Sunday 25 November 2012

Multi Locker

I've seen it on kernelmode for the first time on a post, i've looked fastly just the panel...


Edit a file:


More recent, a friend gived me this link via IRC:

Oh... it's another RunPE crap:

When unpacked, just 15 AV detect it:
as winlock?! let's have a look.
A routine decode the config strings inside:

Then it retrieves the address of functions
And start the work, hide the file:

Add a registry persistence in \Run and delete \SafeBoot

Create windows:

If program manager is found, terminate it:

Set the windows topmost:

Test internet:

Prepare the landing:
Then i've run F9...

Lame landing:

It also call the gate to know if we kill the process or not

Multi Locker landing editor for this sample:



Oh... well, another winlock kit ripped from another winlock kit, i'm not amused to find sale thread and shit, this kit is designed to fail, my net is slow as fuck for the moment i will post the rest of pictures from the C&C later.


Analytics botnet:





 Change password:


  1. I have some questions:

    1: what is that /SafeBoot that it needs to delete?
    2: is all the CreateWindow thing is just preperation for the landing?
    3: what is "program manager" ?

    Greate blog, keep it up.

  2. Hi,
    SafeBoot is deleted to make the system BSoD if he try to go into safe mode
    CreateWindow is used to create the windows some sort of preparation for the landing yep
    for program manager i don't know

  3. hi xilytol, im wondering if you could answer a question, thats the only place i know you answer regulary.

    which vpn/proxy do you use if you use any?

  4. When you say, "this kit is designed to fail". Are you saying that because of the ripped code or how easily it is to get rid of the locker from the cpu?

  5. where do you get the multi locker ?
    did you pay for that ?

    thx in advance

    1. lol xyli wouldnt pay for useless shit like this
      researchers share this kind of stuff