Trojan.MBRlock (porno_xxx.avi.exe)

This trojan blocker ( MD5: 2dd6e1adf25964330a38bda9a76dc68b ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

Transfer number: 89162609465
Code to unlock windows: n7856tbt*&^n

Trojan.MBRlock (xxx_video_48529.avi.exe)

This trojan blocker ( MD5: 314373072c134689912cdef38e7dd120 ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

WebMoney: 079030161849
Code to unlock windows: 00043176

MBRLocker Builder v0.1 / MBRLocker Builder v0.2

Yesterday Vazonez released a new winlock generator

This hack tools build MBR lockers, it write the MBR, and request  unlock code.
MBR code is based on an existing ransomware (Trojan.MBRlock.6).

You can configure the message text, password, unlock code, color and icon.
Here, a sample made by MBRLocker Builder v0.1 in action:

 It's simple as usual for find the unlock code.

Edit 25 Jul 2k11: MBRLocker Builder v0.2 released
What's new ? fixed sector bug, Serial is now xored with a random key

IDA Schem of the serial check:

Hiew view:

More 10 sec to unxor the serial maybe.
I've made a VB6 code for retrieve serials of MBRLocker v0.2

'MBRLocker Builder v0.2 Generic serial retriever
'Contact: xylitol@malwareint.com
'Add just one Textbox with name: Text1
'Then just Drop your infected MBR Dump


Option Explicit
Dim XorKey, strSubstr, buffer, sHold, sText, sFileExtention, TotalChaine, Path, ipos, sOutput As String
Dim iLocationOfString1, iLocationOfString2, iCompareStyle As Long
Dim a, b, i As Integer

Private Sub Form_Load()
Forme.OLEDropMode = 1  'Manual Ole Drop Mode
End Sub

Private Sub Form_OLEDragDrop(Data As DataObject, _
                              Effect As Long, _
                              Button As Integer, _
                              Shift As Integer, _
                              X As Single, _
                              Y As Single)
  With Data
  sText = ""
    If .GetFormat(vbCFFiles) Then
      If .Files.Count = 1 Then
        'Only one filename was dragged.  Retrieve it.
       Path = .Files(1)  'Note numeral 1.
       'Pull text file data into our textbox.
         Open Path For Input As #1
            Do Until EOF(1)
              Line Input #1, sHold
              sText = sText & sHold & vbCrLf
            Loop
          Close #1
          Text1.Text = sText
      If .Files.Count > 1 Then
      Exit Sub ' Dude, wtf are you doing here ?
     End If
    End If
  End If
End With
ipos = InStr(1, Text1, "EnTeR c0d3:") 'Check 1
If ipos = "0" Then
Text1.Text = "Error: This is not a MBR or it's not infected"
Exit Sub
Else
ipos = InStr(1, Text1, "wExE") 'Check 2
If ipos = "0" Then
Text1.Text = "Error: This is not a MBR or it's not infected"
Exit Sub
Else
TotalChaine = ""
buffer = ""
Text1 = funcParseStringFromString2String(Text1, "EnTeR c0d3:", "wExE") 'Parsing
Text1 = Replace(Text1, " º€¹ ¸ » Í ê8 Š ‹}¬Š €ò", "") 'Remove useless shit (generic)
XorKey = Left$(Text1, 1)      'XOR Key
XorKey = Asc(XorKey) 'Get the Dec
strSubstr = Left$(Text1, 15) 'Hardcoded remove
Text1 = Replace(Text1, strSubstr, "") 'Remove hardcoded
For a = 1 To Len(Text1)           'Let's loop until the end
b = Asc(Mid(Text1, a, 1)) 'Grab one dec char
TotalChaine = XorKey Xor b 'unxor it
buffer = buffer & Chr(TotalChaine) 'make it char and add it to the final serial
Next
Text1 = buffer 'Final result
End If
End If
End Sub

Function funcParseStringFromString2String(sSourceString, sString1 As String, sString2 As String, Optional fCaseCaseInsensitive As Boolean = False) As String
 If fCaseCaseInsensitive Then
iCompareStyle = vbTextCompare
 Else
iCompareStyle = vbBinaryCompare
 End If
 sOutput = sSourceString
 iLocationOfString1 = InStr(1, sOutput, sString1, iCompareStyle)
 iLocationOfString2 = InStr(1, sOutput, sString2, iCompareStyle)
 If iLocationOfString1 = 0 And iLocationOfString2 = 0 Then
'nothing found
sOutput = ""
 Else
If Len(sString1) = 0 And Len(sString2) = 0 Then
 'do nothing
ElseIf Len(sString1) = 0 Then
 If iLocationOfString2 <> 0 Then
sOutput = Mid(sOutput, 1, iLocationOfString2 - 1)
 End If
ElseIf Len(sString2) = 0 Then
 sOutput = Mid(sOutput, iLocationOfString1 + Len(sString1))
Else
 'cut off begining
If iLocationOfString1 <> 0 Then
sOutput = Mid(sOutput, iLocationOfString1 + Len(sString1))
 End If
 'take off the end part
iLocationOfString2 = InStr(1, sOutput, sString2, iCompareStyle)
 If iLocationOfString2 <> 0 Then
sOutput = Mid(sOutput, 1, iLocationOfString2 - 1)
 End If
End If
 End If
 funcParseStringFromString2String = sOutput
End Function

Related ~
How to debug MBR Ransomware (14 Jul 2k11)
Trojan.MBRlock (xxxvideo.avi.exe) (9 Jul 2k11)
Trojan.MBRlock (xxxvideo.avi.exe) (4 Jul 2k11)
Trojan.MBRlock (output.exe) (25 Apr 2k11)

Already noticed on the past: here (25 Apr 2k11) ~ here (4 Jul 2k11) ~ here (9 Jul 2k11)

How to debug MBR Ransomware.

I received several questions about previously posted MBRLock, the idea here to resume all: a tiny tutorial for pwned these lockers.

Firstly get infected (lol) you have two options, browsing a fake porn site and get exe or visit an infected webpage who lead to MBRlock execution.

The xxxvideo.avi.exe file have generally a ~61Kb size and most of time use a VB crypter.
It spawns new copy of process, decrypts data and writes them to new process ImageBaseAddress and then resumes main thread.
A quick way to unpack it is to set breaks on CreateProcess/WriteProcessMemory, but here the unpacking is not really important (We want just the MBR right?)

A fast way is to use HideToolz by Fyyre and enable the reboot protection, then you can infect your machine, HideToolz will block ExitWindowsEx done by the MBRLock.

The MBR is infected... what's now ?
For make a dump personally I know two way: Hiew and HDHacker.


HDHacker is really handy:

Hiew is fastest (and used by most of malware researcher?)

For make a dump with Hiew, load it like this: hiew32 \\.\PhysicalDrive0

Then in hex mode press * for select the infected block and * again for finish,
Then, F2 to save the dump.

Now we have a copy of our infected MBR
To debug it, we will use IDA Pro, but firstly you need the good packages.
- Bochs v2.4.6 (you can use a newer version if you want but IDA Team doesn't recommend after v2.6.6)
- Python 2.7
- IDAPython
- MBR package of Elias


Now.. install 'em all.
Drop IDAPython folders into good IDA install dirs
Make your bochs image with bximage.exe, hd, flat, 10
Then build your image file with "mbr.py update"
Edit the bochsrc file of Elias to fix the directories lines and voila !

If you use another version than v2.4.6, some parameters may appear deprecated from the bochsrc file.
vga_update_interval: 150000 => vga: update_freq=60
keyboard: serial_delay=250, paste_delay=100000, type=mf
or well, just figure it out by reading the docs :)

Drag 'n' drop your bochsrc file on IDA, and you can start to debug, if everything load properly :þ

From command line if you prefer debugging directly:
idaq -c -A -OIDAPython:mbr.py bochsrc
ren bochsrc.idb mbr.idb
idaq -rbochs mbr.idb

For do it fast with these lame lockers, here is the interesting code inside the bootloader:

Nj0y ~

As a tutorial, special hello and thanks to: Fyyre, EP_X0FF, Corkami, Hex-Rays guys.

Trojan.MBRlock (xxxvideo.avi.exe)

Thanks to EP_X0FF for the sample.
This trojan blocker ( MD5: 832d2a45c441a9e095ffcc4373be1f35 ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

Number to Call: 89091621343
Number to Call: 89629880508
Code to unlock windows: H701630

Already noticed on the past: here (25 Apr 2k11) ~ here (4 Jul 2k11) ~ here (9 Jul 2k11)

Trojan.MBRlock (xxxvideo.avi.exe)

Thanks to EP_X0FF for the sample.
This trojan blocker ( MD5: d4d95cd82b571b614bc6e92bfaa19e8e ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

Number to Call: 89645619483
Number to Call: 89645098429
Number to Call: 89645098377
Number to Call: 89645098176
Number to Call: 89645098067
Number to Call: 89645098055
Number to Call: 89645097965
Number to Call: 89645097898
Number to Call: 89645097685
Number to Call: 89645097585
Code to unlock windows: G610481

Trojan.MBRlock (xxxvideo.avi.exe)

Another MBR Ransomware, i got this one from EP_X0FF (thanks man)
Dropper in VB, a copy in /%TEMP%/ with the name 'x2z8.exe' is done.
Very familiar huh?

Code to unlock windows: 4011894

Ваш компьютер заблокирован за просмотр, копирование и тиражирование видео с
элементами педофилии, деского порно, гей-порно. Для снятия блокировки Вам
необходимо оплатить штраф в размере 500 рублей. Для этого, в любом терминале
оплаты, пополните счет абонента БИЛАЙН 89636197151 на указанную выше сумму.
В случае оплаты суммы равной штрафу, либо превышающей ее, на фискальном чеке
терминала Вы найдете код разблокировки. Его нужно ввести в поле в нижней части
окна. После снятия блокировки Вы должны удалить все материалы, содержащие
элементы насилия и педофилии. В случае отказа от оплаты, все данные на вашем
персональном компьютере будут безвозвратно уничтожены.

Infected MBR:

MD5: 05e01b6e95c5aff32f484298fd0b6429

Trojan.MBRlock (output.exe)

I got this one when it was new on the wild but not maked a blog entry.
And i've view this post.. so it's time :)

This trojan blocker ( MD5: 1a0f12cc7736b07fb153733c7494d76e ) prevents all software execution.
To remove the Trojan (and unlock windows), infected users need to enter a valid serial number.

output.exe VirusTotal: https://www.virustotal.com/file-scan/report.html?id=5c368108517de7cf09e9614ef205cf49b13b384b49d5456316f3b1a2fe19b9ec-1303456070

The main executable modify your MBR and launch a reboot procedure, when rebooted you see this:

It says after three days the unlock is not possible, but it's alway possible.
That just a way to scare user and push them to call the service.

Attention ! Windows activation period is exceeded.
This windows copy is illegal and not registered properly.
The further work is not possible.
For activating this copy of windows yo must enter registration code.

This code you can find in your windows distribution package.
If you not find them you can receive it by the phone: +423 877 0158.
Registration code must be entered not later then three days, if it entered later the unlocking is not possible

For unlock your computer, enter any 14 chars (or more) serial.
Example: XYLIBOXXYLIBOX
Just after having typed Enter (al = 0d in key code), it check the lenght of your serial (value in DI) and that all.

The original MBR is not lost.

When a valid serial is entered, the infected part is gone

Merci Ange ;)