Malware Analysis - HolyCrypt and PowerWare Ransomware
Channel: MalwareAnalysisForHedgehogs
Date: 2016-07-24

We analyse two ransomware families that made it into the news this week, one .NET assembly that executes a PowerShell script and one Portable Executable that was created from a Python script.

My malware analysis course for beginners: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?referralCode=EE0E2DC9FA7388FF25B7
Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

HolyCrypt: https://malwr.com/analysis/MzU0YjJmMDRiYTc5NGU5OWIyZjdhMjg2ZDU5MmZmYjk/
http://www.bleepingcomputer.com/news/security/new-python-ransomware-called-holycrypt-discovered/

PowerWare: https://www.hybrid-analysis.com/sample/7f1023a3d523ab15fe3cceb7fde8038199510703a65dd03d78b9548eb2596b51?environmentId=100
Alternative download (password "infected"): https://www.file-upload.net/download-12594937/holycrypt.zip.html

PyInstaller: https://github.com/pyinstaller/pyinstaller
pyinstxtractor: https://sourceforge.net/projects/pyinstallerextractor/
PortexAnalyzer: https://github.com/katjahahn/PortEx/tree/master/progs
strings.exe: https://technet.microsoft.com/en-us/sysinternals/strings.aspx