[patriq]

64bit loader .dll (detection ratio 5/56)
https://virustotal.com/en/file/9ca837ca ... /analysis/

looks like some hybrid cryptowall/teslacrypt based only on ransom notes and payment C&C. Don't have a 64bit vm setup at the moment.

.png not allowed, converted to jpeg
de_crypt.jpeg (116.17 KiB) Viewed 1199 times

Attached.

[Kafeine]

Reveton guys are back in the Ransomware business.

https://www.proofpoint.com/us/threat-in ... ing-angler

Attached it the zip with all the data mentionned in the post.

[Kafeine]

FWIW This :

https://www.virustotal.com/file/51f939e ... 460955077/

Appears to be the associated DecryptionTools

[Antelox]

Now both CryptXXX 1.0 and CryptXXX 2.0 can be decryptable by RannohDecryptor!

RannohDecryptor

BR,

Antelox

[g00dv1n]

New sample

[xors]

New sample

In the attachment

[g00dv1n]

New sample

In the attachment

Could you describe your strategy for unpack it ?

I looked the sample in Olly but i found only trash jumps and ReleaseMutex functions.

Thanks.