NewsThe story behind Avira’s new Mac application: Developing security software with Apple’s latest technology stack Learn more
Compression used in Maktub locker is BZip2 ….
1000516E FFD0 CALL EAX ——————————–> kernel32.ReadFile
10005170 85C0 TEST EAX,EAX
10005172 75 08 JNZ SHORT 1000517C
10005174 8B4D E4 MOV ECX,DWORD PTR SS:[EBP-1C]
10005177 E9 A9000000 JMP 10005225
1000517C 8D45 D4 LEA EAX,DWORD PTR SS:[EBP-2C]
1000517F C745 EC 00000000 MOV DWORD PTR SS:[EBP-14],0
10005186 50 PUSH EAX
10005187 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
1000518A C745 D4 00000000 MOV DWORD PTR SS:[EBP-2C],0
10005191 50 PUSH EAX
10005192 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
10005195 C745 E8 00000000 MOV DWORD PTR SS:[EBP-18],0
1000519C 50 PUSH EAX
1000519D FF75 E0 PUSH DWORD PTR SS:[EBP-20]
100051A0 FF75 E4 PUSH DWORD PTR SS:[EBP-1C]
100051A3 E8 B8040000 CALL 10005660 ————————> BZCompression_proc
thanks!