Extracted

• rbot_netapi_vnc_ipswitch.rar

  .rar

  Password: infected

• rbot_netapi_vnc_ipswitch/Bin/reptile.exe

  .exe windows x86

  Password: infected

  9b55aa4609e6e98ebe1940ddefd1b771

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ws2_32

  WSAStartup

  gethostbyname

  htons

  socket

  connect

  recv

  send

  closesocket

  WSACleanup

  user32

  wsprintfA

  IsCharAlphaNumericA

  oleaut32

  GetErrorInfo

  msvcrt

  wcsncpy

  _CxxThrowException

  __dllonexit

  _onexit

  _exit

  _XcptFilter

  exit

  _wcsupr

  __getmainargs

  _initterm

  __setusermatherr

  _adjust_fdiv

  __p__commode

  __p__fmode

  __set_app_type

  _except_handler3

  ??1type_info@@UAE@XZ

  _controlfp

  fopen

  fseek

  ftell

  fread

  fclose

  strtoul

  atoi

  _strlwr

  wcsncmp

  strrchr

  system

  mbstowcs

  wcslen

  wcscpy

  printf

  __CxxFrameHandler

  strstr

  strcat

  strcpy

  malloc

  free

  memcmp

  strcmp

  sscanf

  memcpy

  srand

  strncpy

  strtok

  memset

  rand

  _snprintf

  strlen

  sprintf

  strncat

  wcscat

  fwrite

  _vsnprintf

  _iob

  fprintf

  _splitpath

  strchr

  ??2@YAPAXI@Z

  _strcmpi

  toupper

  _acmdln

  kernel32

  CopyFileA

  GetStartupInfoA

  GetSystemDirectoryW

  GetProcessHeap

  HeapFree

  HeapAlloc

  GetWindowsDirectoryA

  GetFileTime

  SetFileTime

  GetFileAttributesA

  LocalAlloc

  LocalFree

  CreateMutexA

  ReleaseMutex

  CompareStringW

  VirtualFree

  VirtualAlloc

  DuplicateHandle

  CreateFileW

  GetFileSize

  ReadFile

  MoveFileW

  GetWindowsDirectoryW

  GetSystemDirectoryA

  ExpandEnvironmentStringsA

  lstrlenA

  lstrcmpA

  lstrcpynA

  lstrcpyA

  lstrcatA

  GetCurrentThread

  GetCurrentProcess

  TerminateProcess

  OpenProcess

  SetFileAttributesA

  DeleteFileA

  GetModuleHandleA

  GetProcAddress

  LoadLibraryA

  GetLocaleInfoA

  TerminateThread

  CreateProcessA

  GetVersionExA

  WaitForSingleObject

  GetTempPathA

  ExitProcess

  WriteFile

  CreateFileA

  TransactNamedPipe

  CloseHandle

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetLastError

  ExitThread

  GetTickCount

  GetModuleFileNameA

  CreateThread

  Sleep

  lstrcmpiA

  Sections

  .text

  Size: 61KB - Virtual size: 61KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 27KB - Virtual size: 385KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• rbot_netapi_vnc_ipswitch/Driver/Driver.cpp
• rbot_netapi_vnc_ipswitch/Driver/Driver.dsp
• rbot_netapi_vnc_ipswitch/Driver/Driver.dsw
• rbot_netapi_vnc_ipswitch/Driver/Driver.h
• rbot_netapi_vnc_ipswitch/Driver/Driver.ncb
• rbot_netapi_vnc_ipswitch/Driver/Driver.opt
• rbot_netapi_vnc_ipswitch/Driver/Driver.plg

  .html
• rbot_netapi_vnc_ipswitch/Driver/Jiurl_PortHide.cpp
• rbot_netapi_vnc_ipswitch/Driver/Jiurl_PortHide.h
• rbot_netapi_vnc_ipswitch/Driver/Jiurl_tcpioctl.h
• rbot_netapi_vnc_ipswitch/Driver/ProcessName.c
• rbot_netapi_vnc_ipswitch/Driver/ProcessName.h
• rbot_netapi_vnc_ipswitch/Driver/Release/Driver.pch
• rbot_netapi_vnc_ipswitch/Driver/Release/vc60.idb
• rbot_netapi_vnc_ipswitch/Driver/Release/vc60.pdb
• rbot_netapi_vnc_ipswitch/Driver/Rootkit.cpp
• rbot_netapi_vnc_ipswitch/Driver/Rootkit.h
• rbot_netapi_vnc_ipswitch/Driver/ioctlcmd.h
• rbot_netapi_vnc_ipswitch/Extras/encrypt.exe

  .exe windows x86

  Password: infected

  d37c06b7a012aae518363f1da9c49f07

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mfc42

  ord4998

  ord4710

  ord2514

  ord6052

  ord4078

  ord1775

  ord4407

  ord5241

  ord2385

  ord5163

  ord6374

  ord4353

  ord5280

  ord3798

  ord4837

  ord4441

  ord2648

  ord2055

  ord6376

  ord3749

  ord5065

  ord1727

  ord5261

  ord2446

  ord2124

  ord5277

  ord2982

  ord3147

  ord3259

  ord4465

  ord3136

  ord3262

  ord2985

  ord3081

  ord2976

  ord3830

  ord3831

  ord3825

  ord3079

  ord4080

  ord4627

  ord4425

  ord3597

  ord324

  ord825

  ord641

  ord4234

  ord4673

  ord4274

  ord6375

  ord4486

  ord2554

  ord2512

  ord5731

  ord3922

  ord4853

  ord5199

  ord2396

  ord3346

  ord5300

  ord5302

  ord2725

  ord4079

  ord4698

  ord5307

  ord5289

  ord5714

  ord4622

  ord4424

  ord3738

  ord561

  ord815

  ord616

  ord609

  ord800

  ord2621

  ord2575

  ord4396

  ord3574

  ord2411

  ord2023

  ord4218

  ord2578

  ord6055

  ord1776

  ord4398

  ord5290

  ord3402

  ord3582

  ord1146

  ord1168

  ord860

  ord540

  ord567

  ord2298

  ord2289

  ord2370

  ord2302

  ord1768

  ord2379

  ord755

  ord470

  ord6334

  ord6199

  ord2614

  ord858

  ord922

  ord2818

  ord5572

  ord2915

  ord4160

  ord4376

  ord1089

  ord5265

  ord1576

  msvcrt

  exit

  _acmdln

  __getmainargs

  _initterm

  __setusermatherr

  _adjust_fdiv

  __p__commode

  _XcptFilter

  __set_app_type

  _except_handler3

  _controlfp

  strtok

  atoi

  __CxxFrameHandler

  _setmbcp

  _exit

  _onexit

  __dllonexit

  _snprintf

  __p__fmode

  sprintf

  kernel32

  GetModuleHandleA

  GetStartupInfoA

  user32

  SystemParametersInfoA

  GetSystemMetrics

  GetClientRect

  DrawIcon

  SendMessageA

  LoadIconA

  EnableWindow

  IsIconic

  msvcp60

  ??1Init@ios_base@std@@QAE@XZ

  ??0_Winit@std@@QAE@XZ

  ??1_Winit@std@@QAE@XZ

  ??0Init@ios_base@std@@QAE@XZ

  Sections

  .text

  Size: 8KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 4KB - Virtual size: 412B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 32KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• rbot_netapi_vnc_ipswitch/Extras/reptile.txt
• rbot_netapi_vnc_ipswitch/Extras/vnc.cpp
• rbot_netapi_vnc_ipswitch/advscan.cpp
• rbot_netapi_vnc_ipswitch/advscan.h
• rbot_netapi_vnc_ipswitch/banner.cpp
• rbot_netapi_vnc_ipswitch/banner.h
• rbot_netapi_vnc_ipswitch/commands.cpp
• rbot_netapi_vnc_ipswitch/commands.h
• rbot_netapi_vnc_ipswitch/configs.h
• rbot_netapi_vnc_ipswitch/configss.h
• rbot_netapi_vnc_ipswitch/crypt.cpp
• rbot_netapi_vnc_ipswitch/crypt.h
• rbot_netapi_vnc_ipswitch/dcom.cpp
• rbot_netapi_vnc_ipswitch/dcom.h
• rbot_netapi_vnc_ipswitch/defines.h
• rbot_netapi_vnc_ipswitch/download.cpp
• rbot_netapi_vnc_ipswitch/download.h
• rbot_netapi_vnc_ipswitch/driveinfo.cpp
• rbot_netapi_vnc_ipswitch/driveinfo.h
• rbot_netapi_vnc_ipswitch/externs.h
• rbot_netapi_vnc_ipswitch/fphost.cpp
• rbot_netapi_vnc_ipswitch/fphost.h
• rbot_netapi_vnc_ipswitch/ftpd.cpp
• rbot_netapi_vnc_ipswitch/ftpd.h
• rbot_netapi_vnc_ipswitch/fu.cpp

  .js
• rbot_netapi_vnc_ipswitch/fu.h
• rbot_netapi_vnc_ipswitch/fudll.h
• rbot_netapi_vnc_ipswitch/functions.h
• rbot_netapi_vnc_ipswitch/includes.h
• rbot_netapi_vnc_ipswitch/info.cpp
• rbot_netapi_vnc_ipswitch/info.h
• rbot_netapi_vnc_ipswitch/ioctlcmd.h
• rbot_netapi_vnc_ipswitch/ipswitch.cpp
• rbot_netapi_vnc_ipswitch/ipswitch.h
• rbot_netapi_vnc_ipswitch/irc.cpp
• rbot_netapi_vnc_ipswitch/irc.h
• rbot_netapi_vnc_ipswitch/keylog.cpp
• rbot_netapi_vnc_ipswitch/loaddlls.cpp
• rbot_netapi_vnc_ipswitch/loaddlls.h
• rbot_netapi_vnc_ipswitch/lsass.cpp
• rbot_netapi_vnc_ipswitch/lsass.h
• rbot_netapi_vnc_ipswitch/ms04-007.cpp
• rbot_netapi_vnc_ipswitch/ms04-007.h
• rbot_netapi_vnc_ipswitch/ms05-039.cpp
• rbot_netapi_vnc_ipswitch/ms05-039.h
• rbot_netapi_vnc_ipswitch/mssql.cpp
• rbot_netapi_vnc_ipswitch/mssql.h
• rbot_netapi_vnc_ipswitch/navicopa.cpp
• rbot_netapi_vnc_ipswitch/navicopa.h
• rbot_netapi_vnc_ipswitch/netapi.cpp
• rbot_netapi_vnc_ipswitch/netapi.h
• rbot_netapi_vnc_ipswitch/netapi2.cpp
• rbot_netapi_vnc_ipswitch/netapi2.h
• rbot_netapi_vnc_ipswitch/netbios.cpp
• rbot_netapi_vnc_ipswitch/netbios.h
• rbot_netapi_vnc_ipswitch/netdde.cpp
• rbot_netapi_vnc_ipswitch/netdde.h
• rbot_netapi_vnc_ipswitch/netstatp.cpp
• rbot_netapi_vnc_ipswitch/netstatp.h
• rbot_netapi_vnc_ipswitch/netutils.cpp
• rbot_netapi_vnc_ipswitch/netutils.h
• rbot_netapi_vnc_ipswitch/passwd.h
• rbot_netapi_vnc_ipswitch/pnp.cpp
• rbot_netapi_vnc_ipswitch/pnp.h
• rbot_netapi_vnc_ipswitch/processes.cpp
• rbot_netapi_vnc_ipswitch/processes.h
• rbot_netapi_vnc_ipswitch/protocol.cpp
• rbot_netapi_vnc_ipswitch/protocol.h
• rbot_netapi_vnc_ipswitch/pstore.cpp
• rbot_netapi_vnc_ipswitch/pstore.h
• rbot_netapi_vnc_ipswitch/pstorec.tlh
• rbot_netapi_vnc_ipswitch/pstorec.tli
• rbot_netapi_vnc_ipswitch/redirect.cpp
• rbot_netapi_vnc_ipswitch/redirect.h
• rbot_netapi_vnc_ipswitch/regcontrol.cpp
• rbot_netapi_vnc_ipswitch/regcontrol.h
• rbot_netapi_vnc_ipswitch/replace.h
• rbot_netapi_vnc_ipswitch/reptile.cpp

  .vbs
• rbot_netapi_vnc_ipswitch/reptile.dsp
• rbot_netapi_vnc_ipswitch/reptile.dsw
• rbot_netapi_vnc_ipswitch/reptile.h
• rbot_netapi_vnc_ipswitch/reptile.ncb
• rbot_netapi_vnc_ipswitch/reptile.opt
• rbot_netapi_vnc_ipswitch/reptile.plg

  .html
• rbot_netapi_vnc_ipswitch/reptile.sln
• rbot_netapi_vnc_ipswitch/reptile.suo
• rbot_netapi_vnc_ipswitch/reptile.vcproj

  .xml
• rbot_netapi_vnc_ipswitch/reptilepass.txt
• rbot_netapi_vnc_ipswitch/secure.cpp
• rbot_netapi_vnc_ipswitch/secure.h
• rbot_netapi_vnc_ipswitch/service.cpp
• rbot_netapi_vnc_ipswitch/service.h
• rbot_netapi_vnc_ipswitch/sniffer.cpp
• rbot_netapi_vnc_ipswitch/sniffer.h
• rbot_netapi_vnc_ipswitch/socks4.cpp
• rbot_netapi_vnc_ipswitch/socks4.h
• rbot_netapi_vnc_ipswitch/speedtest.cpp
• rbot_netapi_vnc_ipswitch/speedtest.h
• rbot_netapi_vnc_ipswitch/strings.h
• rbot_netapi_vnc_ipswitch/stub.exe
• rbot_netapi_vnc_ipswitch/svchost.cpp
• rbot_netapi_vnc_ipswitch/svchost.h
• rbot_netapi_vnc_ipswitch/tcpip.h
• rbot_netapi_vnc_ipswitch/thcsql.cpp
• rbot_netapi_vnc_ipswitch/thcsql.h
• rbot_netapi_vnc_ipswitch/threads.cpp
• rbot_netapi_vnc_ipswitch/threads.h
• rbot_netapi_vnc_ipswitch/tibco.cpp
• rbot_netapi_vnc_ipswitch/tibco.h
• rbot_netapi_vnc_ipswitch/utility.cpp

  .js
• rbot_netapi_vnc_ipswitch/utility.h
• rbot_netapi_vnc_ipswitch/vnc.cpp
• rbot_netapi_vnc_ipswitch/vnc.h
• rbot_netapi_vnc_ipswitch/vscan.cpp
• rbot_netapi_vnc_ipswitch/vscan.h
• rbot_netapi_vnc_ipswitch/vscandef.h
• rbot_netapi_vnc_ipswitch/wfp-readme.txt
• rbot_netapi_vnc_ipswitch/wfp.cpp

  .vbs
• rbot_netapi_vnc_ipswitch/wfp.h
• rbot_netapi_vnc_ipswitch/win2k139.h
• rbot_netapi_vnc_ipswitch/win2k445.h
• rbot_netapi_vnc_ipswitch/windows-2000sp2-pnp445.h
• rbot_netapi_vnc_ipswitch/wins.cpp
• rbot_netapi_vnc_ipswitch/wins.h
• rbot_netapi_vnc_ipswitch/wkssvc.cpp
• rbot_netapi_vnc_ipswitch/wkssvc.h