Executive Summary
The McAfee Advanced Threat Research Team (ATR) observed a new ransomware family named ‘Nemty’ on 20 August 2019.
We are in an era where ransomware developers face multiple struggles, from the great work done by the security community to protect against their malware, to initiatives such as the No More Ransom project that offer some victims a way to decrypt their files. Not only that, but the underground criminal community around such ransomware developers can also be hyper critical, calling out bad code and choosing not to purchase ransomware that is not professionally developed.
After one such developer, going by the name jsworm, announced Nemty on underground forums, we noted how the ransomware was not well received by some users in the criminal community. Certain sectors of that forum started to rebuke jsworm for technical decisions made about the functions in the ransomware, as well as the encryption mechanism used.
Jsworm replied to all the comments, adding evidence about how the critical statements made were wrong and showcased the value of their new versions. They also fixed some ugly bugs revealed by users in the forum:
One of the users in the forum highlighted a function for how Nemty detects extension dupes in a system, which needed to be re-written by the author:
Despite the shortcomings in their ransomware, the Nemty developers are still in the underground forum, releasing new samples and infecting users through their affiliate program.
Telemetry
Based on our telemetry, we have seen Nemty activity in these locations:
FIGURE 1. Telemetry Map
Nemty Technical Analysis
Nemty runs on a Ransomware-as-a-Service (RaaS) model. We’ve observed it being delivered using:
- RIG Exploit Kit in September 2019
- Paypal dummy sites
- RDP attacks through affiliates in their campaigns
- Botnet: Distributed through Phorpiex botnet in November 2019
- Loader: SmokeBot
FIGURE 2. Nemty ransomware announcement
In the release announcement the Nemty developers offered two types of collaboration: affiliation or private partnership. We found two aliases advertising Nemty, one of which is jsworm, who is quite active in the forums and announces all the news and updates there.
This is the timeline of the operations performed by the Nemty crew:
We observed how the Nemty developers adopted some characteristics from other old ransomware families like the defunct Gandcrab. One example of this is the reuse and reference to a URL that leads to an image featuring Russian text and a picture of the Russian president, like Gandcrab had in its code.
FIGURE 3. Hardcoded URL inside the Nemty ransomware pointing to the same image as GandCrab
The Nemty authors released different versions of their ransomware. In this research article we will highlight how the first version works and the significant changes added in subsequent versions.
Hash: 505c0ca5ad0552cce9e047c27120c681ddce127d13afa8a8ad96761b2487191b
Compile Time: 2019-08-20 19:13:54
Version: 1.0
The malware sample is a 32-bit binary. The packer and malware are written in the C/C++ language as the author announced on the underground forum.
The compilation date in the PE header is the 20th of August 2019.
FIGURE 4. EXEInfo Image
Nemty uses RunPE in execution, meaning it unpacks in memory before execution.
Analyzing the sample, we could find how the developer added certain protections to their code, such as:
- Decrypting certain information in the memory only if the encryption process is working as planned
- Clearing the memory after finishing some operations
- Information sharing between different memory addresses, cleaning the previous memory space used
Ransomware Note Creation Process
In order to create the ransomware note, Nemty takes each string and saves it into memory. When the ransomware compiles all the required strings it will join them together to create the entire ransomware note. In this operation, Nemty will decrypt line by line, moving the data to another memory address and cleaning the previous one to leave the information only in the new memory space.
For the first version of Nemty, the encryption method was not applied consistently to all the strings, which is why it is possible to see some strings and spot part of the functionalities or juicy files from them.
FIGURE 5. Clear strings in Nemty
Nemty and the Logical Units
In execution, Nemty will check all the logical units available in the system, saving the information about them in a static list with the following information:
- Type of unit
- Available free space
Through the use of the Windows API, ‘GetDriveTypeA’, the ransomware will differentiate units between:
- Removable
- Fixed
- Network
FIGURE 6. Checking the type of logic units
To check the free space available in the system, Nemty will use “GetDiskFreeSpaceExA”, again through the Windows API:
FIGURE 7. Checking free disk space
Extracting Public IP Address from the Victim
Since the first version, Nemty has implemented a functionality to extract the public IP address of the victim. The information is extracted through a request to the IPIFY service at http://api.ipify.org. These types of services are frequently used by RaaS to check the location where the victim was infected.
FIGURE 8. Nemty getting the public IP
The User-agent for some of the Nemty versions was the ‘Chrome’ string. The user-agent is hardcoded as a single string in the ransomware instead of using an original user-agent.
FIGURE 9. Getting the IP address of the victim machine
The IPIFY service is used to retrieve the public IP address of the victim and, with the extracted data, Nemty makes another connection to http://api.db-api.com/v2/free/countryName using the data previously obtained as an argument. The extracted IP address and country data is used later used as a part of the ransomware note creation.
FIGURE 10. Getting the country name strings based on the IP address
Victim Information Extraction
Nemty will extract the following information from the victim:
- Username
- Using the windows API GetUserNameA
- Computer name
- Using the windows API GetComputerNameA
- Hardware profile
- Using the windows API GetCurrentHwProfileA
With this data, the authors ensure that the infected victim is unique, which helps the RaaS operators quantify how many victims they were able to infect themselves or through the use of affiliates.
FIGURE 11. Get Username, Computer Name and Hardware Profile from the victim machine
Nemty 1.0, Wrongly Applying the Country Protection
RaaS families usually apply some protections to prevent infecting certain geographic regions. In the first version, Nemty still had this feature in development as our analysis showed that the ransomware did not check whether the victim belonged to any of the supposed blacklisted countries. During our analysis of ransomware it is quite usual to find functions that are still in development and are then incorporated in future versions.
If the detected country is in the blacklist, Nemty returns the string “true” and keeps it in the config. If the country is not found, the value of the field will be false.
FIGURE 12. Check the country name and return true or false string
Nemty Encryption Keys
Immediately after making this check, Nemty will decode, from base64, the value of the master key and keep it in a memory address to use later. In parallel, it will prepare a random string with a fixed size of 7 characters and use it with the string “_NEMTY_” to create the ransomware note with the specific extension used in the encrypted files. Nemty will create a pair of RSA keys, one public and one private, in this process.
FIGURE 13. Export public RSA and private keys
Within this operation, Nemty will encode those keys in base64:
FIGURE 14. Encode of RSA keys generated
After this encoding, Nemty will decode again the victim RSA public key and import it for later use.
FIGURE 15. Decoding of the RSA public key for later use
The same operation is again used but this time with the master RSA public key from the ransomware developers.
Nemty Encryption Keys
In the encryption process, with all the data collected from the user, Nemty will create their config file, all in memory. The config file is a JSON structured file with all the collected data and the AES key previously created. Regarding the key used, it is the same for all of the files, however Nemty uses a different IV for each file.
Nemty Configuration File:
An example of the information collected by Nemty and later used in the config file can be found below:
This is an example Nemty configuration file:
FIGURE 16. Nemty config file
The different fields for the configuration file are:
The configuration file will be saved on the disk encrypted with a RSA public key of 8192 bits and encoded in base64.
FIGURE 17. Crypt the config file and encode in base64
Nemty will get the username logged in the system through ‘SHGetFolderPathW’ and will save and encrypt it with the .nemty extension on that folder.
FIGURE 18. Getting the user’s root folder
FIGURE 19. Creation of the config file on the disk
Nemty Encryption Threads
For the encryption, Nemty will create a new thread per each logic unit found in the system in order to encrypt the files.
The method used to encrypt the files is similar to other RaaS families, getting all the files using the function ‘FindFirstFileW’ and ‘FindNextFileW. Nemty will avoid encrypting folders with the following names:
- .
- ..
- …
The encryption process will also avoid using files with the following names:
FIGURE 20. Check of the blacklisted folder and file names
This check is done using the insensitive function “lstrcmpiW”. Where Nemty is encrypting a file it will try two combinations, one in lower case, one in uppercase.
The extensions checked are:
FIGURE 21. Check of the file extensions
If Nemty has successful checks, it will create a random IV and encrypt part of the file with the AES keys previously generated. It then begins the IV using the victim’s RSA public key and appends it to the encrypted file.
FIGURE 22. Write the crypted file and put the IV in it
Nemty will put the information required to decrypt the file in the encrypted part of it and then add the extension “.nemty” and continue with the next folder or file.
FIGURE 23. Renaming of the new file with the Nemty extension
After finishing the encryption process Nemty will use the function ‘WaitForSingleObjects’ and wait for all the pending threads. It will also download the Tor Browser and open a connection in the loopback with the configuration file.
As a final action, Nemty will execute the command prompt of the machine with the hardcoded word “cmd.exe” and open the ransomware note.
FIGURE 24. Opening the ransom note
The style of the ransomware note changed across the different versions that the Nemty developers released.
FIGURE 25. Different ransom notes between versions
On the left side, we can see Nemty version 1.4. On the right side, the ransomware note belongs to Nemty version 1.0.
Like other ransomware families, Nemty will perform these actions at the end:
- Delete the shadow copies using vssadmin
- Disable boot protections with bcedit and wbadmin
- Delete the Windows catalog with WMIC using the class shadow copy
All these calls are made with the function “ShellExecuteA” with the “cmd.exe” string as the main program and the other as an argument.
FIGURE 26. Deletion of the shadow volumes, disabling boot protections, and deleting the catalog
Mutex
Nemty will create a specific mutex in the system every time it infects a system:
The ransomware will check the existence of the mutex using the function “GetLastError”.
FIGURE 27. Creation of the hardcoded mutex
If the system was infected previously with Nemty and it contains the mutex, the ransomware will finish the execution using the function “ExitThread”. This call will end the main thread of the malware, finishing the execution and returning the control to the operative system.
The “ExitProcess” function is often used to avoid simple API monitoring.
Nemty uses RC4 to encrypt its strings and, in execution, those will be decrypted and decoded from base64 and then be used as a part of the ransomware note.
FIGURE 28. Calculating the size of memory to decode from base64
The RC4 key used for Nemty 1.0 is ‘f*ckav’. Other malware families also often use offensive names or expressions regarding the security industry in their implementations.
For decryption, the developers implemented a function through the API to reserve the needed space with ‘malloc’ and later decode the string in memory. As a protection, if the ransomware fails to get the size or on the decoding operation, the execution will finish using “ExitThread”.
FIGURE 29. Decrypt the data with RC4
Nemty – Learning by Doing
Since the first version of Nemty was released, the authors started to evolve their ransomware by adding new capabilities and fixing aspects of its code.
Analyzing the early versions of Nemty, we can state that they were more advanced in techniques and obfuscation compared to other RaaS families, but the first version still contained functions with some mistakes, such as references to API calls that were not used by the ransomware.
At the time we wrote this article, the developers behind the ransomware have released 9 different versions:
Changelog Nemty 1.4
We have observed changes across the different versions of Nemty. For version 1.4, the developers applied the following changes:
- The ransomware will gather information regarding the logical units after checking if the victim has the Nemty mutex.
- Language check
- In this version, Nemty will respect and avoid encrypting files for victims inside the CIS countries.
FIGURE 30. Check to avoid crypting if the language is blacklisted
CHANGES IN VERSION 1.5
Compared with Nemty 1.4, this newer version was a major release, adding the following changes:
- Victim information stored in the registry
- Persistence
- Ability to kill processes and services
- New mutex
- Hardcoded image change
- C2 panel publicly accessible
- 4 new blacklisted countries
Victim Information Stored in the Registry
The first major change in this version of Nemty was the use of the Windows registry to store information about the infected machine. The hive used is HKCU with the NEMTY identifier.
FIGURE 31. Information saved in the registry
Ability to Kill Processes and Services
The second feature added is the possibility to kill certain processes to facilitate file encryption in the system, something that is commonly implemented by other RaaS families.
In order to kill those processes, Nemty will use taskkill /im PROCESSNAME.
FIGURE 32. Termination of processes
Among certain kill processes, Nemty will stop certain services in the system with the same objectives:
To stop the services Nemty, will use “net stop” and the service name.
FIGURE 33. Stop of services on the victim machine
Persistence
The first versions of Nemty did not have any persistence technique, so the author decided to add it in version 1.5. The persistence is done through a scheduled task, “create /sc onlogon”. The binary is copied into the main user directory with the name hardcoded (this can be adapted for every binary released) “AdobeUpdate.exe” and the task launched using “ShellExecute”.
FIGURE 34. Creation of a schedule task to persistence
Hardcoded Image Change
Regarding the picture hardcoded in the first versions, for this version, Nemty decided to change it and include a new one.
FIGURE 35. New image referenced in the malware
C2 Panel Publicly Accessible
The author, decided to swap TOR for a public C2 panel where Nemty will send the victim’s data.
https://nemty.hk/public/gate?data=<victim_data>
4 New Blacklisted Countries
For this version, the author added four new countries to the blacklist:
Changes in Version 1.6
Compared with the previous version, Nemty in the 1.6 version only implemented one single change. The author used their own implementation of the AES algorithm instead of using the CryptoAPI.
The way that the malware previously generated the random key was based on functions of time but with version 1.6 it mostly used some other value to generate the random key.
FIGURE 36. Changes in the key generation function
One of the partners in the No More Ransom project, Tesorion, decided to publish a free decryptor for victims infected by Nemty. After the announcement, the Nemty authors released a new version utilizing a proper AES function using CryptoAPI.
FIGURE 37. New implementation of the AES crypto using CryptoAPI
Like in a game of cat and mouse, Tesorion released a new decryptor for this specific version. The Nemty authors responded by including a harcoded message to Tesorion in the samples:
Tesorion “tesorion, thanks for your article”.
Second Version of 1.6
Instead of changing the Nemty version number in this new binary, the authors released a new version of 1.6 with some changes.
The changes added for this version are:
- New vssadmin utility used
- New processes and services to kill
- FakeNet feature
This new version was released just 2 days after the first 1.6 version was released; this means that the actor is quite active in developing this ransomware.
New Vssadmin Utility Used
The first change for this version is how the logical units where enumerated. The Nemty author implemented the use of the utility “vssadmin” and also reduced the capacity of the shadow volumes to 401MB. This change probably helped the ransomware in terms of performance.
FIGURE 38. Resize of the shadow volumes in the target logic unit
The idea of this change was to remain more stealthy against endpoint security products, instead of just deleting the shadow copy and executing queries through WMI, BCEDIT, etc. The author changed their approach to use vssadmin with the delete flag.
New Processes and Services to Kill
The Nemty authors added new processes to kill in order to facilitate file encryption:
In addition to new processes, the author also included new services:
FakeNET Feature
For this version the Nemty authors decided to add one interesting feature. The ransomware in execution had implemented a function to retrieve the victim’s public IP address. In the case that Nemty cannot connect with the external IP address, the ransomware will add fake data in order to continue the encryption process. The fake data will be:
FIGURE 39. Nemty using fake IP address and country name information if it cannot connect to the URL to get a WAN IP
This feature implemented by Nemty will expose users in the protected countries as it will encrypt the system, even if the user belongs to one of the countries specified in the static blacklist.
Version 2.0
In this version the developers decided to remove certain features and added a new encryption process:
- The FakeNet feature was deleted and Nemty only used the old mechanism to check the victim’s region.
- An initial function that prepares a container to use the RC4 algorithm with the name “rc4” and get a key based in the hardcoded string (can change in other samples) “sosorin :)”. This key is used to decrypt part of the ransom note and certain strings. It changes the use of the authors’ own RC4 implementation to now use the RC4 algorithm with CryptoAPI.
- A new generation of RSA containers of keys, improving the key generation process.
- The ransom note text included “NEMTY REVENGE” instead of “NEMTY PROJECT” and also added the sentence: “Don’t trust anyone. Even your dog”.
FIGURE 40. Nemty ransomware note
Version 2.2
For this version, the Nemty developers only made two minor changes:
- Change of the mutex name
- A new ransom note:
FIGURE 41. Example of the new ransom note
Version 2.3
In this version, we found major changes compared with the prior version:
- A new mutex value
- The service used to get the public IP changed from https://api.ipify.org to https://www.myexternalip.com/raw
- In case the lookup fails, the external address changes from NONE to NOT_DEFINED.
- The Windows OS check for XP was duped in prior versions and now only has one specific check.
- The configuration fields changed, certain fields were removed and new ones were added.
- This is an example for the new configuration file:
{
“fileid”:”NEMTY_E1EIVPU”,
“configid”:”mArJi2x3q3yFrbvL8EYkKezDeGPgWeOG”,
“compid”:”{a3cande1-f85f-1341-769f-806d6172f54544}”,
“ip”:”NONE”,
“country”:”{ ” “errorCode” “: ” “INVALID_ADDRESS” “, ” “error” “: ” “invalid addr” “,” “version” “:” 2.3 “,” “computer_name” “:” “USERPC” “,” “username” “:” “User” “,” “os” “:” “Windows XP” “,” “pr_key” “:” BwIAAACkAABSU0EyAAgAAAEAAQDdTDOyFDw4+kjmmP2epZ/484E7PLyyZ5W1obSZSHWPirGeobWwqnoVTXLPbKVYXZ4qszCzO71hwFKcKjeYjX1dVzSlonqpWlU5d2XLtM+6oN9PTUIv2Fp8Quf8w3FU+0OmmS9A0s3n6cnvpA8oIJTZFgYurYDs78Gv3dt4dUkQioqyT/kWBOTZMBARqjiN6JwCCZDU4moRm+9IcqiXzUydebF99EoHxKcJrAekIHuHbHzZq/FcVogFSHT+4aV2/NTrESiNLeLYWv0S/GJrYs2xoLLe3NpdW7disE/PY1yn4flWGPU931AWy4/ba8+bjRXr1UPCKFk370oqWesemfK8j694toexJlRYc8s1mql2T6gq/NnqsWIxgR2B4Esn3xMzXcGZD86mA+XO/gZWgZw9kyJ4rzonWiF8OMWznKgmC0n4rxoOh70eE0m15LPkJOJwmBcVoHE189R71titoNMEYZsK8/WE0x8YJjAAdxmI4ATufV1ZUDbO7yOf5Tc5UuHTxu5iUOL0dO004Hh0t6SZIxbjUbtlHhJTiUULL+TpyG9YP1LyNMhKDE80viN9Co/a6xbs6IRhxhRRFthtHE/kRBeYfhptCblWOStLebtrNgwfe8f3AR2XdH6uESiQ8rTXG/dSgXOfmUQzuvSbxdL4aQ5docbtjQlMEl/FqYqs1pGTEB+cBATRoeY97LSCr/ZvhQPUVPyAD0NHKPOUawrGtXyiAYP3WWhKOQFM1nqQ1E9Mf38NHbaQtNJ8s/BOvMxra2Q9AaCd34IGz3uZuEZIqqXx2qqchHoHPFvopBnkCiJThmb0PoUHsA4keC7EIv3To038Wg2GYhfzy6+vwEIx01F02xhZSHjSUlSmYM2YiS4FZu2F02L49tUPIueqo3ON2ts+G/z36kkaBFocPRJjQGL2cUmG0jI0kdahL6uNYfUL3Cu261bmxewxS1eSk+cb2zC5OckuwxoT66ZddRF+Ud2K2SIPV3oMy3D/4oUtsrAEUv2inEthtwvY8FdzzsM1KlcvLszggKHRdTe4a3hf9ALU7omy3avhGaCtznhRnZvD0W1QNKyKRYBCtHc7e30EpbYtQ8kxRBrrQfySsQMDPfagETSDQMRdD0lLmNCsaJJqS9s7CnsXuTedTiOZA7Nddrc/qUceeZ7ZXMvwhpQJ6TglLJ/qCMFz6u63biGhCi38BxVRhrFzMIV4wEHlmw/7ZKiIsE49XvWzJJH3J6cgvw8XGysgS29w8McqSVaucPhw+lONwc8SLTqDwZ78ozJmr3Hq4bWFjlMSeo/H8tzr++eVMAwNiiECWo2/i2WwraBG7/jpwtedjQF576tBE6TEvriVjohjyhAYj0SprtJoqS5kX6NVM8c8GaeVKbcUp6bPqZLlGi1yfP0dhgpnR81SfDVuv/RaLPedYPfKL3hK1g6UbRJvENVgrr5tik8TLley6v73MI1pbWmEnr48Zk8Y6bb4fm0H9OvkiDYmDDTh4I49TNEyuw8eD8auJ6CsapZUTmvqMlrGI3rnjueTdjQ= “,” “drives” “:[{” “drive_type” “:” “FIXED” “,” “drive_letter” “:” “C”:”/” “,” “total_size” “:” 9GB “,” “used_size” “:” 9GB “},{” “drive_type” “:” “NETWORK” “,” “drive_letter” “:” “E”:”/” “,” “total_size” “:” 9GB “,” “used_size” “:” 9GB “\”}]}”
- The User-agent changed to a new one, “Naruto Uzumake”.
- Concatenating a lot of taskkill commands through the use of “ShellExecuteA”; this version of Nemty kills a lot of new processes.
FIGURE 42. Killing processes with CMD
- For this version, the authors added PowerShell executions using a command prompt with the function “ShellExecuteA” :
FIGURE 43. Launching a PowerShell command
- This version added a new subkey in the registry key “Run” in the hive HKEY_CURRENT_USER with the name “daite drobovik”:
FIGURE 44. Creating persistence
- The ransom note was again changed for this version:
FIGURE 45. Example of the ransom note in version 2.3
Version 2.4
This version was a minor release like Nemty 2.2. In our analysis we only noted changes for the ransom note:
FIGURE 46. Example of the ransom note in version 2.4
Version 2.5
This is the last version of Nemty we discovered. This one represents a minor release and we only spotted two changes for this version:
- A new mutex value
- A new ransom note:
FIGURE 47. Example of the ransom note in version 2.5
Relationship between JSWORM and Nemty
Our Advanced Threat Research (ATR) team followed the activity of the user jsworm in the underground forums, and uncovered another piece of their ransomware, called JSWORM ransomware. Below is an announcement they made on the same forum on which they presented Nemty:
FIGURE 48. JSWORM ransomware and Nemty announcement
We analyzed all the samples we had of JSWORM and Nemty and could not find any relationship in the code base between them, but it is clear that both pieces of ransomware belong to the same moniker.
| HASH | FAMILY | Compilation timestamp |
| 0b33471bbd9fbbf08983eff34ee4ddc9 | Nemty | 2019-08-29 08:31:32 |
| 0e0b7b238a06a2a37a4de06a5ab5e615 | Nemty | 2019-08-19 04:34:25 |
| 27699778d2d27872f99ee491460485aa | JSWORM | 1992-06-19 22:22:17 |
| 31adc85947ddef5ce19c401d040aee82 | JSWORM | 2019-07-19 05:21:52 |
| 348c3597c7d31c72ea723d5f7082ff87 | Nemty | 2019-08-25 11:58:28 |
| 37aaba6b18c9c1b8150dae4f1d31e97d | Nemty | 2019-08-20 19:13:54 |
| 4ca39c0aeb0daeb1be36173fa7c2a25e | Nemty | 2019-08-13 14:46:54 |
| 5126b88347c24245a9b141f76552064e | Nemty | 2019-08-21 16:16:54 |
| 5cc1bf6122d38de907d558ec6851377c | Nemty | 2019-08-21 14:27:55 |
| 74701302d6cb1e2f3874817ac499b84a | JSWORM | 2019-07-10 08:44:29 |
| 7def79329823f3c81a6d27d2c92460ef | JSWORM | 2019-07-09 18:54:23 |
| dcec4fed3b60705eafdc5cbff4062375 | Nemty | 2019-08-21 19:25:16 |
| de9e1a5fc0f0a29b97eb99542d1f297a | JSWORM | 2019-07-09 20:25:14 |
| f270805668e8aecf13d27c09055bad5d | Nemty | 2019-08-21 18:42:10 |
| f796af497399c256129f2ce61eb8855b | JSWORM | 2019-07-19 05:24:00 |
| fbf7ba464d564dbf42699c34b239b73a | JSWORM | 1992-06-19 22:22:17 |
| 0f3deda483df5e5f8043ea20297d243b | Nemty | 2018-12-04 11:00:39 |
Some of the samples released contain custom packers so the compilation timestamp is not accurate for those cases.
Based on the data of the binaries we found, we can see how Nemty activity started some time after the JSWORM ramsomware disappeared. This could indicate that the threat actor jsworm was developing both pieces of ransomware at the same time.
Free Decryptor Available Through No More Ransom
One of the partners of NoMoreRansom was able to release a working version of a Nemty decryptor. If someone is affected by this ransomware, it is possible to contact them through NoMoreRansom to get a decryptor.
Nemty Releases Customer Data Publicly
In our analysis of the Nemty ransomware, we spotted a new trend in how its authors managed the data of their victims.
In this instance, much like we have seen with other ransomware families like Maze, Nemty has its own website on which customer data is publicly released.
Image source: Bleeping Computer
Conclusion
Despite the number of RaaS families that appeared this year, Nemty represents another piece to observe and follow. Since we started to watch the activities of this ransomware, the criminals behind it have released multiple new versions with bug fixes and improvements. Such activity suggests that ransomware authors are feeling pressure from the great work done by security researchers and organizations, and in the case of Nemty, even from the underground criminal community which itself was quick to criticize some of its functions and implementations.
Tesorion, now a partner in No More Ransom, released a working decryptor for Nemty and so we now expect that the author will change the ransomware again to continue their activities. The last action we observed from this group was the website shown above, created to leak customer data.
Mitre ATT&CK
The sample uses the following MITRE ATT&CK
techniques:
| Technique ID | Technique Description |
| T1124 | System Time Discovery |
| T1083 | File and Directory Discovery |
| T1012 | Query Registry |
| T1057 | Process Discovery |
| T1047 | Windows Management Instrumentation |
| T1035 | Service Execution |
| T1215 | Kernel Modules and Extensions |
| T1179 | Hooking |
| T1112 | Modify Registry |
| T1107 | File Deletion |
| T1089 | Disabling Security Tools |
| T1055 | Process Injection |
| T1179 | Hooking |
| T1055 | Process Injection |
| T1132 | Data Encoding |
Coverage
Generic Trojan.si
GenericRXIS-SF!348C3597C7D3
GenericRXIS-SF!37AABA6B18C9
GenericRXIS-SF!5CC1BF6122D3
GenericRXIU-OJ!0B33471BBD9F
Ransom-Nemty!09F3B4E8D824
Ransom-Nemty!2FAA102585F5
Ransom-Nemty!65B07E2FD628
Ransom-Nemty!9D6722A4441B
RDN/GenDownloader.alr
RDN/Generic.fps
RDN/Generic.fqr
RDN/Generic.fry
RDN/Generic.ftv
RDN/Generic.fxs
RDN/Generic.fyy
RDN/Ransom.gg
RDN/Ransom.gn
Trojan-FRGK!484036EE8955
Indicators of Compromise
| Hash | PE TimeStamp |
| 64a1ce2faa2ab624afcbbbb6f43955e116b6c170d705677dba6c4818770903aa | 1992:06:20 00:22:17+02:00 |
| c537c695843ab87903a9dbc2b9466dfbe06e8e0dde0c4703cbac0febeb79353a | 1992:06:20 00:22:17+02:00 |
| 8e6f56fef6ef12a9a201cad3be2d0bca4962b2745f087da34eaa4af0bd09b75f | 1992:06:20 00:22:17+02:00 |
| ca46814881f2d6698f64f31e8390fe155b9fd0d8f50b6ab304725a2251434aa7 | 2009:08:13 23:36:24+01:00 |
| 5d04d789d66152e3fc0a2d84a53c3d7aa0f5d953c1a946619deeb699f3866e26 | 2017:01:02 12:16:24+01:00 |
| a743d29eb16f9b4a59b2fd8c89e59053bdccce362f544fe82974e80d580c88f6 | 2018:03:27 07:09:32+02:00 |
| 5439452012a052851fdd0625abc4559302b9d4f4580e2ec98680e9947841d75d | 2018:04:17 01:50:07+02:00 |
| 20d432c171ec17e7c5105f032210a96ea726ffc52154b79ec43acd62d6e3f304 | 2018:06:09 22:43:06+02:00 |
| 9fad280bb034a4683be9ab4a35d2859e61dc796a6134436b4403c2cb9a9ebfea | 2018:06:09 23:45:15+00:00 |
| 7c1aaccca9dd236b9271c734d987d0fccc3e91bfa4c445c5e1c7c41e61ffe3ca | 2018:06:16 17:31:40+02:00 |
| 2f2aeb72dd127057fac1eeefdc0539fc3fa7bdff36d288bd7e20f2756194253d | 2018:06:16 23:24:06+02:00 |
| 6b3fea34cb8bb5cc6d698e30933884e1fe55c942d8768da85eb1c8085525bb41 | 2018:06:20 00:56:49+01:00 |
| 345380e840249081cba552af4ab28d7c65d4052f6e4bedd748b673b8853e6e96 | 2018:06:20 01:56:49+02:00 |
| 0f6e82387a5fe0f64d7cec15466b17a623aa8faaf9971df3c49ab65d49d1422e | 2018:07:06 02:30:25+02:00 |
| 4b86f102eff21382c1a40a28bd4db19356e1efd323336bcec6645e68592e754a | 2018:07:07 17:59:57+01:00 |
| b604a25ae4a668170bf28bfc885d0e137f4ff3a29eb7f772ba7098ecfb9bacb3 | 2018:07:08 12:47:46+02:00 |
| 664b45ba61cf7e17012b22374c0c2a52a2e661e9c8c1c40982137c910095179a | 2018:07:14 02:09:27+01:00 |
| 536209365d143bf90a44f063eff9254639d7976b2f77edcc2a0ff6ac1e5a5464 | 2018:07:23 22:32:23+02:00 |
| e29d154b067f298bab794d9f85ee7b3d58ebf17b56f6cff6601fb6ce48482f09 | 2018:08:01 20:19:32+02:00 |
| c2a32b7094f4c171a56ca9da3005e7cc30489ae9d2020a6ccb53ff02b32e0be3 | 2018:08:06 17:50:00+02:00 |
| 5d58c85ba5bd7a4ca3d5ade7bff08942a12399f82defa370691524d8797a1095 | 2018:08:09 01:11:34+02:00 |
| c8d44e8c91ed028626a8e2b3a526627790a2ac3e7078316172e35371fb984eee | 2018:08:09 01:11:34+02:00 |
| 7eb2b5125f9fbcc2672c05031456b6a2432c8921e9fa561bb7d7fa72010638b0 | 2018:08:22 21:17:21+01:00 |
| 06c1428e1a41c30b80a60b5b136d7cb4a8ffb2f4361919ef7f72a6babb223dd3 | 2018:08:22 22:17:21+02:00 |
| 66e55d3ffc0dcc4c8db135474cb8549072f8b1015742038f2ebb60d8c5dbd77c | 2018:08:24 01:21:20+02:00 |
| 7fab9295f28e9a6e746420cdf39a37fe2ae3a1c668e2b3ae08c9de2de4c10024 | 2018:08:27 18:49:08+02:00 |
| bf3368254c8e62f17e610273e53df6f29cccc9c679245f55f9ee7dc41343c384 | 2018:08:28 00:50:58+02:00 |
| eb98285ef506aa5b6d38bbd441db692b832f7ed1b9cb1dc4e2fec45369c8432a | 2018:08:29 19:54:20+02:00 |
| 676224fb3ab782fc096351c2419ebd8f7df95a9180407f725c57e72d2bbec5b1 | 2018:08:29 20:05:56+02:00 |
| 9b5067d5e7f7fbf52b5069f5557d5b0cf45752a6b720f5a737b412600da8c845 | 2018:09:07 18:40:54+02:00 |
| 30832d5709f93b16a6972fca9159fbd886a4e9815ef0f029fade5ca663e9761e | 2018:09:08 01:26:36+01:00 |
| e5527d1bfc8b1448dcd698f23ac7142a066bb19b6109ef1c92df4d6214aa2d6a | 2018:09:11 22:58:35+02:00 |
| c09272b4a547aa5e675f9da4baf70670bd192b1dfd8dd33b52a42ee83f782cac | 2018:09:30 18:36:38+02:00 |
| aa36aa7425e9591531d5dad33b7e1de7ffbe980376fc39a7961133f5df8ab31a | 2018:10:03 22:27:20+02:00 |
| a54bca66aac95cb281d313375e38cd8058ace1e07c5176995531da241c50dbd6 | 2018:10:06 10:02:23+02:00 |
| 63ed68751000f7004bf951bc4a4c22799a94d28602f4022d901b6558ff93b46b | 2018:10:09 22:04:03+02:00 |
| fe639627cf827e72c30992c627fffd458f7afb86d5b87e811415b87c2276e59c | 2018:10:12 20:11:41+02:00 |
| 74f8c39f3b0e4338eeaabad97c9303139336be9ebe059501a78174570540eb9e | 2018:10:14 01:10:44+02:00 |
| 0a472cb6772f554afc9720064a0ba286ddc02250b9249cace39b3bdd77b5265c | 2018:10:20 16:38:09+02:00 |
| 0a0fb6e146bf8473b8931c3775529b2a0c8baf0db9afae7d3bb53f3d1da8c6ca | 2018:10:21 23:30:07+02:00 |
| 0285a046ecaa82e685275ea53ae56134cb992991ef0d2ac5af3f5c15ebd136cc | 2018:10:25 23:28:29+02:00 |
| 3d852ca618763ced2e280f0c0079e804935b70dcd4adc3912c2e2b3965e196c4 | 2018:11:03 16:59:21+01:00 |
| 4f3c6b42a2182b530f44d37fb82df8c2e1ca3858bfdd6d921aa363efe3e6e7bb | 2018:11:03 16:59:21+01:00 |
| 3d9742b2ca3756645f88e885d1dadb2827a19f01ca6fb4a5170f2888cced35e1 | 2018:11:03 16:59:21+01:00 |
| a2f6c36cb8f46207028fbd3f3b69e306d3bdc4fc0391cfda5609812df880be07 | 2018:11:10 17:30:47+01:00 |
| b3dbfbd64088691b4bf07b9001890bc60ff7f95fb44acdc20d95e8dd3c72c050 | 2018:11:11 00:53:46+01:00 |
| 5e4a090b75ca915fc42a149c7ddfba0dbe1a6846fe3b36249923549656c31218 | 2018:11:25 19:51:19+01:00 |
| a5590a987d125a8ca6629e33e3ff1f3eb7d5f41f62133025d3476e1a6e4c6130 | 2018:12:04 12:00:39+01:00 |
| a7558decb9516122781243e791c982977660152813817fb7ed00359365fcb0d3 | 2018:12:06 17:53:43+01:00 |
| b2c11e6126a7de326e5fef14679279bf9fa920b7ba7142984d99790d89155b69 | 2018:12:06 17:53:43+01:00 |
| 4379f688682395f0ebcd70acd14c304a1074928198b4d0bebb5362d56328f76e | 2018:12:06 21:13:33+01:00 |
| 8dca973cccf5073a9f53f055fa275215520ba67416b5d206c673df533532efe5 | 2018:12:07 01:04:23+01:00 |
| 9913afe01dc4094bd3c5ff90ca27cc9e9ef7d77b6a7bdbf5f3042a8251b96325 | 2018:12:10 19:04:48+01:00 |
| 17864c4e21c0ebaf30cca1f35d67f46d3c3c33a5b8ea87d4c331e9d86d805965 | 2018:12:15 23:24:41+01:00 |
| 36bd705f58c11c22529a9299d8c0c1a33cf94fb9b7cce0a39a79e4d8f523308d | 2018:12:16 21:12:50+01:00 |
| 1b18d04d4ca37ecc25bd8d4f229121c89a57c80615d40ff94868f380cdfaed7c | 2018:12:24 21:33:38+01:00 |
| b0bd94cf4f409bb5ba2661d875e0488e59492c95a539508172e2670d74feb0ea | 2018:12:27 21:42:57+01:00 |
| b9ff00a4b426742892e21601a68b19ffa44668f3274ec250e60843c3224b6b42 | 2018:12:30 01:14:36+01:00 |
| 4f5bb92d861601642aec31ecbd7864b2dcca9027ef3ff7256c0d12915580181b | 2019:01:10 22:35:38+01:00 |
| 2a5f9e5d72b4841538a73ee2556865d8ed76e3da38571f00148368874edf55c8 | 2019:01:19 23:44:33+01:00 |
| 708922215acc1ddbe35a9549afce408aaa0aa74caa78feca96150e755ebf7b98 | 2019:02:02 11:07:14+01:00 |
| 03e46ba0d430afd4c85eaef47dcb38faf8cd7ef78ef25f8aa911c216a598245c | 2019:02:02 23:01:04+01:00 |
| cbb016cab1718c610f2bd98e0190bb5a426a2de38ddfccfec86196294e47bca0 | 2019:02:05 04:34:44+01:00 |
| 2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5 | 2019:02:08 18:17:02+01:00 |
| 947bddf40d6dcf4cbbf174b2067a9f5e09fa2eb03d039974feba1d398ddeb184 | 2019:02:11 23:26:07+01:00 |
| 3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889 | 2019:02:16 17:40:03+01:00 |
| ee3a8512f4109ec7a21831aee68ba53fb431d5eac613b66bf9877f50118c0cd4 | 2019:02:16 19:26:22+01:00 |
| 9caae99f53cc1446f04703754fa03b98a6303882e0999653c2c5fbfe656e3164 | 2019:02:26 00:00:02+01:00 |
| cfe5682a41c5b4a3fd9c09070262171a05e0ce99868ef0e2058a5d65385ed681 | 2019:03:10 18:09:02+01:00 |
| 1ac0c87c3ff27dc6d630cb3f543311fb48edfc88d33470836438b1d388ae9687 | 2019:03:12 20:03:50+01:00 |
| 57a73c98866cd1aa0e57b84c0a13a54901077d23b6683d16b713d652d74fd1c7 | 2019:03:24 20:58:51+01:00 |
| f2c6e0a2500876a3426b191cfbd3b65625bb182f23fda68d256f56a644f4f123 | 2019:04:02 11:44:51+02:00 |
| 5078a0940abc31a7fa271483ac345044a91a0e21c517bceb85091cd3fca310f7 | 2019:04:03 01:09:42+01:00 |
| 92981ed851493d6897339df02a77799645a0edf078daa8cf6cf09293f0801b7c | 2019:04:06 02:29:49+02:00 |
| 084da93689b04f0a162bcd6fa2d43937f84182ac94d40b871d8650d89501c2bd | 2019:04:10 00:40:47+01:00 |
| e563bfae9ee7effe4c9766ded059dc2e91f7f76830973dfdadfb203c47fe8c2a | 2019:04:12 17:33:50+01:00 |
| a77beff2bf75a2a82b7c96438e9c55e2839cba2ea057892422b714876b8def58 | 2019:04:12 21:09:21+01:00 |
| d341571f9b8ea62f52b9563ca1fb77bee5127a2a5b93d00682622eb116db0275 | 2019:04:12 22:26:26+01:00 |
| 510c0746a5d8b0175e80e2fbbbfbf194c8e20e56cccd5a9ec5fac4ad2e2f77f7 | 2019:04:15 19:01:48+02:00 |
| e070a88883634bf7105f9744123adfd3890947e8da4754d2560293e68f809f10 | 2019:04:17 01:57:08+02:00 |
| 44c6edb224810748a0b15512a47647f5e35157fdaa30357d2820c1eb250273e4 | 2019:04:17 20:57:27+01:00 |
| db25fd682243d4449c423a57591bd0d69a98f3e6149b815e6c556a76b5fbb71a | 2019:04:19 19:05:12+02:00 |
| 405df2b5aa985c8386d347b6e7f269e546231a02abd1e793ae792010248bc9da | 2019:04:27 00:59:44+02:00 |
| 081444b3b8b82c06c631d3106859ab530435af68292a8009c4b6eb2285cb9929 | 2019:04:27 22:03:27+02:00 |
| a380640490d3aa7380255ed9269bb967a4daee6d2d20353a50154e7e6d399746 | 2019:04:28 23:52:25+02:00 |
| fe244ab332b490623a8a313a8b64a1d280f3e03b2457f6c3235d01ee8f21c701 | 2019:04:29 00:49:00+02:00 |
| abf148370f7cc9c16e20c30590a08f85208f4e594062c8a9e59c0c89cd8ff43f | 2019:04:29 02:32:07+02:00 |
| 034b86e971f24282bd0c1b74a257c7c60ec7d83fa45ac5d5321e7c436675be89 | 2019:05:04 17:03:52+02:00 |
| 859e8f98203fa9b8fb68cf1e4c6f9a1143c970bd2830601841b83ee49b2a72ba | 2019:05:05 22:59:32+02:00 |
| 2e436f4277a6cac69c5b484284160559752ef0679e27e2af8112e78c9074a17c | 2019:05:07 23:20:09+02:00 |
| 6be9cc0bda98fee59c94d687c293b83f1b41588ca991f35328f4d56c9c1f38e4 | 2019:05:17 12:12:43+01:00 |
| 29ba2b8099985501ae9aafa964daeca66d964e9fbc1d0025928b49fcae0efb63 | 2019:05:17 12:58:42+02:00 |
| a08dc1e27b9e92ba70dcd2bce611fa51ec3601e4a2e7cdbb7713b656160c3773 | 2019:05:28 21:36:33+02:00 |
| cc496cec38bbc72bae3cb64416baca38b3706443c4f360bd4ba8300d64b210d2 | 2019:08:13 16:46:54+02:00 |
| 267a9dcf77c33a1af362e2080aaacc01a7ca075658beb002ab41e0712ffe066e | 2019:08:19 05:34:25+01:00 |
| 505c0ca5ad0552cce9e047c27120c681ddce127d13afa8a8ad96761b2487191b | 2019:08:20 20:13:54+01:00 |
| 6a07996bc77bc6fe54acc8fd8d5551a00deaea3cc48f097f18955b06098c4bd3 | 2019:08:21 16:27:55+02:00 |
| d421d9b0cc9ce69fc4dea1d4bd230b666b15868e4778d227ead38b7572463253 | 2019:08:21 17:16:54+01:00 |
| f854d7639a5db4c42b51aecd541aaf61879591adf42ebcba068f3b111fb61a34 | 2019:08:21 19:06:44+01:00 |
| 688994783ce56427f20e6e2d206e5eee009fcc157ba37737dce1b14a326cc612 | 2019:08:21 20:25:16+01:00 |
| 4cf87dd16d57582719a8fe6a144360f3dfa5d21196711dc140ce1a738ab9816e | 2019:08:21 20:34:34+02:00 |
| 15084aa0f30f5797bd666f18d0992dfcdb1c080c8d25cf2f6d97f9166e45b93b | 2019:08:31 14:06:01+01:00 |
| 7c638c17b3fc92393c421dff34a1c9245c26f9526fb20699af567e6a38535a06 | 2019:09:04 14:05:11+02:00 |
| 022076c2c8f1555ee98a08ff5714aa1db20e1841fe3b8d1362fed0d6bef1c87d | 2019:09:19 22:32:44+02:00 |
| fb81f82121f9604a664925790e83763f7dceb2adaa4aeafaf8af24f7986e1f12 | 2019:09:24 12:28:55+02:00 |
| a41949b9cddc2838534c0f70c0a615a7135fc95e452270ff661247a60d6b638d | 2019:09:24 14:55:26+01:00 |
| 3aeaf37af33b92dfa62489250ec2857d6bab1098fcf356cdb58e05efabe359cb | 2019:09:27 12:59:27+02:00 |
| 9f2a0b1553f8b2e1a5c0c40023ac9abed76455cdb0f5a346601088615606eac0 | 2019:09:28 11:31:11+02:00 |
| 068575719283c1e33abb8530340d7ac0b4d44b15da1ee0877c03537216df3001 | 2019:09:30 02:31:49+02:00 |
| 9574f57f7a4192f0507fa3361fb3e00e1f1101fdd818fc8e27aaba6714cd373c | 2019:10:02 17:22:33+01:00 |
| 98f260b52586edd447eaab38f113fc98b9ff6014e291c59c9cd639df48556e12 | 2019:10:04 09:56:21+02:00 |
| 30ad724c9b869ff9e732e95c7e3b94a0d118297c168ffd4c24bac240e0cba184 | 2019:10:04 13:01:21+01:00 |
| 62c3b52b5310393dbf0590bc246161249632a1d2f21c3aa7fb779dc8018a0edf | 2019:10:05 03:10:25+01:00 |
| d041cc7e2e9d8d6366b28abc0428b7d41ad75bcfb67631830a838c32e49fd365 | 2019:10:07 17:57:43+02:00 |
| 88fcdfd4c89a9d3108582e5746b58beda9e538f357f3b390a008a7e5925c19f5 | 2019:10:07 18:22:30+02:00 |
| 9b5a42c4dbb2df3e1457e8a7bdbe93a2a4b4382a4de70077ace34a3c5a04ba1f | 2019:10:10 02:55:12+02:00 |
| 2497543441cf35647afa60d6bc76825cfebf24e3421fbe101b38838aed63ba21 | 2019:10:11 02:44:30+02:00 |
| 5e2c0b6d2f74605f11047a6b6ebff7026035471bccd3e2c6ba03df576eef08cd | 2019:10:12 20:12:30+02:00 |
| aaaa143d3636133fa952b79f3e447264a56a4db223a046906b95802e50a359f9 | 2019:10:25 11:04:07+02:00 |
| 0c18068dab291fcdd5a9aa94fb6cb07b8aeec1e4ecbab3746c3b0586e7bbd692 | 2019:10:26 06:58:37+01:00 |
| 36e66c1d562af0df6c493cb998b24f8b52da55452dce6514d92e14ee64ab41c6 | 2019:11:26 20:09:10+01:00 |
| 2160391fc7c69bc30dea5c4e0e3e6ca2045d021087d4f1170d74eacedae9ebd2 | 2019:11:26 20:09:10+01:00 |
| b01054d750aaa982359bee75707847f30df668135ca139e25b142e18f8cf2f51 | 2019:11:26 20:09:10+01:00 |
| 97c5eeddaaa99a578a94609a69be099d7ac61f4d797f14a5f9a696566205366e | 2019:11:26 20:09:10+01:00 |
| c5d43698296b4e9b9f7491669b7b20ef651302593c72b827462c08c9d6e76ae3 | 2019:11:26 20:09:10+01:00 |
| d5b4f6cd5c6d142cdcfeca789b58942ee01270cb52de1d0f4c8d3cb7f44fa6e4 | 2019:12:14 15:45:13+01:00 |
| e04d28b43fcc11ef8869641c2795774ae139ee6ed06c295c772d8a4f2381e831 | 2019:12:15 09:55:10+01:00 |
| 1d3f2ba1c701ecf04c288b64d9f2470c6f58744d5284174c1cb8e8b3753f3fae | 2019:12:15 09:55:10+01:00 |
| 45c3faeb8cdd2cbdcf6161f05b2e72aba7927594138da693b0020f24db9e60d8 | 2019:12:15 09:55:10+01:00 |
| 4402b31f717bfe82498d162adac0c9b4f5a9ca413c883ac94ab8e322c50f11db | 2019:12:23 09:17:02+01:00 |
| a3cb6814fcdb42517728815c875f2dc169ac7b15f615b971eff209c4e2937527 | 2019:12:23 17:10:14+01:00 |
| 0a14d4313ded36716d9de16b8487ac91b0dcf6a77c9f0c21531916c31a0a5ee9 | 2019:12:24 05:03:25+00:00 |
| 735ef043f3f64a9c57ba938dddc6fdac60ed30fa746a728635835c7162729710 | 2019:12:25 20:14:11+01:00 |
| 92cf38b5bee56490871c19e1ee31239c550a0eb6d177a37d02079465be9e4f7d | 2019:12:27 18:55:35+01:00 |
| 4b4feffb0783aca42f0e9c38961340a76b4a2b3fd324f71e764a88ab500f1372 | 2019:12:27 18:55:35+01:00 |
| 5a022aba75d4986adedb1a5fb62fce8946d43f06846f663a851ba93e9e317f8c | 2019:12:27 18:55:35+01:00 |
| 3ae7d44569b2885de360c0e6c3448772f74c1c3ff4ee3f594053a95bfc73850f | 2019:12:27 18:55:35+01:00 |
| 42e9356feb10e5814fb73c6c8d702f010d4bd742e25550ae91413fa2a7e7c888 | 2019:12:27 18:55:35+01:00 |
| bf6b8563773f7a05de33edcb1333d9e39e5bc60c91d111d3fb4ec7f5cfbb6c43 | 2019:12:28 03:06:43+01:00 |
| 842b92ed20115ff28fd5b8b204e80e88168594aa5ce44c288a560ec6f907516a | 2019:12:28 03:06:43+01:00 |
| eedefda5ff588f0b194b97a0244d6d3e4892b9a5f1539b33aa0fa86a47be7ea1 | 2019:12:28 03:06:43+01:00 |
| d398280940af9fcb5aad2f0eb38d7b00b9d241ad1c4abfe3ca726accded70e2a | 2019:12:29 09:38:39+01:00 |
| 6e18acc14f36010c4c07f022e853d25692687186169e50929e402c2adf2cb897 | 2020:01:07 10:57:37+00:00 |
| 8e056ccffad1f5315a38abf14bcd3a7b662b440bda6a0291a648edcc1819eca6 | 2020:01:18 12:03:36+01:00 |
The post Nemty Ransomware – Learning by Doing appeared first on McAfee Blogs.