[kmd]

I'm wondering now, how these script-kiddies managed to write their own mbr code while everything else in all lockers are piece of sh*t coding example (however this does not mean that this mbr code is perfect of course).

i think i know

from "Hacker" magazine http://www.xakep.ru/magazine/xa/079/114/6.asp

article from well known writter K.Kaspersky who sell itself into McAfee
he helped these scriptkiddies very well, he can be proud.

[EP_X0FF]

The same MBRlock type from different server.

Unblock code: 67334561

In attach dropper, fully unpacked dropper (all crypter data removed, 61Kb -> 9 Kb) and MBR.

Screenshot will be the same.

Source hxxp://limboclitor.ru/xxxvideo.avi.exe

[EP_X0FF]

MBRlock of the same type. Screenshot the same.

Looks like they spawns new copy every day.

Tel to call:

89645619483
89645098429
89645098377
89645098176
89645098067
89645098055
89645097965
89645097898
89645097685
89645097585

Unblock code: G610481

Source

hxxp://lusindasexxis.ru/xxxvideo.avi.exe
hxxp://kamasssutra.ru/xxxvideo.avi.exe
hxxp://matherfukker.ru/xxxvideo.avi.exe
hxxp://ulimutixxx.ru/xxxvideo.avi.exe

Dropper + unpacked in attach.

[EP_X0FF]

While scanning for other MBRlock locations I've found about 50 MBRlock site clones, almost all currently suspended or not exists. Previously all they distributed MBRlock as payload.

[EP_X0FF]

New domains.

hxxp://antirozzza.ru/xxxvideo.avi.exe
hxxp://bazapornoflv.ru/xxxvideo.avi.exe

Unblock code: H701630

[mc0blck]

New link:
hxxp://LUSINDASEXXIS.ru/xxxvideo.avi.exe

[rkhunter]

I was surprised when i saw that MSE don't check MBR and boot sectors. Is it true? It really is useless from MBR/boot-start malware?

[EP_X0FF]

I was surprised when i saw that MSE don't check MBR and boot sectors. Is it true? It really is useless from MBR/boot-start malware?

That's actually not true.






However in most cases (and where it is possible/available) it is recommended to use recovery console.

[rkhunter]

Ok, But i test MSE on detection/remove Mayachok.2 and not detect it with last update. Actually, I making quick scan.

[EP_X0FF]

Current MSE engine does not providing 100% detection and 100% curing for all known and newest bootkits like Cidox.
Especially when they are not so widely distributed.