[twisterxz]

hey guys,

I'm new around the forums. And i like to learn about malware analyses, but unfortunatly i don't have much time to learn.
so i just look around here and read your topics.

But straight to the point. my boss came to me today, and showed me his pc. His pc is infected with zyklon locker ransomware
I never heard of this one before, so if anyone wants to analyse it, feel free. or just delete this post if im doing someting wrong.

Best regards,

twisterxz

[xors]

I am not the best with .NET/C# so don't assume that i am correct 100%.
As far i can see the when the 'freegaza_israeli_killers.exe' is executed it will run the 'Ponmsiyyks.exe' from the %temp% folder. The 'Ponmsiyyks.exe' will create the 'RegAsm.exe' process and will inject the malicious code inside it. In the attachment you will find what i found so far.

https://malwr.com/analysis/ZjZjOWY1Y2Rj ... FkZDFlMWE/

[Black1024]

Thanks for your samples.