[Cody Johnston]

Anyone seen new samples in the past few days, things have been quiet over here for me.

[edmanz1]

This sample/C2 worked once for me yesterday morning, but not anymore:

http://urlquery.net/report.php?id=7947769

It completes the initial post, but I never get the ransom messages. Any insight as to what is going on behind the scenes would be much appreciated!

[Cody Johnston]

hxxp://194.28.174.119/0388.exe

https://www.virustotal.com/en/url/466e3 ... /analysis/

It completes the initial post, but I never get the ransom messages. Any insight as to what is going on behind the scenes would be much appreciated!

It will not bring the message up until the RSA key is returned from the server and it can encrypt the files. Otherwise it will just spin through the DGA and then do nothing.

[Intimacygel]

https://www.virustotal.com/en/file/c7dc ... /analysis/

This sample in particular deletes system restore points including the VSS (Volume shadow service) which is really nasty as around 2/3 of the samples I've been testing leave that alone and allow me to restore previous save states of files.

Does anyone know the exact command this uses to access and delete these restore points? I'm looking to see if it's possible to create heuristic detection on anything that tries to do this as I know of no legitimate process that would do this..

Thanks!

[Grinler]

Code: Select all

"C:\Windows\SYsWOW64\cmd.exe" /C "C:\Windows\Sysnative\vssadmin.exe" Delete Shadows /All /Quiet

http://www.bleepingcomputer.com/virus-r ... yptolocker

[Intimacygel]

Code: Select all

"C:\Windows\SYsWOW64\cmd.exe" /C "C:\Windows\Sysnative\vssadmin.exe" Delete Shadows /All /Quiet

http://www.bleepingcomputer.com/virus-r ... yptolocker

Awesome. Thanks for the help.

Does anyone know if this happens before or after encryption?

[Intimacygel]

Anyone got any working samples still? Most of the ones I've found here only drop their components and make registry changes, but they wont encrypt or show the ransom window. I presume because the server it would send the RSA key is no longer active...

[Intimacygel]

Got one - pulled it off of a customers box.

invoice.exe dropped it.
E4817AE88D6D43FB9AF973827241FDE0
Then dropped this
F4073E00E675D759CBAC3A556ACDD739
Then dropped this
2BEE39281327441275E59A6247C9F9AC
Then dropped this
186D960FDF8F96855A78376FBD9EEA3A
Which then dropped the active cryptolocker process.
2A1609EF72F07ABC97092CB456998E43

Still working as of my last test a couple hours ago.
Attached is the 2A1609EF72F07ABC97092CB456998E43

https://www.virustotal.com/en/file/038d ... /analysis/

[r3shl4k1sh]

Still working as of my last test a couple hours ago.
Attached is the 2A1609EF72F07ABC97092CB456998E43

https://www.virustotal.com/en/file/038d ... /analysis/

This one has DGA to get the server address.

In attached unpacked exe: B1D46F77F3A12235ED1699363ACF6948

VT 16 / 48

[Grinler]

The latest sample from their C2.