Dynamic AnalysisThe malware sample is distributed in the form of a DLL. To run it in our analysis environment we can use the
Rundll32 utility.
The malware locks the screen by displaying a form that covers the entire screen. For this, it obtains the size of the screen through the
GetSystemMetrics function which is then used to set the size of the form.
To restrict the screen locking to a small area, we can modify the return value of this function call, such that the form only covers a small part of the screen as in the following image.
In addition to the above method, we can also use the
desktops utility from Sysinternals to create a new desktop which is unaffected by the screen locker.
Disabling the screen lockThe best and ideal way to disable the screen lock is to enter a secret pin code. The screen locker would automatically close itself if the secret pin is entered. Unfortunately, this pin is almost impossible to find as we only know the md5 hash it(EB65306635FECC6ADC4AFC5752C2B20A), which is infeasible to reverse. In the following image, we can see that it compares the md5 hash of the entered pin to the hardcoded value and terminates itself if they match.
These pin codes are actually cash voucher codes from ucash or paysafecard. An example of such ucash code is 6337180015919250100. After we use the code, the malware tries to communicates with its C&C, and checks for verification. Since at this time, the C&C is down, I have not done further analysis.
PS:
Thanks to deque for your contribution in this field. Hats off.
