A forum for reverse engineering, OS internals and malware analysis 

Win32/Urausy (aka "WinLocker")

Forum for analysis and discussion about malware.

Re: Win32/Urausy (aka "WinLocker")

 #21186  by Cody Johnston
 Thu Oct 17, 2013 6:36 pm
Fresh from today

SHA256: 21972c7dac68aead72c0d04f82996aa87fddac9210bad346bc0658ec279eaff1
SHA1: ef07ede3790fa8f6ffe2a4aba66e1adbec7c1e86
MD5: 063e0fe4f07b247feddb9cb32f5a8ec8
Detection ratio: 12 / 47

https://www.virustotal.com/en/file/2197 ... 382033542/
Attachments
Password: infected
(47.86 KiB) Downloaded 94 times

Re: Win32/Urausy (aka "WinLocker")

 #21368  by thisisu
 Fri Nov 08, 2013 8:46 pm
Sorry couldn't find a proper home for this one.

MS identifies as TrojanDownloader:Win32/Cbeplay.R but description on their site doesn't seem to match the very obvious ransomware screen w/ audio that I experienced.

https://www.virustotal.com/en/file/c5e2 ... /analysis/
http://www.microsoft.com/security/porta ... ay.R#tab=2
Code: Select all
HKLM\...\Run: [yCpCQSpcQDy4] - C:\Documents and Settings\Owner\Local Settings\Application Data\RsbYH13.exe [154624 2013-07-23] (Microsoft Corporation)
Attachments
pass: infected
(110.02 KiB) Downloaded 76 times

Re: Win32/Urausy (aka "WinLocker")

 #21369  by nullptr
 Sat Nov 09, 2013 8:50 am
thisisu wrote: MS identifies as TrojanDownloader:Win32/Cbeplay.R but description on their site doesn't seem to match the very obvious ransomware screen w/ audio that I experienced.
This is Cbeplay ransomware as described at http://malware.dontneedcoffee.com/2013/ ... ks-to.html
Extracted executables + decrypted strings attached.
Attachments
pwd: infected
(96.21 KiB) Downloaded 72 times

Re: Win32/Urausy (aka "WinLocker")

 #21371  by thisisu
 Sat Nov 09, 2013 6:12 pm
Nice find, thank you

Here is another sample, this time Urausy -- MD5: 9bf9bcad600fb7f8d3014a0331e4284a
Code: Select all
Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Other.exe ()
HKU\Owner\...\Winlogon: [Shell] explorer.exe,C:\Users\Owner\AppData\Roaming\Other.res [ 2011-11-16] () <==== ATTENTION
https://www.virustotal.com/en/file/c418 ... 384020275/
Attachments
pass: infected
(78.51 KiB) Downloaded 100 times

Win32/Urausy

 #21721  by colbyiscute4e
 Tue Dec 17, 2013 6:20 pm
Should i put more about it or what could it do.. I just joined and read the rules so bear with me..
Colby :D

Re: Win32/Urausy

 #21735  by thisisu
 Wed Dec 18, 2013 11:32 pm
colbyiscute4e wrote:Should i put more about it or what could it do.. I just joined and read the rules so bear with me..
Colby :D
As a courtesy you can upload the malware to VirusTotal (https://www.virustotal.com) and add a link to your post. Screenshots of the malware and any reversing tips about said malware are also appreciated but not required.
  • 1
  • 5
  • 6
  • 7
  • 8
  • 9
 Return to “Malware”