First Zeus, now SpyEye – look @ the source code now!

Searching_ _ _ · Aug 15, 2011

Today, for the first time, SpyEye builder patch source code (for release 1.3.45) was leaked by an infamous French security researcher named Xyliton, part of the Reverse Engineers Dream Crew (RED Crew). He was able to locate a copy of SpyEye builder 1.3.45 and created a walkthrough/tutorial that enables the reader (once in possession of SpyEye builder) to crack the hardware identification (HWID) which has been secured using VMProtect (a licensing tool that locks an installation of software to a particular physical device). This leak is important as it illustrates the coding techniques of Gribo-Demon’s team (the authors of SpyEye) and also deals another blow to the underground criminal ecosystem.

1. Now that a patch/crack for the SpyEye builder (the tool that generates the SpyEye malware) has been released along with source for the HWID crack, security researchers can now begin bug hunting for vulnerabilities in the authors work.

The steps for the walkthrough are listed here on a blog titled XyliBox – http://Xylibox.blogspot.com/2011/08/cracking-spyeye-13x.html. This does not link to the source, but illustrates the capability if you know where to look. The walkthrough is hard enough to keep newbs from getting into trouble, but just enough information for any seasoned security professional or criminal to get started – for good or for evil.
Click to expand...

First Zeus, now SpyEye – look @ the source code now! - Damballa Blog

tomazyk · Aug 16, 2011

That's an interesting reading. Thank you.

Log in or Sign up

First Zeus, now SpyEye – look @ the source code now!

Searching_ _ _ Registered Member

tomazyk Guest

Log in or Sign up

First Zeus, now SpyEye – look @ the source code now!

Searching_ _ _ Registered Member

tomazyk Guest

Useful Searches