A forum for reverse engineering, OS internals and malware analysis 

Trojan Winlock / Ransom / ScreenLocker

Forum for analysis and discussion about malware.
 Topic locked

Re: Trojan Winlock / Ransom / ScreenLocker

 #4174  by EP_X0FF
 Wed Dec 29, 2010 9:07 am
This one aggressive. UPX + custom cryptor, written on Delphi. Completely locks screen and drops second trojan additionally (it is encrypted in Delphi binary resources).

Runs through HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell as C:\Program Files\Common Files\qip\svhost.exe

to unblock type 12345 (in all three input fields) two times, ignore winlock stupid messages.

https://www.virustotal.com/file-scan/re ... 1293610882
https://www.virustotal.com/file-scan/re ... 1293610339
Attachments
pics from trojan :)
(40.11 KiB) Downloaded 71 times
second trojan, pass: malware
(76.96 KiB) Downloaded 61 times
pass: malware
(290.26 KiB) Downloaded 72 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #4437  by EP_X0FF
 Thu Jan 13, 2011 4:34 pm
Very funny Winlock, written on dot net.

Image

Distributes through fake Kaspersky site (hxxp://www.kaspepsky.ru). Very detailed copy.

Download source hxxp://kaspepsky.ru/downloads/internetsecurity.updater.exe

Image

Autorun through HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell as c:\windows\system32\explorerr.exe

Unblock is kinda problematic because of
Code: Select all
  .method public void Ok_Click(class System.Object a, class System.Object b)
  {
    ret
  }
so Alt+F4
Attachments
pass: malware
(1.33 MiB) Downloaded 67 times

Re: Trojan Winlock / Ransom / ScreenLocker

 #4439  by EP_X0FF
 Thu Jan 13, 2011 5:01 pm
Yes I've noticed that. There also another winlock of the same type :)
 Topic locked
  • 1
  • 2
  • 3
  • 4
  • 5
  • 9
 Return to “Malware”