Welcome to the new Woodmann RCE Messageboards Regroupment
Please be patient while the rest of the site is restored.

To all Members of the old RCE Forums:
In order to log in, it will be necessary to reset your forum login password ("I forgot my password") using the original email address you registered with. You will be sent an email with a link to reset your password for that member account.

The old vBulletin forum was converted to phpBB format, requiring the passwords to be reset. If this is a problem for some because of a forgotten email address, please feel free to re-register with a new username. We are happy to welcome old and new members back to the forums! Thanks.

All new accounts are manually activated before you can post. Any questions can be PM'ed to Kayaker.

gosong.net - malware site

This forum focuses on analyzing malware and any aspects of dealing with packer protections.
User avatar
Posts: 1538
Joined: Tue Sep 18, 2001 2:00 pm

gosong.net - malware site

Post by evaluator »


accidentally got on http://gosong.net/
all download pages have malicious setup_file "song.exe" URL:
which will download bunch of installers (1mb 4mb 2mb size);
little one I included in attachment "down.3504.helper_setup.exe".

pasw: malware

p.s. Don Wooma will shut it down soon, you bad-ies :P
(721.21 KiB) Downloaded 108 times
User avatar
Junior Member
Posts: 27
Joined: Sun Dec 06, 2009 10:58 pm

Post by Gunther »

For anyone who wants to try to analyse this.
This is the VirusTotal Analysis link.
https://www.virustotal.com/en/file/e060 ... 400384820/
https://www.virustotal.com/en/file/f5fb ... 400385342/

Even though both are classified as "PUP" or Adware.
My guess is that they could be used to spread botnet over time if it's lucrative enough.

[ Gunther ]