German Ransom (GEMA, GVU, InetAccelerator)

Forum for analysis and discussion about malware.
markusg
Posts: 735
Joined: Mon Mar 15, 2010 2:53 pm

Re: Trojan Winlock / Ransom / ScreenLocker

Post by markusg » Tue Nov 01, 2011 8:01 pm

0.4184793218357642.exe
MD5   : b5c2c2b2476ee126f402002b4881fd53
https://www.virustotal.com/file-scan/re ... 1320176752
You do not have the required permissions to view the files attached to this post.

User avatar
EP_X0FF
Global Moderator
Posts: 4884
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Contact:

Re: Trojan Winlock / Ransom / ScreenLocker

Post by EP_X0FF » Wed Nov 02, 2011 4:55 am

markusg wrote:0.4184793218357642.exe
MD5   : b5c2c2b2476ee126f402002b4881fd53
https://www.virustotal.com/file-scan/re ... 1320176752
Equal to http://www.kernelmode.info/forum/viewto ... 8984#p8984
Ring0 - the source of inspiration

markusg
Posts: 735
Joined: Mon Mar 15, 2010 2:53 pm

Re: Trojan Winlock / Ransom / ScreenLocker

Post by markusg » Wed Nov 02, 2011 5:58 pm

4aygerhye4.exe
MD5   : 6a5577f7f1fa78f172ea37c1ca9fc2cc
https://www.virustotal.com/file-scan/re ... 1320255720
dwlGina3.dll
MD5   : 1173123287198dce1eb831f04e28352c
http://www.virustotal.com/file-scan/rep ... 1320255656
You do not have the required permissions to view the files attached to this post.

User avatar
EP_X0FF
Global Moderator
Posts: 4884
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Contact:

Re: Trojan Winlock / Ransom / ScreenLocker

Post by EP_X0FF » Thu Nov 03, 2011 4:12 am

markusg wrote:4aygerhye4.exe
MD5   : 6a5577f7f1fa78f172ea37c1ca9fc2cc
https://www.virustotal.com/file-scan/report.html?id=eafbdaaae9bccd0f81af19e88f05078ed62184b0dff22bf721ec49a158c299a4-1320255720
dwlGina3.dll
MD5   : 1173123287198dce1eb831f04e28352c
http://www.virustotal.com/file-scan/report.html?id=65d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba-1320255656
Such exceptional Delphi7 design

Image

dll embedded in ransom resources. There is form set on all screen with TWebBrowser component.

Call home hxxp://85.121.39.2/~mfeeling/gema/

See more http://home.mcafee.com/VirusInfo/VirusP ... 38869#none
Ring0 - the source of inspiration

markusg
Posts: 735
Joined: Mon Mar 15, 2010 2:53 pm

Re: Trojan Winlock / Ransom / ScreenLocker

Post by markusg » Tue Nov 15, 2011 2:38 pm

svhcost.exe
MD5   : fff77ca0b854b64f46fe85e0fd9f1e7e
https://www.virustotal.com/file-scan/re ... 1321367144
You do not have the required permissions to view the files attached to this post.

markusg
Posts: 735
Joined: Mon Mar 15, 2010 2:53 pm

Re: Trojan Winlock / Ransom / ScreenLocker

Post by markusg » Wed Nov 16, 2011 11:58 am

upd.exe
MD5   : e65cd7a7c886638499ed56adaf5bb564
https://www.virustotal.com/file-scan/re ... 1321443725
You do not have the required permissions to view the files attached to this post.

User avatar
EP_X0FF
Global Moderator
Posts: 4884
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Contact:

Re: Trojan Winlock / Ransom / ScreenLocker

Post by EP_X0FF » Wed Nov 16, 2011 12:35 pm

markusg wrote:upd.exe
MD5   : e65cd7a7c886638499ed56adaf5bb564
https://www.virustotal.com/file-scan/report.html?id=d9151104716792e5b2ad334cdd08b7af2c151557dab0266128085e762ab5e021-1321443725
Ransom Bundez Polizei v3.3 (y:\src\_cpp\bwin3_3\Release\bwin3.pdb)

Call home hxxp://89.248.165.131/i.php?a=1

Decrypted in attach
You do not have the required permissions to view the files attached to this post.
Ring0 - the source of inspiration

User avatar
EP_X0FF
Global Moderator
Posts: 4884
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Contact:

Re: Trojan Winlock / Ransom / ScreenLocker

Post by EP_X0FF » Wed Nov 16, 2011 12:59 pm

markusg wrote:svhcost.exe
MD5   : fff77ca0b854b64f46fe85e0fd9f1e7e
https://www.virustotal.com/file-scan/re ... 1321367144
The variation of the same
Achtung!
Aus Sicherheitsgrunden wurde Ihr Windows system blockiert. Durch das Besuchen von Seiten mit infizierten und pornografischen Inhalten ist das Computersystem an eine kritische Grenze angekommen, nach der das System zusammenbrechen und die ganzen Dateien verloren gehen konnen. Um das System wiederherstellen zu konnen, mussen Sie ein zusatzliches Sicherheitsupdate herunterladen.

Dieses Update ist ein kostenpflichtiges Upgrade fur besonders infizierte Windows systeme. Es beschutzt das System vollstandig von Virus und Schadprogrammen, stabilisiert Ihr Computersystem und verhindert den Datenverlust. Wahlen Sie Ihre bevorzugte Zahlart. Nicht moglich da PC stark virenverseucht! Moglich! Damit Ihr Computersystem schnellstens verbessert wird, geben Sie bitte weiter unten einen Code fur 50,-Euro Ukash oder Paysafe ein. Diese konnen Sie an fast jeder Tankstelle oder einen Kiosk in Ihrer Nahe kaufen. Diese Codes gibts auch uberallda, wo Sie Handyaufladekarte erwerben konnen. Sofort nach der Eingabe und der Gultigkeitsprufung wird Ihr Computer komplett aktualisiert und gesichert - alle Trojaner und Viren werden geloscht.
Decrypted in attach
You do not have the required permissions to view the files attached to this post.
Ring0 - the source of inspiration

markusg
Posts: 735
Joined: Mon Mar 15, 2010 2:53 pm

Re: Trojan Winlock / Ransom / ScreenLocker

Post by markusg » Thu Nov 17, 2011 8:04 pm

0.2841721611520367.exe
MD5   : f0f3c3fd03f36065f6dafda3c24afaa4
https://www.virustotal.com/file-scan/re ... 1321559530
You do not have the required permissions to view the files attached to this post.

User avatar
EP_X0FF
Global Moderator
Posts: 4884
Joined: Sun Mar 07, 2010 5:35 am
Location: Russian Federation
Contact:

Re: Trojan Winlock / Ransom / ScreenLocker

Post by EP_X0FF » Fri Nov 18, 2011 4:59 am

markusg wrote:0.2841721611520367.exe
MD5   : f0f3c3fd03f36065f6dafda3c24afaa4
https://www.virustotal.com/file-scan/re ... 1321559530
Equal to this

In attach decrypted (http://www.virustotal.com/file-scan/rep ... 1321591702).
You do not have the required permissions to view the files attached to this post.
Ring0 - the source of inspiration

Post Reply