From hxxp://213.186.33.4/3n72h
Attachments
Password:infected
(144.23 KiB) Downloaded 84 times
(144.23 KiB) Downloaded 84 times
@xorsthingsv2
A forum for reverse engineering, OS internals and malware analysis
From hxxp://staffsolut.nichost.ru/jwz8i9
Attachments
password:infected
(178.28 KiB) Downloaded 85 times
(178.28 KiB) Downloaded 85 times
@xorsthingsv2
From hxxp:techproconsult.com/m2q3u
Attachments
password:infected
(178.23 KiB) Downloaded 79 times
(178.23 KiB) Downloaded 79 times
@xorsthingsv2
Not sure if they changed anything but i found the following sample on hybrid analysis.
https://www.hybrid-analysis.com/sample/ ... mentId=100
The unpacking process and the execution of the malware is not the same ( compared to the latest campaigns, Also it doesn't need any arguments to run).
https://malwr.com/analysis/MGZkYTg0OTI4 ... NjNjMwNTY/ (the unpacked)
https://www.hybrid-analysis.com/sample/ ... mentId=100
The unpacking process and the execution of the malware is not the same ( compared to the latest campaigns, Also it doesn't need any arguments to run).
https://malwr.com/analysis/MGZkYTg0OTI4 ... NjNjMwNTY/ (the unpacked)
Attachments
password:infected
(282.42 KiB) Downloaded 78 times
(282.42 KiB) Downloaded 78 times
@xorsthingsv2
xors wrote:Not sure if they changed anything but i found the following sample on hybrid analysis.Yep it's different, hollowing process there. BTW should be Locky affid=3, maybe for this.
https://www.hybrid-analysis.com/sample/ ... mentId=100
The unpacking process and the execution of the malware is not the same ( compared to the latest campaigns, Also it doesn't need any arguments to run).
https://malwr.com/analysis/MGZkYTg0OTI4 ... NjNjMwNTY/ (the unpacked)
BR,
Antelox
From hxxp://209.222.76.36/98uhnvcx4x
The packed file looks different compared to the previous one. However, the unpacking process remains the same.
The packed file looks different compared to the previous one. However, the unpacking process remains the same.
Attachments
password:infected
(237.37 KiB) Downloaded 80 times
(237.37 KiB) Downloaded 80 times
@xorsthingsv2
From hxxp://125.206.125.198/54fc3rc3fr
https://www.virustotal.com/en/file/d74e ... /analysis/ (3/53)
https://www.virustotal.com/en/file/d74e ... /analysis/ (3/53)
Attachments
password:infected
(296.83 KiB) Downloaded 69 times
(296.83 KiB) Downloaded 69 times
@xorsthingsv2
This uses the ".zepto" extension instead of ".locky". Im not saying this isnt locky as bindiff shows it has a significant amount of similarities. Looking back over my data i havent seen the .locky version since the 27th of June. Anyway here is the config which is stored exactly the same way:
Code: Select all
{
"delay": 42,
"installPersistence": false,
"fakeSvchost": false,
"seed": 9577,
"campaignId": 3,
"urlPath": "/upload/_dispatch.php",
"ignoreRussian": true,
"ips": [
"51.255.172.55",
"146.120.110.130"
]
}
From hxxp://122.147.183.55/87yg5fd5
Attachments
password:infected
(267.03 KiB) Downloaded 78 times
(267.03 KiB) Downloaded 78 times
@xorsthingsv2
In the attachment
Attachments
password:infected
(280.89 KiB) Downloaded 76 times
(280.89 KiB) Downloaded 76 times
@xorsthingsv2