[GMax]

FileName: Private_Brute.exe
Size: 534 Kb (546816 byte)
Data/Time compile: 01.01.2011 / 14:19:51 UTC
MD5: 3C09A47B4A673A9E46CB0DE70B02454D
PEiD: ['BobSoft Mini Delphi -> BoB / BobSoft']
http://www.virustotal.com/file-scan/rep ... 1295177816
http://www.threatexpert.com/report.aspx ... e70b02454d


Unlock key: 10293838

[Xylitol]

winlock generator found in the web according to my search it was from december 2010
https://www.virustotal.com/file-scan/re ... 1300267030

generated ransomware are huge ~435 Kb







generated winlock:


disas winlock:




----
Edit: Found a winlock source

Attached.
--------
Edit again: Found the version 0.3 of the winlock builder
https://www.virustotal.com/file-scan/re ... 1299569441








Edit again, again (lol): This winlock generator remind me one sample found by Gmax in Jan 2k11:
http://www.kernelmode.info/forum/viewto ... 4481#p4481
the Winlock builder was made in december 2010, i'm pretty sure the sample of GMax was generated by this.

[Xylitol]

WinLocker Builder v0.4 is in the wild, i think we will see soon new variants.









Generated winlock (4/41 (9.8%)) http://www.virustotal.com/file-scan/rep ... 1303744185

difference btw the 0.3 and the 0.4 on the serial check it use a simple xor

[EP_X0FF]

Primitive Winlock (probably created through Winlock generator).



Unblock key: 816908 (created as result of xor operation over 922039 and key asd9sa786ves)

http://www.virustotal.com/file-scan/rep ... 1308812764
http://www.virustotal.com/file-scan/rep ... 1308560423

In attach both original and unpacked (removed VB crypter and UPX).

[Maxstar]

http://www.virustotal.com/file-scan/rep ... 1322818568
Result: 35/ 43 (81.4%)

[GMax]

unlock code = '611138??0702824' xor 'asd9sa786ves'

Number to call: 8(917)970-46-69
Unlock code: 725809876151910

[Mosh]

I found this on 193.109.247.70 (Virgin Islands, British)

https://www.virustotal.com/es/file/cf66 ... 373340431/

Code: Select all

hxxp://warface68.ucoz.ru/_ld/0/1___.rar