A forum for reverse engineering, OS internals and malware analysis 

Win32/Urausy (aka "WinLocker")

Forum for analysis and discussion about malware.

Re: Win32/Urausy (aka "WinLocker")

 #19580  by Xylitol
 Sun Jun 09, 2013 3:07 pm
193 Urausy directly from the BestAV affiliate. (before they changed domain to bestsoft.pro)
or do it yourself:
Code: Select all
@echo off
color 17
cls
set target=test.bestavsoft2.com/soft/download/soft2/?affid=
set droppath=BestAVsoft2
set start=1
set affiday=00
set end=8888
set step=1
if not exist %droppath% (
mkdir %droppath% )
FOR /L %%G IN (%start%, %step%, %end%) DO wget -U "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" -S -t 100 -P / "%target%%%G%affiday%" -O "%droppath%/%%G"
FOR %%i IN (%droppath%\*) do if %%~zi LEQ 2 DEL %%i
echo Done.
pause
Attachments
infected
(2.03 MiB) Downloaded 84 times
infected
(9 MiB) Downloaded 85 times
  • 1
  • 3
  • 4
  • 5
  • 6
  • 7
  • 9
 Return to “Malware”