A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #7481  by EP_X0FF
 Thu Jul 21, 2011 2:20 pm
Hehehe, author has incredible hex-editing skills with original MBRlock :)
 #7487  by GMax
 Thu Jul 21, 2011 4:28 pm
hxxp://pornoseksas.ru/xxxvideo.avi.exe

Number to Call:
89057027973
89057027942
89057027854
89057032376
89057032377
89057032394
89057032467
89057032469
89057032305
89057032298
Unlock code: IGOPOPRD
 #7501  by EP_X0FF
 Fri Jul 22, 2011 2:46 am
hxxp://prostituytka.ru/xxxvideo.avi.exe

Numbers to call:
89057032209
89057032237
89057029790
89057023982
89057028020
89057039474
Unblock code: 100YOYOD

hxxp://zhopaseksporno.ru/xxxvideo.avi.exe
hxxp://69pozavideo.ru/xxxvideo.avi.exe
hxxp://anusanalzhopa.ru/xxxvideo.avi.exe

Numbers to call:
89057024254
89057024089
89057024019
89057043622
89057043534
89057043527
89057043364
89057043329
89057043328
89057043321
Unblock code: F2001ORD

hxxp://mossdamozxxx.ru/xxxvideo.avi.exe

Numbers to call:
89057043206
89057025714
89645914398
89645917411
89645917415
89057025720
89057025738
89057040767
Unblock code: Z0909PRD
 #7535  by mc0blck
 Sat Jul 23, 2011 5:31 am
New Blocker: hxxp://ALISSSASEX.ru/ (91.220.0.35) -> hxxp://valaskor.ru/in.cgi?5 (212.124.110.134) -> hxxp://mossdamozxxx.ru/ (91.220.0.35) -> hxxp://mossdamozxxx.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://SOKIZSOSOK.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://ANUSANALZHOPA.ru/xxxvideo.avi.exe (91.220.0.35)
 #7546  by EP_X0FF
 Sat Jul 23, 2011 2:28 pm
mc0blck wrote:Blocker: hxxp://SOKIZSOSOK.ru/xxxvideo.avi.exe (91.220.0.35)
Blocker: hxxp://ANUSANALZHOPA.ru/xxxvideo.avi.exe
Tel to call:
89057024254
89057024089
89057024019
89057043622
89057043534
89057043527
89057043364
89057043329
89057043328
89057043321
Unblock code: F2001ORD

hxxp://soskisoskii.ru/xxxvideo.avi.exe

Tel to call:
89057028034
89057028066
89057028177
89057028592
89057028614
89057028725
89057029247
89057025415
89057025339
89057025549
Unblock code: CEKAMAZD

Tel to call:
89057034267
89057034292
89057034425
89057034429
89057034515
Unblock code: G101932D
 #7562  by Xylitol
 Sat Jul 23, 2011 7:09 pm
MBRLocker Builder v0.2
bugfixs, nothing new.


Edit 25 Jul 2k11: I've talk to fast, serial is now xored with a random key

Image

Image

IDA Schem of the serial check:
Image

Xor Key and serial position on a MBR dump:
Image
Attachments
pwd: xylibox
(177.33 KiB) Downloaded 85 times
 #7649  by Xylitol
 Mon Jul 25, 2011 10:12 pm
As requested by EP_X0FF, here is a small tool for find serial of locker powered by MBRLocker Builder v0.2
Just make a dump of your infected MBR and drop it on the form
if that don't work for you feel free to edit the code, source code and bin attached.

For easily get a dump you can use HideToolz v2.2 by fyyre with the option reboot protection enabled
then just run the locker and make a mbr dump with hdhacker or Hiew.

Image
Attachments
(58.97 KiB) Downloaded 73 times
 #7852  by EP_X0FF
 Fri Aug 05, 2011 5:07 am
Tel numbers:
89057037594
89645527343
89645611150
89057034517
89057034543
Unblock code: X001934D

Tel numbers:
89057038279
89057038281
89057038331
89057038354
89057038423
89057038540
89057038543
89057039044
89057038937
89057038913
Unblock code: DF100321

Tel numbers:
89057038913
89057038937
89057039044
89057038543
89057038540
89057038423
89057038354
89057038331
89057038281
89057038279
Unblock code: MZ102992

Tel numbers:
89036159386
89036187584
89036159702
89036159833
89036160684
89057038910
Unblock code: OP10341D

Tel numbers:
89057038910
89036160684
89036159833
89036159702
89036187584
89036159386
Unblock code: 0019313D

Tel numbers:
89057039436
89057039403
89057039353
89057023970
89057025916
89645535096
Unblock code: 305004RD

Tel numbers:
89060313721
89060313495
89060320652
89060320946
89060316733
Unblock code: 000452RD

Tel numbers:
89060313351
89057037517
89057037346
89057042523
89057026140
89057026619
Unblock code: X105221D

Tel numbers:
89036166798
89036166283
89036165118
89036162161
89036161859
89036161857
Unblock code: 8904438D

Tel numbers:
89036156693
89036156712
89036156795
89036157416
89036157649
89036157759
Unblock code: 1031823D
  • 1
  • 4
  • 5
  • 6
  • 7
  • 8
  • 10