malwr.com Trustworthy?

avastuser3796 · 2015-05-26T23:26:48.000Z

Yeah, so. A few of the experts here will know this site. It will be unfamiliar to a lot of you guys though!

https://malwr.com/analysis/YjkwZTRhNGI4NjViNGExODk5Nzg5M2YwNDhjYmI0MDQ/. Conclusion, it’s ransomware (Malwr’s Analysis!). I edited to tags to become a little more accurate.

Actual conclusion though revealed by personal testing and screenshots. It’s a fake Anti-Virus.

Can we conclude that we should be able to trust malwr.com for accurate and precise reports regarding uploaded samples?

According to that report, I think not…

Looking at that FRST report, and malwr.com’s report, the do, are very dissimilar!

avastuser3796 · 2015-05-26T23:28:25.000Z

And yes, Windows is fake. Downloaded an ISO file for a demo purpose for class tomorrow.

essexboy · 2015-05-27T14:19:37.000Z

Fake AV not ransom

Pondus · 2015-05-27T14:26:26.000Z

essexboy post:3:

Fake AV not ransom

yea, but you have to pay to get the full fake protection ;D

avastuser3796 · 2015-05-27T14:55:33.000Z

Pondus post:4:

essexboy post:3:

Fake AV not ransom

yea, but you have to pay to get the full fake protection ;D

Technically, it can be classed as Ransom because of that, and it’s extremely difficult to use the system under “Normal” terms. However, bear in mind the Tag:Urausy.

http://www.bleepingcomputer.com/virus-removal/remove-urausy-fbi-ransomware

That, is not Urausy!!

I’m curious, how did malwr.com mess this up? Made for an interestinng removal case (Wasn’t expecting that, although the process is the same… Safe Mode w/ CMD > Open explorer > run FRST > Create a Fixlist > Run and reboot!) but. That is obviously not Urausy.

Edit:

=============================================================

Fixlist looked like this:


CloseProcesses:

HKU\S-1-5-21-953904158-1915589922-4174002194-1000\...\RunOnce: [18AFB925B8834DCF000018AFA07A5209] => C:\ProgramData\18AFB925B8834DCF000018AFA07A5209\18AFB925B8834DCF000018AFA07A5209.exe [399360 2015-05-26] ()
2015-05-26 18:08 - 2015-05-26 18:08 - 00399360 _____ () C:\Users\John\Desktop\5902daf659559dd976f9e662f782d877dd4da4b90ca1ac44aa26a224919da779.exe
2015-05-26 18:07 - 2015-05-26 18:23 - 00001184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-26 18:07 - 2015-05-26 18:23 - 00001184 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-26 18:21 - 2015-05-26 18:21 - 00002048 _____ () C:\Users\John\Desktop\System Care Antivirus.lnk
2015-05-26 18:21 - 2015-05-26 18:21 - 00000000 ____D () C:\Users\John\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Care Antivirus
2015-05-26 18:13 - 2015-05-26 18:21 - 00000000 ____D () C:\ProgramData\18AFB925B8834DCF000018AFA07A5209

Due to the fact that this was run in Safe Mode, CreateRestorePoint: was not inlcuded because it can’t be done while in Safe Mode w/ CMD.

Also, EmptyTemp: was excluded because it’s a new system, although I would normally include it anyways.

Edit 2: In case anyone is curious why it’s named John for a user, I copied Windows example for a User Name :-). Wouldn’t put anything that might reveal personal info in there.

Announcements