机窝安全--研究者发现CryptoMix勒索软件新变种

Today, BleepingComputer discovered a new variant of the CryptoMix ransomware that is appending the .ERROR extension to encrypted file names. This article will provide a brief summary of what has changed in this new variant.

As we are always looking for weaknesses, if you are a victim of this variant and decide to pay the ransom, please send us the decryptor so we can take a look at it. You can also discuss or receive support for Cryptomix ransomware infections in our dedicated Cryptomix Help & Support Topic.

Changes in the ERROR Cryptomix Ransomware Variant

While overall the encryption methods stay the same in this variant, there have been some differences. First and foremost, we have a new ransom note with a file name of _HELP_INSTRUCTION.TXT. This ransom note contains instructions to contact either error01@msgden.com,error02@webmeetme.com, or error03@protonmail.com for payment information.

ERROR CryptoMix Ransom Note

The next noticeable change is the extension appended to encrypted files. With this version, when a file is encrypted by the ransomware, it will modify the filename and then append the .ERROR extension to encrypted file's name. For example, an test file encrypted by this variant has an encrypted file name of 36C25A08104EA9E6B8B1F4AC14CC8926.ERROR.

Folder of Encrypted ERROR Files

This variant contains 11 public RSA-1024 encryption keys that will be used to to encrypt the AES key used to encrypt a victim's files. This allows the ransomware to work completely offline with no network communication.

As this is just a cursory analysis of this new variant, if anything else is discovered, we will be sure to update this article.[出自:jiwo.org]

IOCs

File Hashes:

SHA256: 9583a703f23f03aad5541c363aa2495a6497aa0091d75d46a4adf469d5c520b2

Executed Commands:

sc stop wscsvc
sc stop WinDefend
sc stop wuauserv
sc stop BITS
sc stop ERSvc
sc stop WerSvc
cmd.exe /C bcdedit /set {default} recoveryenabled No
cmd.exe /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
C:\Windows\System32\cmd.exe" /C vssadmin.exe Delete Shadows /All /Quiet

Filenames associated with the ERROR Cryptomix Variant:

_HELP_INSTRUCTION.TXT
C:\ProgramData\[random].exe

Registry entries associated with the ERROR CryptoMix Variant:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "[random]"="C:\ProgramData\[Random].exe""

ERROR Ransom Note Text:

Hello!

Attention! All Your data was encrypted!

For specific informartion, please send us an email with Your ID number:

error01@msgden.com, 

error02@webmeetme.com

error03@protonmail.com

We will help You as soon as possible!


DECRYPT-ID-[id] number

Emails Associated with the ERROR Ransomware:

error01@msgden.com, 
error02@webmeetme.com
error03@protonmail.com

Bundled Public RSA-1024 Keys: