Since someone asked before if the malware has some kind of unlock code. That appears to be the case. The unlock code of this variant is "783MN02KA6N1B37M90NUY7JHV". Once you put it in, the screen locker will decrypt the files and remove itself from the system. The code block at 0x0040423D handles the password processing. The unlock code is stored in an obfuscated format within the executable. Take a look at the string deobfuscation function at 0x004011A0 for more details which deobfuscates both the encryption key as well as the unlock code.
Fabian Wosar wrote:Since someone asked before if the malware has some kind of unlock code. That appears to be the case. The unlock code of this variant is "783MN02KA6N1B37M90NUY7JHV". Once you put it in, the screen locker will decrypt the files and remove itself from the system. The code block at 0x0040423D handles the password processing. The unlock code is stored in an obfuscated format within the executable. Take a look at the string deobfuscation function at 0x004011A0 for more details which deobfuscates both the encryption key as well as the unlock code.Specifically when using the unlock code, a flag is set on the PC which the dropper checks for, and does not reinfect the system.
