[Xylitol]

Meet ‘Tox': Ransomware for the Rest of Us ~ https://blogs.mcafee.com/mcafee-labs/me ... rest-of-us


https://www.virustotal.com/en/file/f138 ... 432628218/

Code: Select all

hxxp://toxicola7qwv37qj.onion/downloads/ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr

https://malwr.com/analysis/MWExODFmZjM5 ... MzOTcyYzI/ - http://www.threatexpert.com/report.aspx ... 9c119530ce
https://blockchain.info/en/address/1KKG ... pkJ532cLko

[Snakebyte]

"Out of the gate, the standard of antimalware evasion is fairly high, meaning the malware’s targets would need additional controls in place (HIPS, whitelisting, sandboxing) to catch or prevent this."

Am I missing something? where is the fairly high part? UPX?

[maddog4012]

the only thing I can see are

Attempts to detect sandbox characteristics Info:
Sample attempted to detect Sandbox using the following string: Failed to create syscall sandbox filter
Sample attempted to detect Sandbox using the following string: Sandbox
Sample attempted to detect Sandbox using the following string: ...Sandbox; at most one can be set
Sample attempted to detect Sandbox using the following string: ...Sandbox is not allowed.
Sample attempted to detect Sandbox using the following string: Can't change PidFile while Sandbox is active
Sample attempted to detect Sandbox using the following string: ...Sandbox is active
Sample attempted to detect Sandbox using the following string: Can't change Logs while Sandbox is active
Sample attempted to detect Sandbox using the following string: Can't change ConnLimit while Sandbox is active
Sample attempted to detect Sandbox using the following string: ...Sandbox mode.(%sTransportPlugin line was %s)
Sample attempted to detect Sandbox using the following string: ...sandboxing is only implemented on Linux. The featu...
Sample attempted to detect Sandbox using the following string: sandbox_init
Sample attempted to detect Sandbox using the following string: ...sandbox.h

and Deletes files to compromise the system or to remove traces of the infection

other then that and UPX that is all I am seeing I would not use the term fairly high for evasion

here are a few more samples