Malcreant's av-trackers online.....

General Topics
1

Hi malware fighters,

Just a couple of days ago a website for malcreants went online to protect their maliicous creations against analysis and research from av-vendors. AV Tracker publishes informationm on automated analysis systems used by av analysts. The malcreant uploads a file to the av coder’s system and waits for execution. This file then “rings home” with additional system information that could be used to blacklist av IP addresses.
The collected information is then published at “AV Tracker”, exposing information about the analysis systems. Besides some well-known AV companies, also CWSandbox and Anubis were affected.

We analyzed the binary and found that it sends a simply HTTP request, in which all extracted information is encoded. An example for an analysis report generated by one of the samples is http://anubis.iseclab.org/?action=result&task_id=361b5a8ee7235954252b02d33b3a7d24. This can be defeated by blocking access to the reporting server or by regularly changing the IP address of the analysis systems, but at the end this will be some kind of arms race again.

At the moment lists were made for Bitdefender, Kaspersky, VirusTotal and ThreatExpert. According to the maker of AV Tracker the IP-lists can also be used for launching an anti-AV DDoS-attack.

A similar malcreant initiative was launched here: http://tra.cker.mobi/

polonus (malware fighter)

2

The link to anubis is giving a blank page with ‘Database error.’

So perhaps they are doing some maintenance work there or being attacked or the URL is wrong ???

3

and just now got this update : http://threatpost.com/en_us/blogs/black-hat-loses-control-102209

nmb

4

Hi DavidR,

I think anubis is certainly crippled at the mo and they are measuring up the damage done to them. Go to the other link and see what they are seeking out to sneak on, well even personal malware analysts are taken into consideration, they come listed with the malcreant’s.

On the other hand one of our other great analyst’s sites is back on, good news, so the arms race is on.
Good that I am in the right camp…with the malware fighters,

polonus (malware fighter)