A forum for reverse engineering, OS internals and malware analysis 

Trojan:Win32/Ransom.BY

Forum for analysis and discussion about malware.

Trojan:Win32/Ransom.BY

 #4497  by Xylitol
 Mon Jan 17, 2011 12:32 am
xxx.avi
https://www.virustotal.com/file-scan/re ... 1295209071
https://www.virustotal.com/file-scan/re ... 1295224064

Image
Attachments
see archive comment for password
(28.66 KiB) Downloaded 80 times
see archive comment for password
(51.47 KiB) Downloaded 92 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #4647  by Xylitol
 Sun Jan 23, 2011 12:16 am
https://www.virustotal.com/file-scan/re ... 1295729840

Image


flash_player.exe: (unacked.exe)
https://www.virustotal.com/file-scan/re ... 1295700806
unlock: poputalda

xxx_video_53636.avi_Unpacked:
https://www.virustotal.com/file-scan/re ... 1295744505
Attachments
see archive comment for password
(28.72 KiB) Downloaded 77 times
see archive comment for password
(332.8 KiB) Downloaded 70 times
see archive comment for password
(53.12 KiB) Downloaded 87 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #4913  by Xylitol
 Sun Feb 06, 2011 11:44 am
new loc: hXXp://pepka-master2012.narod2.ru/xxx_video.avi.exe
Code: Select all
00406B81  |.  E8 62EAFFFF   CALL 004055E8           ; \GetWindowTextA
serial must start with "000" someone can confirm i dont really understand how work the regitration schem ?
Image

Image

Image
Attachments
see archive comment for password
(102.54 KiB) Downloaded 66 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #5025  by Xylitol
 Sat Feb 12, 2011 2:38 pm
new loc: hXXp://tanechkaagafonova.narod2.ru/xxx_video.avi.exe

http://www.virustotal.com/file-scan/rep ... 1297521416
https://www.virustotal.com/file-scan/re ... 1297521496

Image
Attachments
see archive comment for password
(114.28 KiB) Downloaded 59 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #5080  by Xylitol
 Thu Feb 17, 2011 1:47 pm
locs: hXXp://video.barabas.cz.cc/video/xxx_video.avi

http://www.virustotal.com/file-scan/rep ... 1297950042
https://www.virustotal.com/file-scan/re ... 1297950143

Image
Attachments
See archive comment for password

xxx_video_55843.avi.exe.vir
xxx_video_55843.avi_unpacked.exe.vir
(109.52 KiB) Downloaded 57 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #5085  by Xylitol
 Thu Feb 17, 2011 10:58 pm
loc: hXXp://video.bldupel.cz.cc/video/xxx_video.avi

Image

http://www.virustotal.com/file-scan/rep ... 1297983390
https://www.virustotal.com/file-scan/re ... 1297983364
Attachments
see archive comment for password
(171.79 KiB) Downloaded 57 times
 Return to “Malware”