Nov 2012 Worm Vobfus Samples

End of the year presents:
This is a sample of W32.Vobfus / Worm_Vobfus

Related News and Analysis:
Nov 2012  
Trend Micro What’s the Fuss with WORM_VOBFUS?

Nov 2012 - W32.Narilam Sample

End of the year presents:
This is a sample of W32.Narilam 

Related News and Analysis:
Nov 2012 (malware is much older but re-surfaced in Nov 2012)
W32.Narilam – Business Database Sabotage
W32.Narilam | Symantec

Oct 2012 - Skype Dorkbot / W32.Phopifas samples

End of the year presents:
These are 4 samples of Skype Dorkbot / W32.Phopifas
Related News and Analysis:
October 2012
Infection Spreads Profile Pic Messages to Skype Users -GFI
W32.Phopifas | Symantec

Medre.A - AutoCAD worm samples

         Medre.A  is a an AutoCAD worm, written in AutoLISP and is a very unusual piece of malware. It was

ACAD/Medre.A – 10000′s of AutoCAD files leaked in suspected industrial espionage and the corresponding whitepaper ACAD/Medre.A and ESET technical analysis is here ACAD/Medre.A Technical Analysis

          ESET reported Peru and neighboring countries as the target but I noticed that one of the samples' (MD5 25c7e10bb537b4265f6144f2cd7f6d95) original name is 未命名1 ( Unnamed 1), so I wonder if some targets/sources were Chinese speaking.

P.S. The samples were donated by an anonymous but the original source is someone from Malwarebytes forum and  I want to thank him/her (sorry don't know the name) for sharing. I hope they do not mind me posting them here.

Aug 28 Morto / Tsclient - RDP worm with DDoS features

 

According to Microsoft, Morto is a worm that spreads by trying to compromise (lame) administrator passwords for Remote Desktop connections on a network. They also note it can perform Denial of Service attacks against attacker-specified targets. 
I can add that it runs what it looks like a quick DoS test against one Google IP. In addition, it creates a lot of traffic: RDP scans, downloads, receiving commands, and interesting DNS queries for command and control servers.
Judging by the domain owners of CC servers (China) and their location (Hong Kong), I would say it is likely it be cybercrimeware originating in erm,...Asia. I don't know how difficult it is for a foreigner to register domains with  Jiangsu Bangning Science & technology Co. Ltd.in China. One of the domains existed for a few years and changed several Chinese registrars and hosting companies. Like in Russia, DDoS attack crimes are very common in China (I don't have stats for other Asian countries but I am guessing common there too :)

I want to thank jsunpack.jeek.org and malc0de.com for the sample.