Reveton's design refreshed - Winter 2015

"Snipshot" of the Reveton DK design :)

Those days Reveton is mainly pushed  on adult traffic via "standalone"CVE-2015-0311 flash (posing as advert) calling an Xtea encoded stream.

After not far from 2 years with the same design it's now showing some fresh clothes.
This might be connected with Green Dot’s decision to stop selling MoneyPak Cards

Here in one image :

Reveton all in one 2015-02-05 Bigger : http://i.imgur.com/rtt1Iue.jpg

Here is the USA and default one (when your country has no specific one)

Reveton - US - 2015-02 (without MoneyPak)

Sample provided at the end of the post.
Launched that way :
%systemroot%\\system32\\rundll32.exe  C:\DOCUME~1\ALLUSE~1\APPLIC~1\7BCB6BAED.cpp,work

Startup shortcut properties

Reveton phone home 2015-02-05

Reveton - AT - 2015-02

Reveton - AU - 2015-02

Reveton - CA - 2015-02