Ransom LockScreen
Thanks for sample to Xylitol and mrbelyash.
Unblock code:
9109101313
Drops from a fake porn site as xxx_video.avi.exe
Runs through
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon as Shell replacement of Explorer.
For unpacking load dropper into debugger and set a break on
CreateProcess (due to drop period ransomware restarts itself from %temp% folder for original file self-deletion purposes). Then locate decrypted payload container in dropper memory and dump it to disk. Cut off garbage, remove UPX and "unpacking" complete. Next it is trivial. Unblock button is Button3. Yes this crapware written on Delphi 7 and even include image named "winlockimage". Used WinBlockTerr Delphi component for various system parameters blocking.
Code: Select allCODE:0047FDCC TForm1_Button3Click proc near
CODE:0047FDCC
CODE:0047FDCC var_4 = dword ptr -4
CODE:0047FDCC
CODE:0047FDCC push ebp
CODE:0047FDCD mov ebp, esp
CODE:0047FDCF push 0
CODE:0047FDD1 push ebx
CODE:0047FDD2 mov ebx, eax
CODE:0047FDD4 xor eax, eax
CODE:0047FDD6 push ebp
CODE:0047FDD7 push offset loc_47FE2B
CODE:0047FDDC push dword ptr fs:[eax]
CODE:0047FDDF mov fs:[eax], esp
CODE:0047FDE2 lea edx, [ebp+var_4]
CODE:0047FDE5 mov eax, [ebx+358h]
CODE:0047FDEB call ControlGetText
CODE:0047FDF0 mov eax, [ebp+var_4]
CODE:0047FDF3 mov edx, offset _str_9109101313.DelphiString
CODE:0047FDF8 call LStrCmp
CODE:0047FDFD jnz short loc_47FE0B
CODE:0047FDFF call pRestoreShell
CODE:0047FE04 call pSelfDelete
VT Original
https://www.virustotal.com/file/c2ce0db ... /analysis/
Unpacked
https://www.virustotal.com/file/91e0a27 ... /analysis/
Both in attach.
