{"id":6120,"date":"2012-02-25T14:32:32","date_gmt":"2012-02-25T21:32:32","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=6120"},"modified":"2018-10-05T10:48:44","modified_gmt":"2018-10-05T16:48:44","slug":"a-peek-inside-the-ann-malware-loader","status":"publish","type":"post","link":"https://www.webroot.com/blog/2012\/02\/25\/a-peek-inside-the-ann-malware-loader\/","title":{"rendered":"A peek inside the Ann Malware Loader"},"content":{"rendered":"<p>The ever-adapting cybercrime ecosystem is constantly producing new underground releases in the form of malware loaders, remote access trojans (RATs), malware cryptors, Web, IRC and P2P based command and control interfaces, all with the clear objective \u00a0to undermine current security solutions.<\/p>\n<p>Continuing the &#8220;A peek inside&#8230;&#8221; series, in this post I will profile a malware loader recently advertised within the cybercrime ecosystem , namely, the Ann Malware Loader.<\/p>\n<p><!--more--><\/p>\n<p>Some of the key features of teh Ann Malware Loader include:<\/p>\n<ul>\n<li>Supporting\u00a0tasks:\u00a0as\u00a0it\u00a0downloads, such\u00a0as\u00a0country, etc.<\/li>\n<li>The sequence\u00a0of tasks<\/li>\n<li>Ability to\u00a0edit and rearrange\u00a0every way\u00a0the job\u00a0sits.<\/li>\n<li>The small size of\u00a0the build,\u00a0only 14\u00a0kb<\/li>\n<li>The program is written\u00a0on pure\u00a0API<\/li>\n<li>Ability to\u00a0control\u00a0loads on the\u00a0bots, and\u00a0selection in\u00a0the white\u00a0zone<\/li>\n<li>AnnLoad\u00a0got\u00a0stable, fast, easy, secure\u00a0admin panel.<\/li>\n<li>The control panel\u00a0does NOT\u00a0even\u00a0store your password\u00a0in the config, only\u00a0cache!<\/li>\n<li>The algorithm\u00a0AnnLoad\u00a0does not contain anything\u00a0that could\u00a0interfere with\u00a0the crypt (service mode, tls, etc &#8230;)<\/li>\n<\/ul>\n<p>The flexible pricing list:<\/p>\n<ul>\n<li>Minimum:\u00a0Loader\u00a0no\u00a0free upgrades\u00a0&#8211; $\u00a0330.<\/li>\n<li>Standard:\u00a0Loader\u00a0+ months\u00a0of free upgrades\u00a0&#8211; $\u00a0380.<\/li>\n<li>Bronze:\u00a0Loader\u00a0+ 3 months\u00a0free upgrades\u00a0Free\u00a0rebild\u00a0+ 1\u00a0&#8211; $\u00a0480.<\/li>\n<li>Silver:\u00a0Loader\u00a0+\u00a0months\u00a0of free updates\u00a0+\u00a02 free\u00a0rebilda\u00a0&#8211; $\u00a0530.<\/li>\n<li>Gold:\u00a0Loader\u00a0+ free\u00a0upgrade\u00a0forever\u00a0+\u00a05% discount\u00a0on our\u00a0products +\u00a05 free\u00a0rebildov\u00a0+ module\u00a0to choose\u00a0a gift\u00a0&#8211; $\u00a0630.<\/li>\n<li>Platinum:\u00a0Loader\u00a0+\u00a0Update +\u00a0free\u00a025% discount\u00a0on our products\u00a0rebildy\u00a0+ free\u00a0+\u00a02 modules\u00a0to choose\u00a0a gift\u00a0&#8211; $\u00a0725.<\/li>\n<li>\u00a0Diamond:\u00a0Loader\u00a0+ Free\u00a0updates\u00a0+\u00a0Free\u00a0unlimited\u00a0rebildy\u00a0without limitation\u00a0+\u00a030% discount on\u00a0all\u00a0our\u00a0products +\u00a0plug-ins\u00a0as a gift.\u00a0=\u00a0$ 825<\/li>\n<li>Upgrades\u00a0&#8211; $\u00a035-85\u00a0(depending on the\u00a0importance of\u00a0the upgrade).<\/li>\n<li>ReBuild (change\u00a0URL) &#8211; $\u00a035.<\/li>\n<li>Sources &#8211;\u00a0discussed separately.<\/li>\n<li>New\u00a0function &#8211;\u00a0is discussed separately.<\/li>\n<\/ul>\n<div>Includes password-grabbing feature covering the following programs:<\/div>\n<div>\n<ul>\n<li>Fxp (ftp)<\/li>\n<li>Total commander (ftp)<\/li>\n<li>Filezilla (ftp)<\/li>\n<li>Wsftp (ftp)<\/li>\n<li>Mozilla Firefox (web, forms)<\/li>\n<li>Opera (web, forms, ftp)<\/li>\n<li>CuteFTP (ftp)<\/li>\n<li>Qip2005 (icq)<\/li>\n<li>Qip2010 (icq, eml)<\/li>\n<li>QipInfium (icq, eml)<\/li>\n<li>The bat (eml)<\/li>\n<li>RDP (rdp)<\/li>\n<li>Google Chrome (web)<\/li>\n<li>Safari (web)<\/li>\n<\/ul>\n<\/div>\n<p>Screenshots of the Ann Malware Loader in action:<\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_01.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-6122\" title=\"Ann_Malware_Loader_01\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_01.png\" alt=\"\" width=\"362\" height=\"386\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_02.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-6123\" title=\"Ann_Malware_Loader_02\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_02.png\" alt=\"\" width=\"556\" height=\"187\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2012\/02\/ann_malware_loader_03.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-6124\" title=\"Ann_Malware_Loader_03\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2012\/02\/ann_malware_loader_03.png\" alt=\"\" width=\"556\" height=\"329\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2012\/02\/ann_malware_loader_04.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-6125\" title=\"Ann_Malware_Loader_04\" src=\"https:\/\/blog-en.webroot.com\/wp-content\/uploads\/2012\/02\/ann_malware_loader_04.png\" alt=\"\" width=\"558\" height=\"311\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><a href=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_05.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-6126\" title=\"Ann_Malware_Loader_05\" src=\"http:\/\/webrootblog.files.wordpress.com\/2012\/02\/ann_malware_loader_05.png\" alt=\"\" width=\"561\" height=\"356\" \/><\/a><\/p>\n<p>What&#8217;s particularly interesting about the Ann Malware Loader is the fact that it comes with an EULA agreement, emphasizing on the fact that the malware loader is to be used for testing purposes only. By doing this, the key coder behind this underground release is forwarding the responsibility for its uses to his customers.<\/p>\n<p>Moreover, thanks to its modular nature, the malware author is offering custom made modules allowing potential cybercriminals to <strong><a href=\"http:\/\/ddanchev.blogspot.com\/2008\/07\/coding-spyware-and-malware-for-hire.html\">hire a malware coder<\/a><\/strong> for a <strong><a href=\"http:\/\/ddanchev.blogspot.com\/2008\/11\/will-code-malware-for-financial.html\">specified amount of money<\/a><\/strong>.<\/p>\n<p>Webroot&#8217;s security researchers will continue monitoring the development of this malware loader to ensure that <strong><a href=\"https:\/\/www.webroot.com\/us\/en\/home\/products\/complete\">Webroot SecureAnywhere<\/a><\/strong> customers are protected from it.<\/p>\n<p>Related posts:<\/p>\n<ul>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/02\/03\/a-peek-inside-the-smoke-malware-loader\/\">A peek inside the Smoke Malware Loader<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/01\/26\/a-peek-inside-the-ubot-malware-bot\/\">A peek inside the uBot malware bot<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/01\/06\/a-peek-inside-the-pickpocket-botnet\/\">A peek inside the PickPocket Botnet<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/01\/20\/a-peek-inside-the-umbra-malware-loader\/\">A peek inside the Umbra malware loader<\/a><\/li>\n<li><a href=\"http:\/\/blog.webroot.com\/2012\/01\/09\/a-peek-inside-the-cythosia-v2-ddos-bot\/\">A peek inside the Cythosia v2 DDoS Bot<\/a><\/li>\n<\/ul>\n<p><em>You can find more about Dancho Danchev at his\u00a0<strong><a href=\"http:\/\/nl.linkedin.com\/in\/danchodanchev\">LinkedIn Profile<\/a><\/strong>. You can also\u00a0<strong><a href=\"http:\/\/www.twitter.com\/danchodanchev\">follow him on \u00a0Twitter<\/a><\/strong>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The ever-adapting cybercrime ecosystem is constantly producing new underground releases in the form of malware loaders, remote access trojans (RATs), malware cryptors, Web, IRC and P2P based command and control interfaces, all with the clear objective \u00a0to undermine current security solutions. Continuing the &#8220;A peek inside&#8230;&#8221; series, in this post I will profile a malware [&hellip;]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[21411,9937,9933,9947,6103,9941,5297,9949,9943,7027,9957,9545,9951,3477,9615,9543,9527,22885,4313,9955],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6120"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=6120"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6120\/revisions"}],"predecessor-version":[{"id":25299,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/6120\/revisions\/25299"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=6120"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=6120"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=6120"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=6120"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}