[EP_X0FF]

No paysafecard needed, your passwords will pay off
http://blogs.technet.com/b/mmpc/archive ... y-off.aspx

[PX5]

Reveton aka FBI/MoneyPak

Link is dead....http://ytojuxate.pl/erolikos (50.7.46.181)

Seen it called Screenlock and other names like Fortinet W32/Moure.A!tr.dldr

I disagree, although screenlock, this is pure reveton, wont be able to share pcap but trust me, its Reveton, all my stolen PWs say so! ;)

https://www.virustotal.com/en/file/4e90 ... 369870629/

https://www.virustotal.com/en/file/38f5 ... 369870675/

https://www.virustotal.com/en/file/8f06 ... 369870684/

[PX5]

Holy Crap!

Best I could do for now, hadda use a camera, safe mode didnt load, havent tried anything else yet, still not awake.

If someone is good at re-sizing photos, have at it and repost so its visible.

Thanks,

MJ

[EP_X0FF]

Holy Crap!

Best I could do for now, hadda use a camera, safe mode didnt load, havent tried anything else yet, still not awake.

MJ

Is it one of the recent samples you uploaded?

[PX5]

Last edited by Xylitol on Thu May 30, 2013 11:41 am, edited 1 time in total.
Reason: image fix

Looks like Xylitol has repaired the image as much as it can be, thanks for asking EP_X0FF. :)

Thank You Much X! :)

[Mosh]

Recently I saw a version with this same design but the name that I found for this was Flimrans.



This is the same Reveton ?

basic analysis:
http://www.nyxbone.com/malware/flimrans.html

links:
http://www.malekal.com/2013/05/25/flimr ... hnologies/
https://www.botnets.fr/index.php/Flimrans

[Xylitol]

https://www.virustotal.com/en/file/cd35 ... 370811679/
https://www.virustotal.com/en/file/1d67 ... 370811681/
https://www.virustotal.com/en/file/c53a ... 370811684/

[Cody Johnston]

Fresh from this morning

VT 7/47 https://www.virustotal.com/en/file/2981 ... 371569564/

MD5: 052f5d4122155f64c95d42ec2a6eed99

[thisisu]

IIRC this one had the "ICE Cyber Crime Center" logo in here somewhere. Pulled from a customer laptop this morning.

MD5: 37dea49af3e2cddf3159e794ac14e77d -- https://www.virustotal.com/en/file/9098 ... /analysis/
FRST:

Code: Select all

HKU\Owner\...\Command Processor: "C:\Users\Owner\AppData\Local\Temp\khpvjhtueuosbxwdt.exe" <===== ATTENTION!

[Win32:Virut]

rundll32.exe path,XFG00

https://www.virustotal.com/en/file/90b6 ... 375267929/

I was just browsing some websites and got infected, maybe some site was infected.