[Aleksandra]

h**://videoxxx-conline2g.ru/q/

http://virusscan.jotti.org/ru/scanresul ... 34468ae1be

[EP_X0FF]

Ransom extracted from BH EK. Crypted with Zbot crypter. Both dropper and decrypted exe in attach.

4 / 42
https://www.virustotal.com/file/61a36ca ... /analysis/

[EP_X0FF]

WindowsSecurity from BH EK

https://www.virustotal.com/file/d46ade1 ... /analysis/
https://www.virustotal.com/file/19aecb6 ... /analysis/
https://www.virustotal.com/file/992058b ... /analysis/
https://www.virustotal.com/file/e84b578 ... /analysis/

[EP_X0FF]

FUD

0 / 42
https://www.virustotal.com/file/28ad8a1 ... 334757662/

Decrypted and unpacked
https://www.virustotal.com/file/9e29467 ... 334757833/

[EP_X0FF]

New crypter used, RunPE variant. Main must be pending update.

https://www.virustotal.com/file/6bb3f3d ... /analysis/
https://www.virustotal.com/file/0028350 ... /analysis/

[RomaNNN]

video.scr
MD5: d3df180cacd8e1671b3f49117e84fd3f

https://www.virustotal.com/file/acfc773 ... 335824953/

[thisisu]

MD5: 3c3c0a29923ee617ed7cfe83ae97e770
https://www.virustotal.com/file/ee61c14 ... 335946037/

[rkhunter]

MD5: 891d1d820622a86c0dcc4a6592d3d2e4
https://www.virustotal.com/file/9a90ed0 ... /analysis/

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\S10887119

[EP_X0FF]

It is still Pliqpay_monexy but design is different + RunPE. What is the source of this trojan?

[rkhunter]

What is the source of this trojan?

I haven't.