General

  • Target

    06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3.sample

  • Size

    199KB

  • Sample

    210726-3jlzdh6tmj

  • MD5

    9f39c185c3cb3ea935d829d5280633eb

  • SHA1

    70b067106ac7a336f68c3d4317fec402c718ce7d

  • SHA256

    06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3

  • SHA512

    f70768c093b9fd8a6bb58f882b2a57e3c15f7c54b5eccc424730579cc700be8479ac47fa5cb773a25b5476ba5ce1f4b9ad2e7e6b8356e8e2e04270ca5aad1557

Malware Config

Extracted

Path

C:\NEMTY_5BGFY7F-DECRYPT.txt

Family

nemty

Ransom Note
---> NEMTY 2.3 REVENGE <--- Some (or maybe all) of your files got encryped. We provide decryption tool if you pay a ransom. Don't worry, if we can't help you with decrypting - other people won't trust us. We provide test decryption, as proof that we can decrypt your data. You have 3 month to pay (after visiting the ransom page) until decryption key will be deleted from server. After 3 month no one, even our service can't make decryptor. 1) Web-Browser a) Open your browser. b) Open this link: http://nemty.top/public/pay.php c) Upload this file. d) Follow the instructions. 2) Tor-Browser a) Download&Install Tor-Browser. b) Open Tor-Browser. c) Open this link : http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php d) Upload this file. e) Follow the instruction. <BEGIN NEMTY KEY> eCnThtyzIEwlZ44RVGflZ4DtZgamFa9k9HtWFe5vrUA6/VycuU/FBe2gX6gwKikxWdmt7r6sSXn7UriiALUex5u2bU2qlcek0UqR/P+WVLt1RVWooMEshdphYYwqmXlZdzcWNcQTUaTewqd6shMJvPbIq7/LwN8GSBejD8vi77eBgQIF5OC+wI0+tWLw7/sXaJ92/+CAOshH8v8tGZ5K2DN1mPZ0L+yw0VyGa29GMuMbvJZiIzfyLNW1v8eLlM7luc4PYmQoGFxDb+++HN5Pdj71KssWWOk+s1CFP4DnI1x/cKoSyOu0XlAeCzIVhlR192srU4xi/IFXm64Jci379keAEbGJ67br/4heYQIBjBOEcJg9wToOj7R0uHEd5GUjdsbDUYqEjss2yItu0tOZtmk/IdvM3AMdLDy1VjxL60MnJhOwSo7YRKce/NrxQfHiW6VktSnVJLN1VzAL6hgL238WzBecNt6sh7mYdx5I6HzdHr4vtifXi0J65UHza/HZZwAGQcMJB5Qo0q3sx6P2LKjg/VVcAcS/m6IG0OVk0utq0KYkSX2B5yTphOrXSNBZ4iY9gLfAPhSYE4VCS/pI+7VTlvY6kfh4+f4FIo/mFuJPIU7WI5YuttAIQEYR5amKQUQMQtw9HaaCclhop8B8V8p0kap08TFjWoP2kcyLRgX5eIRlNunWzOCa7VciE56MByqk1fGw//7i/2Sn5pXa2gK7sW478T72ZoJTdIo+B6zLmyufDjWlVFwJxZhdL0yYBXtblRTfCtMXXob6oHWNswt5rXyZD7y//ErBBK1J/plRadKZK6gXdWZIGbUqT3tLmBc1MjKwLbrOxIeOnmM712OA1xRqQPRHwqFzdCD1dV/whNx8UI5c8MkHPGWaZqhRBU3N/FrwmRqKFcLVA/Nq78iRX79AgzbRSsXUpijkD71DxeFjfBgNGr2h61shFXs0HuWM5UbK7rDqjV7XU41jyHlWLOD5uGPWP8/PoIcYlW6xzq0N4wh4wjPpS6Gl26ECJmfNogMyzkoYKePUq2qZ/KTKVGdznxEwF9PZ1LpKM0oAh00GLPaqQLfV8uZMrPAaf8K9gZ6kee/zT+ZpH8wXOwuY4bUAcEVvLerFh+O5lkmFANobcWJi8tYIChsTHCqlmM8uWe+anV2fDz65XAf9pdOeGaYH2w7SYdN5Pt3c7U/4hPujYQKPz9gI+FxgJhGksahcXqsAE19Lx8sJW/ak33oaRNVvvAd7Dv1fpRc0MiHuOrmC/qZmjWMXWttiIoxD+FlWSd+QokPNnPiAJo/D6SHa//ZKJeVXCfIJ+Xkh7Fn/VJFjKk05FNZx5xe+gAR03wwwUzcRmtMgfMU5XaQCIQ==5d1KS6LvK337Xczr2Yod9PI3ny8YlISkY5P6rb4MpZcbKfLr1gVyaQLbt6V7UCuSvLqCMzdXVaz9Cjt9qy6Hvg57HkAZ5cZV+eD1itU5a3RxavpGpBLLy7Jwh71CQcWTqswJSwqZAsPYmvog1mgYzcNaDwaAyNWckLa8HV27eX+Tb27ua0h+a4CqGSUfjrfapHe64jZmvaOnU+pajApc0AFCNkUZl7U+wOrgOHQv+SA4VYgledPuNp4S+yUGll0x4g1qCJV1NmqrqZseQlNTeyhq+8OuXHLXVF8GnI8GgWQbwFKtWKrzT+0oUjbUaxpp3wPAf4cwgKL3KUuy+agpIWPNN+U63g94yX0OXkunwY3Qw24KWpoLAb0dgsTLVxIOxHAcd5/7jUCv9ON5G/UO8g/K7/v4q8Kekd7T1g4Lh8gIxNYzQ5VVyvYn+bbuGPFxOsLxaLC7H04E2/jBr1IQGcgF8yukDq2D1cJzyQuRHTYSiuN7RCPSzA8cyWM1FeaAdboAkyofSVYhtNN/t9EVoU2c3jMFzZWJOtH6QIv8lygFYKqRFkgdei3lzKovD4EuItVt+P2mOe/aw81Bq3sVfKTIK/xLeqDQSTBhIVFKU/d8XjrYFZxFYspb3klJ7+HIRq4lywninU8yC+kIu+d99/IKG4jqi3Xrgci/rP2nX2EDNQdSmuyD5Yr2ML18P3venWCNZCNVkeu6Sozy7Cv9ILXwmXswVcoNaxDwQ7lK8DGKY6Jwnj2qWa8mlZAAZ3MCl0WMt9nzg5lGVWgRM40rYYCeGkuyu158WCBSe0VXI10UnecsMFWvjCZavXLOz+JbEuQTLhzVYKLIAxPAts8tHE6WiDCclk0apJytxJ48g3jkEFi/DiJQlUdehcbBB5pU834Ggj4KQ6tH+rOk6CCuBFv0ITnCF9L2mhYQC7m1nuv1FKpf+enMRpRPfdwohOhBlOx6lLh/XgA78mk4lujRbEtpR2L8wwaVD/BFNpJaRDKuq91BBaoZWOHZDRnlLzmvV9ubqgLk+odH0kxwPonWskVLHSzM6PAs/SaVQknRT9Mm33v9b2ANBc/1pIfzzXk2gmF7CMljcEl2Jt4dH0UkZWN9NIG6eG0EAwC0K7c8hdw5H5gq/tGOV9heQp8FtWYZ8dI+AHbCjWtQ86IdjWnBY4GhxGQKHaCb8IC4PM+H7PaoOLlIEgDna6i4DFGJhB0qbwJoLWp7r3QL056r3jSMLPkc4aTQ07RI27ytL/9DbeWyFUnJXp6cNuykHdC57DwIS+GmIa5rNL8rvYLis0lr1D/draDnr2lHwG3loifq9RB/1pybyT3dMyiB6tFK0YDFQdXf/VaFVjdRmX9UPrUaqQ==
URLs

http://nemty.top/public/pay.php

http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php

Extracted

Path

C:\NEMTY_LZHHLEO-DECRYPT.txt

Family

nemty

Ransom Note
---> NEMTY 2.3 REVENGE <--- Some (or maybe all) of your files got encryped. We provide decryption tool if you pay a ransom. Don't worry, if we can't help you with decrypting - other people won't trust us. We provide test decryption, as proof that we can decrypt your data. You have 3 month to pay (after visiting the ransom page) until decryption key will be deleted from server. After 3 month no one, even our service can't make decryptor. 1) Web-Browser a) Open your browser. b) Open this link: http://nemty.top/public/pay.php c) Upload this file. d) Follow the instructions. 2) Tor-Browser a) Download&Install Tor-Browser. b) Open Tor-Browser. c) Open this link : http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php d) Upload this file. e) Follow the instruction. <BEGIN NEMTY KEY> cqcB97OOkww0oMZMCmy9q6X8+8/FQ03A0no5RYHxRSlxydnvjJAuPpRiZbVd9qNHBTOAur8FW9EA4LbuUjHfA0gshS4CYLS4KTxAQYK+nz7ym6q/DtvtNX5ybe/ds5FS+rODck9k468cSQWw6l2sZdAX2h2LRwt/m9AnYQR3Bvi542UO8QzPGS1ALyCK3b+HObayM7xzwXxKbNqc21iBO5ls5yU7q0IdFl0jST8pF9mL8FE2GWXqIlPzhXkDmWWOGmT+/9MXl/xmuAYmat0NBcjuIBcma9KOXduEelSc6V6bMe/+1SH6mabCXA8TaoM1ybeMEPjQ+aYPzfgsBrWLMZEOMkqUKJkpl8QbOUNAAfbKbawP91HuoOMh1gzCQEs2BWW6WvGwe8HT4wkkhKgpq2WliFtpIpGpyugXp43S52KE7MVkndEVkOIHuWDd0tXGPUduivUaZKKS+6Wj5z6CFZ78jFq56T4tFy4HfpyP7he+BwAP29uWu38FAVdMNQReyzLaSsQe6Xh3Ck2nymEynm/MBYPCVZpAVNz3jtqtTfxugYmiIH8W4gIhB9v/VS2xilNuALg3dNxdSR3yS3Mzfe3G45N3MiPzHBxfvEiFPtV+OwngQRpckAN1ZSnTVGRUTPXtZMR2yiZ7ACaHb2ZFhBDzBHeC7DVpqqpw3r38gw9YGHJbcFC87mCLfPgj2X+aIsS7RbW8lIMrEWReJG5VVPcg9z+LBCFoZTLl//TeZC01PFitIogM1UE4U03ACo0dwjkVKPXmKW2fU8tAdcT/GYIay5PKq0oHvitZ68ZUkNaOVD+c2MXk1Ba4MXyH7sjbsFzYbU2w9xGLbKD+p0iPUsuN8gUl2FrS6GxDS9VS4JVXjm7mJgr77zy/wYVmPweu1WvBudrXcOb8okE/DcYIa8y7jS8mB0CAETcwwv/sqfBSQPBSvnL0Q2gimkjfMIvRqzSEuqlcjcg1NuYzyEeIOUEf/EFANjil3gW/zMBTfWLHgZZb0GuRd6xicaWWo761ykg2REfjJ558dukZxkUjQ2Xg8eQQFnTaP0K3gEup+sC7f61o5d01tJTkk2NXBKTdjnwNaVHXoswv3KE950Sll4szGFJsgXziZy4SmWt9HcoBeJQbf3iDe3ym1gLaisJ9gcW01zXz18rdKB+K84cL4e/nrH7rn7ZA27xQgxMOGSmHvqieJIhlswfgSPj1e9HRV3NeBi3dxJHU6EBvaGz+VbqoTaU0Na7WrIIK6GtgQFRcSDt8BowJ3FldxiYL4WB8S/Uc6zm38Q3yU05gmzzqH480dJsgSy5GFKaTpOCvAwRHa9uxhQdWqkwCQTp6IfzlqL+T9v4k3Yvx/uAoEkrufg==3G20tPrFKTOV1to4hJadIMrDBjJ4ASrly6BXvA0IFj+NccHrahZ7a6NK7Q5yF9K9p5b1/WjMJIpY0Biyqy89x7YOBHc6s1s0DYz3tAXhOD4+d7kZi81lBl6gE8rE/o1O8HYjifEAo5NDXCh5rWrp5nVclZoLxy7IkNZIolShwKe8/T+lChsI9ZP91dEeegyswwW/8cnhDpMmQJu4+Sd4kDYK483A7v/04bDHtn+Fao5oAD/qYKm6zWAhsRjjzlWcoOvy+yujzDiC00imGOHLGsOzLxrkVA/Gfx+OXkLRDKiyXixrbzH7e90Vl8bQMkKvqiOPaplT6RELtOxY0DqdT2xlxxxZ8BZyz8xWx8tjLzh3WW/86CpVU+bLiHAbqeWnTglWQmBpyVez0FafXqY0WsvySc3XjuSRgR0W0XcOV7Cl0tRyy+KLtRr0qk1XRsTaIfuA6vJCUadc4ggs6LtevvHXkvN1XHcioP+Ean6qaOIYhL3VHpRCvR3LueH+8H5WwY3PeHiAP7ZJpzR1GhcpmdxXQV32LvNN9h2hcIT3m50LJICHUmWVd3a0B6AjyLwYDQykzVLZYRHVFotC3MTqNFrf4+rpNvGJABBbFyB8mXjJGymVcgKA8E1AiUC2HDlH4wbhmeDVFguZUP3m3y4nhz3Nkl4J5gVjh5PSFpwi7cwM617DJSQ/SUYr3+eK8udyGRWiNFoDrZIXhE+Xa13oBNjU2ejS5r2OVL6QMCY1qVoNhocNmU9llz3yvraJ43DPFiog28jYCxnjfahHoz/zp+b5rEkJtlmi/MKN+qYgNWX9eL/wK/EXNTs1vdRDz8mlrrByHxPrFmLa8yMslsy4M+rTUQ6s0NTJDFx+7X/WiOj5lvwU0itIjU4/8BK2VKXPRhDRNcl7cB6ZyKPhBRb0s1scUJHg6VyaeXkSRVywU1gBg4OQWzv0Vqz3l2a91HXaR5eTXCTA1sc14gUjdRqc/oRgWcKaHqFv/frUFnOOyUDIOusgTgfHq8wH2qQDIa78FdNFCDl+n5EUg/vUb79Aa5ucth6ymnqPJzOTFQGq92TZMUgm+ndgY9OLeTZ5qqqNr1bbaYAm/9FJDika/3XxVccw5f8sG0GEt4xBHmk6h/23f69TicP9zU59CNRGoJW/j7HNCTPFAZurN12eXQw8z6yHh9htPob1Mm1fHxEIOZ66rvJFghSPYcba6JWrE0jSafRHublGnjT/KsbuBAdPAMKRQYfS1gzeRByxTnDaeeScEsNDWsTsnErMhsb75jogDzrjdPM13Oodvrp7DAbQwJ5CWja8cK6C3N2s6cAzHD+CdJoev4JL77GKNMUrZApEzF8D8Vl6B+a2QHhslcTXRw==
URLs

http://nemty.top/public/pay.php

http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php

Targets

    • Target

      06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3.sample

    • Size

      199KB

    • MD5

      9f39c185c3cb3ea935d829d5280633eb

    • SHA1

      70b067106ac7a336f68c3d4317fec402c718ce7d

    • SHA256

      06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3

    • SHA512

      f70768c093b9fd8a6bb58f882b2a57e3c15f7c54b5eccc424730579cc700be8479ac47fa5cb773a25b5476ba5ce1f4b9ad2e7e6b8356e8e2e04270ca5aad1557

    • Nemty

      Ransomware discovered in late 2019 which has been actively developed/updated over time.

    • suricata: ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M1

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Discovery

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks