Ransomware lands on the MBR

Full Story: http://www.prevx.com/blog/163/Ransomware-lands-on-the-MBR.html

TH

 

Ransomware can be subverted through proper Windows Securityware.

 

MBR Ransom (Seftad)

As a test I installed MBRguard in a Win 7 VM then ran this variant with the VM rebooting straight back into desktop.

Before installing MBRguard:

 

@ Triple Helix

Thanks for the link etc Turns out it's NOT encrypted at all Cheeky ! Also clever that you can't use the usual “fixmbr” to restore the MBR Trying to fix this would be a nightmare for most people out there and so i guess they would probably pay, which is of course the MO unless they got pro help.

Indeed, if set up properly and the user isn't tricked into clicking etc.

@ Franklin

Good to see that MBRguard protected in the VM case Do you know if it's VM aware, and if MBRguard would protect in normal mode ?

*



FAQ's -http://safe-data.ru/faq_en.html

 

No i don't think it's VM aware as it does what it does as normal.

This sample doesn't encrypt anything and one of the fellas over at KernelMode mentioned it could just be a test release before the real thing.

 

If set up properly, the clicking by the user is rendered impotent.

 

@ Franklin

Okay, thanks

Not always, because if someone mistakenly allows something they believe to be OK but isn't, then even though they have good protection in place **** can and does happen !

 

"allows something" What does that mean?

"good protection" How do you define that?

 

would a low level format using dareks nuke boot remove this ~ Snipped as per TOS ~ malware??

 

If you have the same one I tested you could try the unlock key or fixmbr command.

Unblock key is aaaaaaciip.

I noticed you posted in both the MBR and Screenlocker threads over at KM. Which one is it you're trying to get rid of.

Some of the screenlockers are active in safemode so I would say you would would have to use a most recent live AV cd such as Dr Web or Avira or if you know what and where the main exe resides then a live cd that can mount the file system and delete it manually.

 

its the mbr version i am trying to get rid off. it is on a clients pc and the unblock key does not work.
i have tried all bootrec.exe commands but its still there, re-installation of win 7 fails half way through. any ideas?

 

Have you tried deleting/recreating the partition first then reinstalling?

 

yes i recreated partitions using partition magic and then deleted the partitions from the windows 7 setup menu. still no joy

 

Besides 0-ing the disk as a last resort, have you tried recreating a new partition table.
Wilders' resident Mrkvonic has a concise explanation on his Dedoimedo website for GParted; check 'Task 4: Create Partition Table ' link.

Mind you, 'seftad' is not something I'm familiar with, so it's just a suggestion.

 

Have read that Partition Magic shouldn't be used for a Vista/7 install.

You could give Partition Wizard a run which seems pretty good or GParted.

 

Franklin, how does sandboxie stand up to this?

 

i tried it from a live cd so it should not matter, i'll give your suggestion a go along with baserk's suggestion

 

Sandboxie, Geswall, Bufferzone, Returnil, Shadow Defender have no probs handling the sample I have.

 

Thanks Franklin for your test. How about DefenseWall againt the sample?

 

Run as untrusted then no probs stopping it.

 

Any chance you could test Mamutu? Interesting to see whether a behaviour blocker can handle it.

 

Mamatu - sheesh, what a pain to setup with email address/passwords but wins against this sample.

 

Thanks Franklin!

 

Thanks Franklin for test and expected promising result.

 

I played with it for a while.

GesWall- - - - - Passed
Win 7 UAC - - - - Passed
CIS Defence Plus - - - - Passed both on default settings and paranoid maximal settings( though you get a prompt to sandbox it on default settings, you must choose sandbox then).