Ransom.Win32.NEMTY.A

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• %Cookies%\{user name}@db-ip[1].txt
• %User Profile%\_NEMTY_{7 random characters}_.nemty

(Note: %Cookies% is the Internet Explorer browser cookies folder, which is usually C:\Documents and Settings\{user name}\Cookies on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Cookies on Windows Vista and 7, or C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCookies on Windows 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• cmd /c %User Profile%\NEMTY-DECRYPT.txt → opens ransom note
• vssadmin delete shadows /all /quiet → deletes shadow copies
• notepad %User Profile%\NEMTY-DECRYPT.txt → opens ransom note
• bcdedit /set {default} bootstatuspolicy ignoreallfailures → disables Windows error recovery
• bcdedit /set {default} recoveryenabled no → disables automatic repair
• wbadmin delete catalog -quiet → deletes backup catalog
• wmic shadowcopy delete → deletes shadow copies

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It creates the following folders:

• %User Profile%\TorDir → contains extracted TOR Browser

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• hate

Download Routine

This Ransomware accesses the following websites to download files:

• https://dist.{BLOCKED}ject.org/torbrowser/8.5.4/tor-win32-0.4.0.5.zip

It saves the files it downloads using the following names:

• %User Profile%\tor.zip

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name} on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other Details

This Ransomware connects to the following URL(s) to get the affected system's IP address:

• http://api.ipify.org/
• http://api.db-ip.com/v2/free/{BLOCKED}.{BLOCKED}.230.51/countryName
  • It terminates itself if the location of the IP address is any of the following:
    • Russia
    • Belarus
    • Kazakhstan
    • Tajikistan
    • Ukraine

It does the following:

• It encrypts files in fixed, removable, and network drives.
• It will not proceed with its routine if found not running on any of the following:
  • Windows 7
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows XP

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• nemty
• log
• LOG
• CAB
• cab
• CMD
• cmd
• COM
• com
• cpl
• CPL
• exe
• EXE
• ini
• INI
• dll
• DLL
• lnk
• LNK
• url
• URL
• ttf
• TTF
• DECRYPT.txt

It avoids encrypting files with the following strings in their file path:

• $RECYCLE.BIN
• rsa
• NTDETECT.COM
• ntldr
• MSDOS.SYS
• IO.SYS
• boot.ini
• AUTOEXEC.BAT
• ntuser.dat
• desktop.ini
• CONFIG.SYS
• RECYCLER
• BOOTSECT.BAK
• bootmgr
• programdata
• appdata
• windows
• Microsoft
• Common Files

It appends the following extension to the file name of the encrypted files:

• .nemty

It leaves text files that serve as ransom notes containing the following text:

• {Encrypted Directory}\NEMTY-DECRYPT.txt