A forum for reverse engineering, OS internals and malware analysis 

Trojan WinAD (alias Ransom.ER, Winlock, Win32.Timer)

Forum for analysis and discussion about malware.

Re: Trojan.Winlock - WinAD

 #5081  by Xylitol
 Thu Feb 17, 2011 1:51 pm
new locs: hXXp://gworldxxx.info/1q6fdpn1npgg39ugsiiq2f746e8r7i3h/pornoplayer.exe
hXXp://gworldxxx.info/xxx/15zv9ql24q2wq6631i58n7v87x99gewx/pornoplayer.exe
hXXp://hworldxxx.info/p4sg5q556iqj5z4y7sq5i65t58j1lm8t/pornoplayer.exe
hXXp://hworldxxx.info/xxx/1it7621pa8fl53617gjjbj2bwcxqodpe/pornoplayer.exe

Re: Trojan.Winlock - WinAD

 #5092  by GMax
 Fri Feb 18, 2011 9:07 am
New active URL "spermTV"
cworldxxx.info
dnakedgirls.info
fuckgirlsa.info
fuckgirlsh.info
fuckgirlsu.info
fuckgirlsy.info
gigasexc.info
gigasexl.info
gigasexx.info
gigasexz.info
inakedgirls.info
tworldxxx.info
unakedgirls.info
wnakedgirls.info
xcliphplay.info
xworldxxx.info
xxxbazab.info
xxxbazai.info
xxxbazau.info
xxxbazav.info
zworldxxx.info
+ \78pn3a4v96jsz5n2lzgs9kq629gw41wy/pornoplayer.exe

Re: Trojan.Winlock - WinAD

 #5100  by Xylitol
 Sat Feb 19, 2011 9:09 am
new locs: hXXp://cworldxxx.info/sa2uwa88i6636y8iop9kti7mzx2q26wa/pornoplayer.exe
hXXp://cworldxxx.info/xxx/71xb53i75mk1tholx1sab6s3alj8997h/pornoplayer.exe
hXXp://vworldxxx.info/ci8cebmz2233te63g28693311f63p3d8/pornoplayer.exe
hXXp://vworldxxx.info/xxx/8229f12x586e1us3lxs847ys3ngzwtg1/pornoplayer.exe
Code: Select all
18/02/2011 - 00:14:20 - 79A12D3F96BFE0290C2B61FF4612E8F6_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 01:14:23 - 5AD614AB432214FCEDDC910A9452677A_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 02:14:25 - 68BF6DE98951E48571A9B11E3411F739_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 03:14:30 - D896CBC91A20484EA2E6D8ADE1F6D76C_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 04:14:30 - D774EE79641A0F93B71826273DA32EEF_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 05:14:30 - 5064DF62DF6E1667D9FCF162A4F451C3_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 06:14:30 - F2D184C5CFFADCB26DD4E7766D4CB26D_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 07:14:30 - AF4CE9265DBAACB8D00D1E97E47CBE21_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 08:14:30 - 02D2FE3B073865FECAF29FBEDE5324D8_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 09:14:30 - 1D03DD65B35488FF895ED3B70FBAD53D_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 10:14:30 - B72BFAA184F5232E376CB07EC5C980F5_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 11:14:30 - 9066AF4A0930DBDF3AD49E2FA2867A73_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 12:14:30 - 112FBC581286BEAA509EAA79A0FD2365_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 13:14:31 - AD45AB70DA22279F1564F3640C974991_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 14:14:34 - B08903C349888E2CA0E002DB070CB544_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 15:14:40 - 5C54ED1F20715607D41F1C61564DAD82_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 16:14:42 - B16B44CF984B47C6DE114EA0B1C32D28_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 17:14:42 - C3C756A8B6638684E1E9BFEC3A21E3D1_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 18:14:50 - 9A4E3057A0FC83B5198EDFBBB2B19013_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 19:14:50 - 1E5DD0931F5C572DBD03A0A7BE9C0BDF_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 20:14:51 - E479A604906620FE5D2E29FB1256D6A2_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 21:14:55 - 15A6CBF721DDDE90C3BDA4D7DEAC3088_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 22:14:55 - D46D87B6215A2ADE0B4508F7DC0B0BFB_pornoplayer.exe.ViR
DONE! ~ WAITING
18/02/2011 - 23:14:56 - 702A276C8586245404D7413FD5243C6C_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 00:14:58 - E6E6BF6FB39969E93F920B0BA9691D65_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 01:14:59 - 013ACF55F070202F5C6191F0011F8DC9_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 02:14:59 - 35414F29A044F20537273951CECB80BE_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 03:14:59 - 4BEB36094C4C3BD7AE0535364A460C9E_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 04:14:59 - F6FD9D282B1D2F9759A869A954C95A49_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 05:14:59 - 965AB67488556FD9382EC28C137DB1F8_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 06:14:59 - 09A5D9E184461E8A94D32D709DCC52F1_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 07:14:59 - 5FD09B28B93A0462F8258A26A6953433_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 08:14:59 - 47E03081B35156A5DC2BEA789E2B2BAE_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 09:14:59 - 5C8A0CBC7C5CB0924175AAA987CB594A_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 10:15:00 - BC6A698E761A2C56A3C566F7332AC089_pornoplayer.exe.ViR
DONE! ~ WAITING
Attachments
See archive comment for password
(1.56 MiB) Downloaded 45 times

Re: Trojan.Winlock - WinAD

 #5109  by GMax
 Sat Feb 19, 2011 7:39 pm
+ URL spermTV sites
bworldxxx.info
eromtube.info
erontube.info
fuckgirlsb.info
fuckgirlsm.info
fuckgirlsn.info
fuckgirlsq.info
gigasexb.info
gigasexm.info
gigasexn.info
gigasexv.info
mnakedgirls.info
mworldxxx.info
nnakedgirls.info
nworldxxx.info
qnakedgirls.info
vworldxxx.info
xxxbazam.info
xxxbazan.info
xxxbazat.info
xxxbazay.info

Re: Trojan.Winlock - WinAD

 #5121  by Xylitol
 Sun Feb 20, 2011 6:44 pm
new locs: hXXp://mworldxxx.info/dspr785on4cb65z2hi6e627uh1378yog/pornoplayer.exe
hXXp://mworldxxx.info/xxx/2ujw155e18uszne69lt72brfw7hi5y3f/pornoplayer.exe
Code: Select all
19/02/2011 - 09:14:59 - 5C8A0CBC7C5CB0924175AAA987CB594A_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 10:15:00 - BC6A698E761A2C56A3C566F7332AC089_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 11:15:03 - 83E1567427D2DDC8BD0260904FC4E4E1_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 12:15:05 - 14143CD6B191D60F44B5AACE6AFD6856_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 13:15:04 - 9FA428749012E9FBE7E2F4C012B30367_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 14:15:04 - 720F090665B534D5DBA5209FDD7A6D0F_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 15:15:05 - 7059DC7D363D7331A3FBAACF17B7E847_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 16:15:05 - 5B7703965B171F0D8BCC68CBBD15C8A1_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 17:15:07 - 3D9ECDBB4B9EE68DE44101200D8A7CEC_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 18:15:05 - 6750EE2B3788FED2CE63F2A9AE582A9C_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 19:15:05 - EFB24D8ECAB5293300FA3DBCFA121ADD_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 20:15:06 - 7BB377E371BCCCEA776BB6438E403131_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 21:15:07 - 4AF82BE1B11A7E8022CB1F106AD229C1_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 22:15:07 - 7B0B075F47EFB996BB1F07B0FBA234C1_pornoplayer.exe.ViR
DONE! ~ WAITING
19/02/2011 - 23:15:07 - 1B69338E57613326A30406C070A0D566_pornoplayer.exe.ViR
DONE! ~ WAITING
20/02/2011 - 00:15:07 - AA21D54408BCDCC6C7A7DBE8A455BCD6_pornoplayer.exe.ViR
DONE! ~ WAITING
20/02/2011 - 01:01:27 - C42128FB8654FEB87C89E445EF42F0A3_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 02:01:30 - F165D6B2C6899F0E50AFE2081B18E300_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 03:01:31 - D41D8CD98F00B204E9800998ECF8427E_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 03:57:24 - D41D8CD98F00B204E9800998ECF8427E_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 04:07:55 - 7AD3816B032339A2C0D2F815D512C2D8_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 04:08:44 - 7AD3816B032339A2C0D2F815D512C2D8_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 04:18:13 - 7AD3816B032339A2C0D2F815D512C2D8_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 05:18:13 - 07F658AA155A74E4C3AB47CD6750A776_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 06:18:13 - 6F16FF501F4CF6094C0B9DC3C5D1607B_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 07:18:14 - 141825413B822C803D854B42C2728929_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 08:18:14 - E6E7ADE729D0CE34FB8087E12C1AE479_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 09:18:14 - 39D3485228B2A692671EB67D5455C045_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 10:18:14 - 84AAEE34B05F176031A5AE527AC33F86_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 11:18:15 - BE367C745734302E67034CA0B11F8008_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 12:18:15 - EDAC3A323EEB45EB972D7DD884466011_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 13:18:18 - 95EEE0334C659920A5CC83A336A720D7_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 14:18:20 - BF7CBC5BAE9E730FEA70C03F16275673_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 15:18:21 - 7644FC36097E72DB0E379DAA4837D591_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 16:18:24 - D7195635B1A81B2BD71F67C22B3FC724_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 17:18:28 - 9FC27F5CAA44F87AC9FDFE78336404A9_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 18:18:28 - 1DC83004A438396587827E3BBC0D1CDA_pornoplayer.exe.ViR 
DONE! ~ WAITING
20/02/2011 - 19:18:29 - 9B5D754DA68CD0557D64BA1D4C8BB966_pornoplayer.exe.ViR 
DONE! ~ WAITING
Attachments
Archive password: xylibox
(1.51 MiB) Downloaded 41 times
  • 1
  • 4
  • 5
  • 6
  • 7
  • 8
  • 17
 Return to “Malware”