Meet ProPack Exploit Pack - yes that's a lot of pack

Initial ProPack Exploit Pack announcement (20-10-2012)

Text:
------------------------------------------


------------------------------------------
translated by google as :
------------------------------------------

ProPack exploit pack - a professional bunch of rent on your server.

And so, we are pleased to introduce a new product in the market - ProPack exploit pack.

"Everyone chooses for themselves something of his own: who is checkered, and who is going ...
We can not boast of creative design, ease of interface, additional gadgets.
Minimalist in design, high performance and test - the key points on which we focused in creating our product.

The main features of our product:

The highest-performance:
Buffer technology, all-consuming operations are performed in batch mode, the post-processing
use the fastest today SypexGeo instead MaxMind GeoIP to determine the country of the visitor
technology independent threads - no need to introduce an additional parameter, and run on the basis of

High-breaking, due to:
highest performance issue
Small file size and sployty neresursoemkim js Krypto
modern set of exploits:

java aio - java all in one or 3 exploit java atomic, java byte, java 7 in one. jar file (do not forget about the fifth branch of Java)
libtiff - exploit for Adobe Reader 8-9 branches
collab - exploit for Adobe Reader 6-7 branches
printf - an exploit for Adobe Reader 7.1.0
mdac - good old exploit that still gives a certain breaking traffic

-Simultaneous multiple injection test. Exe files one thread *:
java exploits and mdac were specifically rewritten to provide this opportunity
can be loaded at least 10 ekze both the main thing that they all managed to Resume

* Pdf exp while this feature is not supported

-Threading
pour traffic into multiple streams and ship each thread its ekze file / multiple files simultaneously ekze

-Flexible Licensing
licensing system based on license keys, get the key for 1 day, week, month or year, you can use a bunch
on the server upon which the license key was first pressed for a time frame of which was issued this license key

-The system of automatic purge
just click ReFUD in admin and all the threads are loaded bundles clean files

-Do not weep sployty: double check before issuing java (js + uag), version check before issuing a pdf

PRICES:

$ 80 per day
$ 480 per week
$ 1800 per month

TEST:

10k traffic - $ 20

Limit:

150k cores per day
Large amounts of cores per day / withdrawal limits discussed separately

Simultaneously to lease-only 7 seats.
Looking for a permanent partner and to find 7 people fall under this criterion - we leave in private.

Contacts:

ICQ: 646143773
Jabber: propack@neko.im

------------------------------------------

Yesterday it was announced that domain auto-rotation will soon leave test mode for production :



Text:
------------------------------------------
------------------------------------------
translated by google (and fixed by @aelsmartin )
------------------------------------------
2-3 days domain-autorotation will operate mainly (not test) mode.
------------------------------------------

And now let's see infection tree...

CVE-2012-5076 Boom...

Announced same week as all others

ProPack announced as incorporating CVE-2012-5076

So...no surprise :

CVE-2012-5076 path on ProPack EP (and Ransomware getting his clothes)

GET http://37.9.53.83/build2/serge/hxkwlqdoky.php 200 OK (text/html)
GET http://37.9.53 .83/build2/serge/hxkwlqdoky.php 200 OK (text/html)
GET http://37.9.53 .83/build2/serge/92fq59.php?j=1&k=1 200 OK (application/octet-stream)

CVE-2012-5076 in the Jar

CVE-2012-4681 Boom...

CVE-2012-4681 positive path and a new  Ransomware design for botnets.fr ( Adneukine looks like a variant of Lyposit )

Out of scope : The Adneukine ransomware 508496feb09432521008902946b33d82
http://dl.dropbox.com/u/106864056/508496FEB09432521008902946B33D82.zip

CVE-2012-4681 in ProPack EP jar

CVE-2012-0507 Boom...

CVE-2012-0507 positive path on ProPack

CVE-2012-1723 (seems safe?)

CVE-2012-1723 looks like an untrapped path on the ProPack

CVE-2010-0188 Boom...

CVE-2012-0188 (AR 9.3.0) in ProPack

Pdf :  32adc9115dedb6e0e9945da2d34f8baa
http://wepawet.iseclab.org/view.php?hash=32adc9115dedb6e0e9945da2d34f8baa&type=js (escaped)


CVE-2006-0003 MDAC Boom...

CVE-2006-0003 MDAC positive path on ProPack

Landing :

One landing code

after some Malzilla manipulation : http://pastebin.com/TKJjfQZf

One ProPack landing deobfuscated

Files: