dumb110 wrote:German ransomware!Decrypted in attach.
Attachments
pass: malware
(45.11 KiB) Downloaded 67 times
(45.11 KiB) Downloaded 67 times
Ring0 - the source of inspiration
A forum for reverse engineering, OS internals and malware analysis
There is a German Ransomware around that uses what looks like Child Sex images.
Quads
Quads
German ransomware threatens with sick kiddie smut: http://www.theregister.co.uk/2013/04/05 ... ansomware/
Here's the newest version of Revoyem...first seen on May 01. It seems that only the german landing page works...the criminals also use Ramnit in the UK. This ransomware threatens with 4 pix of child pornography!
http://www.evild3ad.com/2391/bka-trojan ... blockiert/
http://www.evild3ad.com/2391/bka-trojan ... blockiert/
Attachments
PW: evild3ad.com
(13.48 KiB) Downloaded 76 times
(13.48 KiB) Downloaded 76 times
Last edited by evild3ad on Sat May 04, 2013 7:56 am, edited 1 time in total.
Revoyem.exe (MD5: 06f041771579b59fc684d2f856040d18)
anyone would mind attaching the sample?
anyone would mind attaching the sample?
dumb110 wrote:Revoyem.exe (MD5: 06f041771579b59fc684d2f856040d18)Will this do ?
anyone would mind attaching the sample?
Attachments
Pass: infected
(13.79 KiB) Downloaded 77 times
(13.79 KiB) Downloaded 77 times
SHA256:
361f20ceea4a6f0db5e5321d7ac71d6442163e2282ffee89c4bdb203b0dfc7d7
Dateiname:
SQLSE20.DLL
Erkennungsrate:
2 / 46
https://www.virustotal.com/de/file/361f ... /analysis/
361f20ceea4a6f0db5e5321d7ac71d6442163e2282ffee89c4bdb203b0dfc7d7
Dateiname:
SQLSE20.DLL
Erkennungsrate:
2 / 46
https://www.virustotal.com/de/file/361f ... /analysis/
Attachments
(74.58 KiB) Downloaded 70 times