[Xylitol]

MBRLocker builder

http://xylibox.blogspot.com/2011/07/mbr ... r-v01.html

In attach, the builder.

[EP_X0FF]

Hehehe, author has incredible hex-editing skills with original MBRlock :)

[GMax]

hxxp://pornoseksas.ru/xxxvideo.avi.exe

Number to Call:

89057027973
89057027942
89057027854
89057032376
89057032377
89057032394
89057032467
89057032469
89057032305
89057032298

Unlock code: IGOPOPRD

[EP_X0FF]

hxxp://prostituytka.ru/xxxvideo.avi.exe

Numbers to call:

89057032209
89057032237
89057029790
89057023982
89057028020
89057039474

Unblock code: 100YOYOD

hxxp://zhopaseksporno.ru/xxxvideo.avi.exe
hxxp://69pozavideo.ru/xxxvideo.avi.exe
hxxp://anusanalzhopa.ru/xxxvideo.avi.exe

Numbers to call:

89057024254
89057024089
89057024019
89057043622
89057043534
89057043527
89057043364
89057043329
89057043328
89057043321

Unblock code: F2001ORD

hxxp://mossdamozxxx.ru/xxxvideo.avi.exe

Numbers to call:

89057043206
89057025714
89645914398
89645917411
89645917415
89057025720
89057025738
89057040767

Unblock code: Z0909PRD

[mc0blck]

New Blocker: hxxp://ALISSSASEX.ru/ (91.220.0.35) -> hxxp://valaskor.ru/in.cgi?5 (212.124.110.134) -> hxxp://mossdamozxxx.ru/ (91.220.0.35) -> hxxp://mossdamozxxx.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://SOKIZSOSOK.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://ANUSANALZHOPA.ru/xxxvideo.avi.exe (91.220.0.35)

[EP_X0FF]

Blocker: hxxp://SOKIZSOSOK.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://ANUSANALZHOPA.ru/xxxvideo.avi.exe

Tel to call:

89057024254
89057024089
89057024019
89057043622
89057043534
89057043527
89057043364
89057043329
89057043328
89057043321

Unblock code: F2001ORD

hxxp://soskisoskii.ru/xxxvideo.avi.exe

Tel to call:

89057028034
89057028066
89057028177
89057028592
89057028614
89057028725
89057029247
89057025415
89057025339
89057025549

Unblock code: CEKAMAZD

Tel to call:

89057034267
89057034292
89057034425
89057034429
89057034515

Unblock code: G101932D

[Xylitol]

MBRLocker Builder v0.2
bugfixs, nothing new.


Edit 25 Jul 2k11: I've talk to fast, serial is now xored with a random key





IDA Schem of the serial check:


Xor Key and serial position on a MBR dump:

[Xylitol]

As requested by EP_X0FF, here is a small tool for find serial of locker powered by MBRLocker Builder v0.2
Just make a dump of your infected MBR and drop it on the form
if that don't work for you feel free to edit the code, source code and bin attached.

For easily get a dump you can use HideToolz v2.2 by fyyre with the option reboot protection enabled
then just run the locker and make a mbr dump with hdhacker or Hiew.

[EP_X0FF]

Tel numbers:

89057037594
89645527343
89645611150
89057034517
89057034543

Unblock code: X001934D

Tel numbers:

89057038279
89057038281
89057038331
89057038354
89057038423
89057038540
89057038543
89057039044
89057038937
89057038913

Unblock code: DF100321

Tel numbers:

89057038913
89057038937
89057039044
89057038543
89057038540
89057038423
89057038354
89057038331
89057038281
89057038279

Unblock code: MZ102992

Tel numbers:

89036159386
89036187584
89036159702
89036159833
89036160684
89057038910

Unblock code: OP10341D

Tel numbers:

89057038910
89036160684
89036159833
89036159702
89036187584
89036159386

Unblock code: 0019313D

Tel numbers:

89057039436
89057039403
89057039353
89057023970
89057025916
89645535096

Unblock code: 305004RD

Tel numbers:

89060313721
89060313495
89060320652
89060320946
89060316733

Unblock code: 000452RD

Tel numbers:

89060313351
89057037517
89057037346
89057042523
89057026140
89057026619

Unblock code: X105221D

Tel numbers:

89036166798
89036166283
89036165118
89036162161
89036161859
89036161857

Unblock code: 8904438D

Tel numbers:

89036156693
89036156712
89036156795
89036157416
89036157649
89036157759

Unblock code: 1031823D

[Xylitol]

unlock code: 111


requested by mrbelyash.