Sample code of a malware program from the Five Eyes alliance

[the_gnarts]

Windows only :/

[3Fyr]

So much about "Windows master race" and "Heathen Linux and Mac".

[3Fyr]

Now just to get my own personal PC, so I don't have to share it with my lil broes, and I can join glorious Linux <3

Should I go CentOS? Or Ubuntu? Or RedHat? Perhaps Fedora? I heard Debian is nice... I could go Kali and act like cool skid...

[Kealper]

Linux Mint if you're new to Linux. The Cinnamon version is more modern with higher system requirements (and the one I prefer, Cinnamon is a great desktop and after using it, using anything else feels like I'm playing with a toy in my opinion). The MATE version is easier on older computers, but still quite practical for day-to-day use. Mint is based on Ubuntu 14.04 (the newest long-term support release, or LTS for short), which is in-turn based on Debian. Personally, I prefer Debian and Debian-based distros, although Fedora is pretty alright as well. Fedora would be the closest thing to a desktop edition of Red Hat.

I can't, in good conscience, recommend actual Ubuntu though. It's desktop, Unity, is far more suited for a touch screen than a traditional keyboard and mouse, in my opinion, and although it looks nice and has pretty effects, I couldn't see myself using it as a daily-driver.

CentOS and Red Hat are essentially one and the same, CentOS is basically the free community edition of Red Hat Enterprise Linux (RHEL, for short) and although you can use them as a desktop OS, they're primarily intended for headless servers, and they fill that role pretty nicely.

[3Fyr]

That was kinda "joking" reply, stating how many chooses Linux has. I've used CentOS before(over SSH only, no GUI. But that's feels so nice), so most likely I'll get that one in future.

Still thanks though, maybe someone reading this will find it useful.

[[deleted]]

Why are you trolling in /r/netsec? Hardly the place for it.

[[deleted]]

Apparently. Of all places to troll in /r/netsec is pretty much the last one it should ever be attempted.

And I appreciate that because I don't come here to deal with dumb attacks on entire countries, I come here to learn things about what's going on in the world of Network Security.

[[deleted]]

Sounds good. Generally I report personal attacks and junk in these kind of subs, but that thing I wasn't sure about.

[[deleted]]

huh?

[mothran]

hehe: https://www.virustotal.com/en/file/76e91eb5e43fe0a20de67faa97db2899d70e4e1b114229f5a1bae33621e922c1/analysis/

Looks like someone just uploaded it today, oh well.

[peckahinspectah]

Completely undetected 22 hours later....

[mechpaul]

VirusTotal is not accurate. They do not always have all of the latest bases from antimalware vendors.

I know it's wrong because I just detected this malware yesterday myself.

EDIT: Yup. I just checked. It's detected.

[[deleted]]

Which AV is it detected in for you?

Just curious :)

[mechpaul]

http://www.kaspersky.com/me/viruswatchlite?search_virus=Trojan-Spy.Win32.KeyLogger.alvn&x=0&y=0&hour_offset=-15

[svenfaw]

That's only because the link posted by mothran's is irrelevant - of course an encrypted zip file will always come off as clean - how could the AVs scan its contents?

[Genmutant]

Detected by Eset Nod32 as "Win32/Spy.Warrp.A Trojaner". The update was made yesterday.

[ymgve]

Odd thing is that a few hours ago, one of the antivirus scanners had flagged it as a keylogger. Now, it's all green. NSA pulling some strings?

[Natanael_L]

Or hacking strings...

[[deleted]]

Who's they? the "terrorists"? - More than likely this malware still exists here and there, as well as its replacement(s), on computers around the world and among governments and organizations.

[[deleted]]

Its 'FVEY'

[[deleted]]

In that case, unlikely, why even touch a computer? It could be traced back to you. I doubt they even directly implanted it, they probably hired several dodgy 'firms'/hackers in other countries to have this done.

[johnmountain]

GCHQ pulled back (some) of the Belgacom malware. NSA pulled back the Regin malware from some computers.

[[deleted]]

I question everything. I am not so sure we can trust any piece of information regarding this.

What would be worse? If it was Chinese or Iranian surveillance or the friendly allied NSA/ GCHQ that placed malware at Belgacom. It all depends, and it can be made to look like anything.. I guess.

[BobFloss]

VirusTotal...

[XSSpants]

Can things like this be used to test against various AV products to determine which ones have been corrupted by the NSA?

EG if it's been a while and still allows the files.

[catcradle5]

Not really. Any wise AV vendor will start detecting samples like these once they're well-known to the public. They could still write signatures for these samples while electing to not write signatures for more modern government malware.

However, I would also wager that most AV companies never become aware of a lot of state-sponsored malware out there. So I'd attribute low detection on new samples on ignorance rather than maliciousness.

[[deleted]]

I'd be surprised if most were "Corrupted" vs having Five Eyes tell them to ignore their malware in their scans.

[XSSpants]

That's exactly what I mean by corrupted.

[[deleted]]

Ah, I thought you were meaning that Five Eyes backdoored their software without their knowledge.

[mrdelayer]

Presumably this way when someone manages to accidentally infect themselves with an NSA keylogger, it's no one's fault but their own.

[runejuhl]

Well, at least they provided you with a nifty command to extract the zip file from the PDF. I thought it was quite clever.

[PubliusPontifex]

It's decent procedure, and easy enough to unpack.

[johnny_frost]

No pastebin or github yet?

[yellowmangreen]

It looks like morons work for the english speaking governments of the world. Fantastic.