139b2c5bb139234c08d43, which, size, 608, 904, bytes, decode, output, decoded, vbscript, picture, scroll, bottom, kind, converted, ascii, format, within, save, disk, antivirus, product, detect, malicious, 333abc2f9864b70f7ef48b049cba9286, command, line, utility, first, place, measure, performance, servers, correctly, responsive, sometimes, possible, tool, ddos, attack, 6b01071c7936d4a1ba1f53b5651db5f604dfe7f5aa3e4ed38d48f6ba66eebd5e, malwr, yzkznduxotlmotqxndaxymewnjdmngi4mtk5yjbmyzi, 1a8cbf4acb5944d1856d04d4e72b8ed7, scriptdecode, jean, luc, antoine, behind, english, microsoft, products, lifecycle, clocks, android, decided, db01f96d5e66d82f7eb61b85eb96ef6e, 52a30b58257d338617a39643e2216d0c, original, extra, protection, appeared, obfuscated, when, decompiling, following, permission, used, installed, analyzed, class, determine, emulator, there, are, many, functionality, would, able, completely, spy, going, through, classes, initiate, load, pre, defined, configuration, base64, detection, earlier, might, found, bind, application, seem, legitimate, 099a57328de9335c524f44514e225d50731c808145221affdd684d8b4dad5a1d, storage, settings, prevent, sleeping, retrieve, view, connections, find, accounts, device, delete, contents, card, bookmarks, history, contacts, log, precise, location, gps, based, record, audio, take, pictures, videos, send, receive, edit, reroute, outgoing, calls, status, identity, directly, numbers, dexguard, mila, parkour, dendroidbot, ssl, alternatively, good, advice, cnet, news, filosottile, gist, harlo, 10199638, provide, like, image, giving, several, critical, organisation, exposed, including, government, cve, 0160, million, trouble, developed, valsorda, release, source, btw, actually, cryptography, any, memory, dalam, bahasa, malaysianya, adalah, kelemahan, terdapat, kriptografi, perisian, membolehkan, pengguna, luar, membaca, sistem, memori, terjejas, versi, tertentu, sahaja, broken, heart, data, leaks, one, somebody, new, thousand, automatically, browser, far, time, happened, server, temporarily, down, awhile, fixing, 40k, retweeted, done, poping, auto, viruses, banko, latest, related, keep, have, more, leave, comment, thank, add, another, n3r0, securelist, 66988, manipulating, machines, proofpoint, insight, meet, fireeye, suceful_next_genera, html, ask, prefer, alternator99, gmail, zip, google, drive, 85652bbd0379d73395102edc299c892f21a4bba3378aa3b0aaea9b1130022bdd, neopocket, 3639e8cc463922b427ea20dce8f237c0c0e82aa51d2502c48662e60fb405f677, 853fb4e85d8b0ad7c156ad6d3fc4b0340c8b29fa0548a3df758e7845ba8b23ae, 639d2d926325275cb023014d0b446d03f1dcc8526bff1aa72373e27d78a6a674, 8bb5c766de0a73dc0eff7c9fce086565b6220465185e258c21c5b9dfb0bef51d, 6c59cd1e12bc1037031af48b934e9398fc85efb2a067d03b6a100dd8423e5d9b, 16166533c69f2f04110e8b8e9cc45ed2aeaf7850fa68845c64d92ff907dd44f0, b670fe2d803705f811b5a0c9e69ccfec3a6c3a31cfd42a30d9e8902af7b9ed80, d33d69b454efba519bffd3ba63c99ffce058e3105745f8a7ae699f72db1e70eb, c7cb44e0b075cbc90a7c280ef8f1c69e8fe06e7dabce054b61b10c3105eda1c4, suceful, d99339d3dc6891cdd832754c5739640c62cd229c84e04e9e3cad743c6f66b1b9, 34acc4c0b61b5ce0b37c3589f97d1f23e6d84011a241e6f85683ee517ce786f1, 0df8ac0440a151fac1f6957f7d181640590e1eb3e4c4cbd9968892e59f34f941, 0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025, b7e61f65e147885ec1fe6a787b62d9ee82d1f34f1c9ba8068d3570adca87c54f, 77850f738ba42fd9da299b2282314709ad8dc93623b318b116bfc25c5280c541, 7544e7a798b791cb36caaa1860974f33d30bc4659ceab3063d1ab4fd71c8c7e0, 50db1f5e9692f217f356a592e413e6c9cb31105a94efc70a5ca1c2c73d95d572, 20a1490b666f8c75c47b682cf10a48b7b0278068cb260b14d8d0584ee6c006a5, sha, 256, faq, contact, pages, security,

Text of the page (random words):
data0 net security blog pages home about contact faq twitter alternat0r wednesday september 30 2015 collection of atm malware greendispenser samples here you can download the latest atm malware called greendispenser and other related to atm malware i will keep update on it if you have more samples and and hash feel free to leave a comment thank you full sha 256 hash list greendispenser 20a1490b666f8c75c47b682cf10a48b7b0278068cb260b14d8d0584ee6c006a5 50db1f5e9692f217f356a592e413e6c9cb31105a94efc70a5ca1c2c73d95d572 7544e7a798b791cb36caaa1860974f33d30bc4659ceab3063d1ab4fd71c8c7e0 77850f738ba42fd9da299b2282314709ad8dc93623b318b116bfc25c5280c541 b7e61f65e147885ec1fe6a787b62d9ee82d1f34f1c9ba8068d3570adca87c54f ploutos 0106757fac9d10a8e2a22dce5337f404bfa1c44d3cc0c53af3c7539888bc4025 0df8ac0440a151fac1f6957f7d181640590e1eb3e4c4cbd9968892e59f34f941 34acc4c0b61b5ce0b37c3589f97d1f23e6d84011a241e6f85683ee517ce786f1 d99339d3dc6891cdd832754c5739640c62cd229c84e04e9e3cad743c6f66b1b9 suceful c7cb44e0b075cbc90a7c280ef8f1c69e8fe06e7dabce054b61b10c3105eda1c4 d33d69b454efba519bffd3ba63c99ffce058e3105745f8a7ae699f72db1e70eb tyupkin b670fe2d803705f811b5a0c9e69ccfec3a6c3a31cfd42a30d9e8902af7b9ed80 16166533c69f2f04110e8b8e9cc45ed2aeaf7850fa68845c64d92ff907dd44f0 6c59cd1e12bc1037031af48b934e9398fc85efb2a067d03b6a100dd8423e5d9b 8bb5c766de0a73dc0eff7c9fce086565b6220465185e258c21c5b9dfb0bef51d 639d2d926325275cb023014d0b446d03f1dcc8526bff1aa72373e27d78a6a674 853fb4e85d8b0ad7c156ad6d3fc4b0340c8b29fa0548a3df758e7845ba8b23ae 3639e8cc463922b427ea20dce8f237c0c0e82aa51d2502c48662e60fb405f677 neopocket 85652bbd0379d73395102edc299c892f21a4bba3378aa3b0aaea9b1130022bdd download from google drive click here to download password protected zip feel free to ask for the password prefer email at alternator99 at gmail com references https www fireeye com blog threat research 2015 09 suceful_next_genera html https www proofpoint com us threat insight post meet greendispenser https securelist com blog research 66988 tyupkin manipulating atm machines with malware update add another 5 tyupkin and 4 ploutos samples thanks to n3r0 for the samples posted by kamil alta at 11 53 am no comments email this blogthis share to x share to facebook share to pinterest labels atm banko greendispenser malware viruses virustotal thursday june 12 2014 tweetdeck xss vulnerability cause user auto retweet as i m one of the tweetdeck user somebody has post new xss on twitter causing thousand of user automatically retweet the xss script message this is only affected on tweetdeck on browser so far an example of post has been retweet an example of xss message poping up once user click ok it will retweet the post by the time this is happened tweetdeck server temporarily down for awhile for fixing and 40k of retweeted post has been done alternat0r posted by kamil alta at 1 01 am no comments email this blogthis share to x share to facebook share to pinterest labels tweetdeck xss wednesday april 9 2014 heartbleed may broken your heart as data leaks recent openssl bug called heartbleed cve 2014 0160 causing million of website in trouble heartbleed test developed by filippo valsorda has been release as open source i just give some play around with heartbleed btw what is heartbleed bug heartbleed bug is actually vulnerability on openssl cryptography library that cause any user to read system memory affected on vulnerable version only dalam bahasa malaysianya ia adalah kelemahan yang terdapat pada library kriptografi perisian openssl yang membolehkan pengguna luar membaca sistem memori terjejas pada versi tertentu sahaja as i giving test to several malaysia website most critical organisation website exposed to this vulnerability including government filippo also provide a website for you to test your webserver and if it is vulnerable you will get message like image below alternatively you can access to malaysia honeynet heartbleed website to test your webserver http heartbleed honeynet org my here some good advice how to protect yourself from heartbleed bug http www cnet com news how to protect yourself from the heartbleed bug references http heartbleed com https github com filosottile heartbleed http filippo io heartbleed http heartbleed honeynet org my https gist github com harlo 10199638 alternat0r posted by kamil alta at 7 03 pm no comments email this blogthis share to x share to facebook share to pinterest labels heartbleed ssl vulnerable thursday march 13 2014 dendroidbot quick analysis as i get the sample of dendroid apk malware i decided to make quick analysis on it thanks to mila parkour for the sample db01f96d5e66d82f7eb61b85eb96ef6e 52a30b58257d338617a39643e2216d0c the original sample is protected with dexguard to give extra protection on its code as its will appeared to be obfuscated when decompiling the following permission can be used once it has been installed directly call phone numbers read phone status and identity reroute outgoing calls edit your text messages sms or mms read your text messages sms or mms receive text messages sms send sms messages take pictures and videos record audio precise location gps and network based read call log read your contacts read your web bookmarks and history modify or delete the contents of your sd card find accounts on the device full network access view network connections retrieve running apps prevent phone from sleeping modify system settings test access to protected storage as we analyzed the java class its also can determine if its running on emulator or not there are many functionality that would be able to completely spy your phone as we going through its java classes initiate load pre defined configuration with base64 encoded here from virustotal detection list https www virustotal com en file 099a57328de9335c524f44514e225d50731c808145221affdd684d8b4dad5a1d analysis although this sample is an earlier version of dendroid some user might already found recent version of it bind with other application to make it seem legitimate apps alternat0r posted by kamil alta at 11 44 am no comments email this blogthis share to x share to facebook share to pinterest labels android apk malware wednesday february 19 2014 countdown to windows xp end of support the end of windows xp support will be on saturday 8 april 2014 countdown clocks http windows microsoft com en us windows products lifecycle posted by kamil alta at 7 54 pm no comments email this blogthis share to x share to facebook share to pinterest labels english windows xp saturday february 1 2014 apachebench behind the encoded vbe file recently i received a vbe file from a friend that looks suspicious with its encoded content and request to do quick analysis on it so i manage to play around with it and see what s inside the file name that i got is s64 vbe 0b826d9869b139b2c5bb139234c08d43 which is an encoded script file content the size of this file is around 608 904 bytes the content of the encoded file is shown below to decode this file i use scriptdecode vbs from jean luc antoine the output of the decoded file is a vbscript as shown in the picture below if we scroll to the bottom of the file we can see this is some kind of windows binary file that is converted into ascii format within vbs the file svchost exe is the file name use to save into the disk and run it most of antivirus product is already detect this file as malicious https malwr com analysis yzkznduxotlmotqxndaxymewnjdmngi4mtk5yjbmyzi share 1a8cbf4acb5944d1856d04d4e72b8ed7 https www virustotal com en file 6b01071c7936d4a1ba1f53b5651db5f604dfe7f5aa3e4ed38d48f6ba66eebd5e analysis the svchost exe 333abc2f9864b70f7ef48b049cba9286 file is a program called apachebench command line utility at first place this program use to measure performance test of http web servers although the binary file that i got is not correctly run as it not responsive sometimes it is possible to use this tool as ddos attack alternat0r posted by kamil alta at 1 13 am no comments email this blogthis share to x share to facebook share to pinterest labels malware vbe friday june 21 2013 python basic virustotal uploader just my little quick note about submitting malware sample to virustotal com be reminded that this python code is not handling an error properly just for quick reference import postfile import sys getopt def main argv inputfile sys argv 1 host www virustotal com mfile inputfile selector https www virustotal com vtapi v2 file scan fields apikey your public api key file_to_send open mfile rb read files file mfile file_to_send json postfile post_multipart host selector fields files print json if __name__ __main__ main sys argv 1 you can replace the your public api key with your own key get it at virustotal com alternat0r posted by kamil alta at 12 22 pm no comments email this blogthis share to x share to facebook share to pinterest labels analysis tools virustotal older posts home subscribe to posts atom search facebook twitter tweets by alternat0r blog archive 2015 1 september 1 collection of atm malware greendispenser samples 2014 5 june 1 april 1 march 1 february 2 2013 2 june 1 february 1 2012 11 november 2 september 1 august 3 may 3 april 1 january 1 2011 9 december 3 november 1 april 3 february 1 january 1 2010 17 december 1 november 2 october 1 september 2 august 1 july 1 june 1 may 3 april 2 march 2 january 1 2009 17 november 2 october 2 september 1 june 1 may 2 april 2 march 3 january 4 2008 11 december 8 november 2 september 1 2007 1 october 1 2006 1 july 1 2005 3 september 3 2004 7 september 6 august 1 subscribe posts atom posts all comments atom all comments loading loading copyright 2006 2021 data0 net powered by blogger