A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #20057  by Fabian Wosar
 Fri Jul 12, 2013 12:36 am
Since someone asked before if the malware has some kind of unlock code. That appears to be the case. The unlock code of this variant is "783MN02KA6N1B37M90NUY7JHV". Once you put it in, the screen locker will decrypt the files and remove itself from the system. The code block at 0x0040423D handles the password processing. The unlock code is stored in an obfuscated format within the executable. Take a look at the string deobfuscation function at 0x004011A0 for more details which deobfuscates both the encryption key as well as the unlock code.
 #20060  by Cody Johnston
 Fri Jul 12, 2013 12:55 am
Fabian Wosar wrote:Since someone asked before if the malware has some kind of unlock code. That appears to be the case. The unlock code of this variant is "783MN02KA6N1B37M90NUY7JHV". Once you put it in, the screen locker will decrypt the files and remove itself from the system. The code block at 0x0040423D handles the password processing. The unlock code is stored in an obfuscated format within the executable. Take a look at the string deobfuscation function at 0x004011A0 for more details which deobfuscates both the encryption key as well as the unlock code.
Specifically when using the unlock code, a flag is set on the PC which the dropper checks for, and does not reinfect the system.
 #20264  by Fabian Wosar
 Mon Jul 29, 2013 5:57 pm
New Harasom variant with a Russian (?) lock screen this time. Encryption key is "4dKne87BNjeqlOmdkJHCDVlwir46983I". Decrypter has already been updated. The original sample as well as an unpacked version are attached.
You do not have the required permissions to view the files attached to this post.