[Buster_BSA]

in a virtual mode there not working.

I assume all three samples are identical, so I take care only of one of them. In attach crypter free sample with removed AntiVM part so it should work everywhere.

Exactly what kind of anti-* stuff was removed?

I tried the sample under Sandboxie and it aborts execution. I noticed it checks for SbieDll.dll presence, but the DLL is hidden so execution continues after the check, so that´s not what the malware is detecting.

[EP_X0FF]

in a virtual mode there not working.

I assume all three samples are identical, so I take care only of one of them. In attach crypter free sample with removed AntiVM part so it should work everywhere.

Exactly what kind of anti-* stuff was removed?

VM detection (VirtualPC, VBOX, QEMU, VmWare), Wireshark detection, Sandboxie detection.

I tried the sample under Sandboxie and it aborts execution. I noticed it checks for SbieDll.dll presence, but the DLL is hidden so execution continues after the check, so that´s not what the malware is detecting.

if this was this patched binary then it seems checks for sandbox somewhere else additionally.

[Buster_BSA]

Exactly what kind of anti-* stuff was removed?

VM detection (VirtualPC, VBOX, QEMU, VmWare), Wireshark detection, Sandboxie detection.

VM detection is discarded as I am running the sample in the host. Sandboxie detection is also discarded because it checks for SbieDll.dll presence and I have it hidden. So probably it´s related to Wireshark detection.

Do you know what is the malware checking for related to Wireshark? WinPCap driver maybe?

if this was this patched binary then it seems checks for sandbox somewhere else additionally.

Your patched binary runs fine. I tested the original sample.

[EP_X0FF]

Do you know what is the malware checking for related to Wireshark? WinPCap driver maybe?

It looks for presense of "wireshark.exe" in list of running processes.

Additionally this malware is three stage loader.

First - decryption of payload and spawning copy of loader. Second - Vm/Sandboxie/Wshark check and mapping copy of itself to svchost.exe (I assume any). So it can fail here for example, just because it was unable to inject code. Third stage is inside svchost - it's again decryption of real payload with numerous VM/Sandboxie/WShark checks. Patched binary was extracted from 3 stage.

[Buster_BSA]

Do you know what is the malware checking for related to Wireshark? WinPCap driver maybe?

It looks for presense of "wireshark.exe" in list of running processes.

Additionally this malware is three stage loader.

First - decryption of payload and spawning copy of loader. Second - Vm/Sandboxie/Wshark check and mapping copy of itself to svchost.exe (I assume any). So it can fail here for example, just because it was unable to inject code. Third stage is inside svchost - it's again decryption of real payload with numerous VM/Sandboxie/WShark checks. Patched binary was extracted from 3 stage.

The problem is in the mapping copy of itselt to svchost.exe. This process is running out of Sandboxie so the injection fails and the malware aborts.

Thank you very much for the information!

[rkhunter]

German FakePoliceAlert Ransom, makes impossible boot in safe mode.

MD5: 86AE8A6E7AC0A9B826E464013D3BFDAD
https://www.virustotal.com/file/d52ad8e ... /analysis/

[thisisu]

GEMA - cffc2bfa4f74e2a0bb04427f1048b29f
https://www.virustotal.com/file/ee968b6 ... /analysis/
More details here and here

[thisisu]

GEMA - f8eeecb3c9ea0ace4e485fd1611fa1ab
https://www.virustotal.com/file/3859d83 ... /analysis/
ram_reserver64.exe

[evild3ad]

GVU - FD3F7AAEF6B290AC4C1D6EBCB36209C9
itunes_service01.exe
https://www.virustotal.com/file/f9966fd ... /analysis/

[tachion]

GVU 776da636fcb778485d4dbd5dbb08cda2
Ransomware GVU

https://www.virustotal.com/file/33df9bd ... /analysis/