Navilog

[Thanos]

Hi there

Navilog is a tool dedicated to nuke magic control/ navipromo infection. It's developped by il.mafioso

More information here => http://il.mafioso.pagesperso-orange.fr/Nav...resentation.htm

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Version de la base de donn

[nosirrah]

C:\Program Files\Navilog1\gnc.exe

I have run this a few times and this file is not generated, please zip and attach a copy.

[Thanos]

Hi ,

My mistake: you're quite right nosirrah I 've just infected a XP machine with navipromo, and then ran navilog. There's no gnc.exe file in this folder > C:\Program Files\Navilog1

I asked the person to de-quarantine the file and send me a sample.

I'll attach a copy asa I get it

[Thanos]

Hi there

I finaly got it ^^

Vt scan result here (I tried to reanalyse it but the file was queued 1174 !! ) => http://www.virustotal.com/file-scan/report...7f29-1272428242

thanks again

gnc.zip

[nosirrah]

I am not sure if this is the original final form but the attached version uses packing typically only used on malware. Virustotal has moved from 20 to 22 detections for this file so even if we delist it, the big picture will be unchanged.

I am sure that il.mafioso already knows but for the record there were ways to pack/protect this that would have resulted in virtually no FPs.

[Thanos]

Hi nosirrah,

I am not sure if this is the original final form but the attached version uses packing typically only used on malware.

I was thinking the same thing, so I'll send a sample of the file to il.mafioso to see if it's the "legit" one.

Virustotal has moved from 20 to 22 detections for this file so even if we delist it, the big picture will be unchanged.

I understand

Thanks for your answer.