A forum for reverse engineering, OS internals and malware analysis 

Win32/Somhoveran

Forum for analysis and discussion about malware.

Re: Trojan Winlock / Ransom / ScreenLocker

 #19932  by EP_X0FF
 Wed Jul 03, 2013 11:59 am
TETYYSs wrote:Russian "WinLocker".

Win32.Gimemo / ScreenLocker.BC / Win32/LockScreen.ATZ / Trojan-Ransom.Win32.Gimemo.autu / Win32/Somhoveran.A

MD5: 2f9d774bf6bfb32b91a1706a0968e399
VT: https://www.virustotal.com/fr/file/96c2 ... 370970028/
Script-kiddie ransom, created in Delphi and packed with PECompact and after this MPRESS (it is boring even upload here as unpacked). This and locker "content" mean it was created by kids. Pretty popular trend for last half of year - these ransoms usually called "anticheat" programs.

Authors youtube chanel -> http://www.youtube.com/user/garrik20002000, 2000 probably is year of birth :)

Review http://www.youtube.com/watch?v=d7S1gIypZ8Q

Posts moved as this ransom have nothing to do with professional Reveton ransom.

Re: Win32/Somhoveran

 #27877  by kakarot
 Mon Feb 15, 2016 1:42 pm
Hey , i tested out this screenlocker on my vm , it was good for me since i am beginner . I just have 1 question how can i change the text of this malware i mean it's all in russian i want to reverse or duplicate it in english :) . How can i do that ? any starting points ?

Re: Win32/Somhoveran

 #27881  by EP_X0FF
 Tue Feb 16, 2016 3:42 am
kakarot wrote: I just have 1 question how can i change the text of this malware i mean it's all in russian i want to reverse or duplicate it in english :) . How can i do that ? any starting points ?
Here is the answer, #1 http://www.kernelmode.info/forum/viewtopic.php?f=8&t=16

Re: Win32/Somhoveran

 #27894  by kakarot
 Thu Feb 18, 2016 8:59 am
Got my answer :) Now i know what not to ask :D .

P.S. I never had any ill intention regarding that malware . I was just curious on how to reverse a malware . That's ALL !!
 Return to “Malware”