Overview

overview

10

Static

static

5078a0940a...le.exe

windows7_x64

10

5078a0940a...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5078a0940abc31a7fa271483ac345044a91a0e21c517bceb85091cd3fca310f7.sample

  • Size

    243KB

  • Sample

    210726-sxy8rb1lpn

  • MD5

    7334c27a6a2531b01ec94922160b87cf

  • SHA1

    451cf681bda77ea4bce041bed83050f78a135c3b

  • SHA256

    5078a0940abc31a7fa271483ac345044a91a0e21c517bceb85091cd3fca310f7

  • SHA512

    e833072c48f3f5ec9a3bb7134d402f8858f8a0722c0066db5303944016f696985edde773e3949ccf590b63e4fe8434c17d19d193ab264009a4a8604ef85da2b6

Score
10/10
nemtyransomwaresuricata

Malware Config

Extracted

Path

C:\_NEMTY_GDQ7HQH_-DECRYPT.txt

Family

nemty

Ransom Note
NEMTY PROJECT V1.5 Don't worry, all your encrypted files can be restored. It's a business, if we can't provide full decryption, other people won't trust us. In confirmation, that we have decryption key, we can provide you test decryption. On our website you can upload 1 encrypted picture (png,bmp,jpg,gif) and get it decrypted. There is no way to decrypt your files without our help. Don't trust anyone. Even your dog. There is 1 way how to get to the website: 1) Any browser a) Open your browser b) Type this url: nemty.hk/pay c) Upload this note NEMTY DECRYPTION KEY: /zFUd0dulHGyzZX6OY3IjuSbJK3mukjPYN0GM57D5SaUgbdv/MC+IyIni5T9OCjBlT0NLEuc7MVs2QDLaiU1f4dSlTmlLy47L+hn3X8oJov2xul6wRTLURvTpGJhktDyD0nipwmlXmNT7eREHsP0JftMLplJVyox/LS+R8MrQWNyDAd0dQxNi7HYd0vuvqKRpVQ/TpK9sBiVnYH4KG2ehZtWH8D4e25ZbXEiSf1klTldTvyHqvQdDrFI68e7FoMA6R0A/JkpiGFTdmnSkibYM0fRQmyD672l4q5bn0fo82AmDFICJkO5kESH6pivJa2DcJ9Cc4dAAoIT762FvLb2fDQBlzDiWd/QlBDlhQ4y/AoaSzz+ca8jO1KGF54Ytx7PDkuHhQlacUT7Mu234U6gK57xwLcUg9yRfGPNwZXsWU15CZKDIF66mg+Ehlwct0dyCILLujFN5pnhgf3a26a7fu3uJJ+Xqbg7WT7N7Rj+TdiRVfSr/rW/PlzI+9py8ma5v9eFtB9RIVkkZpMQcPJAsQYZ50mZzLTLNhfw13J1k3W5TK0c5xffBHn63/pPNtDaoi+1e43TFFC7HqAXs/4Sqjhu7CI1oFsGACffzahdU+oJoqxJPg7I9AQUKPYUIOrmbZstiC+agczuuzFm/xOYvW2fN1lEAfSLVV1ZJa4GoLSII4HvEDLNCvRYoP0CHZmX2lHv5XFvkjhBoDFOWGX4nsbpFELor38PQTKNOZx/Tqlj6vOsFkOinOfMZB6PLUx5lQaDJIL/v5DOXWw6JTR+7KlofhuEFYw69nUuEveXsyZt9fMambeQiqi1Pji8qagwPjTMDBHpEs58GPEjnu0DLrcRDJDvSHgWJTksNEgLurK2HuOPrPLAg7NB25ROhD7DoN4PJTdl8NK+ot1UAsXFp9dgksuhgs5Z09QDBt0dy6oxdcReNgbqoO8uugjXdEUXn0N57S+8UWomGrY8UEinA7eDalGfMq5j3Cx/B63yU53S1RJJJbfjZeb2wruoHNxYQXIzrlyz2oN64oKBI+78OI7m43mAp32zGfJDEUdufLa6VBGgZHJodpbNr3xxde8LirQkZFFDYQYwPDO39jqtHTNK5yP29k6V6/BXMtus7tTLW6z1rGmTQgihCkotouGEFWMsd6sUZYOwXfyFVH90/Tbo1n+QR3/AZGw9Et0QYp4zAcIBHLc9njR77tbpskePMdqYbBHBDRXFqfkbv1ZqDVItyxJBHrTuqsQFJeHDesZY5gAKTr/g7Ue0dduCZsNzD0gWsVQA2oy9OVQhU9RM4lcttw63ZOW17g1OXFUcO//5alZNFOqEk8qW4Zn5Y1ht0s97gw7GstVUaO3hMnYoKQ==3ofMyh+lM0NhCoQSJyOGOJuWQSJyWpkXJRniCWaVgP3n8BdWzUb2kZS8N0Lub4if1hUieDATjW32stSQW5gahIRAlB3rjy5D6KuvLWbQW5aMFgmzxvlhmH6rIcxvmv1B59sofElz0hpWfapk9PH9AWpkrWo9NnkMKtMwq4kQybHOF7tBBh/DTpNt6M/Bq3wegNZQS2CHJTvMFeEhZIKI4pc0nNPQmGx6MabVtABwp93IEZIj9d4L480ZMTBu+DTwFelZ8feYfHw5XTHLsFpV99h1Vm75D5TW6a37RJ3opeAX/nND5C66Ullu/z/SdeMHx+JktbtmKg39BtG1AC4CqKL1Mxx5kqTFbRn3PLLZeIP3H0xDw8Wu/NVaYvw13MkU3d+0WnWMfk+D/LPJHDP10BoRFwgcXMc/bDehdZIjRmDHl0SVF4UdcHnSlwGY5mtY0/0MLMbinSzgYJ33M2Zy0ixeh9AwERxAYi6ajLirPNHX1W3WYK3wudjxOTA5r5ox2dwe1e9MCKq649oSi8HWzD1JsQBnw7Nn0a899YUkjluysbTnpncwCNP5sc8cwkcw68DZWfZd8Qlz2SCpZ5WQZ1C/QtkzNwL3i8QfGod2M60zIXvZihe43I7Sey+qQVgXettTXGCqE+sYNkBBFt33Igf+HxiUni91/U+E9YBJHSxAMJ1268DIDeCm9c1C2LTNnqZBAtSwxqrTDknRenbwwCs5YWVXXJZBsLyFpOOFN/weldnsn26Hk6aQysVmzPzSBGEc7GcRsD0m97zxJTTHfsgT89YuLQfX+ZrVeQ4mAffqsNOYfdvTUiNN7mh/UsuDjuFJHVA4Q3wCAgcIEg+h3s7AkooLwQVIkZeT+678aV/7x1b723RUTLTd636w4M0zCyyMzdjrdibkDjir27jDxAfLN5Z3Hzo53cqoMOvlFoRn2pfdI6KQEFWpdj3KwSHOfNOrTGTE3xSRAFK/dxdlkTVEBhg02KNYRGIqY88auvBP52hxIuW/tyAOJCvBSHgF6hMMCHjWBU3cdU8eUdPZsLcix/IVgLRmjMnTg5xGSpfci63GOmFrzmZXh26udm9LOdqsMsjCX+V4E9U0uF2gjJiLcPImTOOlWS3WTUbz8xw51lKXHzpQCsosgkq0nMg2iS16jclE/D09jIlqqIMLxnAY2/Z/wWTui70wxiL6/bAhSBZpDU84V0dSn/6VlKNRJ+eGdNX9cX6jywkiB06t4YhQDtS/axpkyaelt4rCGmeGdxP1fTp/4oZIEjYAmOBf6mYUce7qTAiX/dtx6iYAql9B27m317moXKum/LCSmUqbR/SOYeqjvlsSeQVoq7P5ckeZ7o+JUUkxAsVM7oLExg==
URLs

http://nemty.hk/pay

Targets

    • Target

      5078a0940abc31a7fa271483ac345044a91a0e21c517bceb85091cd3fca310f7.sample

    • Size

      243KB

    • MD5

      7334c27a6a2531b01ec94922160b87cf

    • SHA1

      451cf681bda77ea4bce041bed83050f78a135c3b

    • SHA256

      5078a0940abc31a7fa271483ac345044a91a0e21c517bceb85091cd3fca310f7

    • SHA512

      e833072c48f3f5ec9a3bb7134d402f8858f8a0722c0066db5303944016f696985edde773e3949ccf590b63e4fe8434c17d19d193ab264009a4a8604ef85da2b6

    Score
    10/10
    nemtyransomwaresuricata

    • Nemty

      Ransomware discovered in late 2019 which has been actively developed/updated over time.

      ransomwarenemty

    • suricata: ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M1

      suricata

    • suricata: ET MALWARE Win32/Nemty Ransomware Style Geo IP Check M2

      suricata

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

File Deletion

2
T1107

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks