Trojan Ransom

[EP_X0FF]

Ransom WindowsSecurity

hxxp://91.202.244.89/files/957f2
hxxp://91.202.244.89/files/a69fa
hxxp://91.202.244.89/files/bdd35

[MysteryFCM]

Cheers

[EP_X0FF]

Ransom WindowsSecurity

hxxp://91.202.244.89/files/920b8
hxxp://91.202.244.89/files/443aa
hxxp://pl122h.ru/c.php?f=fbf92&e=5

Redirector (probably filters non-russian IP)

hxxp://mtds5.ru/in.cgi?2

BH EK

hxxp://pl122h.ru/index.php?page=132fe37e97d99a65

[EP_X0FF]

Ransom WindowsSecurity is now masqueraded as Flash Update.

hxxp://porkaxcxafreexeh.ru/f/flash_play.exe
hxxp://eh8cja.ru/files/03bc9
hxxp://eh8cja.ru/files/5b260
hxxp://eh8cja.ru/files/be99d

landing page

hxxp://porkaxcxafreexeh.ru/f/

Redirector

hxxp://rtds6.ru/in.cgi?2

BH EK

hxxp://eh8cja.ru/index.php?page=113c7244d24b264f

http://wepawet.iseclab.org/view.php?hash=161510e36933c847f3a2152dd1631683&t=1337218418&type=js

[Xylitol]

mbr ransomware

Code: [Select]

hxxp://police-center.in/forum/exe/4.exe

[dlipman]

mbr ransomware

Code: [Select]

hxxp://police-center.in/forum/exe/4.exe

Drops a file in German which translates to...

Antivirus v2.2 harddisk repair .. The computer has been infected with Trojan.Agent.ARVP. This computer virus was .. especially for the removal of information from the computer opponents .. geschaffen.Alle information encrypted on your hard drive for Verschlusselungs algorithm AES-256, this is impossible at this time is to decipher. .. Reinstall the operating system deletes all information for .. ever! The specialist forces of our company has succeeded, the weaknesses in the algorithm of the virus .. Trojan.Agent.ARVP identify and to your computer .. a special version of the antivirus HardDisk Repair v2 .2 to invite to your files .. wiederherzustellen.Unser Program is an important parameter HDDKEYbekommen that is needed to heal the disc to your computer and decode decodieren.Um all your disks, you must obtain a LizenzschlusselHardDiskRepair v2.2. you have to .. system www.paysafecard.com www.ukash.com a PIN or codeine to buy the high of 100 EUR, and reach us by e-mail: Send systemantivirus@yandex.rudie following data: 1 .... . PIN-code XXXX XXXX XXXX XXXX www.paysafecard.com www.ukash.com or (100 EUR) 2 Your unique HDDKEY: xxxxxxx .... let decrypt your password, we need 24 hours .. payment. A password will be sent to your e-mail address ... License activation: Your unique HDDKEY systemantivirus@yandex.ru ..: ...........

[EP_X0FF]

Ransom WindowsSecurity

hxxp://91.202.244.122/files/2f646
hxxp://91.202.244.122/files/2c753
hxxp://91.202.244.122/files/36cf4

[EP_X0FF]

Ransom WindowsSecurity

hxxp://91.202.244.122/files/06d87
hxxp://91.202.244.122/files/0512d
hxxp://91.202.244.122/files/67fcb

[EP_X0FF]

Ransom WindowsSecurity (former LockEmAll) moved to new IP 91.202.244.134

Redirector

hxxp://apumunav.ru/video.htm -> hxxp://og2cjn.ru/in.cgi?5 -> hxxp://x.fdeeeeroiitee.ru/x/

BH EK

hxxp://x.rk41qq.ru/indexx.php?pagex=aab27326c543cd88

Files

hxxp://91.202.244.134/files/1f747
hxxp://91.202.244.134/files/dd6b5
hxxp://91.202.244.134/files/6a513

[EP_X0FF]

Ransom WindowsSecurity updated their Blackhole (I assume to v2)

BH EK (new format)

hxxp://wj8nfq.ru:8787/SgLolK?bZoQR=31

http://wepawet.iseclab.org/view.php?hash=d283de6e9f28e0ee27e069169fb29011&t=1347715382&type=js

Redirector (could be IP location aware)

hxxp://1traffxmd.ru/tds/in.cgi?15

Payload VT
https://www.virustotal.com/file/c8a0bb1589a2d7fc15b25cdcfd566e88148cda20858532fc03b42e59f3229397/analysis/

Nice forum update btw

[SysAdMini]

Ransom WindowsSecurity updated their Blackhole (I assume to v2)

BH EK (new format)

hxxp://wj8nfq.ru:8787/SgLolK?bZoQR=31

It's an exploit kit, but not Blackhole.

Nice forum update btw

Thanks. It has been on my todo list a long time. I wasn't sure if SMF 2.0 is stable and secure enough.
But I noticed that support for version 1.x will end soon, so I had to upgrade. I like the Aqua Theme too.

[EP_X0FF]

Redirects to Ransom LokoMoTo

hxxp://adavysalu.ru/ -> hxxp://xx0909093.ru/tds/in.cgi?15 -> hxxp://videoxmx-onlinee4b.ru/a/ -> hxxp://videoxmx-onlinee4b.ru/a/video.scr

https://www.virustotal.com/file/95bc53d14413d646c8adfcb4a9b213ce26431a3e33e50f20bb7a57d5d6359986/analysis/1352436481/

Exploit Kit (Sweet Orange?)

hxxp://ua2m43.ru:8787/shtgls?ZWtNH=139

[SysAdMini]

I'm sorry. None of the urls works for me here.

Redirects to Ransom LokoMoTo

hxxp://adavysalu.ru/ -> hxxp://xx0909093.ru/tds/in.cgi?15 -> hxxp://videoxmx-onlinee4b.ru/a/ -> hxxp://videoxmx-onlinee4b.ru/a/video.scr

https://www.virustotal.com/file/95bc53d14413d646c8adfcb4a9b213ce26431a3e33e50f20bb7a57d5d6359986/analysis/1352436481/

Exploit Kit (Sweet Orange?)

hxxp://ua2m43.ru:8787/shtgls?ZWtNH=139

[EP_X0FF]

Russian IP required for redirector, otherwise nohow.

[EP_X0FF]

hxxp://pedencyclopaedia.asia/

all downloads lead to Trojan MBRlock