Search the Community

Cryptographic ransom. Delivered via email. Smart install maker -> Delphi. In attach dropper and extracted ransom. Installs to %Program Files%, runs via HKLM Run key. Used https://github.com/SnakeDoctor/FGInt Changing desktop wallpaper to it own with ransom message. Wallpaper can be found inside ransom resources. Email: trojanencoder@aol.com Target extensions Autoelevate in loop pExecInfo.cbSize = 60; pExecInfo.hwnd = GetFocus(); pExecInfo.fMask = 1280; pExecInfo.lpVerb = "runas"; pExecInfo.lpFile = (LPCSTR)sub_404E98(); pExecInfo.lpParameters = (LPCSTR)sub_404E98(); pExecInfo.nShow = 1; while ( !ShellExecuteExA(&pExecInfo) ) Sleep_0(0x7D0u); VT https://www.virustotal.com/en/file/add92cb6047f2fb412dcbcb5a2d8ee7fad56091ccd6667105d977b010a33b561/analysis/1433824692/ https://www.virustotal.com/en/file/94f36b586379137a58862ca46cd1cd6c01c20ea9f56755f7b193f0c97b7a57bd/analysis/1433824702/ Derivative of this https://securelist.ru/blog/issledovaniya/24070/shifrovalshhik-cryakl-ili-fantomas-razbushevalsya/ ( use google translate ) Download pass: infected Source