App Review CryptoLocker Ransomware - Demonstration of attack

[GrujaRS]

Require payment of 0.55 Bitcoin to the address; Support e-mail:

suppteam03@india.com suppteam03@yandex.ru

 

[Dirk41]

Thank you again.

No smartscreen here

Would not be useful to know if the test is run under admin rights ?

 

[Anker_by]

thank you for sharing.

 

[DardiM]

Thanks for your video

- Antivirus scan for bda316616f19691c1cc65c3f3acc332f54cd2ab4c0eb0d670c0fc228640ff87c at 2016-11-12 00:08:07 UTC - VirusTotal
- https://www.hybrid-analysis.com/sam...ab4c0eb0d670c0fc228640ff87c?environmentId=100

This file is on the samples posted by @silversurfer (Malware Vault forum), see there for AV tests :
https://malwaretips.com/threads/11-11-2016-11.65387/

Remark :
"Demonstration of attack"
The aim of video reviews from @CyberSecurity GrujaRS with this sentence, is to show us from the beginning to the end the attack of some recent malware version and the ransom part, not to test any AV / Security tools

 

[Dirk41]

Thanks for your video

- Antivirus scan for bda316616f19691c1cc65c3f3acc332f54cd2ab4c0eb0d670c0fc228640ff87c at 2016-11-12 00:08:07 UTC - VirusTotal
- https://www.hybrid-analysis.com/sam...ab4c0eb0d670c0fc228640ff87c?environmentId=100

This file is on the samples of Malware Vault forum, see there for AV tests :
https://malwaretips.com/threads/11-11-2016-11.65387/

Remark :
"Demonstration of attack"
The aim of video reviews from @CyberSecurity GrujaRS with this sentence, is to show us from the beginning to the end the attack of some recent malware version and the ransom part, not to test any AV / Security tools

How do you know which files the OP used ?

 

[DardiM]

How do you know which files the OP used ?

See the video at 00:11, we can see the :

MD5: 881f86bf4bb4b9f0e993b2853a0a27cf

Spoiler: details

=> it is then easy to use the search tool on

​

- VirusTotal - Free Online Virus, Malware and URL Scanner
​

or

​

- Free Automated Malware Analysis Service - powered by VxStream Sandbox,​

On some other websites, the MD5 can't be used to find the file, so the SHA1 can be useful in this case

(Why not use the file name ? Because it can be different of the one you see on videos : we must use an identifying signature)