General

  • Target

    4003130247f2cab8b87f3d8de23293ddbc9568dbac75ad594abc7e01a04390d3

  • Size

    87KB

  • Sample

    220201-h5fdsabca3

  • MD5

    c96613c857018555f3a5bc227567e6e7

  • SHA1

    a402f5e46c8e056c9e9494f7e83902e0fcae3a61

  • SHA256

    4003130247f2cab8b87f3d8de23293ddbc9568dbac75ad594abc7e01a04390d3

  • SHA512

    086fa536e03882efe6eb79a6f56d954205e00c37885f5d23f8eae47702125d7fed2a8c76d6d2e01d6eeb175f273185844a6494847bef2f0f805560867f075c41

Score
10/10

Malware Config

Extracted

Path

C:\NEMTY_YX2KTOA-DECRYPT.txt

Family

nemty

Ransom Note
---> NEMTY 2.6 REVENGE <--- Some (or maybe all) of your files got encryped. We provide decryption tool if you pay a ransom. Don't worry, if we can't help you with decrypting - other people won't trust us. We provide test decryption, as proof that we can decrypt your data. You have 3 month to pay (after visiting the ransom page) until decryption key will be deleted from server. After 3 month no one, even our service can't make decryptor. 1) Web-Browser a) Open your browser. b) Open this link: http://nemty.top/public/pay.php c) Upload this file. d) Follow the instructions. 2) Tor-Browser a) Download&Install Tor-Browser. b) Open Tor-Browser. c) Open this link: http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php d) Upload this file. e) Follow the instruction. <BEGIN NEMTY KEY> snn96GTXEwIAQiYoAxBI2v6tFcqBzrtdXgpoVCw5vEZi+uqI9/WzNHMJ1uAuHA/LCaewJTSzYbidIL1XhqgpjBR0mqOuSefKn/zV7/w0HVVfaoJTcnrmXWqerKfFxeuDjVkhYBcSaPwpvJceE6kQR6Pl0ZlESEQZwUfBCDs//HW2WlSg3YEhGn2yCPSYpBuVP7pcfj93kagJ+3zSKIGzqI/fzLDAyAnDgoKsS7tejdd/RswBevsLzmKf5Nrk4OGs/ZMjkh+hgZCbFwiL2A6VWuvWAGz2fWeW8lFdNsflzZYu07iJJYZKNzMz+0XFQJNW903zi0/0KJ3XY6ceS10wSSlBhdsGfcTcQhVgvqpdMD7s/nkxTUcNdlzkhyHRTT4kewRpKo3YC1Dbnt7qCsJCkPyD9ikjpn5Yvuv/hvu8kcoGm2L9+4XuxnFNYX0Efl1PmDRj1KvWlkSOcGvpomqel2Y5gHdi1MVrjDfyPOUmvGoHR4aKnK5dSkrU1BeJA94wagqGc5sJrTTfb3GKFnXXCgUdIj2ZseuRNMmpmahBb7NsNtqGqvgNOokfRYRiWH8CKQ6zQyp6Wm7sV2KNw7LY0JitQ4SMfMLP/F8rW2is9a4QEpD8QbW57TTnzMA66nW6o3Kmpy0bmnSophxsoFmGcQvEW51qla6RtcYsc0FkWvOHdV4i/pxSnQDCmB2awuwo5V+vI3GpBvUiHKK4noJLnf3PLzStLeHqD6HbZ/aKoYUJLxxQyUI+og+YWcLqvrUGlvWKWk6zsufVJ5BxiYun6jbg6QTFa/JGCMy12TX1P2YHikp/rMp/MO1WBYPJHz1gyc3EpKC2jNW2lnl+cWpHSnOZk9mswbjsDu509RbrknnO3wYuA0DrMbrdI2etk5hMJi0XE4izYHW4VwuUqtzRxRvRbzn7PoK7WM4puOlFGf8NqjvKU/n2z4Ntx7lqL/niV/uhCAw7tLoqStlcEtt/kb4u/0xwBcR7LMHKF81LbJdkCFCKTTOLqT5tlbejrP/wALubudKF/iQexFUObv1cHlJvynz+9xrZdu6enSGOhpsJnjUB7UQEPHdAHaSB003nzvTDjZDIUD7CS/cq+Q2dviPjby9jNGlXTjsR2WtowzeC5q4sx+ZT6xnLsRPny/55n+iReUe5kBbtvzT5q4J4s5CeP5tm6ZRaunvyj24gyhpvwOUC3++vknRI6Eau31EgatpvTxdSgDDY+SXP8JselJJGBmh5x37noqcw+dhrpTsidA8RQfxgtiyOFi64H9Lvz9OfyPQ1YnETPAH9pNCmugVo1O3aFVKVPzeGHlKu6Si2suW/9RvuFX9VH9AwpnUI6rOs8x1kSc3+KhTkKZw2JA==ShHJXHQ17PN2cmxA40fHjz7rQBppIfbD7TesezD8j4Jj6bZNgLUhboAvNNIf0O53hWBYZgH7RySKg9Q+wJE2WF9tb06PQjgYDNrrqFEBqinIxbY+Axe/yxj7wxUl/Yjt/CYNk7+Eng+BLmIldmLcY2eIaHGbAGgpVCjtpvT8YLQrzZWrfkPtfGcUrsKjSXA5VIwyGGwmvBx1oN6RvkZKzfUoW37mEjbGt1yIJE1JPw6MiTyQuCUM44mzjMWOPcBl6/Vq2RJaNSNUYbrAiruWBQ7tOR6D+ML2G2kI6nnsvfBtp1K0lt40qE9pNzvHEGCbhgYTvTdww0I/mvoDvIrBZD2KGXGDBUGiBEpH/IpC4uL4sknrTkMPxvQh5OLPpHMB0JqHbtKqwCUNVUGafaQt9ZkO+5XjOG4RMdpdks7JqrdoYwtI9XfN+935LwPcjCJ3ZGroBjs8DCCwtEPy5DI0Rec8kVZea/MXNQbTtQS1bTxT1U9FNVBS7ZLgvufEIFHGkpo92Dxbs0TVu2AOs4cLoOm5cKRy7+Ieu75twWtMwIRYl2Ruyf7fMeae2v141Wq6ly2yW5aIqZ6VRkZyyb8ep8anQbQ+qiAyK5xNwXsdPsrwjIe8Bmi67QrGd6LnidxcnoszwQhYZeNuS4uGmo9tEKijDXytNiBTazV7d3jLUiQ26FtMQkAH9oFHXo7H8rcpdktuEFsjjJwAH690BVcU5z2ZC6anaBn3omBD9eE/OPgTbbwZhkIJGveMG2SJHTDrueHmIDj/KlNpaip2Syg1iohKXjgipq1vhuHwcnPQqcU4s8FC7bzyJJEbzFEqEuyIyU9eWevOlVnVeRJPWr2JYZ5Q0p/PdLGKQV6Aty98Y0w4mihuEekaEk006JTkM8B941gqcKxpFPozcE9f23e1pVLAxDr44mjHenZr3CkMw7ZR6w2nH9dyJ1Y6h0RarYhmZ79NtXcBUPX08MznG/voDuCt6wQoNhgkrnTaWH2yAYOrz33WLXAdxHviZpxIW0X9HBi/KM+ynm03M66GXkP4lkQcyD0S2uizgvglQNLOQeyw0bLLgCH8sJu4ImG9sBjcxLot2k5zCt5MI2qMsImhDMubgvn/5ULJ5pjdrAtg5gvzXS+5f+ZNHaDoL+UbX+2g1TZt+XRestMWShrzf9D7Hx8XJRHY/ubIpcNcz0VaVUqKenknQlnQz/qxe56oHR+LP2bYuWSlM5qcH9Hy8ecBgg0Bhuo64pcR6JAIx1Lx4RM85e+JI5DsL8ryyHOTSUrRS+OkkW9yopFmsq0FxlHaDtj57+WoxCOaCHGUY+Bo3V7/vt4U7mPxB4noKvp49WLU8tK5PtPA/f55uSe8T+1xqA==
URLs

http://nemty.top/public/pay.php

http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php

Extracted

Path

C:\NEMTY_WJ29D2J-DECRYPT.txt

Family

nemty

Ransom Note
---> NEMTY 2.6 REVENGE <--- Some (or maybe all) of your files got encryped. We provide decryption tool if you pay a ransom. Don't worry, if we can't help you with decrypting - other people won't trust us. We provide test decryption, as proof that we can decrypt your data. You have 3 month to pay (after visiting the ransom page) until decryption key will be deleted from server. After 3 month no one, even our service can't make decryptor. 1) Web-Browser a) Open your browser. b) Open this link: http://nemty.top/public/pay.php c) Upload this file. d) Follow the instructions. 2) Tor-Browser a) Download&Install Tor-Browser. b) Open Tor-Browser. c) Open this link: http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php d) Upload this file. e) Follow the instruction. <BEGIN NEMTY KEY> G59pUjwBJMScb1D5O9NLL6p3yJf7qkdMcTvTEnDyN0VKGagsnH3Z6FBo4crhlF2FmaVmmK0uyFGsDFI4b/7xLWzzdKXL1FRSgIoQRAbYRTPVGVvMex4W/siW3Zkv8Is5dBt/5vxA5O3m0U/CaQBQuBWsmVDWrg7jq/xSHejn1ASZSES0gOJnu1l2iTTwLJ/NuFXvBxZjhKNS5EST79WROyKekOdEPgBvsYzft733N9Xc8jLpInSKCNdDSc+0C66bWshgHx0WhC9Ny7hS5ox4J10cWgi/rjwdN+e0WarxLS9mZX7IRcvUY7m6M37peB6aJqVdSVDHejfnUlWmkMy2+D2KMPo5CYthEAAau0ucDlDAmpAi1xREuySqnUZz9x+oPezu6si3WMKbeK60ofc0r4L2YW2YeQaldKyYTInyduYPZ+fTZJET+jRmAd+PyJG/eL+guSWlbErZLIyWJ36fiVS8IorHViAxr41RYQer3NsZcxwJB3h0KKti1AYQbhkxhDlgvG4vn6S5IKIV0P1QwtJmbdoowZSI7askGdvjbolf6jtFZlmBVFgIcY1v/RlfFSgfYgi84zpMIEiXkIsKufWnY87UCyY6Xb2P+OTVN+dRLQg7Cd+kxVoPfSPORFOCnXrQmvX9IKK5BSjLqJjR9cHEmGO5oKj/zZSlR4kApdewprwu/+RCKUI1EPjRZKlGTpvEdyvF3vVwmZmoB9ixagyehmyakBj8fB4y08Zq2EElfbc/1UwXks7H0YIBH23w4bXViz1tAp7QE1ngCnS2X1YDifJLE5An1qsavfE+lYOh7UOVul84H8OKUMCbB+e0qbZIdwr60WLtK25TRDTV2fQ7WfFyVPdCHbKsazPQ0s8N4+wHQdYyWoSXKcGMUHi2cAo+UgvQswH1antAybkKhQtTk8WZPjEdrVEGYVZB0ajkYneHw22X0RWWez2WBJh3hnbBP3N+tOqvjALGjwrZzIJSdAIxQdYmjI+9/Ql8XuKCJOxHCqgPplRZyHCq++2d/rnbeLw4dpfdDY/Fdt26HkSa/fXSI6/0EEuG78Q2m6mazt87p1hoUAp6DRfdea24ZNiRdx62jYJuegouygHEQOhnYf3WBszz0KIvvJeyisjbhOnPVPJdHFbJzjP1nivr/gcKKHgAdL6tZ/0PCqiUj2iUQoyvCNWuclwuhKKz4Xztbq/DBAWaxsRC19A+57BE3CxzCnvL10ia0rO3rFRNiZePUkgrcU7WDdNOkZwTX3u71SBbeFm9BY4zAIfQ5ZM4xy7ZJ284mDc9mTug2RmVEq5NNxh+U1yu+cPjr/8cETlDRfc6YQKOMMbk4Yd6r6pmGraPSvgTc3SSEy8GAOK6Mg==HPrVxQCoQM1qyrn09meVILGP1JtmG54X5Aty8RdflVn1ynKWBcHA6smFH1tO0IlWVqVhD3cBvrvBAnTagD9pH//M0geTbqBNPDeuOa0RzO3DU+PODF2IhIYq01K4w6tpMMi33kf7FL3p+Xg1/HxkI5sL9dWDoxqK63zUxdWrD1iEtDcSEUIsOebcg68guXUH+Eon/KUEBo3Qlsypyh/e1mqVh8Bp5SHzi21H2Jel/n3L9tI42tgyd0KJGzvB1g8W5ILpdagz6ARLxmGo3zqhL3sDWfv762fEtdxJYa3xBt2oFKdHMDdgjZZQaX8vnIbcE0XtOhbJdn/GvaTHAFfOiA8Gmyajwu2Ty0f4EdpgxnPhBxrFJzk4rWJDKHyypS6kAnPRBVeodwOxRIGEzMRj9WANFF9CcxpShIGFRHv8SVpcd8VB0k1k3lQiMw6TiJS4GaMVqit+6ZNberIDtn63r4KXBi+fQQmvb/ZvoklcODGfaCxej5LyKjL7w3Gk3shEdXGpcQQJ5X8iQDlvEC5qZIpWuBOkGmAbtALHFwVDsc+X4GE6IYu/Gi5HwLmuSHl1OZSNxq04srlvH3TvpuIob1ytQBTGw9b4owCKctAhUPswfqGR++TGwX1rvsD2wVGHxcDDdmrlXx5tG1OChsJVEldsIJvYp5Z+QFzRdm1pTjvfGG7gpTcexkoqPpwzr1rOrilLy1FlWV7W51vfAxh4S1PKVkoJeY7ctZsvuW3ivb26sZ6nzXNsvaxiWwdM5GFZDyT9HT6TCcyrNy0I6VvQpL5GtcHLOJwmFMkEA3NiuYmRjaKnDJiayr60x/WPxrrN55FL+GFmsVCy+2Ym1efr32V6mYTiHpulEoDRLqT6slcPk7eiXGYIzQrenTewW3KTYWQ6KfE9egTzNEWaIpZO7trfIQiaqNa/VuO1sRiZDRnon/YnhqUk88l0IDg1LwbgTLBwe7RTSvfVmqpOikZRIlHEzQQmF5Vf7jrzFKs65jV3XVBT/SWVwO6oboksnEMR1HcwnG7deOCA3vOLMqHsxBcDriy3SFHfoaLxyYWlzE+4yr9KgtXmzYX1sWwy2zYxwo2D6R5ySD93HlGTJRAiNOs8nCQ7PACPmo2EFtcUJ4DZle11+59NN7ymHB+gIXiJTa6YsaBkxlqYdYxkRblZQzLDZHHFGkxvjaPlZtstvg+GMpmtXqqvVe059NeLEP0Arsenv6LN76eht7p+5n0ODD2vS0qtOo3yz/0fGHKq2knZqGp9iUc2p6Ne9KoVHS4zpZlhlnbEYDLFM7a3PM41JoZ432VUcozRLuCNHRdQ+1g77TMW9K8o/xT+wo+O2GuQI9mRQ9UmpaqBzyVRSuz8OA==
URLs

http://nemty.top/public/pay.php

http://zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion/public/pay.php

Targets

    • Target

      4003130247f2cab8b87f3d8de23293ddbc9568dbac75ad594abc7e01a04390d3

    • Size

      87KB

    • MD5

      c96613c857018555f3a5bc227567e6e7

    • SHA1

      a402f5e46c8e056c9e9494f7e83902e0fcae3a61

    • SHA256

      4003130247f2cab8b87f3d8de23293ddbc9568dbac75ad594abc7e01a04390d3

    • SHA512

      086fa536e03882efe6eb79a6f56d954205e00c37885f5d23f8eae47702125d7fed2a8c76d6d2e01d6eeb175f273185844a6494847bef2f0f805560867f075c41

    Score
    10/10
    • Nemty

      Ransomware discovered in late 2019 which has been actively developed/updated over time.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Impact

Inhibit System Recovery

2
T1490

Tasks