fannyworm | fd20bb3ea728b779343dde60b865accdddc51dfa0e1ae4482490cecd475a58f8

Sharing

General

Target
jaffacakes118_Trojan-Ransom.Win32.Scatter.ur.5ea8f299a6e41e2ac1c125a3bbec9924
Size 4.2MB
Sample261016-lrwemacy4n
SHA256 fd20bb3ea728b779343dde60b865accdddc51dfa0e1ae4482490cecd475a58f8
MD5 5ea8f299a6e41e2ac1c125a3bbec9924
SHA1 9fd0d2794f4a80efed00948a209e316ce5bafcf9
SHA512 0f703a48efcdfd677048db5616ea65f266cf0c522c0ae07a4041a070fd0005d4a4ab6cd0e220327492828b21141ffbd40091c82f51e5e7372a002b545c6819f9
SSDEEP 98304:Qux6GZIsUYQC777dXHIoNSgzyhew0oiETfaJmchA+/knCZdHgreY:rxSNYQC37dXHIoNSgG/0oiifgmchA5kA
TLSH
T1D41633136164092FB994A581F38CA21EF33EFED2AF4E0186DD701E1066D9D0AD7C9B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

gtd31000.duckdns.org:10750

Mutex

fa13c4b5-e860-4ea3-9882-c2fa3f838271

Attributes

activate_away_mode
false
backup_connection_host
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2016-11-30T16:26:16.088434736Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
10750
default_group
fevrier
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
fa13c4b5-e860-4ea3-9882-c2fa3f838271
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
gtd31000.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Path

C:\Users\Default\ReadMe.txt

Ransom Note

jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 0772474757

URLs

http://rktazuzi7hbln7sy.onion/

Extracted

Path

C:\Users\Default\ReadMe.html

Ransom Note

<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>❶<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>❷<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 0772474757</big></h1></center> </div> </div> </body> </html>

URLs

http-equiv="content-type">
http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.html

Ransom Note

<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="content-type"> <title>jaff decryptor system</title> </head> <body style="background-color: rgb(102, 204, 204); color: rgb(0, 0, 0);" alink="#ee0000" link="#0000ee" vlink="#551a8b"> <div style="position: absolute; top:0; text-align:center; width:100%" > <h1 style="font-family: System; color: rgb(102, 102, 102);"><big>jaff decryptor system</big></h1> </div> <style> .center { width: 1000px; padding: 10px; margin: auto; background: #fc0; } </style> <div style="position: absolute; top:15%; left: 30%;" > <p style="border: 3px solid rgb(255, 255, 10); padding: 10px; background-color: rgb(223, 213, 209); text-align: left;"><big><big>Files are encrypted!</big></big><br> <br> <big><big>To decrypt flies you need to obtain the private key.<br> The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet<br> <br> </big></big>❶<big><big> You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en<br> <br> </big></big>❷<big><big> After instalation, run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/<br> <br> Follow the instruction on the web-site.</big></big><br> </p> <br> <br> <center><h1><big>Your decrypt ID: 0213839990</big></h1></center> </div> </div> </body> </html>

URLs

http-equiv="content-type">
http://rktazuzi7hbln7sy.onion/<br>

Extracted

Path

C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.txt

Ransom Note

jaff decryptor system Files are encrypted! To decrypt flies you need to obtain the private key. The only copy of the private key, which will allow you to decrypt your files, is located on a secret server in the Internet You must install Tor Browser: https://www.torproject.org/download/download-easy.html.en After instalation,run the Tor Browser and enter address: http://rktazuzi7hbln7sy.onion/ Follow the instruction on the web-site. Your decrypt ID: 0213839990

URLs

http://rktazuzi7hbln7sy.onion/

Targets

- Target
  BlackWorm.exe
- Size 833KB
- SHA256 72abca8b0ffffd9996b365927551c610c7e8c96c624b6a7d4bcc000c5bf4e3eb
- MD5 8b2b4272651fdf82be9cc0976f2bea5d
- SHA1 16abcd4d81c467515203ec04bdbaf6a63487bbb3
- SHA512 18b8393b273c519fde801f19c778b18cd1d5c74727627e4ceaaa3d059951f8d289e52b04b3fdc09d5b8396935c30e04a9e47fb49e08cfe5cc357d061f24a23fc
- SSDEEP 12288:MnT2gpxunnC6kcp3+fpzm9pf6DXYYF7RW2z/9ouZQ8gdA8VqYc:YpxuC6ky+BmfopRW2w0Sc
- TLSH
  T18505125233C5C933C21A2631C5BB8A54F3B1AF841B2A89032BF0BF4FBFB56975A54165
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nanocore keylogger persistence spyware stealer trojan
- Family: NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  Black Worm.exe
- Size 864KB
- SHA256 72a7a0918a9a352ae1e81ec88eb40cf281454258920343f3ff49d5f638194bc7
- MD5 01f5ca95bf85f4a33ad6fef9ad879079
- SHA1 3965db258dd7f730bd3345feec23e4f5c3bedfa2
- SHA512 69c4c6fb5e72352e9af8537b54368f9d06beb9ffc8b51c59c7446b26c95fa0c35bfa161b03c33ef6132ff57d41fedd65f241cab5ff9b0ea7389713e869e6ba83
- SSDEEP 12288:O2gjnGg7zBnAoAiR48OyJ+Sriqs9EL5QIyTTH2gTn:SFxFRAqsT/
- TLSH
  T1921570037B85FD28C53855F9B2805FD4A20B1F5D9A758AFA68457F7630E26C038EA7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  taskmgr.exe
- Size 434KB
- SHA256 af62076f817b74710b8554f8cd508a5aede9c9978dbcc17860ac90ebc8285999
- MD5 8f89bad926c3ccbe3fac866674a1da69
- SHA1 a0f5313b073e22cf64c4a4c2ab9859985f7c5c16
- SHA512 6099267ff5dafd4934599da5880273b62e58e469f56f0d8b96912004bbbc0b7a696669acf6ea712544168e4694aab73508750ced764d6171daff4f7e6965f916
- SSDEEP 12288:v2FvhXTfGoMtF4etucipyy9GFQl71Ib2AX+pbTAzOQuw:v6lw2bnbQ
- TLSH
  T1A094F1527EC0DD59C928A474E63BC1011BEA7C271852C78F3C53BB1F6A725B48E23A79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery nanocore keylogger persistence spyware stealer trojan
- Family: NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  defense_evasion trojan
- Suspicious use of SetThreadContext
behavioral5 behavioral6
- Target
  CyberBot.Worm.v1.0.4.exe
- Size 1.0MB
- SHA256 1f14c7e211e99bf95824bfe4b74dd12aca1cee6ea70c7d041db028b51759dc1e
- MD5 cea4ab0bea3970e498c2ef9085d714ba
- SHA1 45311d344f48706ea7007b73b90b9e662c42ac34
- SHA512 8d8309700c27c27b013a759df37847e94124cd052e0ac56f9e928e6e62d9fc8b979382b5b7c5001a35527fa1bf416fe82122c90a4aac339a57f91c9cc68a1c1e
- SSDEEP 24576:HVjoVTwSNqCwJmXvHSlevWDUWOsAQgd5:HhoqZj0CcsS
- TLSH
  T18E259C2732E4DE05D57C87B1C4A096F013F1FCAED612D34F3D997DA87AB22849922786
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  FannyWorm.dll
- Size 180KB
- SHA256 e991473817f7ef9144fd41cc08db9f3935df61272ac4992514cabe4d2a698959
- MD5 a8a973b3861c8d2f18039432b9f38335
- SHA1 aa8a6124ac7c35eb9cc8b59d234c2a01fb81deaf
- SHA512 f4f9795d89f2569a55de7af037e4d996dbb61ca1a39587d1a007212eb97d8f0b827924ff35290ebb4567551e20498e6ed04b5abf00536f37026686f13e6b8635
- SSDEEP 3072:TtnKCLmVZ0mBTYejpSIAq2tn2TBfki43y97FozS4Oq1sqH73oGC:peEEsejpYqun2TB8i4i0zLOosqHkG
- TLSH
  T1A4048E0A9B9702A3DAA4043071945ABB7FBE7C3338DF646FCB165A3115A15C5D034EEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  H-Wormer.exe
- Size 4.6MB
- SHA256 d392649ade9f2ebd65d3ad7ac31243561bd13c474ab755f3667ca162f6646e13
- MD5 5a1234b28cf8316031c31734629ba450
- SHA1 d1b9f8077d011e1a61de16fa086a137d49a9ec98
- SHA512 d484bb3fe362cf250294840c7ad0010f5152b3f2975b218b07db2898aba03881cbef18fc638c9abbf8cfaa06def63f10c39189bc6c91ef15d64370ecc7312892
- SSDEEP 49152:Yw2iI8FeNTT/kBlDGntMREURK2lBCw26xYrbv6KtNGB:
- TLSH
  T170367EB3D1D3ED5B89CD2414B8483ED05C7898A7C7A9CE28D54CB7F3648E9159A3CCA8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral11 behavioral12
- Target
  VJWorm.js
- Size 9KB
- SHA256 ea9c35f40730fcba5ea08cf0af764284bf743148cc48aa81df27be6fab340df2
- MD5 0b4f62278f571ac6f67c8d5cb47b0306
- SHA1 17d4e2a3455077b01e1c8d9ff9c64be414278ed1
- SHA512 6c8d9ea04a082bb23fce30cbb2a5ff4cf0ee30178577694f649e6ec28549cf55251303067b73478cbdca731c0025416a85bcc08e1ae10e36289c59b3e95f3891
- SSDEEP 192:FZVhZHvf5P0242ZQOrhVO/mU+stVLxmXR8kLIh0uhhDnUBluV6wcsHnPoYlDF:vVP3F6shVOmWTGKCW
- TLSH
  T1F122459CD392DD1B4B8E6B4FAC944DDAB87D4076AAC43257C209BBCC169AD93C1C0CB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution vjw0rm persistence trojan worm
- Family: Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application
  persistence
behavioral13 behavioral14
- Target
  WormGen.exe
- Size 679KB
- SHA256 39aad4bd8dd513dd5f4442e92bee39bd58d11c1cb06a5562a7f02e6a042d8c01
- MD5 7cdc6c21d92af00e071d72a9496703b0
- SHA1 ac6c6fd30f1d416dc62f044cc960e4446f5063d8
- SHA512 90219f6c2940891a50dff1aa7becd326d80889dc25bdb3b4269e6b127d6d52925eb21f3b43fdae43db2b701b9bdc583c44a17902847c5c2dfa0b3e23e93029de
- SSDEEP 12288:qZR6TYzBm51foUMXoOis8bpCl6Z0ofUPSaUAPj3R:4/ovwDtLRQC6amAPDR
- TLSH
  T193E47D62F2E05D73C02B2A39CC1B97E45929BE912D2459873BF43E4CDF39751382A297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  Zeus.Ransomware.exe
- Size 184KB
- SHA256 983101e79144db3fae052dde29ab67211a393da5221613e24fc1aaf29ff3cd27
- MD5 b0c25cd913143c764ec9da58a101ddb1
- SHA1 215ee1070242fe19a0648fa01b286cf26d060183
- SHA512 ca4ff25d962fac276a7457f4f69c8ef3d1a466fca8b5d2cfa30c9bae46e1db7f2cb2b1f6849fdc11981dfc16a4287a006f7d9082654231f28a2adf9761fe3c4b
- SSDEEP 3072:H/IBtQnE7OhssdWJ5jy392aCmCbBqPMiIaOrrU5kTy4Q88hlG7aMzg+OidnyASe:Kqvhssdu5jyYaCmCQPMEAULhhlv5Tcya
- TLSH
  T1E704E17CBA001DBDE6BE2677D694B9BC02770912E946948391E96FC220F3374FE47506
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
- Suspicious use of SetThreadContext
behavioral17 behavioral18
- Target
  dredudre20.exe
- Size 172KB
- SHA256 41bce3e382cee06aa65fbee15fd38f7187fb090d5da78d868f57c84197689287
- MD5 f5ebb00e1fb9bbcfe5ae742082e2002f
- SHA1 83edee74728aa231cb77d62a442fa560c64ecdee
- SHA512 295df12f3399ae468091029dbaea4574c864021f6e5ee00ce0a7480a1ed599ce7b72d5d04d105e751f61c61e417d9757805acfaa8c1f130e07cc04551f480dc4
- SSDEEP 3072:PldaD6pVgjyNbZR53FMmIpyTTnxa2yi35kXuudea+W6PZUHz:Nd3pVgOlZXFTcyfxca5JuAa+WfH
- TLSH
  T1D004BE3E72A5C1BFD46B41B072765227B218BD3209E5AC07B3801D5AEBF05D27A23B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery ransomware spyware stealer
- Renames multiple (5966) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops file in Drivers directory
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral19 behavioral20
- Target
  woyp.exe
- Size 134KB
- SHA256 3322817fdea1047e32a954f9cd6c3b3398bc3f729fe42f3537a16fa39d70d9b9
- MD5 1a75d43de5f762fbc513ab194fba63c5
- SHA1 7ce28e88a5a7f0cd33ffc55da87ae0cde1e75e0d
- SHA512 b601261cca71bc3ab36bf9242553a32221e8286f6a92fa64adecc92de7f17ced977b6e83e38533c1bd4acc7556678c17eeddee979837ebf40eb2ba2641639823
- SSDEEP 3072:HXIBtQnE7OhssdWJ5jy392aCmCbBqAqxSh8GH:Sqvhssdu5jyYaCmCQVxg8GH
- TLSH
  T1C5D3D07CB9001DFDE6AF1277D985F87C03771923EA4A548292E96F8224F3271FE46606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of SetThreadContext
behavioral21 behavioral22