[Grinler]

New CoinVault ransomware from the same family as CryptoGraphic Locker. Encryption and decryption performed by same executable. Appears to use AES for encryption.



Files associated with CoinVault:

Code: Select all

%AppData%\Microsoft\Windows\coinvault.exe
%AppData%\Microsoft\Windows\edone
%AppData%\Microsoft\Windows\filelist.txt
%Temp%\CoinVaultFileList.txt
%Temp%\wallpaper.jpg

Registry entries associated with CoinVault:

Code: Select all

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Vault	"%AppData%\Microsoft\Windows\coinvault.exe"
HKCU\Control Panel\Desktop\Wallpaper	"%Temp%\wallpaper.jpg"

[Blaze]

Fresh samples (dropper + payload) attached.

[likeamirror]

Hey, I'm new. Couple of questions regarding this specimen.
Is it normal practice for things that get semi-big to be written in a .NET language, like this sample?
Is it normal practice to have all of your functions stored as bytes, and then decrypt that at runtime?

[EP_X0FF]

Is it normal practice for things that get semi-big to be written in a .NET language, like this sample?
Is it normal practice to have all of your functions stored as bytes, and then decrypt that at runtime?

Yes/Yes.