General

  • Target

    98f260b52586edd447eaab38f113fc98b9ff6014e291c59c9cd639df48556e12.sample

  • Size

    234KB

  • Sample

    210726-g55m9m53sx

  • MD5

    3e6672a68447e4e7c297e4dd7171b906

  • SHA1

    72a1af262187ac809a3c6395e5f3f3f5804e51e3

  • SHA256

    98f260b52586edd447eaab38f113fc98b9ff6014e291c59c9cd639df48556e12

  • SHA512

    033b9387428e83ebae802fa3a2547bef5b4741acd2a1d508c79ec942421d599d68f26196d78961fc07e469226c4a6d24d8e32ff56710105162b9967e5f8159a9

Malware Config

Extracted

Path

C:\_NEMTY_SVSVKQT_-DECRYPT.txt

Family

nemty

Ransom Note
NEMTY PROJECT V1.6 Don't worry, all your encrypted files can be restored. It's a business, if we can't provide full decryption, other people won't trust us. In confirmation, that we have decryption key, we can provide you test decryption. On our website you can upload 1 encrypted picture (png,bmp,jpg,gif) and get it decrypted. There is no way to decrypt your files without our help. Don't trust anyone. Even your dog. There is 1 way how to get to the website: 1) Any browser a) Open your browser b) Type this url: nemty.hk/pay c) Upload this note NEMTY DECRYPTION KEY: vq2kk4FX66mX8scR2CLIz7YUInHsCx/ZIl1BXuEKo5YG9ZDh2yaQCe607qDnO4BAJM8g6ZLPIK/x7O+P9Kt7YRVLJIkhxEJbWNJrOhVwiSeaQFO41BAjdrpZuJUOBs7/Mr3LH0Lnr95sz8Yat8KyGNcSBRfrQKovVlcYkr9koHZL0Jw0b438/eEXn/lzTsVyZHC+DScr/WoZYoO90BLjHmB6h2uBK9x7Xu5vNAjwkahnsKN4Vn3QgLXcMQJTjTYkMKU5Qa4hni1SGhNxGawnwEmis9/NxC5JfGfTQULlDdosLroXJRKNEVMg/oIlFsUamk4wCWEHMvlWuvIt93DPyQf4VsfCORLlC1huwL2Qji5sMXz3jgtSUO6UKGPRn5fC5Hu2mL/p9HiC5B7O+/HVWkDl4cpZ64+Pwlsfp59d7FDJtoEC0anJlfFTWcIHWbuoPKie1Jkc/5KBibUW+vjxJzHkEM+rjw3bGl+C7uOOdBPI89RW04uhsmmVBI2MKFjf25QZw5/59lvvEhGXurbAIuzFUIIGd9IXRbYbjYuH08ThTwC1VmzQzaQeu4sZK43oqzPpVBjyI5OfsJwqXK+KWfM2CYDqO32PSdALgnd1zCg7OMwLZFRhautbD7b6JK7uklY/ZAE0B+LBRiagwy2XCH+0kDeWrbODzshtzhGhzYZmCgng0OleImy88J3q1shGdMX6iOnPgTep+pXI6cLrSUCvF7ItIG9HSONp+xRclf9Q5JzB1GgHwYhUwxi7CiSyTJtuYlbdaLtqJfRubANXYRFLjLjaz8PTTHp48A5FBqoIbvs/7OwQBXsX/nVpXW6Sv10nPp+4BtctsuNXIJDDNLmHkeeyeF+k0DGM//t6HPVVg0VIjWDxc0TfedWNujHsOTQISsAiOqjGMm9VlhFkjhCRN3pcdOlk6v5HB+3HJvXNjg4QnIplQC7fBKAU3yl3WLPDk7oeqRmSluGcNmsc/13qsTiDYhy/KxmGTz1R9OiTA4IMJrYdmgM0wGHsatk7mZKmL+TE7owtikA2utyJYJ8MDkb2LImRoAvCYG1CyjjzetdLTkqhl2ZdO416Nw2GZGtBg+V3Hp8ByDqkwpyRTwhqPEjF8zCi7O5N6tlcQlvlUQ87CnVddANGLAECUaz7fzWbyD3rmN7I3wBxpW2d10fp1cUujgZFaLPfeNCfBtVpvN/X/gIlV+O3WrT+xZ/hL9XGl+Y0/yrt/cZ0Flhmq90WGo1y4oBUPjx92MkVeUksqdVjLXSHl4wYmrhJVrtIbypOSGZHJDWna7AW/DBpXSNc/cdQrtHlJ1MvGp8YM6ji+1OoDDCZ17Zz3STBK0MLk/gPf9Z9OAgGqHxRpO0suw==ZOspwb3YNSi6IaBAWnmGxVWsSp/0IjZJtSyzAkUldzfsbCnuYAc7fC8McQhuojE2yMJfSjTEaSdIMcKfvMqoUPhgR3gMa1eG0oElKyAWtot5jJOS9ymEUj4ukcPFuTa2jiWV2vcH0R7U+YaafUzcW80M3mp8mUmZS5TvWXmJp5bhKH3WPk4wXsn8tGzphqM2qRYB9KL+GaAOPIRqyp6j73JNz2sPpuULgKHTcpZQd71bY8xxduAOYjr2eu+u/6xYRmPiK/YMoUcKabioEIi3XqYbjqhTjxOVXjfpqUaykUF/e/8OdJKXSQ3evfkMm7bFJSxeqxzVKrxoKbC1m6q+KmdWCAzsG7zYDKAESOFkoE+w6o2zjCMYapnKyBHYQn8FvxjoCY47flU0HzZc2OzI49fYacSKqGG7peklzOi30QFnvEkER+k/NdypkcHQhNrN8/SoVACaC17kb8nqz6Aonkwq0dsGeVocdJxNQUxGe6gHdz5oTLvc1ynirTC9mqOBlijX1VfMpmkfQ/++5AWQhdW77pEOEchcPnqVfmnj26d9ED4UoPjBVRmFhfrDvUdEi3Il8rsfyvbosQXa4dDN2v5m4Z0u+HfCitZG9FyNsjEo6i3RzQ1ixmJoV5JqdgSi7AdQDpcFNCP+3jIQckBgXjhV1H18bpFu7OA38gMurS4Ngmo8KEE0pbA2Cl79LebW/xexmlPCEzCb1fyCdu/80awroj92MN0F31iNHVXqepj5zAwzofJT50gdkSsoPs9UfZxI7vdhYRODt+p4Jj2pui57K0ZFALSfpk0M9LAAAf5mdE4/RJj/tAJ1Yi9caRLCR7SSXG/wdIbDVG5sTwN/nZb8O1rtfwzVRn9sQ4miNjlYdzvOMSgChslYIHIW79vsUILRbwOY8qwi2k9mzdEosRy9oa9bpb7AiRha3XUo9UOBe0tZiXWigLB4Z96tjSoIjW++88R4CUnyH5yo0AHfTZqJ4o7g8g081u73RmX7Mcb1WzGEYpfR5XQqTm0HE+CPc3PmjmpU45XrdRY0ZFMZAluxdmbbAymBsw7TIPOIx9SFYWwU1DT4+16DwScb5IH3/A1ie2fLt9NQu+3E8oeeRiNpK5SuueeyGHH+4nrM+cW1/brcNTp84eatTBYv1jrAEfI1SisPHCGT0UU2kCsNMJUsGzjrORvHQCMnJ0pc9+IYXX+b3CKCtGFNztthoKJJ1QrdkeqgFWwLL4nvs5CfgD0jyoucf+A/NALWhtyR/pLrsfdAurcG2kCmHz1qyPwRaBf+Ul0OvCQHQ84V9pxOhBByCwA4LY5ujzwcIIG6TAmnrHLEe7iswmaUQjH1nBLeiBK4D1AprkTVKHuotoclQg==
URLs

http://nemty.hk/pay

Extracted

Path

C:\_NEMTY_RCDRMWE_-DECRYPT.txt

Family

nemty

Ransom Note
NEMTY PROJECT V1.6 Don't worry, all your encrypted files can be restored. It's a business, if we can't provide full decryption, other people won't trust us. In confirmation, that we have decryption key, we can provide you test decryption. On our website you can upload 1 encrypted picture (png,bmp,jpg,gif) and get it decrypted. There is no way to decrypt your files without our help. Don't trust anyone. Even your dog. There is 1 way how to get to the website: 1) Any browser a) Open your browser b) Type this url: nemty.hk/pay c) Upload this note NEMTY DECRYPTION KEY: M8F9kWvYKYunUJaNWM/wapMbgQDrNypeERz9JJdD24J0aWy2JnHOBHnxQ2rS72qUeNc1T7T5GSru6jyaUszSncUSLXDktXItdvXKAq2D6xzRGZrPLDHpGGEipy9YiwXcyLja4WfRBYCWHuVOhTJbqRH9nCXkZ+MkQOjCLW/C/WFDeX4o90ZZ7pni51O5S9iiKkyVSS91cN/JRLxSncolahll1KCG8Bsn1SkL1oNg/teVwdpbdTveu7CUfEiDQGiYQru+8mjsdvbl3xujF8R1nqEyYrO5BTGtLhqQVUhMoQjRC/6DRe3Qe6j0ZV9G6x+sBZLBnAY1JnNKoFuG2LGwjbwwWeiOdcQk5z+igCcpzQN5L6Jqz/7x4EmHTV85Ygotro4Al1XEQvC4OHuBGaWdxwI+8mBlayHf1hE1T2GZFsKWCheRRSz1gD+OvvuYknS/ySmkP2AhD3YlNhpku/nUp6Qg59c70VnAvq52jW/CUa8SbtvRZWl+PHTs8CG1AGhT667xRTQ9vBbyrXbvAbfCvN8POguJ84NslWz9WBGaBNV7n3OTFNL6OBh5mZhFUUYl4Jx0rb2toWNsDE8T5/qF8gUg5Yw8kE9wSOudKwdu9NgGriTobn9vDzUK+f2+23Qw+6QPc6AQTdatkItGrxKdO2xtys0vBS5pYujznLA0qyK1Pg2H3ao6qfPd2IrACp7O3R1ULF0Oge4DxPNS4EnJRSOLMEmWPWwwfTuw4aXjWKBV6lWgPjaJ6xsiywmmfErW7pajTrSAPS3yicA2AfUs2nKQcNHcr8kgR2XFn+cJPgHDWPvF28Gz1KAGDwWRP01yKNd6+6NlO1IRgn/Kklml3UfVLFW7jIAWDf4stVjzaAujSDJYW744BmKA8ywws6MKVGc7v/n3QzFeFoKWHNJ0PbbqqWNvzLjxLi94jegvmaEP/bCkrDn6d0navH+gzLIKlH+HfbA0v6aa+NgG5a4VBORHYUjY2pbm84p8Hzuk01JDIeVeE0sdNU0bFMQDsBz2CcTzQI13pRoedPyJDJYrWZFuQtTrjttWTfHSO2kEmsP1l0NznDx+bAAHQdfjtlW8Xpa94VcaFYBjlItOpLXs/ccOJF9MIrY6tKp2H+HjdH3h7e3SRlDDoxUmtKOeEpWSLtZwsQBJ7qDZLiJdbvp5eZ6gzASREekXoX7y+kDfL4DW8P9dd9U3fTE7cg2EXp5KPK0MRrGpb+ChxEyQPd1qyUd4uSSsCsEQH5+E/0YpiMuTSYJY6NjDWZIj3y1JGfl0GJAvNEtX0FfHI9pBpUnYs8a7lgp7BYZlxLxwbziW2X7dxpJArI2ikd+Mu2leXOUwqpQJJq7m37sMIGm8q9llyg==BYywzVhWwwFjensJsoeGVBmRs5Q7miKmN3GRJGl6OlXZB0NFYERNPnyYREZZs9SMaMMNlKsulnFxkaSYLhReWQFMOuOcTV1GwMFIaCCaHKO4NPAZirE7Ko59GlKCXimy5NDky9Wu3Rrlx3JQHP63wf3vJuTqu5jWOvPZYbJvpnaJD7cOB0k6Ia66asaVD0nLdKzPjMHabUHJADpbgnp8lhl+3qFjdfmoIGMnWA53FNgfI8JcgoQ8tFIp1QeGYeOuYw9cwVvavKjK9/FuJh4I8dQejTB8+Ky5q7BDr/dDsW2a2nbefcXSgokSF2UWkYb4N8NRp5JL/cg0j/YtTNO9s094dOINxxXGhOoVZImJxU11eLi48ifiBXzVbu30xsI4nLQ1fWHIusS0nd+Mrx+SzyrLoDGgG/53alMJuTOOx1cmMbC7Pya1E7iJwAXIkBvaEuWZJMNRR3/e/SZ/LwZxe09AI6erwUaldg8TkacR3eurGyDe8uvo8rdmx3TdCDmKIuqDHB9YHjGj8M+6Coq2FgMziQz6P0uOhaT5cX2DzzMjMZu+2JH2JPLLhFUyZii8RBsEuBKoX1JGBwoVI29t8xh3giCo0rvtQwYXejI4F/UNWI19isrBVGH9joGoCfD2wtwfaKq0bEPqe49PdfYOwnpQFpVBEMUMBSL8Tw4c5Ja1f1IIpEs7ZeGZn0zrGFGbMdDO17MCn2agSlaMf/HYM/TuVQoLEk1pw5cN3QJaF6ojyLwFEtJ/fujC6vtXBKT9Ny90FRD3moPKftfsS15aEO5mBBdq837tRcH/eBjQ68t07C1Wb+3/J6Y3Pv7cIzgg5KBe/qpQBXNQ5F4Q5m5n9bzUuECjsZEfy6ISTxayUaBBEJEMNnOzYF3+4S41kuEuDAtpQr3knrj6pziFd8MxdkaxgYFjRWX9w37Ux4tDkdBi17znkAQQKee/bcSdrjjkEKyosce1/3T8AATw/hz2X/3pCeYhnYzYgiU0beo8N/uuczbeUL9tZHpuzVKCTgVHN0Wn40YgfPh+V2A4s+c895bee4HUt/TqVCsM2rcFawRKSLTkEwFcKcHKzgIwyI56fKw+JHN6HtKX4MM7pduQbSlsSnMhTbhwOyAUJkGJUFleJKQiQPCkI+Vb8NTsm0kuYWhjqLVTdS4L88g9hKajeHHZLxbbgwskjrodUjOwigV4KsD+KQ0EzPpq6osGGPvxNTwDuwr5Xrxgi7QZoC7g9/Enn4ccONZ1SrzqYs3eMHfCLNtqddhsARJkVAEJ8UBrkYZM18twdn4lHP8aqZrVzkbz12clLY80IlX58g6i3EsdGTi4OpLJaXYWWShMFo3hYIN8pbN8Li98b0f4uj6oWQ==
URLs

http://nemty.hk/pay

Targets

    • Target

      98f260b52586edd447eaab38f113fc98b9ff6014e291c59c9cd639df48556e12.sample

    • Size

      234KB

    • MD5

      3e6672a68447e4e7c297e4dd7171b906

    • SHA1

      72a1af262187ac809a3c6395e5f3f3f5804e51e3

    • SHA256

      98f260b52586edd447eaab38f113fc98b9ff6014e291c59c9cd639df48556e12

    • SHA512

      033b9387428e83ebae802fa3a2547bef5b4741acd2a1d508c79ec942421d599d68f26196d78961fc07e469226c4a6d24d8e32ff56710105162b9967e5f8159a9

    • Nemty

      Ransomware discovered in late 2019 which has been actively developed/updated over time.

    • suricata: ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M1

    • suricata: ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M2

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Deletion

2
T1107

Discovery

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks