5 ms·
Source for CARBANAK backdoor leaked and placed on GitHub
- phoe-krk 8y agoDetails: https://www.fireeye.com/blog/threat-research/2019/04/carbanak-week-part-one-a-rare-occurrence.html https://www.fireeye.com/blog/threat-research/2019/04/carbana...
- lxe 8y agoBest way to learn Russian is to reverse engineer a virus.
- ianhawes 8y ago"Leaked" in this case refers to the fact that 2 RAR archives were uploaded to Virus Total. Certain security researchers are bestowed access to VT raw uploads.
- swiley 8y agoSome hashes are different? what is that about?
- huntermeyer 8y agoTranslated some RU sentences to EN. It's in the README.
- rolph 8y agoif the hash changes [because you append KILROY WAS HERE into a readmefile] then the file cant be tracked as easily. this technique usually involves large padding structures so file size isnt an easy clue to the new file hash. Its a way of evading filters and packet sniffers so the file get from A to B without C stomping on it.
- jc091480 8y agoYou put it on one of these sites and you tip off the creator.
- philpem 8y agoAnd security researchers around the world can poke at it and figure out how to defend against it and derivatives. Another day, another better mousetrap.
- hrdwdmrbl 8y agoWhat's the backstory?
- xs 8y agoCarbanak is a piece of malware originally used to rob banks in Ukraine and Russia by jackpotting ATMs and changing the account balances. Since then the malware has lived on to be used to target US companies such as Chipotle, Ruby Tuesday, Baja Fresh, casinos and so many more. This malware was held tight by the hackers and not shared but now, you can have it too. The podcast Darknet Diaries Ep 35 does a good job explaining it. Very fascinating.
- Nanocurrency 8y agoWhat is ATM jackpotting? https://whatis.techtarget.com/definition/ATM-jackpotting https://whatis.techtarget.com/definition/ATM-jackpotting
- hrdwdmrbl 8y agoOH I listen to that podcast. I'll re-listen to that one :)
- atemerev 8y ago...and it will be gone really soon, grab it while you can. This thing was really dangerous; it is great that it is now available for researchers. From a quick look to the code it looks professional and no obvious WTFs are there. However, it is strange that comments in Russian are all in Cp1251, while Visual Studio supports UTF-8 from long ago. Perhaps the old project, and authors never bothered to convert it?