Crypt0L0cker!!!(Zero DAY)

BeSecure · 2017-03-18T11:23:42.000Z

Source:https://www.hybrid-analysis.com/sample/b05c9fb690bf745884cf9d6154c56fce30bc98540ac546ae28f9f557d4f88b61?environmentId=100

Virus Total:https://www.virustotal.com/en/file/b05c9fb690bf745884cf9d6154c56fce30bc98540ac546ae28f9f557d4f88b61/analysis/

Virus total:0 / 56 :o

Youtube:https://youtu.be/93RqY9sziqo

polonus · 2017-03-18T18:15:40.000Z

Confirmed here and here: https://www.hybrid-analysis.com/feed?raw
and here: https://malwaretips.com/threads/cryptolocker-ransomware-demonstration-of-attack.69727/

Also see: https://www.reverse.it/recent-submissions?filter=file&page=4&lang=zh
or rather: https://www.reverse.it/sample/b05c9fb690bf745884cf9d6154c56fce30bc98540ac546ae28f9f557d4f88b61?environmentId=100

The analysis extracted a known ransomware file, hidden inside a pdf.file.

pol

TrueIndian · 2017-03-19T04:08:27.000Z

Downloaded file is detected as VBA:Downloader-ESI[Trj] by avast,so we are good The downloader that be secure posted is not detected but we should be protected since the downloaded file is caught.

This is a downloader that tricks the user into downloading from their site.Looks like malware writers weren’t getting people to download it from their site so they made this downloader.I had reported this URL yesterday night to avast at 9:28 IST

We are protected avast now detects the downloaded file.

BeSecure · 2017-03-19T04:24:49.000Z

TrueIndian post:3:

Downloaded file is detected as VBA:Downloader-ESI[Trj] by avast,so we are good The downloader that be secure posted is not detected but we should be protected since the downloaded file is caught.

This is a downloader that tricks the user into downloading from their site.Looks like malware writers weren’t getting people to download it from their site since I had reported this URL yesterday night to avast at 9:28 IST

We are protected avast now detects the downloaded file.

Thanks for the info.@TrueIndian

TrueIndian · 2017-03-19T04:28:20.000Z

Here is the URL of the downloaded file.This was already reported yesterday and detected with today’s VPS:
https://www.virustotal.com/en/url/75efa482d1c4b701afbc46a49924eb0f7a255aa887e04bfecf81dcbe8f62f348/analysis/1489897627/

RejZoR · 2017-03-19T11:59:30.000Z

Just because VT doesn’t detect it, that doesn’t mean it’s not detected. VT doesn’t use half of the cloud capabilities and it also doesn’t use Behavior Shield at all.

TrueIndian · 2017-03-19T16:26:38.000Z

RejZoR post:6:

Just because VT doesn’t detect it, that doesn’t mean it’s not detected. VT doesn’t use half of the cloud capabilities and it also doesn’t use Behavior Shield at all.

Yes that is exactly why Virustotal Is unreliable as a source of detection

Announcements