senrath
2011-10-31 22:34:55
So, I just got this email(attached), and I was wondering if anyone else has heard about this bot before.
SRL Archive - Senior News and General
Botting.in.RS website?
Iron Man
2011-10-31 22:43:38
Sounds like a phishing site…
senrath
2011-10-31 22:45:42
Yeah, that's what I figured. Downloaded the "bot" to see what it was like. The file is 32.1 KB. Oh, and when decompiled, it has the class name of "evilrsstealerclient".
Unfortunately, it's obfuscated, and I have neither the time or knowledge to deobfuscate it and see what it's really doing.
Unfortunately, it's obfuscated, and I have neither the time or knowledge to deobfuscate it and see what it's really doing.
Iron Man
2011-10-31 23:55:33
Yeah, it's definitely not a real botting client then. ;)
Hobbit
2011-11-01 00:40:46
lol at the "replyto: [email]impsoft@love.com[/email]"
n3ss3s
2011-11-02 22:16:34
It's a phishing site, and the malicious part of the file is called RSStealer, which pretty much decrypts and sends out your botfiles, not sure if it also has a keylogger…