A forum for reverse engineering, OS internals and malware analysis 

French Ransom (Trojan:Win32/Ransom.FL)

Forum for analysis and discussion about malware.

Re: Trojan Ransom / FakePoliceAlert

 #11659  by rkhunter
 Fri Feb 17, 2012 5:18 am
NarfBang wrote:SHA256:
ce9c7f46cad1e40cb9e411736b5bc66412f61ee2aa6d638e4413ea4efdfde648
This is French ransomware.

Re: Trojan Winlock / Ransom / ScreenLocker

 #12447  by thisisu
 Sat Mar 31, 2012 9:01 pm
"Gendarmerie Nationale"
pass: infected
https://www.virustotal.com/file/9009d5c ... /analysis/
__
Image
__
Code: Select all
"HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load"	""	""	""
+ "C:\DOCUME~1\owner\LOCALS~1\Temp\4A7DE4666052AD44198A.exe,"	""	""	"File not found: C:\DOCUME~1\owner\LOCALS~1\Temp\4A7DE4666052AD44198A.exe,"
Attachments
Gendarmerie Nationale
(44.81 KiB) Downloaded 79 times
 Return to “Malware”