Malware has grown significantly in the last decade, both in prevalence and complexity. We will present some ideas that could help in detecting and disinfecting a Virlock-infected system. The disinfection process for this virus involves searching inside malware code for specific instruction arrangements. Having these protection methods will also make any clean-up attempt quite a challenge. Each new infection is different from any other, mostly because of the timestamps that play an important role in computing the encryption keys. There is also a moment in its first execution when it shifts its shape by changing certain instructions and encryption keys so that new generations will look different. By staggering the decryption/encryption process, it ensures that a memory dump at a certain point will not reveal its features but only the piece of code that is being executed at that time. After a sequence of code is executed, Virlock encrypts it again. It also protects its code by decrypting only the sequences that are going to be executed. Virlock uses several techniques, including code obfuscation, staged unpacking, random API calls and large/redundant areas of decrypted code, to make it difficult to analyse.

In this paper, we aim to cover the techniques used by this virus and discuss methods that can be used to detect and disinfect systems affected by it. Win32.Virlock, with all its variations, is both a new kind of file infector and a piece of ransomware (screen-locker) at the same time.

Increasing the number of executed instructionsĢ.2 Analysing Virlock – Combining purposeģ.1 Revealing the core, inside different malware versions Analysing Virlock, Refining Behaviour, Combining PurposeĢ.1 Analysing Virlock – refining behaviourĢ.1.1 Not embedding malware code, but embedding a clean file Ransomware and file infector evolutionġ.1 Old file infectors, behaviour and purposeġ.2 Old screen-lockers: behaviour and purposeĢ.

Crypto locker source code