A forum for reverse engineering, OS internals and malware analysis
Adslock.A are powered by this: http://www.microsoft.com/security/porta ... fAdslock.A
Adslock related: FileIce Ransomware
https://www.virustotal.com/file/61482c8 ... 354471140/
Also i don't have a bin but someone made 'Razorlock' (same goal of Adslock.A):
And adslock.a in attach (http://www.xylibox.com/2011/09/trojanwin32adslocka.html)
Can't find the md5 of the constructor i've lost it :/
https://www.virustotal.com/file/61482c8 ... 354471140/
Also i don't have a bin but someone made 'Razorlock' (same goal of Adslock.A):
And adslock.a in attach (http://www.xylibox.com/2011/09/trojanwin32adslocka.html)
Can't find the md5 of the constructor i've lost it :/
Attachments
infected
(10.53 KiB) Downloaded 78 times
(10.53 KiB) Downloaded 78 times
infected
(223.9 KiB) Downloaded 105 times
(223.9 KiB) Downloaded 105 times
FileIce winlock in attach
https://www.virustotal.com/file/d305f1e ... 355074854/
edit:
And another adslock builder appeared:
https://www.virustotal.com/file/d305f1e ... 355074854/
edit:
And another adslock builder appeared:
Attachments
infected
(12.53 KiB) Downloaded 69 times
(12.53 KiB) Downloaded 69 times
Another .NET cpa locker
https://www.virustotal.com/file/16ebd48 ... 355428461/
write up: http://www.malekal.com/2012/12/13/ranso ... -continue/
https://www.virustotal.com/file/16ebd48 ... 355428461/
write up: http://www.malekal.com/2012/12/13/ranso ... -continue/
Attachments
infected
(6.88 KiB) Downloaded 62 times
(6.88 KiB) Downloaded 62 times
Here is a sample, this one loads a page with the surveys rather than just loading the surveys directly.
https://www.virustotal.com/file/16ebd48 ... /analysis/
https://www.virustotal.com/file/16ebd48 ... /analysis/
Attachments
Password is "infected" without quotes
(4.81 KiB) Downloaded 67 times
(4.81 KiB) Downloaded 67 times
http://blog.webroot.com/2013/07/08/nove ... lock-code/
Webroot just wake up :roll:
Webroot just wake up :roll:
Or they just read this thread and decided to write :lol: .Xylitol,i remember reading about the very first Adslock variants on your like 2 years ago :D .
Here you can see one more Adlock service,obviously they just edited a public source code .
hxxp://www.hackforums.net/showthread.php?tid=3553463
Here you can see one more Adlock service,obviously they just edited a public source code .
hxxp://www.hackforums.net/showthread.php?tid=3553463
Click to enlarge
MD5: C8E00C8D6A6EF7ECE263A8D01CB65CF0
SHA1: 13B4B03612CEA3441410E1EDA8D135D1710A3F0C
SHA256: 51DC024E250C6F001869FC436AC7CEE2A9D101BE7CD58D8FEE6A721280EE8DDB
https://www.virustotal.com/file/51dc024 ... /analysis/
Attachments
(537.06 KiB) Downloaded 74 times
Hi,
you know what they say,when a looser copies another looser the outcome can only be pathetic :D
A little game,guess where that shit comes from,which forum? ;)
https://www.virustotal.com/sv/file/8524 ... 377105413/
Special thanks to Horgh for sharing the sample with me.
you know what they say,when a looser copies another looser the outcome can only be pathetic :D
A little game,guess where that shit comes from,which forum? ;)
https://www.virustotal.com/sv/file/8524 ... 377105413/
Special thanks to Horgh for sharing the sample with me.
Attachments
infected
(40.53 KiB) Downloaded 60 times
(40.53 KiB) Downloaded 60 times